SFC caused BSOD

[JayJay]

On the spur of the moment decided to run SFC. Started SFC and it
asked a number of times for me to enter the Windows XP CD, I pressed
the retry button and eventually the check completed.
Starting the computer up this morning I received a BSOD with Stop:
0x0000007e error message. Luckily I had made an image file using
Acronis TrueImage just prior to running SFC so was able to restore
back. Just to make sure it was SFC that caused the problem I again
rerun SFC then turned off the computer. After rebooting the BSOD
screen came up with the same Stop message.
With SFC using Windows 98 it gave the option to change the file or
not, I never received any message when running SFC with Windows XP.

I am aware that many forums and newsgroup's recommend running SFC to
check that all system files are okay but if my experience is anything
to go by it's a potential mine field. Has anyone else experienced a
similar problem after running SFC? And how does one go about checking
the system files if SFC causes a problem?

 

[C J.]

On the spur of the moment decided to run SFC. Started SFC and it
asked a number of times for me to enter the Windows XP CD, I pressed
the retry button and eventually the check completed.
Starting the computer up this morning I received a BSOD with Stop:
0x0000007e error message. Luckily I had made an image file using
Acronis TrueImage just prior to running SFC so was able to restore
back. Just to make sure it was SFC that caused the problem I again
rerun SFC then turned off the computer. After rebooting the BSOD
screen came up with the same Stop message.
With SFC using Windows 98 it gave the option to change the file or
not, I never received any message when running SFC with Windows XP.

I am aware that many forums and newsgroup's recommend running SFC to
check that all system files are okay but if my experience is anything
to go by it's a potential mine field. Has anyone else experienced a
similar problem after running SFC? And how does one go about checking
the system files if SFC causes a problem?

Hi Jay,

SFC requires your install CD, so that the program can verify any current
protected Windows System Files it finds, against the files that were
originally installed during initial setup of Windows. If these files are
missing, or they have become corrupted somehow - then SFC replaces the files
as they are found with copies from the CD.

SFC sometimes determines you have a corrupt DLL Cache - it can rebuild that
too as part of the scan, But you have your install CD.

Looking in search for Stop: 0x0000007e error message produced 15 results,
but nothing directly related to SFC - that I could find. So you might have
some other problem afoot with your installation - or even with hardware that
is unrelated to SFC scan.

Was there any sort of WORD__WORD__WORD description as part the Stop error
you saw on your screen?

 

[Rock]

On the spur of the moment decided to run SFC. Started SFC and it
asked a number of times for me to enter the Windows XP CD, I pressed
the retry button and eventually the check completed.
Starting the computer up this morning I received a BSOD with Stop:
0x0000007e error message. Luckily I had made an image file using
Acronis TrueImage just prior to running SFC so was able to restore
back. Just to make sure it was SFC that caused the problem I again
rerun SFC then turned off the computer. After rebooting the BSOD
screen came up with the same Stop message.
With SFC using Windows 98 it gave the option to change the file or
not, I never received any message when running SFC with Windows XP.

I am aware that many forums and newsgroup's recommend running SFC to
check that all system files are okay but if my experience is anything
to go by it's a potential mine field. Has anyone else experienced a
similar problem after running SFC? And how does one go about checking
the system files if SFC causes a problem?

Here is a link to a general reference about that stop error message, but
nothing specific to SFC.
http://aumha.org/a/stop.htm
0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Wonderful that you are using ATI to protect yourself from glitches like
this. Good choice and well worth it, eh?

As you have discovered Sfc /scannow in XP does not give you any messages
about what it's doing. You can look in the logs in event viewer to see what
it has done. I don't remember which of the two logs it places it's
messages, windows of applications.

Here is a link with info on Sfc in XP.
http://www.updatexp.com/scannow-sfc.html

Personally I don't see Sfc being of great value in fixing problems. I have
seen an occasional post where running it helped, but usually not. Maybe
there is a problem with some software or hardware driver installed in your
system that is causing this problem to occur.

