Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Several bluescreens, probably caused by driver


  • Please log in to reply
57 replies to this topic

#1 nezrac

nezrac

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 04:56 AM

Hello,

This is my first post on this board, and I am excited to be part of the community now.

My Problem:
Since a couple of days I get several bluescreens, mainly PFN_LIST_CORRUPT and DRIVER_IRQL_NOT_LESS_OR_EQUAL.
The bluescreens occur either while booting windows or a few minutes after logging in. Sometimes i find myself in an endless loop of the windows loading screen at boot (with no bluescreen).
I googled like mad and found lots of possible fixes. Here's a list of things I already did.
  • Downloading and Installing the new graphics card driver
  • memtest86 for ~10 hours with no errors
  • Updating the chipset drivers
  • Even checked hardware temperatures in my desperation, everything fine

Here's my memory dump:

Microsoft ® Windows Debugger Version 6.2.8400.0 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini072512-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.100216-1441
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Jul 25 11:03:00.171 2012 (UTC + 2:00)
System Uptime: 0 days 0:01:43.788
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 7040a, 3, 0}

Probably caused by : memory_corruption ( nt!MiProcessValidPteList+120 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0007040a, page frame number
Arg3: 00000003, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: avguard.exe

LAST_CONTROL_TRANSFER: from 8051995a to 804f9e0b

STACK_TEXT:
ae8677b0 8051995a 0000004e 00000099 0007040a nt!KeBugCheckEx+0x1b
ae867860 80519d86 ae867878 0000000a 89ca1440 nt!MiProcessValidPteList+0x120
ae867ca4 805b1f7e 08ca6000 c0046528 89ca1440 nt!MiDecommitPages+0x3f0
ae867d4c 8054089c ffffffff 0435f9a8 0435f9ac nt!NtFreeVirtualMemory+0x588
ae867d4c 7c91e514 ffffffff 0435f9a8 0435f9ac nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0435f954 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiProcessValidPteList+120
8051995a cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiProcessValidPteList+120

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a91dc

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MiProcessValidPteList+120

BUCKET_ID: 0x4E_99_nt!MiProcessValidPteList+120

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0007040a, page frame number
Arg3: 00000003, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: avguard.exe

LAST_CONTROL_TRANSFER: from 8051995a to 804f9e0b

STACK_TEXT:
ae8677b0 8051995a 0000004e 00000099 0007040a nt!KeBugCheckEx+0x1b
ae867860 80519d86 ae867878 0000000a 89ca1440 nt!MiProcessValidPteList+0x120
ae867ca4 805b1f7e 08ca6000 c0046528 89ca1440 nt!MiDecommitPages+0x3f0
ae867d4c 8054089c ffffffff 0435f9a8 0435f9ac nt!NtFreeVirtualMemory+0x588
ae867d4c 7c91e514 ffffffff 0435f9a8 0435f9ac nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0435f954 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiProcessValidPteList+120
8051995a cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiProcessValidPteList+120

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a91dc

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MiProcessValidPteList+120

BUCKET_ID: 0x4E_99_nt!MiProcessValidPteList+120

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0007040a, page frame number
Arg3: 00000003, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: avguard.exe

LAST_CONTROL_TRANSFER: from 8051995a to 804f9e0b

STACK_TEXT:
ae8677b0 8051995a 0000004e 00000099 0007040a nt!KeBugCheckEx+0x1b
ae867860 80519d86 ae867878 0000000a 89ca1440 nt!MiProcessValidPteList+0x120
ae867ca4 805b1f7e 08ca6000 c0046528 89ca1440 nt!MiDecommitPages+0x3f0
ae867d4c 8054089c ffffffff 0435f9a8 0435f9ac nt!NtFreeVirtualMemory+0x588
ae867d4c 7c91e514 ffffffff 0435f9a8 0435f9ac nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0435f954 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiProcessValidPteList+120
8051995a cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiProcessValidPteList+120

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a91dc

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MiProcessValidPteList+120

BUCKET_ID: 0x4E_99_nt!MiProcessValidPteList+120

Followup: MachineOwner
---------


I look forward to your answers.

Nezrac.

Edited by hamluis, 26 July 2012 - 08:56 AM.
Edited title spelling error - Hamluis.


BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:09 PM

Posted 25 July 2012 - 05:05 AM

Uninstall avira and install microsoft security essentials.See if that helps :thumbup2:

#3 nezrac

nezrac
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 05:39 AM

thank you for your quick reply!

i have just done this and i'm about to reboot.
Will be back soon!

#4 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:08:09 AM

Posted 25 July 2012 - 05:40 AM

Quick links -
http://go.microsoft.com/fwlink/?LinkID=231274 << MSE installer -

Edited by noknojon, 25 July 2012 - 05:41 AM.


#5 nezrac

nezrac
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 05:55 AM

hmmm... got the IRQL_NOT_LESS_OR_EQUAL bluescreen after rebooting, signing in and leaving the pc for a few minutes.
i am desperate. Should i check the RAM again?

