BSOD 0x07E and PFN_LIST_CORRUPT.

sixerfly · 03 Mar 2013

Hello everyone, long time browser, but first time registered and posted user.

I am pretty tech savy first off, and this being my personal PC thats causing this, I am just stumped.

I first noticed blue screens happening when I upgraded from 7 Ultimate to 8 Professional. Needless to say, my first BSOD was a 0x07E code. Happened once in awhile. Unfortunately, I decided to just go back to 7 Ultimate on a clean install and I thought all my issues would go away, as I hated windows 8 anyway.

Well, boy was I wrong. So I was continuing to get all my driver updates from my Motherboards website and got all that nonsense out of the way, and I thought I had the latest drivers. I was continuing to upgrade all my updates from Windows Update and then I got a 0x07E bluescreen again! I re-installed windows 7 again and did all the drivers again and thought all was well.

Two days ago, I had 15 more updates mostly relating to the Microsoft Framework 4 as I downloaded the Windows Debugger Tools to read previous BSoDs and I stepped out for about 6 hours and when I came back, I came to find a PFN_LIST_CORRUPT bsod. Oh wonderful!

I did some research on here and other places, and the main target was memory. Okay so I popped out my Memtest 86+ CD and began the long test of checking each stick.

First, I checked them both together, as they are a dual channel pair of sticks. No Issues there, so I thought lets try them one by one.

Each stick was ran for about 8 hours. No errors were reported on all the tests at all, so I am assuming the memory is good.

So the next step, lets try and run them one by one. I fired up one stick in the slot and I instantly got a 0x07E BSoD. Popped in the second stick in the same slot, BAM, BSOD. At this point Im thinking possibly the DIMM Slot is shot. So I tried the one next to it and it happened again! Great!

Okay, what else can I think of. So I decided to do Last Known Good Configuration and it allowed me back into windows! hurrah!

I decided just to be safe, I would run a system restore a couple days back and right now I am typing this with only 1 4GB RAM stick in the PC and so far so good.

These BSoDS are so random. I am a heavy gamer and when I play my games for hours, it doesn't crash. Only when it's doing light random things like Windows Update or maybe watching a movie.

I did get the minidump files. Unfourtantely for the 0x7E one, I forgot to change the advanced system settings as it was about 1GB in size, way too large for the forums, so I ran my debugger tools , and copied all the information into a text file. The PFN LIST Corrupt dump file should be ready to go.

RAM seriously looks like it may be my problem, but I just don't have hard evidence to prove that theory, thats why I am posting here.

Thanks everybody!

koolkat77 · 03 Mar 2013

Hi and welcome to Seven Forums.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

Note

Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.

Let us know the results.

sixerfly · 08 Mar 2013

Hey, sorry I didn't get a chance to respond, but I did run the tests and everything came back clean.

Also since running those tests, I reseated the RAM and haven't had a blue screen since the time of the posting.

I also thought most of these Bsods were from windows update anyway.

As of now, it MAY be solved as I been using my pc heavily with no issue, but I will keep you posted for the next few days to let you know how everything is going.

Thanks!

koolkat77 · 08 Mar 2013

No problem, thanks for the update.

Good luck.

koolkat77 · 16 Apr 2013

Have you experienced any further crash?

sixerfly · 20 Apr 2013

Just got a crash. Its been awhile though. Tried to install HD PVR drivers while listening to Spotify.

koolkat77 · 20 Apr 2013

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880023a27f8, fffff880023a2050, fffff80002bbf147}

Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+537 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880023a27f8
Arg3: fffff880023a2050
Arg4: fffff80002bbf147