If you really wanted to check this out in more detail you could do a clean
boot and try SFC again to see if the results are any different. Also I
don't know if SFC will run in safe mode but that's another option to try.
Safe mode loads a limited set of drivers. If it completes ok in Safe mode,
assuming it will run in Safe mode at all, then that would point to a driver
loading in normal mode as the cause.

Clean Boot Troubleshooting

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/?id=310560

How to perform advanced clean-boot troubleshooting in Windows XP
http://support.microsoft.com/?id=316434

How to perform a clean boot in Windows XP
http://support.microsoft.com/?id=310353

A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/kb/315222/en-us

 

[C J.]

Here is a link to a general reference about that stop error message, but
nothing specific to SFC.
http://aumha.org/a/stop.htm
0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Wonderful that you are using ATI to protect yourself from glitches like
this. Good choice and well worth it, eh?

As you have discovered Sfc /scannow in XP does not give you any messages
about what it's doing. You can look in the logs in event viewer to see
what it has done. I don't remember which of the two logs it places it's
messages, windows of applications.

Here is a link with info on Sfc in XP.
http://www.updatexp.com/scannow-sfc.html

Personally I don't see Sfc being of great value in fixing problems. I
have seen an occasional post where running it helped, but usually not.
Maybe there is a problem with some software or hardware driver installed
in your system that is causing this problem to occur.

If you really wanted to check this out in more detail you could do a clean
boot and try SFC again to see if the results are any different. Also I
don't know if SFC will run in safe mode but that's another option to try.
Safe mode loads a limited set of drivers. If it completes ok in Safe
mode, assuming it will run in Safe mode at all, then that would point to a
driver loading in normal mode as the cause.

Clean Boot Troubleshooting

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/?id=310560

How to perform advanced clean-boot troubleshooting in Windows XP
http://support.microsoft.com/?id=316434

How to perform a clean boot in Windows XP
http://support.microsoft.com/?id=310353

A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/kb/315222/en-us

As a side topic discussion...

Its funny you mention "Clean boot - Safe Mode" I have SFC set up to run
from my harddrive instead of off the CD on a "Full Retail" Version of Pro
SP2. I usually run "SFC/ Scannow" from the built in Administrator account
instead of my user account thats experiencing a problem(s). I've seen
messages in safe mode ( administrator account ) that SFC couldn't run
because a Windows service wasn't loaded. Exactly which one it was escapes
me at the moment.

Also, the last time I ran SFC to correct problems with some kooky desktop
behavior about a month ago or so - SFC corrected the problems, (whater they
were) and all updates were current and intact, according to Windows Update.
However, when I went to use Windows Media Player 10 an incorrect version of
wmp.dll was reported, and so I had to reinstall the program and its security
updates. Strange eh?

 

[JayJay]

As a side topic discussion...

Its funny you mention "Clean boot - Safe Mode" I have SFC set up to run
from my harddrive instead of off the CD on a "Full Retail" Version of Pro
SP2. I usually run "SFC/ Scannow" from the built in Administrator account
instead of my user account thats experiencing a problem(s). I've seen
messages in safe mode ( administrator account ) that SFC couldn't run
because a Windows service wasn't loaded. Exactly which one it was escapes
me at the moment.

Also, the last time I ran SFC to correct problems with some kooky desktop
behavior about a month ago or so - SFC corrected the problems, (whater they
were) and all updates were current and intact, according to Windows Update.
However, when I went to use Windows Media Player 10 an incorrect version of
wmp.dll was reported, and so I had to reinstall the program and its security
updates. Strange eh?

Thanks Rock and CJ for the information - Later on to-day I'll go
though the exercise of running SFC in safe mode and doing a clean-boot
and let you both know the results.

Point I should have raised in my original posting is that the machine
was running rock solid before using SFC (as it is now after restoring
the image made previously)

 

[JayJay]

On Fri, 1 Jun 2007 00:28:42 -0700, C J. wrote:

(snip)

Was there any sort of WORD__WORD__WORD description as part the Stop error
you saw on your screen?

None. However, the full stop error message was:
Stop: 0X0000007E (0XC0000005,0XBA052184,0XBACFED28,0XBACFEA24)

Google search for the full stop message failed to bring up any
results.

