Random STOP error 7e - help reading WinDbg analysis of ful..

PeterN · External Since: Jul 23, 2007 Posts: 2

The following STOP occurs once every week or so and reboots. Please
help

My system:
WinXP pro SP2
NVIDIA GeForce 6800 XT
Gigabyte GA965p-DS3
Intel Core 2 duo 6600
WD Raptor 10K rpm drive
Plextor PX 708A DVD/cd writer

**DEBUG REPORT**

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

************************************************************
WARNING: Dump file has been truncated. Data may be missing.
************************************************************
Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri May 4 13:06:55.093 2007 (GMT-4)
System Uptime: 8 days 20:19:23.798
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols

Loading unloaded module list
...................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {c0000005, ba63d86c, bacf3c20, bacf391c}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireScbForLazyWrite+1b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this
address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ba63d86c, The address that the exception occurred at
Arg3: bacf3c20, Exception Record Address
Arg4: bacf391c, Context Record Address

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
Ntfs!NtfsAcquireScbForLazyWrite+1b
ba63d86c 83780801 cmp dword ptr [eax+8],1

EXCEPTION_RECORD: bacf3c20 -- (.exr 0xffffffffbacf3c20)
ExceptionAddress: ba63d86c
(Ntfs!NtfsAcquireScbForLazyWrite+0x0000001b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000008
Attempt to read from address 00000008

CONTEXT: bacf391c -- (.cxr 0xffffffffbacf391c)
eax=00000000 ebx=00000000 ecx=89bc00f8 edx=bacf3d48 esi=e294b0d0
edi=00000000
eip=ba63d86c esp=bacf3ce8 ebp=bacf3cf8 iopl=0 nv up ei pl zr
na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!NtfsAcquireScbForLazyWrite+0x1b:
ba63d86c 83780801 cmp dword ptr [eax+8],1
ds:0023:00000008=????????
Resetting default scope

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000008

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from 804e4779 to ba63d86c

STACK_TEXT:
bacf3cf8 804e4779 e294b0d0 00000001 80558690
Ntfs!NtfsAcquireScbForLazyWrite+0x1b
bacf3d34 804e7081 89e3d1e0 80563720 89e3f020 nt!CcWriteBehind+0x27
bacf3d7c 805379bd 89e3d1e0 00000000 89e3f020 nt!CcWorkerThread+0x12f
bacf3dac 805ce84c 89e3d1e0 00000000 00000000 nt!ExpWorkerThread+0xef
bacf3ddc 8054532e 805378ce 00000000 00000000
nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
Ntfs!NtfsAcquireScbForLazyWrite+1b
ba63d86c 83780801 cmp dword ptr [eax+8],1

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

SYMBOL_NAME: Ntfs!NtfsAcquireScbForLazyWrite+1b

STACK_COMMAND: .cxr 0xffffffffbacf391c ; kb

FAILURE_BUCKET_ID: 0x7E_Ntfs!NtfsAcquireScbForLazyWrite+1b

BUCKET_ID: 0x7E_Ntfs!NtfsAcquireScbForLazyWrite+1b

Followup: MachineOwner
---------

Ron Martell2 · External Since: Aug 30, 2004 Posts: 4325

PeterN wrote:

>
>The following STOP occurs once every week or so and reboots. Please
>help
>
>My system:
>WinXP pro SP2
>NVIDIA GeForce 6800 XT
>Gigabyte GA965p-DS3
>Intel Core 2 duo 6600
>WD Raptor 10K rpm drive
>Plextor PX 708A DVD/cd writer
>
>**DEBUG REPORT**
>
>Microsoft (R) Windows Debugger Version 6.7.0005.1
>Copyright (c) Microsoft Corporation. All rights reserved.
>
>
>Loading Dump File [C:\WINDOWS\MEMORY.DMP]
>Kernel Complete Dump File: Full address space is available
>
>************************************************************
>WARNING: Dump file has been truncated. Data may be missing.
>************************************************************
>Symbol search path is:
>SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
>Executable search path is:
>Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
>compatible
>Product: WinNt, suite: TerminalServer SingleUserTS
>Built by: 2600.xpsp_sp2_gdr.070227-2254
>Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
>Debug session time: Fri May 4 13:06:55.093 2007 (GMT-4)
>System Uptime: 8 days 20:19:23.798
>Loading Kernel Symbols
>.........................................................................................................................................
>Loading User Symbols
>
>Loading unloaded module list
>..................................................
>*******************************************************************************
>* *
>* Bugcheck Analysis *
>* *
>*******************************************************************************
>
>Use !analyze -v to get detailed debugging information.
>
>BugCheck 7E, {c0000005, ba63d86c, bacf3c20, bacf391c}
>
>Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireScbForLazyWrite+1b )
>

On this basis I would do the following:

1. Check for data structure problems on the hard drive. Boot up the
computer, open a Command Prompt window and enter the following
command:

CHKDSK C: /R

The command will be set to run on the next restart. Shut down and
restart right away if you want to get it over with.

2. Check for physical problems with the hard drive. Go to the hard
drive manufacturer's web site and download their free diagnostic test
software. Run this to check out the drive for possible
physical/mechanical problems.

