Windows XP Pro Crashing..Error is STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER

[hiptolick]

Hello to you all. I have searched for the error message stated in the title of the message and note that mostly people experience this while playing games. For my situation, the crash can come at anytime. In fact the computer can be idle and just crash. The error code message from the event viewer is
"Error code 1000007f, parameter1 00000008, parameter2 80042000, parameter3 00000000, parameter4 00000000". To date I have done the following
1. Followed all the steps in the "Before you post your minidump guide" to include;
a. Removing the single 1024 mem stick and cleaning as prescribed.
b. Changing the memory stick slot.
c. Updated the nVidia display drivers for my GeForce FX5200 display adapter.
d. Changed the AGP Aperture size from 128 to 64
e. Tested the memory using "DocMemory" From Simmtester.com
f. Ran chkdsk (no errors found).
g. Set hardware acceleration to none and disenabled write combining
h. Updated mobo drivers.
h. Burned lots of incense and chanted.
As well, I have run a full adaware scan, virus scan, registry check, cleaned the system using CC Cleaner.

At this time I haven't any hypothesis to go on. What is odd about this error is that I can go for months at a time with a fairly stable system, then without warning I will be plagued for days on end.
Thanks in advance for any help and I wish you all a Happy New Year. The attachment contains 4 dmp files along with the cpuz file detailing my system configuration.

Best Regards,
Dan

 

[vegasgmc]

Thats either a faulty video card or bad video driver. The 5200's seem to be extremely troublesome and failure prone.

 

[hiptolick]

You're confirming my susupcion

Since I just updated the video driver today, with no change in behavior I was leaning towards a bad card as well. I will be swapping the card tomorrow with a lower grade ati card from another computer and see if I can get the problem solved, and even duplicated on the other computer.
Thanks for the reply.

 

[cpc2004]

Crash with stack overflow

Hi,

All of your minidumps are crashed same symptom and it is software driver problem. Your windows install a faulty version of ZoneAlarm and the debug report shows that the culprit is AVG. Your AVG has module with different version.

avg7core.sys Sun Nov 27 09:57:01 2005 (4389126D) ??
avg7rsxp.sys Fri Oct 21 16:43:38 2005 (4358AA3A) ??
nv4_disp.dll Sat Oct 30 09:15:58 2004 (4182EB4E) <-- unstable and casue bugcheck code EA

Suggestion
1. Upgrade or de-install ZoneAlarm
2. Re-insall AVG
3. Install nVidia Display Card driver 61.77 and it is stable version
http://www.nvidia.com/object/winxp_2k_61.77.html

Mini123105-01.dmp BugCheck 1000007F, {8, 80042000, 0, 0}
Probably caused by : avg7rsxp.sys ( avg7rsxp+1738 )

Mini123105-02.dmp BugCheck 1000007F, {8, 80042000, 0, 0}
Probably caused by : avg7rsxp.sys ( avg7rsxp+1738 )

Mini123105-03.dmp BugCheck 1000007F, {8, 80042000, 0, 0}
Probably caused by : avg7rsxp.sys ( avg7rsxp+1738 )

Mini123105-04.dmp BugCheck 1000007F, {8, 80042000, 0, 0}
Probably caused by : avg7rsxp.sys ( avg7rsxp+1738 )

 

[hiptolick]

Current Results from Recommendations

Well, I updated Zone Alarm Pro, uninstalled and reinstalled free version of AVG and rolled back the drive for nVidia to 6.1.7.7 as recomended as well as set hardware accelleration to none. However, the dumps persist. I've attached the latest 3 dmp files. Interesting to note that dumps can occur even after I have shutdown AVG (though the services remain running), I have shutdown the control center. Anyway, any help would be apprecaited.

Best Regards,

Dan

 

[cpc2004]

Hi,

Your windows are crashed with stack overflow and exactly the same symptoms. I analyze the stack trace to find out which process used up stack. I find AVG footprint at the stack trace and it seems that file I/O process used up the stack trace. Unless theere has bad I/O block, I believe that this is software error at device driver.

