Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Error code 0000007F

Error code
0x0000007F
Type
Description
UNEXPECTED_KERNEL_MODE

Comments

EventID.Net
This error may indicate hardware-related problems. Investigate all the components of the system for signs of malfunctioning hardware. A typical hardware component causing this is faulty memory modules.

There are instances of this problem when faulty software is involved (see M814512 for example). In this case the solution is to update the drivers or install certain hotfixes (as in M825673).

Another type of conditions when this error may occur is when the computer lacks sufficient kernel space to process kernel-mode drivers. This may occur when there is large volume of I/O activity (like real-time antivirus scanning) of a "busy" file server. For such conditions, it is possible to increase this type of resource via registry settings. See M822789.

From Microsoft:
This Stop message, also known as Stop 0x7F, means that one of two types of problems occurred in kernel-mode, either a kind of condition that the kernel is not allowed to have or catch (a bound trap), or a kind of error that is always fatal. Occasionally, this message can be caused by software problems, but the most common cause is hardware failure.

Interpreting the Message
The four parameters listed in the message are defined in order of appearance as follows:

Processor exception code
0 (zero)
0 (zero)
0 (zero)
The first and most important parameter (0x0000000x) can have several different values. The cause of this error can vary, depending on the value of this parameter. All conditions that cause a Stop 0x7F can be found in any x86-based microprocessor reference manual because they are specific to the x86-based platform. Here are some of the most common exception codes:

- 0x00000000, or Divide by Zero Error, is caused when a DIV instruction is run and the divisor is 0. Memory corruption, other hardware problems, or software failures can cause this error.
- 0x00000004, or Overflow, occurs when the processor executes a call to an interrupt handler when the overflow (OF) flag is set.
- 0x00000005, or Bounds Check Fault, is generated when the processor, while executing a BOUND instruction, finds that a variable's assigned value exceeds the specified limits. A BOUND instruction is used to ensure that a signed array index is within a certain range.
- 0x00000006, or Invalid Opcode, is generated when the processor attempts to run an invalid instruction. This is generally caused when the instruction pointer has become corrupted and is pointing to the wrong location. The most common cause of this is hardware memory corruption.
- 0x00000008, or Double Fault, is when an exception occurs while trying to call the handler for a prior exception. Normally, the two exceptions can be handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. This is almost always caused by hardware problems.
Other exception codes are defined as follows:

- 0x00000001A system-debugger call.
- 0x00000003A debugger breakpoint.
- 0x00000007A hardware coprocessor instruction with no coprocessor present.
- 0x0000000AA corrupted Task State Segment.
- 0x0000000BAn access to a memory segment that was not present.
- 0x0000000CAn access to memory beyond the limits of a stack.
- 0x0000000DAn exception not covered by some other exception; a protection fault that pertains to access violations for applications.

Resolving the Problem
Hardware failure or incompatibility. Stop 0x7F usually occurs after the installation of faulty or mismatched hardware (especially memory) or in the event that installed hardware fails. If hardware was recently added to the system, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics supplied by the system manufacturer, especially the memory scanner, to determine which hardware component has failed. For details on these procedures, see the owner's manual for your computer. Check that all the adapter cards in the computer, including memory modules, are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean. Be sure to wipe the cleaned contacts off, removing all cleaning debris, before reinstalling the adapter card into the computer. If compressed air is available, use it to clear out the adapter card slot.

If the error appears on a newly installed system, check the availability of updates for BIOS revisions on the motherboard, SCSI controllers, or network cards. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Confirm that all hard disks, hard disk controllers, and SCSI adapters are listed on the Windows 2000 Hardware Compatibility List (HCL). For more information about the HCL, see "Additional Resources" at the end of this chapter.

If the error occurred after the installation of a new or updated device driver, the driver needs to be removed or replaced. If, under this circumstance, the error occurs during the startup sequence, restart the computer using Safe Mode to rename or delete the file. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. For more information about Safe Mode and the Recovery Console, see "Troubleshooting Tools and Strategies" in this book.

Also try restarting your computer, and press F8 at the character-mode screen that displays the prompt "For troubleshooting and advanced startup options for Windows 2000, press F8." On the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Overclocking. Setting the CPU to run at speeds above the rated specification (known as overclocking the CPU) can cause this error. If this has been done to the computer experiencing the error, return the CPU to the default clock speed setting.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.

If you encountered this error while upgrading to Windows 2000, it might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners prior to upgrading. Contact the software manufacturer to obtain updates of these tools.

Microsoft periodically releases a package of product improvements and problem resolutions for Windows 2000 called a Service Pack. Because many problems are resolved by installing the latest Service Pack, it is recommended that all users install them as they become available. To check which Service Pack, if any, is installed on your system, click Start, click Run, type winver, and then press ENTER. The About Windows 2000 dialog box displays the Windows version number and the version number of the Service Pack, if one has been installed.

Occasionally, remedies to specific problems are developed after the release of a Service Pack. These remedies are called hotfixes. Microsoft does not recommend that you install a postService Pack hotfix unless the specific problem it addresses has been encountered. Service Packs include all of the hotfixes released since the release of the previous Service Pack. The status of hotfix installations is not indicated in the About Windows 2000 dialog box. For more information about Service Packs and hotfixes, see "Additional Resources" at the end of this chapter.

Finally, if all the above steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.

Another comment from Microsoft:
Explanation:
This is a Windows 2000 Executive character-mode STOP message. It indicates that a trap occurred in kernel mode.

User Action:
If this is the first time you have booted after installing new hardware, remove the hardware and boot again. Check the Microsoft Hardware Compatibility List to verify that the hardware and its drivers are compatible with Windows 2000. For information about the hardware, contact the supplier. If you are installing Windows 2000 for the first time, check the Windows 2000 system requirements, including the amount of RAM and disk space required to load the operating system. Also, check the Hardware Compatibility List to verify that the system can run Windows 2000. If Windows 2000 is loaded and no new hardware has been installed, reboot with recovery options set to create a dump file. If the message continues to appear, select the Last Known Good option when you reboot. If there is no Last Known Good configuration, try using the Emergency Repair Disk. If you do not have an Emergency Repair Disk, contact your technical support group.

* * *
M967582 provides an example when this error code is caused by the Bluetooth host control interface depleting resources when the computer enters the "Sleep" mode (and a hotfix is available for Vista).

EventID.Net
Use the "Memtest86 - A Stand-alone Memory Diagnostic" and "Windows Memory Diagnostic" tools to determine if this problem is caused by bad RAM. See the links below for a download location.

Search

Keywords: error code 0x0000007F and Bugcheck: Google - Bing - Microsoft - Yahoo

Keywords: UNEXPECTED_KERNEL_MODE: Google - Bing - Microsoft - Yahoo

Feedback
If you have additional details about this error code, please send it to us

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...