Solved BSOD 0x7E on XP x64 SP2 after sfc.exe /scannow

Per Hansson

Posts: 1,978   +234
Staff member
Hi, I had an issue where my computer was leaking memory, it used 9GB but no processes had allocated the memory according to Process Exporer, I killed all non-critical processes but the memory usage did not go down, eventually I got a IRQL_NOT_LESS_OR_EQUAL BSOD, Windbg reproted: "Probably caused by Lycosa.sys"

I thought that maybe my Windows files had become corrupt, so after the system rebooted after this BSOD I ran a sfc.exe /scannow (I should add the system started just fine at this stage)

It seems this was a bad choice, I gave it my XP x64 SP2 CD because it asked for it, and then I got all these messages in the eventlog, after this I always get the same BSOD each time I try to boot in normal mode, I can boot to Safe Mode just fine however...
I tried the "Last known good configuration" but this did not help.

I searched for the files it references and they are not in C:\Windows\System32, but many of them are in C:\Windows\SysWow64
I looked in the installation CD for them but they where not there, so it's my assumption these are not normal XP x64 system files...

I attached pictures taken of the BSOD, no Minidump is created for this BSOD...

Code:
Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:16:45
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\commdlg.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:23
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\keyboard.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:29
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\lzexpand.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:35
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\mmsystem.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:35
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\mmtask.tsk could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:37
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\mouse.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:52
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\msvcp50.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:18:53
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\msvideo.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].

Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:19:01
User:		N/A
Computer:	XPX64
Description:
The system file c:\program files (x86)\windows media player\npdsplay.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:19:08
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\olecli.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:19:08
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\olesvr.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].

Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:19:46
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\shell.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].

Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:01
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\sound.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:11
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\system.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:12
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\tapi.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:14
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\timer.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:25
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\ver.dll could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].


Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:26
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\vga.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].

Event Type:	Information
Event Source:	Windows File Protection
Event Category:	None
Event ID:	64021
Date:		2011-11-09
Time:		22:20:40
User:		N/A
Computer:	XPX64
Description:
The system file c:\windows\system32\wfwnet.drv could not be copied into the DLL cache.  The specific error code is 0x00000000 [The operation completed successfully.
].  This file is necessary to maintain system stability.

For more information, see Help and Support Center at [url]http://go.microsoft.com/fwlink/events.asp[/url].
 

Attachments

  • 10112011632.jpg
    10112011632.jpg
    166 KB · Views: 2
  • 10112011633.jpg
    10112011633.jpg
    185.2 KB · Views: 2
  • 11112011634.jpg
    11112011634.jpg
    182.1 KB · Views: 2
I've written down the bugcheck codes from the pictures, they are very similar each time...
I should also mention that I dualboot with Win7 x64 and that works fine, so it's not a hardware problem for sure...

0x0000007E (0xFFFFFFFFC0000005, 0xFFFFFADF28300756, 0xFFFFFADF2A085D50, 0xFFFFFADF2A085760)
0x0000007E (0xFFFFFFFFC0000005, 0xFFFFFADF28300756, 0xFFFFFADF2A093D50, 0xFFFFFADF2A093760)
0x0000007E (0xFFFFFFFFC0000005, 0xFFFFFADF28300756, 0xFFFFFADF2A093D50, 0xFFFFFADF2A093760)

Short version:
0x7E (0xC0000005, 0xADF28300756, 0xADF2A085D50, 0xADF2A085760)
0x7E (0xC0000005, 0xADF28300756, 0xADF2A093D50, 0xADF2A093760)
0x7E (0xC0000005, 0xADF28300756, 0xADF2A093D50, 0xADF2A093760)
 
I finally figured this out, seeing as the system booted fine into Safe Mode I just could not give up ;)
I was looking for a way to make the "Normal Mode" behave just like "Safe Mode" (that is only load the necessary drivers and services).
I did not find a way to do that exactly but I used the program "Autoruns" by Mark Russinovich that I've used before to disable all drivers in it's drivers tab except my LSI RAID controller...

This resulted in a STOP 0x7B BSOD instead, and I then realized that a stupid "SiRemFil.sys" filter driver by Silicon Image that I've tried before to get rid of caused this, I have no idea why my system wont boot without that driver, it has no Silicon Image controllers installed what so ever, but I digress.

So now if you weren't as cool as me you'd just restore your registry backup but alas I had none :D
After some registry hacking re-enabling the stupid "SiRemFil.sys" by loading the hive into my Win7 dual boot I got the system past the 0x7B BSOD, and it actually then booted straight up!

After enabling service by service I finally found out that it was the nVidia Forceware drivers causing the BSOD (nv4_mini.sys) I had version 267.24 installed.
I uninstalled the drivers in Add/Remove Programs, than I rebooted and used Driver Cleaner to remove any remnants, finally I installed the latest 285.62 drivers (selecting a clean install) and the system now runs perfectly :)
It did trigger a reactivation prompt for Windows, but I guess you can't win em all ;)
 
Back