Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Memory Corruption


  • This topic is locked This topic is locked
1 reply to this topic

#1 tryn2learn

tryn2learn

  • Members
  • 220 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Upstate NY
  • Local time:11:04 PM

Posted 04 February 2009 - 11:05 PM

Windows XP Service Pack 3

I'm using a beta version of Soundbooth and Adobe personnel asked me to temporarily disable C:\windows\system32\nvoglnt.dll and try to open a video after renaming this file and starting their software holding the shift key down. Well, their software responded perfectly. I then went back and changed the file back to the normal name. After this I did a restart on the computer. When it was shut down I got the blue screen and when it booted up I got the "this computer has recovered from a serious system error" message. I read through the posts here and thanks to USASMA downloaded the Windbg program and came up with the following report and I don't understand any of it and don't know what to do. Looking for some advise. Thanks


Microsoft ® Windows Debugger Version 6.10.0003.233 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini020409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Feb 4 21:29:40.578 2009 (GMT-5)
System Uptime: 1 days 2:21:23.312
Loading Kernel Symbols
...............................................................
................................................................
..............................................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 400000, 0, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00400000, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

PFN_PAGE_SINGLE_BIT_ERROR: Bugcheck args 2 and 3 differ by a bit, its hardware error.

MEMORY_CORRUPTOR: ONE_BIT

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: rundll32.exe

LAST_CONTROL_TRANSFER: from 80522ddc to 804f9f43

STACK_TEXT:
b4b85178 80522ddc 0000004e 00000099 00400000 nt!KeBugCheckEx+0x1b
b4b851a8 80511a55 c0885198 00000527 8a5ddf98 nt!MiDecrementShareCount+0x3a
b4b851cc 805b0253 00bf0019 8a5ddda0 007ffff8 nt!MiDeleteValidAddress+0x177
b4b851ec 805134f7 8a5ddda0 8a5dded8 8a5ddda0 nt!MiDeleteAddressesInWorkingSet+0x65
b4b85220 805d2712 005ddda0 89d11610 40010004 nt!MmCleanProcessAddressSpace+0x193
b4b852c0 805d27f5 40010004 b4b8531c 804ff94f nt!PspExitThread+0x680
b4b852cc 804ff94f 89d11610 b4b85318 b4b8530c nt!PsExitSpecialApc+0x23
b4b8531c 80541697 00000001 00000000 b4b85334 nt!KiDeliverApc+0x1af
b4b8531c 7c90e4f4 00000001 00000000 b4b85334 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fb10 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_NAME: memory_corruption

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00400000, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

PFN_PAGE_SINGLE_BIT_ERROR: Bugcheck args 2 and 3 differ by a bit, its hardware error.

MEMORY_CORRUPTOR: ONE_BIT

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: rundll32.exe

LAST_CONTROL_TRANSFER: from 80522ddc to 804f9f43

STACK_TEXT:
b4b85178 80522ddc 0000004e 00000099 00400000 nt!KeBugCheckEx+0x1b
b4b851a8 80511a55 c0885198 00000527 8a5ddf98 nt!MiDecrementShareCount+0x3a
b4b851cc 805b0253 00bf0019 8a5ddda0 007ffff8 nt!MiDeleteValidAddress+0x177
b4b851ec 805134f7 8a5ddda0 8a5dded8 8a5ddda0 nt!MiDeleteAddressesInWorkingSet+0x65
b4b85220 805d2712 005ddda0 89d11610 40010004 nt!MmCleanProcessAddressSpace+0x193
b4b852c0 805d27f5 40010004 b4b8531c 804ff94f nt!PspExitThread+0x680
b4b852cc 804ff94f 89d11610 b4b85318 b4b8530c nt!PsExitSpecialApc+0x23
b4b8531c 80541697 00000001 00000000 b4b85334 nt!KiDeliverApc+0x1af
b4b8531c 7c90e4f4 00000001 00000000 b4b85334 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fb10 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_NAME: memory_corruption

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00400000, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

PFN_PAGE_SINGLE_BIT_ERROR: Bugcheck args 2 and 3 differ by a bit, its hardware error.

MEMORY_CORRUPTOR: ONE_BIT

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: rundll32.exe

LAST_CONTROL_TRANSFER: from 80522ddc to 804f9f43

STACK_TEXT:
b4b85178 80522ddc 0000004e 00000099 00400000 nt!KeBugCheckEx+0x1b
b4b851a8 80511a55 c0885198 00000527 8a5ddf98 nt!MiDecrementShareCount+0x3a
b4b851cc 805b0253 00bf0019 8a5ddda0 007ffff8 nt!MiDeleteValidAddress+0x177
b4b851ec 805134f7 8a5ddda0 8a5dded8 8a5ddda0 nt!MiDeleteAddressesInWorkingSet+0x65
b4b85220 805d2712 005ddda0 89d11610 40010004 nt!MmCleanProcessAddressSpace+0x193
b4b852c0 805d27f5 40010004 b4b8531c 804ff94f nt!PspExitThread+0x680
b4b852cc 804ff94f 89d11610 b4b85318 b4b8530c nt!PsExitSpecialApc+0x23
b4b8531c 80541697 00000001 00000000 b4b85334 nt!KiDeliverApc+0x1af
b4b8531c 7c90e4f4 00000001 00000000 b4b85334 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fb10 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_NAME: memory_corruption

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

BC AdBot (Login to Remove)

 


#2 Guest_The weatherman_*

Guest_The weatherman_*

  • Guests
  • OFFLINE
  •  

Posted 05 February 2009 - 01:30 AM

http://www.bleepingcomputer.com/forums/t/197882/alcmtrexe-alcwzrdexe/

In order to avoid confusion, and make the best use of the limited amount of malware removal helpers and their own limited amount of time, this topic is closed. Please do not post in more than one forum, and if you have more topics open elsewhere, please ask that they be closed. Thank you for your cooperation and understanding.

Bleeping Computer Staff




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users