Resolved Stubborn BSOD

For some reason out of the blue, I got a random 0x7e BSOD the other day on my laptop. Usually I reboot and it fixes itself, however, this time it's a persistent problem. I've pulled the HDD out and slaved it off to another computer and the hdd spins up and the data is still on the drive. I've run defrag, chkdsk, malware/spyware/adware scans, and anti-virus checks. I've also pulled each of the memory modules out and tested them one at a time. The system is only set up to dump to a minidump file, but it may be something to go on (I'll post 2 different dumps):

System:
Dell Precision M2400
Windows XP SP3
4GB RAM


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\windows\DUMP61a8.tmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: f:\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100427-1636
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Feb 14 15:18:39.171 2011 (UTC - 5:00)
System Uptime: 0 days 0:00:27.953
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8b015510, ba50f7ec, ba50f4e8}

Probably caused by : ACPI.sys ( ACPI!SleepQueue+8 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8b015510, The address that the exception occurred at
Arg3: ba50f7ec, Exception Record Address
Arg4: ba50f4e8, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
+20
8b015510 f3a4 rep movs byte ptr es:[edi],byte ptr [esi]

EXCEPTION_RECORD: ba50f7ec -- (.exr 0xffffffffba50f7ec)
ExceptionAddress: 8b015510
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00937465
Attempt to write to address 00937465

CONTEXT: ba50f4e8 -- (.cxr 0xffffffffba50f4e8)
eax=7ffa0238 ebx=7ffa00e8 ecx=00005800 edx=00000001 esi=7ffa0400 edi=00937465
eip=8b015510 esp=ba50f8b4 ebp=ba50fb28 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
8b015510 f3a4 rep movs byte ptr es:[edi],byte ptr [esi]
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 00937465

WRITE_ADDRESS: 00937465

FOLLOWUP_IP:
ACPI!SleepQueue+8
b9f96e60 ?? ???

FAILED_INSTRUCTION_ADDRESS:
+3ca2faf00b1dfc0
8b015510 f3a4 rep movs byte ptr es:[edi],byte ptr [esi]

BUGCHECK_STR: 0x7E

EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
Instruction at 8b015510 does not read/write to 00937465

LAST_CONTROL_TRANSFER: from 8b0157b0 to 8b015510

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: ffffffffba50f934

STACK_COMMAND: dds BA50F934-0x20 ; kb

STACK_TEXT:
ba50f914 8b019188
ba50f918 6a6e695b
ba50f91c 5d746365
ba50f920 b9000a0d
ba50f924 00000000
ba50f928 00000016
ba50f92c 0000000d
ba50f930 b9f96e60 ACPI!SleepQueue+0x8
ba50f934 ffffffff
ba50f938 ba50fc14
ba50f93c 00000000
ba50f940 00000000
ba50f944 00000007
ba50f948 8b0e0660
ba50f94c 8b0e0660
ba50f950 8b0e0728
ba50f954 805ced7f nt!PsReferencePrimaryToken+0x17
ba50f958 ba50f9a8
ba50f95c ba50fd5c
ba50f960 00000000
ba50f964 ba50f980
ba50f968 805f7af8 nt!SePrivilegeCheck+0x30
ba50f96c e1002a98
ba50f970 ba50f99c
ba50f974 ba50fa88
ba50f978 ba50f9a8
ba50f97c ba50fd5c
ba50f980 805f666f nt!SeReleaseSubjectContext+0x11
ba50f984 8b0dd020
ba50f988 ba50f9a4
ba50f98c 8060deaf nt!ExMapHandleToPointer+0x23
ba50f990 e1003ca0


SYMBOL_NAME: ACPI!SleepQueue+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ACPI

IMAGE_NAME: ACPI.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 480252b1

FAILURE_BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_ACPI!SleepQueue+8

BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_ACPI!SleepQueue+8

Followup: MachineOwner
---------

...and one other:



Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\windows\DUMP5b7d.tmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: f:\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100427-1636
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Mon Feb 14 12:34:22.015 2011 (UTC - 5:00)
System Uptime: 0 days 0:00:10.640
Loading Kernel Symbols
...............................................................
..........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8aeab510, f78e67ec, f78e64e8}