 

[Rock]

As a side topic discussion...

Its funny you mention "Clean boot - Safe Mode" I have SFC set up to run
from my harddrive instead of off the CD on a "Full Retail" Version of Pro
SP2. I usually run "SFC/ Scannow" from the built in Administrator account
instead of my user account thats experiencing a problem(s). I've seen
messages in safe mode ( administrator account ) that SFC couldn't run
because a Windows service wasn't loaded. Exactly which one it was escapes
me at the moment.

Ok, I haven't tried it in Safe Mode in ages so I didn't remember if it would
run from there. The OP should still try running from a clean boot.

Also, the last time I ran SFC to correct problems with some kooky desktop
behavior about a month ago or so - SFC corrected the problems, (whater
they were) and all updates were current and intact, according to Windows
Update. However, when I went to use Windows Media Player 10 an incorrect
version of wmp.dll was reported, and so I had to reinstall the program and
its security updates. Strange eh?

All SFC does is make sure the dllcache file is populated with the correct
files. Windows file protection takes care of replacing the working files
from dllcache if they get deleted. So that's why SFC usually doesn't have
much impact. It's only when the working file is borked and the file in
dllcache is no good that it helps. This isn't too often.

 

[Rock]

Thanks Rock and CJ for the information - Later on to-day I'll go
though the exercise of running SFC in safe mode and doing a clean-boot
and let you both know the results.

Point I should have raised in my original posting is that the machine
was running rock solid before using SFC (as it is now after restoring
the image made previously)

As CJ pointed out in his last post, SFC didn't run in Safe mode for him. I
didn't remember for sure. You can try but it probably won't so try the
clean boot into normal and run it. Of course if it borks you again, you'll
have to restore the ATI image.

Sorry I don't know why it's doing this. Please post back your results.

 

[C J.]

Ok, I haven't tried it in Safe Mode in ages so I didn't remember if it
would run from there. The OP should still try running from a clean boot.


All SFC does is make sure the dllcache file is populated with the correct
files. Windows file protection takes care of replacing the working files
from dllcache if they get deleted. So that's why SFC usually doesn't have
much impact. It's only when the working file is borked and the file in
dllcache is no good that it helps. This isn't too often.

Heres some FYI for future reference:

When a user attempts to run 'SFC /Scannow in' "Safe Mode" windows displays
a '0x0000006ba [the RPC service is not started]' error dialog.

If you run SFC /Scannow in the "Clean-boot" state it will work just fine.
The User should be certain their access to the internet is disabled.

( Mine wasn't - and so now I'm scanning with NOD to be sure I didn't pick up
any web crud.)

Once the scan completes a user should run msconfig to reset their bootup
sequence back to normal mode, and then reboot.

Finally, user should go to Windows Update online to scan for and download
any updates that will need to be re-applied post SFC.

 

[JayJay]

"JayJay" wrote

If you really wanted to check this out in more detail you could do a clean
boot and try SFC again to see if the results are any different. Also I
don't know if SFC will run in safe mode but that's another option to try.
Safe mode loads a limited set of drivers. If it completes ok in Safe mode,
assuming it will run in Safe mode at all, then that would point to a driver
loading in normal mode as the cause.

As you are now aware SFC doesn't work in safe mode, I did give it a go
for interest sake however.

In the System Configuration Utility dialog box I clicked the General
Tab and then clicked Selective Startup.
I cleared the check box on:
Process System.ini.file.
Process Win.ini file.
Load Startup Items.
Clicked the Service Tab and selected the Hide All Microsoft Services.
Clicked Disable All, clicked OK and restarted the computer.

After a Clean Boot into Windows I started SFC /scannow and allowed the
process to finish.
Rebooted and got BSOD with same Stop error message as before.
This would indicate that the problem isn't with a driver loading in
normal mode?

After rebooting from the BSOD I went into safe mode and used the "Last
Known Good Configuration" option, the computer then continued on to
boot correctly.

