?
Solved

STOP:  Ox0000007E BSOD

Posted on 2008-02-11
18
Medium Priority
?
1,444 Views
Last Modified: 2011-10-19
Laptop is approximately 2 years old; 1GB RAM (2-512MB modules), 160GB HD--plenty of free space.
I've been receiving this error for about a month now, and attempting seemingly every possible solution.  The last stop messages have been as follows:
STOP:  Ox0000007E (OxC0000005, Ox804E4337, OxF7A4FBBC, OxF7A4F8B8)
STOP:  Ox0000007E (OxC0000005, Ox804E4337, OxF7A2FBBC, OxF7A2F8B8)
STOP:  Ox0000007E (OxC0000005, Ox804E4337, OxF7A3BBBC, OxF7A3B8B8)
STOP:  Ox0000007E (OxC0000005, Ox804E4337, OxF7A4BBBC, OxF7A4B8B8)
STOP:  Ox0000007E (OxC0000005, Ox804E4337, OxF7A2FBBC, OxF7A2F8B8)
The first two numbers in parenths are always the same, the last two are close--don't know if that's significant or not.  There have been no other error messages in all caps such as "IRQ_LESS_THAN_OR_EQUAL_TO".

Here's what been done so far:
1)  Flashed BIOS successfully to latest version from Toshiba website.  (This helped a little--can now boot to safe mode w/o BSOD.)
2)  Updated drivers to latest drivers from Intel and Toshiba website for chipset, video, modem, LAN.  (Seemingly difference.)
3)  To my knowledge, up-to-date on MS service packs, updates, etc.
4)  Booted to Recovery Console, and ran chkdsk /r.  Errors reported, and supposedly fixed.
4)  Ran Fujitsu HD quick (no errors reported) and comprehensive (errors *reported*) diags--but no fixes applied.  (See next step.)
5)  Ran SpinRite6 (from grc.com) on level 4--reported bad cluster.  Was able to recover some files; some not.  Don't know which files were affected.  Rest of disk checked out OK.
6)  Re-ran Fujitsu HD comprehensive diags, and now reports no errors--all clean.
7)  Have run multiple CPU, and memory tests (Memtest86+) from new copy of Ultimate Boot CD; several passes without failure.
8)  All devices listed on Device Manager *appear* to be working correctly.

I've noticed (from attached NTBTLOG.TXT file) that some drivers are not loading.  Also have incloded Hijackthis log file, if that helps.  Can include mini-dump file too, if that would help.  Let me know if I need to clarify anything--thanks in advance for your help.  This has been extremely frustrating, and would prefer not to buy another laptop.  

ntbtlog.txt
hijackthis.log
0
Comment
Question by:dhjensen
  • 9
  • 8
18 Comments
 
LVL 21

Expert Comment

by:briancassin
ID: 20867878
you hijack this log has a couple of things
O18 - Protocol: a5res - (no CLSID) - (no file)  
 
O18 - Protocol: XBasic - (no CLSID) - (no file)

your nbtlog you posted is empty.

Please post the minidump file
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20867901
Also have you tried removing the ram and reinstalling one at a time ?

Have you installed anything new since the BSOD errors started, hardware or software ?
0
 

Author Comment

by:dhjensen
ID: 20868274
briancassin:
Thanks, I'll re-post the NTBTLOG.TXT file, and upload the minidump.  (Changed extension to .TXT per EE's allowed files.)
I have re-seated the ram, but not re-installed one at a time--will do.  No new HW or SW additions, etc.  Bear with me, the laptop is at home--can't take to work due to security restrictions, etc.

Thanks again.
Mini021108-01.txt
ntbtlog.txt
0
Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

 
LVL 21

Accepted Solution

by:
briancassin earned 2000 total points
ID: 20868765
Looking at the minidump it is point to ntkrpamp.exe as the problem.

If you can boot into safe mode then it is some service or startup  driver probably causing the issue.
The dump file indicates ntoskrnl.exe but if that trully was bad you would not be able to get into safe mode.

Go into safe mode then go start run type msconfig hit enter
go to the boot.ini tab and click on check all  boot paths, then go to the startp tab if you have anything disabled write it down as we are going to disable everything here. disable everything then hit apply then reboot see if you are able to boot into windows now or not if it can then something in your startup is causing the issue. The way to determine the cause of the problem is to keep enabling items and rebooting until you cannot get into windows then you will be able to identify the cause at which point once that is identified we can see what that is and go from there.

Have you tried doing a repair install of windows ?

What type of network card is in the laptop ?

Do you have any client login software like Novell or so forth ?

We may want to check and make sure you do not have any malware on the system.

Download  combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply along with a fresh HJT log as well
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also go to http://www.tomcoyote.org/hjt download hijack this run it and post the logfile here


If combofix reports it removed files then continue on through this if not then post it's logfile and a hijack this logfile

I would then get

http://www.ccleaner.com   download it and run it to clear out all the windows junk files and make the scans faster.

http://www.superantispyware.com download it update it and run it

http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11    - select to only download and install spyware doctor.

online anti virus scanners

http://www.pandasoftware.com   - panda activescan
http://www.bitdefender.com 
http://housecall.trendmicro.com


Additionally I would download and run rootkit revealer if it comes up with anything odd post it up here.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

Check and make sure you have ntkrpamp.exe in your system and check the date and location of it

Also check the event logs for corosponding errors or warnings of drivers or services failing

this has information for multiple stop errors.
http://aumha.org/a/stop.php#0x7e

get back to me and let me know the results
0
 

Author Comment

by:dhjensen
ID: 20869539
Thanks for the post--will perform thoses tasks tonight.  To answer your questions:
Have you tried doing a repair install of windows ? Not yet.