3. Ensure that S.M.A.R.T. monitoring of the hard drive is enabled in
the computer's BIOS setup. Many manufacturers ship their new
computers with this setting disabled, presumably on the basis that if
the purchasers are not aware of the impending death of the hard drive
they will not file a warranty claim until the drive actually dies,
which will hopefully be after the expiry of the warranty.

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2008)
On-Line Help Computer Service
http://onlinehelp.bc.ca

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

PeterN · External Since: Jul 23, 2007 Posts: 2

Ron,
Thanks very much for your kind response and valued assistance.

I have completed the following steps:
1. Enabled SMART in BIOS
2. Ran chkdsk with 'r' parameter (did not catch the result report)
3. Ran "Extended" test on drive (WD Raptor) with WD's Data Lifeguard
utility (windows version). No errors found.
4. Flashed BIOS to latest revision for my mobo.

All I can do now is "'wait and see" unless my results indicate to you
that the issue my lie in another area.

The BIOS version I updated was only about 5 months old, and the only
issue possibly applicable to my system that they addressed was an
"overclock" issue.

If My stop error occurs again, shall I post to this same thread, or
start a new one?

Thanks again for your assitance,
Peter.

On Mon, 23 Jul 2007 20:58:19 -0700, Ron Martell
<ron.martell.DeleteThis@gmail.com> wrote:

>PeterN wrote:
>
>>
>>The following STOP occurs once every week or so and reboots. Please
>>help
>>
>>My system:
>>WinXP pro SP2
>>NVIDIA GeForce 6800 XT
>>Gigabyte GA965p-DS3
>>Intel Core 2 duo 6600
>>WD Raptor 10K rpm drive
>>Plextor PX 708A DVD/cd writer
>>
>>**DEBUG REPORT**
>>
>>Microsoft (R) Windows Debugger Version 6.7.0005.1
>>Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>>Loading Dump File [C:\WINDOWS\MEMORY.DMP]
>>Kernel Complete Dump File: Full address space is available
>>
>>************************************************************
>>WARNING: Dump file has been truncated. Data may be missing.
>>************************************************************
>>Symbol search path is:
>>SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
>>Executable search path is:
>>Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
>>compatible
>>Product: WinNt, suite: TerminalServer SingleUserTS
>>Built by: 2600.xpsp_sp2_gdr.070227-2254
>>Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
>>Debug session time: Fri May 4 13:06:55.093 2007 (GMT-4)
>>System Uptime: 8 days 20:19:23.798
>>Loading Kernel Symbols
>>.........................................................................................................................................
>>Loading User Symbols
>>
>>Loading unloaded module list
>>..................................................
>>*******************************************************************************
>>* *
>>* Bugcheck Analysis *
>>* *
>>*******************************************************************************
>>
>>Use !analyze -v to get detailed debugging information.
>>
>>BugCheck 7E, {c0000005, ba63d86c, bacf3c20, bacf391c}
>>
>>Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireScbForLazyWrite+1b )
>>
>
>On this basis I would do the following:
>
>1. Check for data structure problems on the hard drive. Boot up the
>computer, open a Command Prompt window and enter the following
>command:
>
>CHKDSK C: /R
>
>The command will be set to run on the next restart. Shut down and
>restart right away if you want to get it over with.
>
>2. Check for physical problems with the hard drive. Go to the hard
>drive manufacturer's web site and download their free diagnostic test
>software. Run this to check out the drive for possible
>physical/mechanical problems.
>
>3. Ensure that S.M.A.R.T. monitoring of the hard drive is enabled in
>the computer's BIOS setup. Many manufacturers ship their new
>computers with this setting disabled, presumably on the basis that if
>the purchasers are not aware of the impending death of the hard drive
>they will not file a warranty claim until the drive actually dies,
>which will hopefully be after the expiry of the warranty.
>
>Good luck
>
>Ron Martell Duncan B.C. Canada

Ron Martell2 · External Since: Aug 30, 2004 Posts: 4325

PeterN wrote:

>Ron,
>Thanks very much for your kind response and valued assistance.
>
>I have completed the following steps:
>1. Enabled SMART in BIOS
>2. Ran chkdsk with 'r' parameter (did not catch the result report)
>3. Ran "Extended" test on drive (WD Raptor) with WD's Data Lifeguard
>utility (windows version). No errors found.
>4. Flashed BIOS to latest revision for my mobo.
>
>All I can do now is "'wait and see" unless my results indicate to you
>that the issue my lie in another area.
>
>The BIOS version I updated was only about 5 months old, and the only
>issue possibly applicable to my system that they addressed was an
>"overclock" issue.
>
>If My stop error occurs again, shall I post to this same thread, or
>start a new one?
>
>Thanks again for your assitance,
>Peter.
>
>

If it happens within the next 7 days, post it back here.

If it is more than 7 days from now then you post it back here or start
a new thread, whichever works best for you, but would you please also
email me at ron.martell DeleteThis @gmail.com with the same subject line.

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2008)
On-Line Help Computer Service
http://onlinehelp.bc.ca

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."