Using the Sigverif tool I checked all unsigned drivers installed and
found quite a number. However, as far as I could ascertain they
belonged to either Fine Print or the Epson printer drivers.
Checked on the Epson site to make sure I have the current driver for
my printer (which I do).
I'm happy to remove the Fine Print driver for test purposes and will
try this tomorrow sometime.

Any further suggestions? Or should I live with the fact that I can't
use SFC.

 

[Rock]

As you are now aware SFC doesn't work in safe mode, I did give it a go
for interest sake however.

In the System Configuration Utility dialog box I clicked the General
Tab and then clicked Selective Startup.
I cleared the check box on:
Process System.ini.file.
Process Win.ini file.
Load Startup Items.
Clicked the Service Tab and selected the Hide All Microsoft Services.
Clicked Disable All, clicked OK and restarted the computer.

After a Clean Boot into Windows I started SFC /scannow and allowed the
process to finish.
Rebooted and got BSOD with same Stop error message as before.
This would indicate that the problem isn't with a driver loading in
normal mode?

No, I don't think you can draw that conclusion. A clean boot doesn't mean
all 3rd party drivers are not loaded. If SFC ran in Safe Mode, and when run
it gave the same error, that would indicate it's not a driver that's loaded
into normal mode.

After rebooting from the BSOD I went into safe mode and used the "Last
Known Good Configuration" option, the computer then continued on to
boot correctly.

Ok so you don't have to restore a previous image.

Using the Sigverif tool I checked all unsigned drivers installed and
found quite a number. However, as far as I could ascertain they
belonged to either Fine Print or the Epson printer drivers.
Checked on the Epson site to make sure I have the current driver for
my printer (which I do).
I'm happy to remove the Fine Print driver for test purposes and will
try this tomorrow sometime.

Any further suggestions? Or should I live with the fact that I can't
use SFC.

The system is clean of malware, right?

You could run driver verifier.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617/en-us

Of course this might not be a driver issue but I would run that just to see
if anything rears it's ugly head.

After that you could do a repair install, and then test.
http://www.michaelstevenstech.com/XPrepairinstall.htm

If that worked you would then need to revisit windows update for all the
updates. If that didn't you could restore the last working image.

 

[JayJay]

No, I don't think you can draw that conclusion. A clean boot doesn't mean
all 3rd party drivers are not loaded. If SFC ran in Safe Mode, and when run
it gave the same error, that would indicate it's not a driver that's loaded
into normal mode.


Ok so you don't have to restore a previous image.


The system is clean of malware, right?

You could run driver verifier.
How to Use Driver Verifier to Troubleshoot Windows Drivers
http://support.microsoft.com/kb/244617/en-us

Of course this might not be a driver issue but I would run that just to see
if anything rears it's ugly head.

After that you could do a repair install, and then test.
http://www.michaelstevenstech.com/XPrepairinstall.htm

If that worked you would then need to revisit windows update for all the
updates. If that didn't you could restore the last working image.

Thanks Rock, that should keep me busy for awhile

 

[C J.]

As you are now aware SFC doesn't work in safe mode, I did give it a go
for interest sake however.

In the System Configuration Utility dialog box I clicked the General
Tab and then clicked Selective Startup.
I cleared the check box on:
Process System.ini.file.
Process Win.ini file.
Load Startup Items.
Clicked the Service Tab and selected the Hide All Microsoft Services.
Clicked Disable All, clicked OK and restarted the computer.

After a Clean Boot into Windows I started SFC /scannow and allowed the
process to finish.
Rebooted and got BSOD with same Stop error message as before.
This would indicate that the problem isn't with a driver loading in
normal mode?

After rebooting from the BSOD I went into safe mode and used the "Last
Known Good Configuration" option, the computer then continued on to
boot correctly.

Using the Sigverif tool I checked all unsigned drivers installed and
found quite a number. However, as far as I could ascertain they
belonged to either Fine Print or the Epson printer drivers.
Checked on the Epson site to make sure I have the current driver for
my printer (which I do).
I'm happy to remove the Fine Print driver for test purposes and will
try this tomorrow sometime.

Any further suggestions? Or should I live with the fact that I can't
use SFC.