Suggestion
1. Run chKdsk /r to diagnostic your hard disk to make sure no bad i/o blocks
2. What is sbfshook? Can you de-install sbfshook?
3. If it still crashes, de-install AVG and install another anti-virus software



Stack trace
f3795c90 f35a76f2 85b09950 8568c008 804eddf9 avg7rsxp+0x1738 <- AVG
f3795cc0 f734be86 8677010b 8676f008 f3795d64 sbfshook+0x16f2 <-- ??
f3795d8c f734bf50 e100aa30 e100eaa8 e100aa30 Ntfs!LfsFlushLfcb+0x429
f3795db0 f7351a1f e100aa30 e100eaa8 e15415f8 Ntfs!LfsFlushLbcb+0x81
f3795dd8 f734aa8e e100aa30 34374d52 0000001a Ntfs!LfsFlushToLsnPriv+0xf3
f3795e18 f73367d7 e15415f8 34374d52 0000001a Ntfs!LfsFlushToLsn+0x8e
f3796004 f732bc97 f3796014 8567c008 0110070a Ntfs!NtfsCommonWrite+0x18f7
f3796178 804eddf9 86790020 8567c008 866c2990 Ntfs!NtfsFsdWrite+0xf3
f3796188 f73ce3ca 85e7e8f8 85e7e8f8 f3796604 nt!IopfCallDriver+0x31
f3796198 804eddf9 866c3548 8567c008 8567c008 sr!SrWrite+0xaa
f37961a8 f78b5738 8567c008 f7b489f0 f7b48436 nt!IopfCallDriver+0x31

f3796604 f35a76f2 85b09950 8567c008 804eddf9 avg7rsxp+0x1738 <-- AVG
f3796634 8055e1cf 85b4f40b 856919d8 f37966dc sbfshook+0x16f2 ??
f3796700 f7366ba3 85b4f4e8 f3796744 f379673c nt!CcZeroData+0x4af
f3796780 f732c131 f3796990 e375cd90 85b4f4e8 Ntfs!NtfsZeroData+0x29e
f3796980 f732bc97 f3796990 856a1008 0110070a Ntfs!NtfsCommonWrite+0x16ab
f3796af4 804eddf9 86790020 856a1008 866c2990 Ntfs!NtfsFsdWrite+0xf3
f3796b04 f73ce3ca 85e7e8f8 85e7e8f8 f3796f80 nt!IopfCallDriver+0x31
f3796b14 804eddf9 866c3548 856a1008 856a1008 sr!SrWrite+0xaa
f3796b24 f78b5738 856a1008 f7b489f0 f7b48436 nt!IopfCallDriver+0x31

f3796f80 f35a76f2 85b09950 856a1008 804eddf9 avg7rsxp+0x1738 <- AVG
f3796fb0 8050b799 85b4f40b f3796fd8 f379706c sbfshook+0x16f2 ??
f3797094 8050c16a e37444d8 e37444f8 e37444f8 nt!MiFlushSectionInternal+0x3bf
f37970d0 804e3665 00000000 e37444d8 00000000 nt!MmFlushSection+0x1e0
f3797158 f7355b75 85a805dc 00000000 00000000 nt!CcFlushCache+0x1b9
f3797184 f736f924 85aaf868 e375cd90 00000000 Ntfs!NtfsFlushUserStream+0x6c
f3797208 f736fdc9 85aaf868 86790100 00000001 Ntfs!NtfsFlushVolume+0x22a
f37972a8 f7363385 85aaf868 85534360 f3790000 Ntfs!NtfsCommonVolumeOpen+0x341
f3797380 804eddf9 86790020 85534360 85605578 Ntfs!NtfsFsdCreate+0x154
f3797390 f73d3876 85534360 866c2990 85605578 nt!IopfCallDriver+0x31
f37973dc 804eddf9 866c3600 00000001 85534538 sr!SrCreate+0x150
f37973ec f78b645b f7b489f0 85534360 85e7e8f8 nt!IopfCallDriver+0x31

