Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD please help


  • Please log in to reply
2 replies to this topic

#1 Zi11a

Zi11a

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 PM

Posted 02 March 2009 - 02:20 PM

I had this BSOD a couple of times.

STOP: 0x0000007E (0xc0000005,0x0100003D,0XBAD0BC84,0XBAD08980)





Microsoft ® Windows Debugger Version 6.11.0001.402 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini030209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Mar 2 15:52:57.218 2009 (GMT+0)
System Uptime: 0 days 4:03:38.950
Loading Kernel Symbols
...............................................................
................................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 100003d, bad0bc84, bad0b980}

Probably caused by : ntkrpamp.exe ( nt!ObpRemoveObjectRoutine+e0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 0100003d, The address that the exception occurred at
Arg3: bad0bc84, Exception Record Address
Arg4: bad0b980, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+16
0100003d ?? ???

EXCEPTION_RECORD: bad0bc84 -- (.exr 0xffffffffbad0bc84)
ExceptionAddress: 0100003d
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 0100003d
Attempt to execute non-executable address 0100003d

CONTEXT: bad0b980 -- (.cxr 0xffffffffbad0b980)
eax=bad0b148 ebx=00000000 ecx=00000000 edx=88e99f68 esi=88e99f78 edi=00000000
eip=0100003d esp=bad0bd4c ebp=bad0bd64 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
0100003d ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000008

EXCEPTION_PARAMETER2: 0100003d

WRITE_ADDRESS: 0100003d

FOLLOWUP_IP:
nt!ObpRemoveObjectRoutine+e0
805bb472 8b4d08 mov ecx,dword ptr [ebp+8]

FAILED_INSTRUCTION_ADDRESS:
+365952f0174dfdc
0100003d ?? ???

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 805bb472 to 0100003d

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
bad0bd48 805bb472 88e99f90 00000000 88e99f90 0x100003d
bad0bd64 805bb8c4 88e99f90 00000001 80562f20 nt!ObpRemoveObjectRoutine+0xe0
bad0bd7c 8053877d 00000000 00000000 8ac7eda8 nt!ObpProcessRemoveObjectQueue+0x36
bad0bdac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
bad0bddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ObpRemoveObjectRoutine+e0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd9

STACK_COMMAND: .cxr 0xffffffffbad0b980 ; kb

FAILURE_BUCKET_ID: 0x7E_BADMEMREF_BAD_IP_nt!ObpRemoveObjectRoutine+e0

BUCKET_ID: 0x7E_BADMEMREF_BAD_IP_nt!ObpRemoveObjectRoutine+e0

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 0100003d, The address that the exception occurred at
Arg3: bad0bc84, Exception Record Address
Arg4: bad0b980, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+16
0100003d ?? ???

EXCEPTION_RECORD: bad0bc84 -- (.exr 0xffffffffbad0bc84)
ExceptionAddress: 0100003d
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 0100003d
Attempt to execute non-executable address 0100003d

CONTEXT: bad0b980 -- (.cxr 0xffffffffbad0b980)
eax=bad0b148 ebx=00000000 ecx=00000000 edx=88e99f68 esi=88e99f78 edi=00000000
eip=0100003d esp=bad0bd4c ebp=bad0bd64 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
0100003d ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000008

EXCEPTION_PARAMETER2: 0100003d

WRITE_ADDRESS: 0100003d

FOLLOWUP_IP:
nt!ObpRemoveObjectRoutine+e0
805bb472 8b4d08 mov ecx,dword ptr [ebp+8]

FAILED_INSTRUCTION_ADDRESS:
+365952f0174dfdc
0100003d ?? ???

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 805bb472 to 0100003d

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
bad0bd48 805bb472 88e99f90 00000000 88e99f90 0x100003d
bad0bd64 805bb8c4 88e99f90 00000001 80562f20 nt!ObpRemoveObjectRoutine+0xe0
bad0bd7c 8053877d 00000000 00000000 8ac7eda8 nt!ObpProcessRemoveObjectQueue+0x36
bad0bdac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
bad0bddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ObpRemoveObjectRoutine+e0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd9

STACK_COMMAND: .cxr 0xffffffffbad0b980 ; kb

FAILURE_BUCKET_ID: 0x7E_BADMEMREF_BAD_IP_nt!ObpRemoveObjectRoutine+e0

BUCKET_ID: 0x7E_BADMEMREF_BAD_IP_nt!ObpRemoveObjectRoutine+e0

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,112 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:30 PM

Posted 02 March 2009 - 03:39 PM

Complex error...Microsoft guidance: http://support.microsoft.com/kb/330182

I would also check Event Viewer for any error that might have occurred in the same time span and which might provide clues.

How To Use Event Viewer - http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/

If you've made any recent hardware changes or installed drivers recently...let us know.

Louis

#3 Zi11a

Zi11a
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 PM

Posted 02 March 2009 - 05:51 PM

Thanks for the help

I haven't made any recent hardware changes or installed drivers recently,apart from a windows update.
I checked the Event Viewer,under System,I found a System Error.



Details
Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4, parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.


User Action
No user action is required.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users