Code:
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\timason\Windows_NT6_BSOD_jcgriff2\011912-13306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02c56000 PsLoadedModuleList = 0xfffff800`02e93e70
Debug session time: Thu Jan 19 14:02:40.080 2012 (UTC - 7:00)
System Uptime: 0 days 0:07:48.001
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, b5f6c, 2, 1}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000b5f6c, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000000001, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002d5613c to fffff80002cc65c0
STACK_TEXT:
fffff880`0c3536a8 fffff800`02d5613c : 00000000`0000004e 00000000`00000099 00000000`000b5f6c 00000000`00000002 : nt!KeBugCheckEx
fffff880`0c3536b0 fffff800`02c6a407 : 00000000`0005f000 fffffa80`02191410 00000000`00000000 fffff880`0c353878 : nt!MiBadShareCount+0x4c
fffff880`0c3536f0 fffff800`02fda03d : fffff980`048c0000 fffff8a0`0c5b4250 fffffa80`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x2c11b
fffff880`0c3539d0 fffff800`02cdf3b7 : 00000000`00040000 fffffa80`06a08200 00000000`00000000 00000000`00ac0000 : nt!CcUnmapVacb+0x5d
fffff880`0c353a10 fffff800`02cb6144 : fffffa80`08edfb01 fffffa80`07da2a50 fffffa80`07d86701 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`0c353aa0 fffff800`02cb9bdc : fffffa80`07d867e0 00000000`00000011 fffffa80`07d867e0 fffff800`00000000 : nt!CcDeleteSharedCacheMap+0x140
fffff880`0c353b10 fffff800`02cba3ec : fffff880`069aed00 fffff880`0c353c18 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`0c353bc0 fffff800`02cd37e1 : fffffa80`06a3dee0 fffff880`012f1980 fffff800`02ecd160 00000000`00000002 : nt!CcWorkerThread+0x1c8
fffff880`0c353c70 fffff800`02f666fa : fffff880`0c2140e0 fffffa80`09de6040 00000000`00000080 fffffa80`06a1d040 : nt!ExpWorkerThread+0x111
fffff880`0c353d00 fffff800`02ca4b46 : fffff880`02fd5180 fffffa80`09de6040 fffff880`02fdffc0 fffff880`0126d810 : nt!PspSystemThreadStartup+0x5a
fffff880`0c353d40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02d5613c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\timason\Windows_NT6_BSOD_jcgriff2\011912-20014-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02c0a000 PsLoadedModuleList = 0xfffff800`02e47e70
Debug session time: Thu Jan 19 04:08:55.271 2012 (UTC - 7:00)
System Uptime: 0 days 2:18:05.566
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d8a16c76d2, b3b7465ef3e948c8, fffff80002c13ae5, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d8a16c76d2, Reserved
Arg2: b3b7465ef3e948c8, Reserved
Arg3: fffff80002c13ae5, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
BUGCHECK_STR: 0x109
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002c7a5c0
STACK_TEXT:
fffff880`031a8598 00000000`00000000 : 00000000`00000109 a3a039d8`a16c76d2 b3b7465e`f3e948c8 fffff800`02c13ae5 : nt!KeBugCheckEx
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002c13aea - nt! ?? ::FNODOBFM::`string'+2d55
[ e9:e8 ]
1 error : !nt (fffff80002c13aea)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
If you are overclocking anything, please stop.
- Possible causes are Memory problems... Drivers...
- Possible causes are Memory problems... Drivers...
Thanks to Dave76 for help understanding possible causes.
- Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a.
Backup your system and user files
b.
Create a system restore point
c. If you do not have a Windows 7 DVD,
Create a system repair disc
d. Run
Driver Verifier
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using
System Restore OPTION TWO.
Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
Quote