f3797408 f78b5692 85e7e840 85605578 f7b48436 avg7rsxp+0x245b <- AVG
f3797864 f35a76f2 85b09950 85534360 804eddf9 avg7rsxp+0x1692
f3797960 805b3642 867738d0 00000000 8569c338 sbfshook+0x16f2 ??
f37979e8 805afb23 00000000 f3797a28 00000040 nt!ObpLookupObjectName+0x56a
f3797a3c 8056a11d 00000000 00000000 797afc00 nt!ObOpenObjectByName+0xeb
f3797ab8 8056aa94 f3797c80 80000000 f3797cac nt!IopCreateFile+0x407
f3797b14 8056e27b f3797c80 80000000 f3797cac nt!IoCreateFile+0x8e
f3797b54 f59b0026 f3797c80 80000000 f3797cac nt!NtOpenFile+0x27
f3797bb0 8053c808 f3797c80 80000000 f3797cac vsdatant+0x19026
f3797bb0 804fdb95 f3797c80 80000000 f3797cac nt!KiFastCallEntry+0xf8

 

[hiptolick]

Acknowledgement

Thanks for the work. I ran chkdsk as one of the 1st things and no errors were reported. I also ran "hijack this" for references to sbfshook but didn't find any, so I'm confused and don't know how to trace this one. Perhaps it is part of the AV, but that is simply a guess. I run the same AV on two other computers and have no problems what so ever. Could it be that there is a specific incompatability between the video card and the AV? Just guessing again.
I'll report back to the group after I take your recommended actions.

Best Regards,

Dan

 

[hiptolick]

Resuts of Round 2

chkdsk 'r' was clean.
sbfshook is a file located in windows/system32/drivers. It has no properties, other than it is a system file created on 12/28. The search also returns entries in documents and settings/temporary internet files, for my profile.
Reference to the file is embedded as part of a very, very large string. The string starts with "chunks.jsp?ipid=string. I wonder if it is part of the avg automatic update that downloads daily updates from the AVG website, as there is a part of the string that contains refernce to avg and sbfshook. So, I suspect that it is part of AVG. I guess based on your analysis the next step would be to query AVG and/or NVidia to determine if they know of an issue that keeps them from playing together nicely. I'll report back as soon as I have some useful information.

 

[hiptolick]

Update

Well, I've tried everthing recommended and was able to get some amount of stability by rolling back the nVidia driver, updating zone alarm and uninstalling and reinstalling AVG, AV. However, I was still experiencing unwelcome and unannounced crashes that seemed to occur randomly. So, I started backing out all software I had installed over the past 30 days. I did this one application at a time starting with iTunes which had no affect as the system crashed upon boot up. Then I went uninstalled an application called "Media One" about 3:00 this afternoon. The system seemed to be stable and remained so unitl I reinstalled Media One an hour ago. After reinstalling the software the system crashed. I am not reposting the dmp files at this time and would rather just wait to see if the system remains stable for a complete day. If so I will post it here. I looked but was not able to find any information from the intervideo web site (media one supplier) regarding a conflict with nvidia, or avg software.

 

[hiptolick]

Update

Very stable and responsive performance today with the Intervideo Media One removed. I have sent a support request to Intervideo asking about any known conflicts between Media One and nVidia, or AVG. Will keep posting updates as received.

Dan

 

[cpc2004]

Hi,

Do you know the device driver of "Intervideo Media One" and I want to do some reserch at google?

 

[hiptolick]

Uninstalled

I have uninstalled the application. Didn't think about taking note of it. If I reinstall it I'll try and get you some information. Do you have Media One installed?