Hi Jay,

Okay, so far we know your system ran fine until you performed SFC. After
that It BSOD'ed on reboot. But - because you imaged the C: drive before
doing SFC, you were able to re-image C: and it booted back up normally.

Something is either occuring in your services axis (could be file
corruption,) or its a hardware related fault of some sort.

We know that Stop: 0X0000007E is the error your receiving, and that
(0XC0000005,0XBA052184,0XBACFED28,0XBACFEA24) are four parameters that are
in the error signature information (BCPx), inside the parentheses of the
technical information for the Stop error message, and can vary according to
your computer's configuration. (thank god for cut and paste, and TY
microsoft)

In order to interpret the error it would be great to find out some the
following:

PC make and model

What sort of hardware config does your system have.

Hard Drive brand and model, size, the Drive type (SATA, RAID, or UDMA)

Make and Model of Motherboard, Processor type, make (Amd Intel) Cpu
speed... Ram memory type? < 512 MB or 512 > up to 1 GB?

Is Video integrated on your motherboard, or is it a PCI or AGP type card.
Basic Info about card.

Is Sound integrated on your motherboard, or is it a PCI card.
Basic Info about card.

Is Modem, or Ethernet integrated on your motherboard, or is it a PCI card?
Info about card.

Are there any specialty boards installed in your system (Scsi adapters, USB
expansion cards,)

Are you on Cable internet (eg: Comcast), Do you use dialup networking, or do
you have DSL?

Have you had to replace any hardware, or do a repair install on your system
in recent months? Are any unusual type /!\warnings, or (x) Errors found in
the Application, or System event logs (control panel, admin tools, event
viewer.)

 

[C J.]

Thanks Rock, that should keep me busy for awhile

Something else you could try would be Chkdsk /F -- and let it run on next
reboot. You have an Image of C: already so theres nothing to lose. If it
works out, disregard my 06/01 23:00hrs post.

 

[JayJay]

On Fri, 1 Jun 2007 23:00:22 -0700, C J. wrote:

Hi Jay,

Okay, so far we know your system ran fine until you performed SFC. After
that It BSOD'ed on reboot. But - because you imaged the C: drive before
doing SFC, you were able to re-image C: and it booted back up normally.

Something is either occuring in your services axis (could be file
corruption,) or its a hardware related fault of some sort.

We know that Stop: 0X0000007E is the error your receiving, and that
(0XC0000005,0XBA052184,0XBACFED28,0XBACFEA24) are four parameters that are
in the error signature information (BCPx), inside the parentheses of the
technical information for the Stop error message, and can vary according to
your computer's configuration. (thank god for cut and paste, and TY
microsoft)

In order to interpret the error it would be great to find out some the
following:

PC make and model

Home built

What sort of hardware config does your system have.

Hard Drive brand and model, size, the Drive type (SATA, RAID, or UDMA)

C: Seagate Barracudda 7200 120GB D: Seagate Bsrracudda 7200 200GB
Plus two external hard drives both Seagate one 200GB and the other
160GB. Externals are in Vantec NexStar 3 enclosures. All drives are
SATA but not raid, the two externals are USB connected.

Make and Model of Motherboard, Processor type, make (Amd Intel) Cpu
speed... Ram memory type? < 512 MB or 512 > up to 1 GB?

Asus A8N-SLI Socket 939 Motheboard.
AMD Athlon64 3700+(2.2hz) 1MB Cache San Diago Core 800mhz socket 939
CPU.
Consair 2x 1GB PC3200 DDR Memory.

Is Video integrated on your motherboard, or is it a PCI or AGP type card.
Basic Info about card.

Leadtek nVidia GeForce 7300GS PX7300GS 128MB PCI-Express.

Is Sound integrated on your motherboard, or is it a PCI card.
Basic Info about card.
Motherboard.

Is Modem, or Ethernet integrated on your motherboard, or is it a PCI card?
Info about card.

Ethernet onboard.

Are there any specialty boards installed in your system (Scsi adapters, USB
expansion cards,)
No.

Are you on Cable internet (eg: Comcast), Do you use dialup networking, or do
you have DSL?
Cable.