Unable to load image iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
Probably caused by : iaStor.sys ( iaStor+39ae0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8aeab510, The address that the exception occurred at
Arg3: f78e67ec, Exception Record Address
Arg4: f78e64e8, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
+39ae0
8aeab510 f3a4 rep movs byte ptr es:[edi],byte ptr [esi]

EXCEPTION_RECORD: f78e67ec -- (.exr 0xfffffffff78e67ec)
ExceptionAddress: 8aeab510
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00937465
Attempt to write to address 00937465

CONTEXT: f78e64e8 -- (.cxr 0xfffffffff78e64e8)
eax=7ffa0238 ebx=7ffa00e8 ecx=00005800 edx=00000001 esi=7ffa0400 edi=00937465
eip=8aeab510 esp=f78e68b4 ebp=f78e6b28 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
8aeab510 f3a4 rep movs byte ptr es:[edi],byte ptr [esi]
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 00937465

WRITE_ADDRESS: 00937465

FOLLOWUP_IP:
iaStor+39ae0
f7b48ae0 ?? ???

FAILED_INSTRUCTION_ADDRESS:
+3e42faf00a7dfc0
8aeab510 f3a4 rep movs byte ptr es:[edi],byte ptr [esi]

BUGCHECK_STR: 0x7E

EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.
Instruction at 8aeab510 does not read/write to 00937465

LAST_CONTROL_TRANSFER: from 8aeab7b0 to 8aeab510

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: fffffffff78e6934

STACK_COMMAND: dds F78E6934-0x20 ; kb

STACK_TEXT:
f78e6914 8aeaf188
f78e6918 6a6e695b
f78e691c 5d746365
f78e6920 8a000a0d
f78e6924 00000000
f78e6928 00000000
f78e692c f78e6950
f78e6930 f7b48ae0 iaStor+0x39ae0
f78e6934 8ade6110
f78e6938 8a224670
f78e693c 00000001
f78e6940 8a224670
f78e6944 00000007
f78e6948 8af20660
f78e694c 8af20660
f78e6950 8af20728
f78e6954 8056c97e nt!PsReferencePrimaryToken+0x17
f78e6958 f78e69a8
f78e695c f78e6d5c
f78e6960 00000000
f78e6964 f78e6980
f78e6968 8057391f nt!SePrivilegeCheck+0x30
f78e696c e1002a98
f78e6970 f78e699c
f78e6974 f78e6a88
f78e6978 f78e69a8
f78e697c f78e6d5c
f78e6980 8056caad nt!SeReleaseSubjectContext+0x11
f78e6984 8af1e640
f78e6988 f78e69a4
f78e698c 8056effd nt!ExMapHandleToPointer+0x23
f78e6990 e1003ca0


SYMBOL_NAME: iaStor+39ae0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: iaStor

IMAGE_NAME: iaStor.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48550e8d

FAILURE_BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_iaStor+39ae0

BUCKET_ID: 0x7E_CODE_ADDRESS_MISMATCH_BAD_IP_iaStor+39ae0

Followup: MachineOwner
---------


Any help on these would be incredible!

Thanks in advance

 

Who Crashed displays the same response for every dump file:

On Mon 2/14/2011 5:34:22 PM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\DUMP5b7d.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0xB3D5)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFFFFF8AEAB510, 0xFFFFFFFFF78E67EC, 0xFFFFFFFFF78E64E8)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

 

Thanks Pete, unfortunately the laptop wont even boot into safe mode. So I can't even install the R130119 update.

 

Oddly enough when I put a different known good hdd, the system boots. I'm about a day and a half into a full chkdsk on the old drive. I've swapped out each of the RAM modules...swapping slots and installing 1 at a time...no luck there either, same 0x7e error!

 

I was able to semi-resolve this. I had to do an MS Backup of the old drive to an external drive, then restore to a new 80GB hdd (and FIXMBR on the new drive). The old hdd diags didn't indicate any errors, but a exact copy of the software on the new drive worked...go figure! Thanks for all of the help!