 

[cpc2004]

Hi,

Your windows is crashed with stack overflow. Your windows has default 12K of kernel stack. From the stack trace, I find there have have big gaps between some stack entreis. Finally the stack is used up and windows is crashed with stack overflow. For example I find there has 1k gap betweeb the following stack trace entry (the stack trace of f37961a8 and f3796604). I believe that extend the size of
stack may resolve the problem.


Stack
f37961a8 f78b5738 8567c008 f7b489f0 f7b48436 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f3796604 f35a76f2 85b09950 8567c008 804eddf9 avg7rsxp+0x1738

Stack overflow
When a thread executes, Windows 2000 allocates 12 KB of kernel stack space for that thread. When the demand for stack space is greater than the available stack space, a Stop 0x0000007f with trap code 08 error occurs, and your computer may restart.

The KStackMinFree registry value specifies a minimum amount of kernel stack that must be free for File System Realtime Protection or Auto-Protect to request file IO from the file system. If the KStackMinFree value is present in the registry, then File System Realtime Protection or Auto-Protect calculates the amount of available stack space before doing any file IO. If the available kernel stack is less than the value in the registry, then File System Realtime Protection or Auto-Protect will not do any IO and will not scan the file.

It is recommends a range between 8.0 KB and 8.5 KB (Hex 2000-2200), though each environment is different and it may take some experimenting to find the right value.
Refer the following webpage to extend KStackMinFree
http://www.annoyances.org/exec/forum/win2000/1102995026