--EDIT--

Oh, while typing this from my phone i got PAGE_FAULT_IN_NONPAGED_AREA again. Jesus

--SECOND EDIT---

Just went into safe mode and analyzed the dump, here it is again. Seems like it's my WLAN card, but I updated the drivers two days ago?

Microsoft ® Windows Debugger Version 6.2.8400.0 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini072512-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.100216-1441
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Jul 25 12:54:48.906 2012 (UTC + 2:00)
System Uptime: 0 days 0:03:16.642
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {a482a558, 0, 8054a0ba, 0}


Could not read faulting driver name
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+b4 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a482a558, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054a0ba, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetUlongFromAddress: unable to read from 80560f30
a482a558

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054a0ba 8b10 mov edx,dword ptr [eax]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: WG311v3.exe

LAST_CONTROL_TRANSFER: from 8054a75f to 8054a0ba

STACK_TEXT:
aec56bec 8054a75f 00000001 00000000 e398bc80 nt!ExDeferredFreePool+0xb4
aec56c2c bf802b13 e398bc80 89ce5a20 aec56c54 nt!ExFreePoolWithTag+0x47f
aec56c3c bf85caba e398bc80 89b36770 89b36770 win32k!HeavyFreePool+0xbb
aec56c54 bf8034c8 e398bc80 00000001 aec56c70 win32k!UserDeleteW32Thread+0xa0
aec56c64 bf85c91a e398bc80 aec56c88 bf819fed win32k!DereferenceW32Thread+0x1d
aec56c70 bf819fed 89b36770 00000000 89ce5a20 win32k!FreeW32Thread+0x14
aec56c88 805d0d4a 89b36770 00000001 89b36770 win32k!W32pThreadCallout+0x4e
aec56d14 805d1162 00000000 00000000 89b36770 nt!PspExitThread+0x3cc
aec56d34 805d14a2 89b36770 00000000 aec56d64 nt!PspTerminateThreadByPointer+0x52
aec56d54 8054089c 00000000 00000000 01b2fef0 nt!NtTerminateThread+0x70
aec56d54 7c91e514 00000000 00000000 01b2fef0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
01b2fef0 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054a0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x50_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x50_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------


Edited by nezrac, 25 July 2012 - 06:03 AM.


#6 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,191 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:10:09 PM

Posted 25 July 2012 - 06:16 AM

Hi,

Any particular reason for you not to update XP with Service Pack 3?

Also i would commend you to enter on the BIOS and do a BIOS Load Defaults to see if it helps.

• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#7 nezrac

nezrac
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 06:28 AM

never had bigger problems yet, so i didn't update... but i'm downloading right now.
Already did that, sorry, forgot that in the list :(

#8 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,191 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:10:09 PM

Posted 25 July 2012 - 06:35 AM

never had bigger problems yet, so i didn't update... but i'm downloading right now.
Already did that, sorry, forgot that in the list :(


Good, try to install the Service Pack 3 with the Antivirus disabled, there are several windows updates for Windows XP SP3 that aren't available for XP with SP2.

• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#9 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:09 PM

Posted 25 July 2012 - 06:37 AM

when did this bluescreen crashes start

Please upload the minidump files and post the link here

Edited by narenxp, 25 July 2012 - 06:38 AM.


#10 nezrac

nezrac
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 06:51 AM

9 days ago, 16th of july.

here's the pastebin link to the first one.
I'm not sure if it would be useful if i'd upload the total of (the ultimate number) 42 dumps, but if that's what's needed to be done...

#11 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:09 PM

Posted 25 July 2012 - 06:56 AM

Compress the minidump files in zip format and upload it to

www.filedropper.com

Post the link here.I dont need the analysis report :thumbup2:

9 days ago, 16th of july.


Do you have a restore point before that?

Did you make any hardware changes? Upgrading RAM ?

Edited by narenxp, 25 July 2012 - 06:58 AM.


#12 nezrac

nezrac
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 07:07 AM

nope, haven't changed my hardware setting since about 1 year (the network card, which never caused problems til now).
Here's the link

#13 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:09 PM

Posted 25 July 2012 - 07:25 AM

Download

mini toolbox

Checkmark following boxes:

List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size

Click Go and post the result

Press Windows+R key and type

cmd and click ok and run this command

chkdsk /r

Click Y to schedule to it on reboot

Restart the PC and run the chkdsk.Let me know if chkdsk is successful.

Edited by narenxp, 25 July 2012 - 07:27 AM.


#14 nezrac

nezrac
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:09 PM

Posted 25 July 2012 - 07:34 AM

i'm from austria so it is in german, is that a problem?
link
I just used the system restore point from the 1st of july. Still bluescreening, but the BSODs started after this date...

#15 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:05:09 PM

Posted 25 July 2012 - 07:37 AM

Go ahead and run CHKDSK




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users