Memory Corruption

Dudex · 02 Sep 2010

I just found out I got some memory corruption, I been trying to get windows update to work and I was told by Flavius and woundering how I could fix this?

I been getting some bluescreens, Windows Update wont update and minor stuff wont save, like to have the desktop on the toolbar.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [G:\Folder1\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*G:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03055000 PsLoadedModuleList = 0xfffff800`03292e50
Debug session time: Wed Sep  1 15:26:51.102 2010 (GMT+2)
System Uptime: 0 days 1:21:14.177
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 59b4, 2, 59b2}

PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000059b4, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000059b2, 0

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details

BUGCHECK_STR:  0x4E_99

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SC2.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800031552bc to fffff800030c5600

STACK_TEXT:  
fffff880`0bec0f28 fffff800`031552bc : 00000000`0000004e 00000000`00000099 00000000`000059b4 00000000`00000002 : nt!KeBugCheckEx
fffff880`0bec0f30 fffff800`03137925 : 00000000`00000000 fffff680`002ecc20 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0bec0f70 fffff800`03099b43 : fffffa80`0a25e060 fffff700`0005820c 0000007f`fffffff8 fffff8a0`0b1ecbf8 : nt! ?? ::FNODOBFM::`string'+0x3226c
fffff880`0bec1000 fffff800`030985a2 : fffffa80`0a25e060 fffffa80`00000000 fffff880`0005563c fffff800`0000002b : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0bec18b0 fffff800`033abc4f : fffff8a0`0c393530 fffff880`0bec1c20 00000000`00000000 fffffa80`09b3f780 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0bec1900 fffff800`033844d1 : 00000000`20010000 00000000`00000001 00000000`fd27d000 fffffa80`087c11f0 : nt!PspExitThread+0x92f
fffff880`0bec19c0 fffff800`030a20e3 : fffff900`c22fbce0 00000000`00000000 fffff900`79747355 fffff900`00000029 : nt!PsExitSpecialApc+0x1d
fffff880`0bec19f0 fffff800`030a2520 : 00000000`31f9fe08 fffff880`0bec1a70 fffff800`033845dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0bec1a70 fffff800`030c48f7 : fffff880`0bec1ca0 fffff800`030d15fa 00000000`0000002a 00000000`73532450 : nt!KiInitiateUserApc+0x70
fffff880`0bec1bb0 00000000`73532dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`31e9f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73532dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`031552bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000059b4, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000059b2, 0

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`fffdf018).  Type ".hh dbgerr001" for details

BUGCHECK_STR:  0x4E_99

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SC2.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800031552bc to fffff800030c5600

STACK_TEXT:  
fffff880`0bec0f28 fffff800`031552bc : 00000000`0000004e 00000000`00000099 00000000`000059b4 00000000`00000002 : nt!KeBugCheckEx
fffff880`0bec0f30 fffff800`03137925 : 00000000`00000000 fffff680`002ecc20 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0bec0f70 fffff800`03099b43 : fffffa80`0a25e060 fffff700`0005820c 0000007f`fffffff8 fffff8a0`0b1ecbf8 : nt! ?? ::FNODOBFM::`string'+0x3226c
fffff880`0bec1000 fffff800`030985a2 : fffffa80`0a25e060 fffffa80`00000000 fffff880`0005563c fffff800`0000002b : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0bec18b0 fffff800`033abc4f : fffff8a0`0c393530 fffff880`0bec1c20 00000000`00000000 fffffa80`09b3f780 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0bec1900 fffff800`033844d1 : 00000000`20010000 00000000`00000001 00000000`fd27d000 fffffa80`087c11f0 : nt!PspExitThread+0x92f
fffff880`0bec19c0 fffff800`030a20e3 : fffff900`c22fbce0 00000000`00000000 fffff900`79747355 fffff900`00000029 : nt!PsExitSpecialApc+0x1d
fffff880`0bec19f0 fffff800`030a2520 : 00000000`31f9fe08 fffff880`0bec1a70 fffff800`033845dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0bec1a70 fffff800`030c48f7 : fffff880`0bec1ca0 fffff800`030d15fa 00000000`0000002a 00000000`73532450 : nt!KiInitiateUserApc+0x70
fffff880`0bec1bb0 00000000`73532dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`31e9f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73532dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`031552bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

I am in no hurry atm, since I am going away over the weekend. could it be a start to clean the RAM sticks?

Neverhavemoney · 03 Sep 2010

No,
It sounds like an infection. Try doing a complete system scan using Malwarebytes and Spybot S&D.

These should yeild some nasties hiding on your HDD.

Let us know what it finds,
Ben

Jonathan_King · 03 Sep 2010

In addition to Ben's advice, please follow these directions: https://www.sevenforums.com/crashes-d...tructions.html

Dudex · 03 Sep 2010

OK. I just left home, but before I did a MemTest 86+, and it found an error. I didnt have time to run the full test thought, and I didnt quite understand what was wrong.