ChildEBP RetAddr Args to Child
f37950dc f732b07c f37956a0 8674cc10 00000002 Ntfs!_SEH_prolog+0x1c
.. ?? around 400 bytes gap
f37952ac f732acf6 f37956a0 8568c008 8674cc10 Ntfs!NtfsPrepareBuffers+0x270 (FPO: [Non-Fpo])
f3795494 f732c03b f37956a0 8568c008 8674cc10 Ntfs!NtfsNonCachedIo+0x20e (FPO: [Non-Fpo])
.. ?? around 450 bytes gap
f3795690 f732bc97 f37956a0 8568c008 0110070a Ntfs!NtfsCommonWrite+0x1824 (FPO: [Non-Fpo])
f3795804 804eddf9 86790020 8568c008 866c2990 Ntfs!NtfsFsdWrite+0xf3 (FPO: [Non-Fpo])
f3795814 f73ce3ca 85e7e8f8 85e7e8f8 f3795c90 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f3795824 804eddf9 866c3548 8568c008 8568c008 sr!SrWrite+0xaa (FPO: [Non-Fpo])
f3795834 f78b5738 8568c008 f7b489f0 f7b48436 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
..
WARNING: Stack unwind information not available. Following frames may be wrong.
f3795c90 f35a76f2 85b09950 8568c008 804eddf9 avg7rsxp+0x1738
f3795cc0 f734be86 8677010b 8676f008 f3795d64 sbfshook+0x16f2
..
f3795d8c f734bf50 e100aa30 e100eaa8 e100aa30 Ntfs!LfsFlushLfcb+0x429 (FPO: [Non-Fpo])
f3795db0 f7351a1f e100aa30 e100eaa8 e15415f8 Ntfs!LfsFlushLbcb+0x81 (FPO: [Non-Fpo])
f3795dd8 f734aa8e e100aa30 34374d52 0000001a Ntfs!LfsFlushToLsnPriv+0xf3 (FPO: [Non-Fpo])
f3795e18 f73367d7 e15415f8 34374d52 0000001a Ntfs!LfsFlushToLsn+0x8e (FPO: [Non-Fpo])
.. ?? around 400 bytes gap
f3796004 f732bc97 f3796014 8567c008 0110070a Ntfs!NtfsCommonWrite+0x18f7 (FPO: [Non-Fpo])
.. ?? around 400 bytes gap
f3796178 804eddf9 86790020 8567c008 866c2990 Ntfs!NtfsFsdWrite+0xf3 (FPO: [Non-Fpo])
f3796188 f73ce3ca 85e7e8f8 85e7e8f8 f3796604 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f3796198 804eddf9 866c3548 8567c008 8567c008 sr!SrWrite+0xaa (FPO: [Non-Fpo])
f37961a8 f78b5738 8567c008 f7b489f0 f7b48436 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
.. ?? There have one 1k gap
f3796604 f35a76f2 85b09950 8567c008 804eddf9 avg7rsxp+0x1738
f3796634 8055e1cf 85b4f40b 856919d8 f37966dc sbfshook+0x16f2
f3796700 f7366ba3 85b4f4e8 f3796744 f379673c nt!CcZeroData+0x4af (FPO: [Non-Fpo])
f3796780 f732c131 f3796990 e375cd90 85b4f4e8 Ntfs!NtfsZeroData+0x29e (FPO: [Non-Fpo])
.. around 600 bytes gap
f3796980 f732bc97 f3796990 856a1008 0110070a Ntfs!NtfsCommonWrite+0x16ab (FPO: [Non-Fpo])
..
f3796af4 804eddf9 86790020 856a1008 866c2990 Ntfs!NtfsFsdWrite+0xf3 (FPO: [Non-Fpo])
f3796b04 f73ce3ca 85e7e8f8 85e7e8f8 f3796f80 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f3796b14 804eddf9 866c3548 856a1008 856a1008 sr!SrWrite+0xaa (FPO: [Non-Fpo])
f3796b24 f78b5738 856a1008 f7b489f0 f7b48436 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
..
f3796f80 f35a76f2 85b09950 856a1008 804eddf9 avg7rsxp+0x1738
f3796fb0 8050b799 85b4f40b f3796fd8 f379706c sbfshook+0x16f2
f3797094 8050c16a e37444d8 e37444f8 e37444f8 nt!MiFlushSectionInternal+0x3bf (FPO: [Non-Fpo])
f37970d0 804e3665 00000000 e37444d8 00000000 nt!MmFlushSection+0x1e0 (FPO: [Non-Fpo])
..
f3797158 f7355b75 85a805dc 00000000 00000000 nt!CcFlushCache+0x1b9 (FPO: [Non-Fpo])
f3797184 f736f924 85aaf868 e375cd90 00000000 Ntfs!NtfsFlushUserStream+0x6c (FPO: [Non-Fpo])
f3797208 f736fdc9 85aaf868 86790100 00000001 Ntfs!NtfsFlushVolume+0x22a (FPO: [Non-Fpo])
f37972a8 f7363385 85aaf868 85534360 f3790000 Ntfs!NtfsCommonVolumeOpen+0x341 (FPO: [Non-Fpo])
..
f3797380 804eddf9 86790020 85534360 85605578 Ntfs!NtfsFsdCreate+0x154 (FPO: [Non-Fpo])
f3797390 f73d3876 85534360 866c2990 85605578 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f37973dc 804eddf9 866c3600 00000001 85534538 sr!SrCreate+0x150 (FPO: [Non-Fpo])
f37973ec f78b645b f7b489f0 85534360 85e7e8f8 nt!IopfCallDriver+0x31 (FPO: [0,0,0])

 

[hiptolick]

Thanks....Sooooooooooooooo

Since uninstalling Intervide Media One application I have not experienced any stop errors, so I'm assuming it to be the culprit of the overflow. I didn't see anything in the dmp data from the last post pointing to media one but that isn't necessarily a good indicator. I am still waiting for a response to my technical support request from Intervideo. I will post it when I receive it.
Thanks,
Dan

 

[Cormith]

Similar issues with a Radeon 9550

I recently Installed a 9550 and get the same error, i also have AVG but it runs fine with my 5200FX Nvidia and no dump errors.
Im going to try some of the easiest fixes first. Thanks for fighting for us all..!!!!
HUGE HELP GUYS THANKS!