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880023a27f8 -- (.exr 0xfffff880023a27f8)
ExceptionAddress: fffff80002bbf147 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880023a2050 -- (.cxr 0xfffff880023a2050)
rax=ebe0ff7db472ffe0 rbx=fffffa800696a2a0 rcx=fffff8a001975570
rdx=0000000000000001 rsi=0000000000000003 rdi=0000000000000001
rip=fffff80002bbf147 rsp=fffff880023a2a30 rbp=0000000000001000
 r8=0000000000000001  r9=fffffa800696a2a0 r10=fffffa800696a148
r11=0000000000000001 r12=fffffa800696a140 r13=0000000000000000
r14=fffffa800a2f74b0 r15=000000003066744e
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`02bbf147 48895808        mov     qword ptr [rax+8],rbx ds:002b:ebe0ff7d`b472ffe8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc2100
GetUlongFromAddress: unable to read from fffff80002cc21c0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`02bbf147 48895808        mov     qword ptr [rax+8],rbx

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`02bbf147 48895808        mov     qword ptr [rax+8],rbx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880014ab519 to fffff80002bbf147

STACK_TEXT:  
fffff880`023a2a30 fffff880`014ab519 : fffff880`00000001 fffffa80`07d7f9d0 00000000`00000008 fffffa80`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`023a2b20 fffff880`014bc1d6 : 00000000`00000000 fffffa80`09c11590 fffff8a0`1cdb67d0 fffff8a0`00000082 : Ntfs!NtfsInsertPrefixHashEntry+0xa9
fffff880`023a2b60 fffff880`014dfc2c : fffff880`022d22a0 fffffa80`09c11590 fffffa80`07d7f9d0 00000000`00000001 : Ntfs!NtfsOpenFile+0x5de
fffff880`023a2d50 fffff880`0144739d : fffffa80`07d7f9d0 fffffa80`09c11590 fffff880`022d22a0 fffffa80`0a2f7400 : Ntfs!NtfsCommonCreate+0xc4c
fffff880`023a2f30 fffff800`02a826f7 : fffff880`022d2210 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`023a2f60 fffff800`02a826b8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`022d20e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+537

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

STACK_COMMAND:  .cxr 0xfffff880023a2050 ; kb

FAILURE_BUCKET_ID:  X64_0x24_nt!ExAllocatePoolWithTag+537

BUCKET_ID:  X64_0x24_nt!ExAllocatePoolWithTag+537

Followup: MachineOwner
---------

Post a screen shot using Crystal Disk Info: CrystalDiskInfo Standard Edition
How to Upload and Post a Screenshot and File in Seven Forums

Make a hard drive test from the hard drive manufacturers website: Hard Drive Diagnostic Procedure

sixerfly · 21 Apr 2013

Hello again,

I went ahead and ran Seagate tools for Dos and Hitachis HDFT. They both came back clean with no errors on each. I also ran a in windows Western Digital HDD diagnostic and that came back good.

Here is the Info you requested.

I also notice when my drive is working hard, it seems to make a loud click sometimes when its reading the drive contents. Its not a constant clicking. Sometimes it will do two or three clicks when its reading or sometimes one. They are loud and it seems to have been doing that for the last three months.

I am assuming that means the drive is on its way out. It seems now that I realize if I am doing a lot at once, it will crash. Usually I only have a couple things open at a time that aren't HDD intensive. Yesterday was a case where it was.

I already made a image onto an external just in-case this was the issue. It's hard to believe the drive has 24,000+ hours on it and almost 900 power counts!

Starting to make some sense now, even though the Diagnostic programs aren't picking it up that there is something indeed wrong.

koolkat77 · 21 Apr 2013

From the picture the HDD looks fine.

Use verifier for 36 hours. Then send us the BSOD reports

Driver Verifier

I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
Driver Verifier - Enable and Disable

Using Driver Verifier to identify issues with Windows drivers for advanced users
Driver Verifier - BSOD related - Sysnative Forums
Using Driver Verifier (Windows Drivers)

sixerfly · 22 Apr 2013

Okay I know it hasn't been 36 hours but here is some info.

I did exactly as suggested, and I went to restart and it came up with a black screen. I booted to safe mode no problem and it actually spat out a blue screen mini dump which i attached.

IT said the main cause was my webroot av. I uninstalled and put avast! on. I then restarted in normal mode and no issues after that.

Running Driver Verifier the system was stable, but the internet was slower than normal and I couldn't play any games. No crashes though after removing webroot. The system felt okay but the speed just wasn't there.

Here is the minidump from today, maybe something else may be in there.