Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


BSOD: System Thread Exception Not Handled?

  • Please log in to reply
4 replies to this topic

#1 Sora57


  • Members
  • 2 posts
  • Local time:12:47 PM

Posted 24 November 2012 - 06:21 PM

Some background info: I am running Windows 7 Ultimate. It is 64-bit. I am running it on a laptop.

I have no idea why I got the BSOD, but I did get it today. Restarted the computer in safe mode, then restarted again in "regular" mode and everything was fine. I'm typing on the same computer now (it's the only one I have, okay?). Can't think of anything that would be wrong with the computer, except the charger broke (I'm pretty sure this is a charger issue, and a new one is in the mail) so the battery doesn't charge: I have to have the computer plugged in when I use it.

Anyway, here's the text from the MEMORY.DMP file. Thanks for your help, guys! I'm a little afraid to even try anything myself, since I've heard messing with these files is a bad idea, so I came here for help first. I hope that's okay.

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`02a54000 PsLoadedModuleList = 0xfffff800`02c98670
Debug session time: Sat Nov 24 14:38:20.293 2012 (UTC - 5:00)
System Uptime: 0 days 2:26:25.088
Loading Kernel Symbols
Loading User Symbols

Loading unloaded module list
* *
* Bugcheck Analysis *
* *

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {ffffffffc0000005, fffff80002d6b74d, fffff880033ff918, fffff880033ff170}

Probably caused by : memory_corruption ( nt!MiFreeRelocations+4d )

Followup: MachineOwner

0: kd> !analyze -v
* *
* Bugcheck Analysis *
* *

This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002d6b74d, The address that the exception occurred at
Arg3: fffff880033ff918, Exception Record Address
Arg4: fffff880033ff170, Context Record Address

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

fffff800`02d6b74d 488b19 mov rbx,qword ptr [rcx]

EXCEPTION_RECORD: fffff880033ff918 -- (.exr 0xfffff880033ff918)
ExceptionAddress: fffff80002d6b74d (nt!MiFreeRelocations+0x000000000000004d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff880033ff170 -- (.cxr 0xfffff880033ff170)
rax=00000000ffffffff rbx=00000000000840a1 rcx=27403d1236540a36
rdx=0000000000008930 rsi=fffffa8005aab010 rdi=fffff8a00aaab000
rip=fffff80002d6b74d rsp=fffff880033ffb50 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff880033ffae0 r12=0000000000000001 r13=fffff8a003981b10
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
fffff800`02d6b74d 488b19 mov rbx,qword ptr [rcx] ds:002b:27403d12`36540a36=????????????????
Resetting default scope




ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

fffff800`02d6b74d 488b19 mov rbx,qword ptr [rcx]


LAST_CONTROL_TRANSFER: from fffff80002d6e20b to fffff80002d6b74d

fffff880`033ffb50 fffff800`02d6e20b : 00000000`000840a1 00000000`00000000 00000000`000840a1 fffffa80`051a33e0 : nt!MiFreeRelocations+0x4d
fffff880`033ffb80 fffff800`02b1f651 : fffffa80`05aab018 00000000`00000001 00000000`00000000 00000000`00000631 : nt!MiSegmentDelete+0x1bb
fffff880`033ffbc0 fffff800`02b1f515 : 00000000`00000000 00000000`00000080 fffffa80`01837040 fffffa80`00000012 : nt!MiProcessDereferenceList+0x131
fffff880`033ffc80 fffff800`02d69e5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDereferenceSegmentThread+0x10d
fffff880`033ffd00 fffff800`02ac3d26 : fffff800`02c45e80 fffffa80`01858040 fffff800`02c53cc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`033ffd40 00000000`00000000 : fffff880`03400000 fffff880`033fa000 fffff880`033ff420 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_NAME: nt!MiFreeRelocations+4d




STACK_COMMAND: .cxr 0xfffff880033ff170 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x7E_nt!MiFreeRelocations+4d

BUCKET_ID: X64_0x7E_nt!MiFreeRelocations+4d

Followup: MachineOwner

BC AdBot (Login to Remove)


#2 TwinHeadedEagle


  • Security Colleague
  • 352 posts
  • Gender:Male
  • Location:Serbia
  • Local time:06:47 PM

Posted 25 November 2012 - 03:16 AM

- Download Who Crashed --> http://www.resplendence.com/download/whocrashedSetup.exe

- Install it and run

- Click on Analyze, after few seconds, you will get the message

- Right click, then Select All, right click, then Copy

- Save text in Notepad, and upload it here

#3 AustrAlien



  • Members
  • 6,772 posts
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:47 AM

Posted 25 November 2012 - 03:36 AM

Let's collect some more information: I'll have a look at it and help you try to resolve the problem.

:step1: Please follow the instructions: Blue Screen of Death (BSOD) Posting Instructions - Windows 8, 7 & Vista

(Note: When you run BSOD_Windows7_Vista_v2.64_jcgriff2_.exe, it will also run autoruns.exe ... and both need to be in the Documents folder!)
... with one exception to the following line under Step 4:
  • "Create a new thread HERE and attach the file(s)."
The BC forums will allow a total attachment size of only 512 kb (and what you need to attach will exceed this limit).
  • Please upload the zip file to a file sharing website of your choice and and post a link to it in this thread so that we can access your uploaded zip file.
See the suggestions in the following links for recommendations on file sharing websites:
  • http://lifehacker.com/388284/best-online-file-sharing-services
  • http://www.hongkiat.com/blog/15-great-free-online-file-sharing-alternatives/
  • http://www.smashingapps.com/2008/08/28/5-best-free-file-hosting-services-to-store-your-files.html

    I can recommend Posted Image: Also suitable is Posted Image

:step2: Please Publish a Snapshot using Speccy, and post a link to it in this thread.
  • It is a convenient and accurate way of providing us with details of your computer specifications.

:step3: Please download MiniToolBox, save it to your Desktop and run it.
  • Checkmark the following checkboxes:
    • List Installed Programs
  • Click Go.
    When the scan is finished, a text file will open in a Notepad window.
  • Copy the entire contents of the Notepad window, and paste in your reply.
    (Result.txt will be saved in the same directory the tool is run.)

Google is my friend. Make Google your friend too.

Posted Image

#4 Sora57

  • Topic Starter

  • Members
  • 2 posts
  • Local time:12:47 PM

Posted 04 December 2012 - 10:02 AM

Sorry for taking so long to reply, guys...I guess it is my problem so it only hurts me, but still.

I followed both procedures, but unfortunately I can't do anything with the file-serving sites until I get home (I'm on a school network).

So, until later, here is the text for the who-crashed report. The others will have to wait. I've just got a free moment to post this now.

Thanks for your help!

Attached Files

#5 AustrAlien



  • Members
  • 6,772 posts
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:03:47 AM

Posted 04 December 2012 - 04:16 PM

Please zip up the most recent 10 or 12 minidumps and attach the zipped file to a reply.
  • (If you try zipping all 19 of the minidumps, the resultant zip file may exceed the 512 kb attachment limit at BC.)
  • Navigate to C:\Windows\Minidump <<< folder
  • Click on the most recent minidump file.
  • Hold down the <Ctrl> key, and click on the 10 next-most recent minidump files to also select them.
  • Release the <Ctrl> key.
  • Now, right-click on one of the selected files > Send to ... > Compressed (zipped) Folder.
    The zip file will be located in the same place (the Minidump folder).
  • Attach the zip file to your next reply.
    When you click on Add Reply, you will see the facility to attach a file just below the box where you type your message.

Google is my friend. Make Google your friend too.

Posted Image

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users