Have you had to replace any hardware, or do a repair install on your system
in recent months?
No.

Are any unusual type /!\warnings, or (x) Errors found in
the Application, or System event logs (control panel, admin tools, event
viewer.)

Recently No.

Intend to do a repair install sometime within the next week, then try
SFC again. If I still can't run SFC without a BSOD I intend to live
with the problem, unless you can come up with another idea

 

[C J.]

On Fri, 1 Jun 2007 23:00:22 -0700, C J. wrote:


Home built


C: Seagate Barracudda 7200 120GB D: Seagate Bsrracudda 7200 200GB
Plus two external hard drives both Seagate one 200GB and the other
160GB. Externals are in Vantec NexStar 3 enclosures. All drives are
SATA but not raid, the two externals are USB connected.


Asus A8N-SLI Socket 939 Motheboard.
AMD Athlon64 3700+(2.2hz) 1MB Cache San Diago Core 800mhz socket 939
CPU.
Consair 2x 1GB PC3200 DDR Memory.


Leadtek nVidia GeForce 7300GS PX7300GS 128MB PCI-Express.


Ethernet onboard.


Recently No.

Intend to do a repair install sometime within the next week, then try
SFC again. If I still can't run SFC without a BSOD I intend to live
with the problem, unless you can come up with another idea

Aren't Homebuilt systems great, I'm on my third one in 12 years, my 2nd one
I've converted into a testbench system for dealing with viruses etc. I've
seldom had a lick of trouble (unless it was self inflicted. We all live and
learn)

You mentioned something about finding many unsigned drivers in a previous
post - were any of those drivers for your BIOS, motherboard chipset, on
board sound, or perhaps for your video card?

My only thought is either its one or more of these unsigned drivers could be
causing Windows to hang and BSOD- during startup, or its a hardware specific
problem.

Perhaps looking at methods 3 and 4 in http://support.microsoft.com/kb/330182
might be of some relevance or shed more light on the problem.

Let us know.

 

[JayJay]

Aren't Homebuilt systems great, I'm on my third one in 12 years, my 2nd one
I've converted into a testbench system for dealing with viruses etc. I've
seldom had a lick of trouble (unless it was self inflicted. We all live and
learn)

I built my first on in 91 when I retired but from now on I'll get a
local lad to build for me, can't be bothered any more.
When I first assembled a computer it was cheaper to build than buy a
brand name, now it's the opposite.

You mentioned something about finding many unsigned drivers in a previous
post - were any of those drivers for your BIOS, motherboard chipset, on
board sound, or perhaps for your video card?

As far as I could ascertain all the unsigned drivers concerned either
Fine Print or Epson drivers. I don't use Fine Print anymore so that
can be deleted and the Epson Printer driver is up to date.
There is a new BIOS for the motherboard but the only new item shown is
for new CPU's so can't see any reason to update. I'll check the
Leadtek web site for the video card to-day.

My only thought is either its one or more of these unsigned drivers could be
causing Windows to hang and BSOD- during startup, or its a hardware specific
problem.

Perhaps looking at methods 3 and 4 in http://support.microsoft.com/kb/330182
might be of some relevance or shed more light on the problem.

Things seem to be okay, at least I can't see anything that stands out.

Let us know.

Will do

 

[JayJay]

On Sat, 2 Jun 2007 15:57:52 -0700, C J. wrote:


Will do

I deleted the Fine Print driver and updated both the video and TV card
drivers, ran SFC twice then rebooted, both times the computer booted
up okay. The machine has been running fine with no problems for the
past few hours which included a number of reboots.

I would like to thank both Rock, and CJ, for all the pointers and
advice - many thanks.

 

[Rock]

I deleted the Fine Print driver and updated both the video and TV card
drivers, ran SFC twice then rebooted, both times the computer booted
up okay. The machine has been running fine with no problems for the
past few hours which included a number of reboots.

I would like to thank both Rock, and CJ, for all the pointers and
advice - many thanks.

So it was a driver. Nice work Jay, fleshing this out, and posting back.