 

[JAsper420]

Hi.

Okay i got a MSI Radeon x600xt pci express x16 video card, and i get an error message like this. I thought it was my card so i sent it back through an RMA and they found nothing wrong. I have tried and MSI and ATI driver, still nothing. I reinstalled several times, and still nothing. My virus scan detects nothing. This is a recent problem for me, it started a month ago. The games i had installed were SWAT 4, Call of Duty 2, Half Life 2 (most source engine games, with some third party mods), Battlefield 2, Battlefield 2 SF, RF online, Americas Army. Im sure there is more but thats all i remeber.

I noticed that the problem didnt occur untill around the time after the install of RF Online, Americas Army, Battle field 2, or Battlefield 2 SF. The crash started of usually random, then whitin 60 to 30 min., then 30 to 10min., and now its basiclly instantly!

Please some please find the problem!

 

[joshuamcdo]

I found a solution that works for me anyway... For Far Cry

I am not sure how many people this will work for, I know after days of fine tuning and memory dumps and combing over things I finally found a solution to the problem and it works 100% for me.

While looking at one of the dumps I generated, I noticed the last thing I saw was 3 letters that could have been easily overlooked. However, having owned a creative MP3 player, I knew what these three little letters mean. E.A.X. I also knew that this is a function of a "Creative" device, and I also knew I didn't have one in this new system.

So I fired up "Configure Far Cry" and got to looking around... Under sound options, there it was bigger than anything. EAX enabled.. Among a few other things like hardware mixer and such. So I turned everything but the first option off. Fired up Far Cry and it worked.. I thought to myself, this must be one of "Those times" that it works for no good reason.. So I rebooted the machine and fired up Far Cry and again it worked, and has worked over 50 times since then. So as it turns out, MS is blaming a video device driver because it's "the most likely cause" when in fact it is sound related.

Hope this helps someone..

Joshua McDowell

Linux FE

 

[toothmkr57]

I am not sure how many people this will work for, I know after days of fine tuning and memory dumps and combing over things I finally found a solution to the problem and it works 100% for me.

While looking at one of the dumps I generated, I noticed the last thing I saw was 3 letters that could have been easily overlooked. However, having owned a creative MP3 player, I knew what these three little letters mean. E.A.X. I also knew that this is a function of a "Creative" device, and I also knew I didn't have one in this new system.

So I fired up "Configure Far Cry" and got to looking around... Under sound options, there it was bigger than anything. EAX enabled.. Among a few other things like hardware mixer and such. So I turned everything but the first option off. Fired up Far Cry and it worked.. I thought to myself, this must be one of "Those times" that it works for no good reason.. So I rebooted the machine and fired up Far Cry and again it worked, and has worked over 50 times since then. So as it turns out, MS is blaming a video device driver because it's "the most likely cause" when in fact it is sound related.

Hope this helps someone..

Joshua McDowell

Linux FE

Sounds good for me to try, but I don't knoiw where to find this EAX option? I'm still learning a whole lot....
Thanks,Paul

 

[joshuamcdo]

Re: Far cry lock up

toothmkr57,
No problem, it's been a long time since I integrated that system but looking at the things I have noted I think I can sort of walk you through it.

So if you click start > all programs > UBI Soft > FarCry > Configure far cry
You should see a little program pop up, and see tabs at the top of that window. One of them should be sound. ( Click it ) Under that tab you should see an option named EAX or E.A.X. . UNcheck this box. Uncheck every option with the acception of the first check box. No matter what EAX should be turned off.
Close the program saving your changes and wa la.. No more nutty lock ups, enjoy hours and hours of Far Cry.. It's a darn nice game..

Joshua McDowell LN-FSE


>> So I fired up "Configure Far Cry" and got to looking around... Under sound >>options, there it was bigger than anything. EAX enabled.. Among a few >>other things like hardware mixer and such. So I turned everything but the >>first option off.