BSOD, PFN_LIST_CORRUPT, error 4e

Anigma · 05 Nov 2011

Hi,
My Laptop has lots of BSODS since yesterday ( every hour..). don't remember of any software installed lately..
system details:
--win 7 home premium 64 bit
-- Full Retail
--the laptop( HP dv6-2155) is 1.5 years old
--OS re-installed again 2 months ago after HD malfunctioned ( the OS was installed
using the recovery disks)

I can't point to something I am doing in particular before the blue screen is shown...
I have Norton AV 2012.

attaching the Windows_NT6_BSOD_jcgriff2 library.

thanks,
Danny

Anigma · 12 Nov 2011

Anyone??

FredeGail · 12 Nov 2011

Hello Anigma & Welcome to SevenForums!

What anti-virus are you using?

Summary

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000007, A driver has unlocked a page more times than it locked it
Arg2: 00000000000acd58, page frame number
Arg3: 0000000000000001, current share count
Arg4: 0000000000000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002ef7108 to fffff80002e97c40

STACK_COMMAND:  kb

FOLLOWUP_IP: 
tcpip!TcpCompleteTcbSend+40
fffff880`0230b720 488b4e48        mov     rcx,qword ptr [rsi+48h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  tcpip!TcpCompleteTcbSend+40

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e001123

FAILURE_BUCKET_ID:  X64_0x4E_7_tcpip!TcpCompleteTcbSend+40

BUCKET_ID:  X64_0x4E_7_tcpip!TcpCompleteTcbSend+40

Followup: MachineOwner
---------

1: kd> lmvm tcpip
start             end                 module name
fffff880`022c7000 fffff880`024cb000   tcpip      (pdb symbols)          c:\symcache\tcpip.pdb\FDC84931FAFA49FBB47E4CF1CB3B1C0C2\tcpip.pdb
    Loaded symbol image file: tcpip.sys
    Mapped memory image file: c:\symcache\tcpip.sys\4E001123204000\tcpip.sys
    Image path: \SystemRoot\System32\drivers\tcpip.sys
    Image name: tcpip.sys
    Timestamp:        Tue Jun 21 05:33:55 2011 (4E001123)
    CheckSum:         001E3A3E
    ImageSize:        00204000
    File version:     6.1.7601.17638
    Product version:  6.1.7601.17638
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     tcpip.sys
    OriginalFilename: tcpip.sys
    ProductVersion:   6.1.7601.17638
    FileVersion:      6.1.7601.17638 (win7sp1_gdr.110620-1602)
    FileDescription:  TCP/IP Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

panais · 12 Nov 2011

FredeGail OP: ""I have Norton AV 2012.""

Anigma You need to update whatever is possible these old software\drivers,

Code:

iirsp.sys        fffff880`016ee000    fffff880`016ff000    0x00011000    0x439f418a    13-Dec-05 11:47:54 μμ                        
nfrd960.sys        fffff880`01600000    fffff880`01610000    0x00010000    0x4485ef94    06-Jun-06 11:11:48 μμ                        
adpu320.sys        fffff880`01200000    fffff880`0122f000    0x0002f000    0x45e4c6ff    28-Feb-07 2:04:15 πμ                        
adpahci.sys        fffff880`0111f000    fffff880`01175000    0x00056000    0x46377921    01-May-07 7:30:09 μμ                        
arc.sys        fffff880`011bc000    fffff880`011d5000    0x00019000    0x4656035b    24-May-07 11:27:55 μμ                        
SiSRaid2.sys        fffff880`019b9000    fffff880`019c7000    0x0000e000    0x48da86c4    24-Sep-08 8:28:20 μμ                        
sisraid4.sys        fffff880`019c7000    fffff880`019df000    0x00018000    0x48e3f1f4    01-Oct-08 11:56:04 μμ                        
adp94xx.sys        fffff880`01371000    fffff880`013ec000    0x0007b000    0x4939bf42    06-Dec-08 1:54:42 πμ                        
lsi_fc.sys        fffff880`016ff000    fffff880`0171e000    0x0001f000    0x493ef531    10-Dec-08 12:46:09 πμ                        
arcsas.sys        fffff880`011d5000    fffff880`011f0000    0x0001b000    0x496e3ca9    14-Jan-09 9:27:37 μμ                        
ql2300.sys        fffff880`01815000    fffff880`019b9000    0x001a4000    0x4978fba2    23-Jan-09 1:05:06 πμ                        
vsmraid.sys        fffff880`0169a000    fffff880`016c4000    0x0002a000    0x4983a701    31-Jan-09 3:18:57 πμ                        
elxstor.sys        fffff880`01000000    fffff880`01087000    0x00087000    0x4988ca9b    04-Feb-09 12:52:11 πμ                        
stexstor.sys        fffff880`019df000    fffff880`019e9000    0x0000a000    0x499b4248    18-Feb-09 1:03:36 πμ                        
amdsbs.sys        fffff880`01175000    fffff880`011bc000    0x00047000    0x49c3e213    20-Mar-09 8:36:03 μμ                        
lsi_scsi.sys        fffff880`01731000    fffff880`01750000    0x0001f000    0x49e7ad9e    17-Apr-09 12:13:50 πμ                        
HpqKbFiltr.sys        fffff880`0903b000    fffff880`09047000    0x0000c000    0x49f85aae    29-Apr-09 3:48:30 μμ

How to find and update drivers? Read here #2 (permalink)

FredeGail · 12 Nov 2011

Alright I found your cause, atleast for one of your BSODs. Sorry for not reading it through through.

Summary

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002caad28, fffff88003d7e838, fffff88003d7e090}

Unable to load image \SystemRoot\system32\drivers\NISx64\1106000.020\SYMEFA64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEFA64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS
Probably caused by : SYMEFA64.SYS ( SYMEFA64+28b3c )

Followup: MachineOwner

Go here, and get it uninstalled and replace it with Anti-virus' like MSE.

Carry on.