What type of network card is in the laptop ?  From Toshiba website:  
" Intel PRO/100 VE Network Connection - 10/100 Base-TX Ethernet
" Integrated Intel Pro/Wireless Network Connection 3945ABG (802.11a/b/g)

Do you have any client login software like Novell or so forth ? No.

Let me know if you have any additional questions--otherwise my next post will contain the results of the testing.
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20869863
Let me know what the results are I have no other questions right now
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 20871959
I find klif.sys is installed (Kaspery AV) and it is bundled with ZoneAlarm.  Maybe klif.sys has conflict with AVG. For problem isolation, I suggest to uninstall ZA.  if no more BSOD occurs, ZA is the culprit.
0
 

Author Comment

by:dhjensen
ID: 20874670
cpc2004:  Thanks, I'll give that a try.  (Although I think it's disabled at the moment, and still BSOD, but willing try at this point--see below.)
Ran MSConfig, disabled everything on startup tab, rebooted.
Ran combofix, got BSOD after a while--log is enclosed (generated automatically after restart).  Should I run in safe mode to avoid BSOD?
Ran CCleanup without BSOD incident--cleaned over 300MB of junk.
Ran superantispyware.  Scanned memory, registry, and approximately 12,000 files before BSOD, but no errors detected before crash.  Run in safe mode?
Am continuing to run the rest of the utilities--taking a little longer than anticipated.  Thanks for the help.

ComboFix.txt
hijackthis.log
Mini021208-01.txt
0
 
LVL 21

Assisted Solution

by:briancassin
briancassin earned 2000 total points
ID: 20874719
If were able to do these things in regular windows before a crash at this point I would try removing ram then reinstalling the one ram stick boot it up and test if you get an error remove that one and put the other in see if the problem continues if the problem stops then the ram is the issue.

in the meantime I will review your log files
0
 

Author Comment

by:dhjensen
ID: 20878022
Uninstalled AVG anti-virus (to isolate possible conflich with ZoneAlarm AV).  Ran MS Rootkitreveal on one ram stick--BSOD after approximately 15 min.  Don't think it's a conflict there--they've (ZA & AVG) coexisted peacefully for several years now.  Changed memory chip and slot, ran ComboFix *completely* without BSOD (that's a first).  Now running MS Rootkitreveal tool....so far so good--fingers crossed.  Will run other suggested programs also.  Will advise regarding progress.
ComboFix2.txt
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20878772
I see a couple off oddities

C:\DOCUME~1\David\LOCALS~1\Temp\GLGFGG.exe [2008-02-12 07:56]
C:\DOCUME~1\David\LOCALS~1\Temp\HNTV.exe [2008-02-12 11:57]

you have executables running from your temp directory... go to that dirctory and find these right click on them and get the properties see if there is a manufacturer at all these do not look like good programs since they are coming from the temp directory

looks like you may have a hotbar infection based on the second file.

I would continue with the anti spyware apps especially run spyware doctor and superanti spyware

http://www.superantispyware.com download it update it and run it

http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20878782
these need to be deleted after you get the information on them

C:\DOCUME~1\David\LOCALS~1\Temp\GLGFGG.exe [2008-02-12 07:56]
C:\DOCUME~1\David\LOCALS~1\Temp\HNTV.exe [2008-02-12 11:57]
0
 

Author Comment

by:dhjensen
ID: 20885135
briancassin:
MS Rootkitreveal kit completed successfully w/o BSOD--didn't find anything, but so far the laptop has completed superantispyware, adaware, spybot, and spyware doctor without BSOD--that's a major development.  I think you found the issue with the RAM--and very interesting since I couldn't get any of the RAM diagnostic tests to fail--not once!    Adaware, spybot, and spyware doctor all found minor infections which I deleted.  Running TM Housecall at the moment.

Interestingly I checked for the C:\DOCUME~1\David\LOCALS~1\Temp\GLGFGG.exe and C:\DOCUME~1\David\LOCALS~1\Temp\HNTV.exe, and they not in those directories.  Even attrib *.* doesn't reveal them as hidden.  They're still showing up on Combofix's log as of this morning.  Any suggestions?
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20885228
thats fine they may have been removed by one of the other applications you are running.

What ram testing software did you use ?

Docmemory or another ?
0
 

Author Comment

by:dhjensen
ID: 20885672
Memtest86+ (and a few others) from the Ultimate Boot Disk.
0
 

Author Closing Comment

by:dhjensen
ID: 31429857
Thanks for the help--I'll let you know the outcome of the other tests when they finish, but IMO the major problem is solved.  Thanks again.
0
 
LVL 21

Expert Comment

by:briancassin
ID: 20885964
your welcome... I always used docmemory myself
0
 

Author Comment

by:dhjensen
ID: 20886189
I'll try it and see if it fails--once the other tests are done.
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes a user will call me frantically, explaining that something has gone wrong and they have tried everything (read - they have messed it up more and now need someone to clean up) and it still does no good, can I help them?!  Usually the standa…
In this article you will get to know about pros and cons of storage drives HDD, SSD and SSHD.
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
How to fix display issue, screen flickering issue when I plug in power cord to the machine. Before I start explaining the solution lets check out once the issue how it looks like after I connect the power cord. most of you also have faced this…
Suggested Courses

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question