Jonathan_King · 03 Sep 2010

See part 3 of this guide: RAM - Test with Memtest86+

Dudex · 05 Sep 2010

Jonathan_King said:

In addition to Ben's advice, please follow these directions: https://www.sevenforums.com/crashes-d...tructions.html

I just got home and ran these tests. I havent had time to run the anti-virus or memtest, since it almost 1130 pm. I will do the virus tests while at school tomorrow.

The "perfmon /report" is using ages. About 15 minutes now :S I didnt do that earlier when I only had 3 RAM sticks in (forgotten to set in the last one in after cleaning).

Windows 7 64 bit. Home Premium
I built the pc myself, at around May.
Havent reinstalled at any times

Dudex · 06 Sep 2010

While at shcool, I ran an memtest86+ on one of my sticks in #1 slot. From 8am-14pm, it found 36 errors... That sounds like alot. I havent tested if its the slot or the stick.

Dudex · 06 Sep 2010

so what should I do?

Jonathan_King · 06 Sep 2010

If I had to blame a single cause, it would be Daemon Tools Lite. Not that the program itself is buggy, but it uses a buggy driver, SPTD.sys, which is a known cause of BSODs.

First, remove Daemon Tools. Then, remove SPTD with this tool: http://www.duplexsecure.com/download...t-v172-x64.exe

In the same BSOD that SPTD showed up as an error, your DeathAdder mouse drivers were directly blamed. See if there is an update for those March 2010 drivers.

I suspect that will do the trick, but if you continue to have BSODs, remove AVG with this tool: http://download.avg.com/filedir/util...removerx64.exe

Replace it with MSE: http://www.microsoft.com/security_essentials

Install these Realtek drivers: Realtek

...Summary of the Dumps:

Code:


Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Sep  1 09:26:51.102 2010 (UTC - 4:00)
System Uptime: 0 days 1:21:14.177
BugCheck 4E, {99, 59b4, 2, 59b2}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  SC2.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Aug 29 04:08:53.579 2010 (UTC - 4:00)
System Uptime: 0 days 16:23:49.940
BugCheck 1E, {ffffffffc0000047, fffff800030b8ef8, fffffa8008f8c010, 100000000}
*** WARNING: Unable to verify timestamp for danew.sys
*** ERROR: Module load completed but symbols could not be loaded for danew.sys
*** WARNING: Unable to verify timestamp for sptd.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Probably caused by : danew.sys ( danew+6da )
BUGCHECK_STR:  0x1E_c0000047
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Aug 28 09:57:02.581 2010 (UTC - 4:00)
System Uptime: 0 days 4:37:11.017
BugCheck 4E, {99, 13e77b, 2, aa341}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

Dudex · 07 Sep 2010

Jonathan_King said:

If I had to blame a single cause, it would be Daemon Tools Lite. Not that the program itself is buggy, but it uses a buggy driver, SPTD.sys, which is a known cause of BSODs.

First, remove Daemon Tools. Then, remove SPTD with this tool: http://www.duplexsecure.com/download...t-v172-x64.exe

In the same BSOD that SPTD showed up as an error, your DeathAdder mouse drivers were directly blamed. See if there is an update for those March 2010 drivers.

I suspect that will do the trick, but if you continue to have BSODs, remove AVG with this tool: http://download.avg.com/filedir/util...removerx64.exe

Replace it with MSE: http://www.microsoft.com/security_essentials

Install these Realtek drivers: Realtek

...Summary of the Dumps:

Code:


Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Wed Sep  1 09:26:51.102 2010 (UTC - 4:00)
System Uptime: 0 days 1:21:14.177
BugCheck 4E, {99, 59b4, 2, 59b2}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  SC2.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sun Aug 29 04:08:53.579 2010 (UTC - 4:00)
System Uptime: 0 days 16:23:49.940
BugCheck 1E, {ffffffffc0000047, fffff800030b8ef8, fffffa8008f8c010, 100000000}
*** WARNING: Unable to verify timestamp for danew.sys
*** ERROR: Module load completed but symbols could not be loaded for danew.sys
*** WARNING: Unable to verify timestamp for sptd.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Probably caused by : danew.sys ( danew+6da )
BUGCHECK_STR:  0x1E_c0000047
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Sat Aug 28 09:57:02.581 2010 (UTC - 4:00)
System Uptime: 0 days 4:37:11.017
BugCheck 4E, {99, 13e77b, 2, aa341}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
BUGCHECK_STR:  0x4E_99
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

Would Avast work, since I got a bug that makes Winodws Update + MSE not update? I previously made a post in the Windows Update section, and he belived that my RAM might cause that problem.