TechSpot

BSOD 0x7E on XP x64 SP2 after sfc.exe /scannow

By Per Hansson
Nov 10, 2011
Post New Reply
  1. Hi, I had an issue where my computer was leaking memory, it used 9GB but no processes had allocated the memory according to Process Exporer, I killed all non-critical processes but the memory usage did not go down, eventually I got a IRQL_NOT_LESS_OR_EQUAL BSOD, Windbg reproted: "Probably caused by Lycosa.sys"

    I thought that maybe my Windows files had become corrupt, so after the system rebooted after this BSOD I ran a sfc.exe /scannow (I should add the system started just fine at this stage)

    It seems this was a bad choice, I gave it my XP x64 SP2 CD because it asked for it, and then I got all these messages in the eventlog, after this I always get the same BSOD each time I try to boot in normal mode, I can boot to Safe Mode just fine however...
    I tried the "Last known good configuration" but this did not help.

    I searched for the files it references and they are not in C:\Windows\System32, but many of them are in C:\Windows\SysWow64
    I looked in the installation CD for them but they where not there, so it's my assumption these are not normal XP x64 system files...

    I attached pictures taken of the BSOD, no Minidump is created for this BSOD...

    Code:
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:16:45
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\commdlg.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:23
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\keyboard.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:29
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\lzexpand.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:35
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\mmsystem.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:35
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\mmtask.tsk could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:37
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\mouse.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:52
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\msvcp50.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:18:53
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\msvideo.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:19:01
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\program files (x86)\windows media player\npdsplay.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:19:08
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\olecli.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:19:08
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\olesvr.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:19:46
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\shell.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:01
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\sound.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:11
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\system.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:12
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\tapi.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:14
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\timer.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:25
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\ver.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:26
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\vga.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
    Event Type:	Information
    Event Source:	Windows File Protection
    Event Category:	None
    Event ID:	64021
    Date:		2011-11-09
    Time:		22:20:40
    User:		N/A
    Computer:	XPX64
    Description:
    The system file c:\windows\system32\wfwnet.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
    ].  This file is necessary to maintain system stability.
    
    For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
    
     

    Attached Files:

  2. Per Hansson

    Per Hansson TS Server Guru Topic Starter Posts: 1,929   +186

    I've written down the bugcheck codes from the pictures, they are very similar each time...
    I should also mention that I dualboot with Win7 x64 and that works fine, so it's not a hardware problem for sure...

    0x0000007E (0xFFFFFFFFC0000005, 0xFFFFFADF28300756, 0xFFFFFADF2A085D50, 0xFFFFFADF2A085760)
    0x0000007E (0xFFFFFFFFC0000005, 0xFFFFFADF28300756, 0xFFFFFADF2A093D50, 0xFFFFFADF2A093760)
    0x0000007E (0xFFFFFFFFC0000005, 0xFFFFFADF28300756, 0xFFFFFADF2A093D50, 0xFFFFFADF2A093760)

    Short version:
    0x7E (0xC0000005, 0xADF28300756, 0xADF2A085D50, 0xADF2A085760)
    0x7E (0xC0000005, 0xADF28300756, 0xADF2A093D50, 0xADF2A093760)
    0x7E (0xC0000005, 0xADF28300756, 0xADF2A093D50, 0xADF2A093760)
     
  3. Per Hansson

    Per Hansson TS Server Guru Topic Starter Posts: 1,929   +186

    I finally figured this out, seeing as the system booted fine into Safe Mode I just could not give up ;)
    I was looking for a way to make the "Normal Mode" behave just like "Safe Mode" (that is only load the necessary drivers and services).
    I did not find a way to do that exactly but I used the program "Autoruns" by Mark Russinovich that I've used before to disable all drivers in it's drivers tab except my LSI RAID controller...

    This resulted in a STOP 0x7B BSOD instead, and I then realized that a stupid "SiRemFil.sys" filter driver by Silicon Image that I've tried before to get rid of caused this, I have no idea why my system wont boot without that driver, it has no Silicon Image controllers installed what so ever, but I digress.

    So now if you weren't as cool as me you'd just restore your registry backup but alas I had none :D
    After some registry hacking re-enabling the stupid "SiRemFil.sys" by loading the hive into my Win7 dual boot I got the system past the 0x7B BSOD, and it actually then booted straight up!

    After enabling service by service I finally found out that it was the nVidia Forceware drivers causing the BSOD (nv4_mini.sys) I had version 267.24 installed.
    I uninstalled the drivers in Add/Remove Programs, than I rebooted and used Driver Cleaner to remove any remnants, finally I installed the latest 285.62 drivers (selecting a clean install) and the system now runs perfectly :)
    It did trigger a reactivation prompt for Windows, but I guess you can't win em all ;)
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...