New
#1
Random BSOD PFN_List_Corrupt
Hi,
Getting some random BSOD all of a sudden within the past 2 days, progressively gotten worse tends to be happening every 30 minutes now.
I've attached the mini dump
Any help would be great
Thanks
Hi,
Getting some random BSOD all of a sudden within the past 2 days, progressively gotten worse tends to be happening every 30 minutes now.
I've attached the mini dump
Any help would be great
Thanks
The cause of your crash is very straight forward - a driver belonging to kaspersky.
Security AppCode:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {2, 52471c, 83ffff, 1} *** WARNING: Unable to verify timestamp for klif.sys *** ERROR: Module load completed but symbols could not be loaded for klif.sys Probably caused by : klif.sys ( klif+1bd4e ) Followup: MachineOwner --------- 8: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000002, A list entry was corrupt Arg2: 000000000052471c, entry in list being removed Arg3: 000000000083ffff, highest physical page number Arg4: 0000000000000001, reference count of entry being removed Debugging Details: ------------------ BUGCHECK_STR: 0x4E_2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT PROCESS_NAME: consent.exe CURRENT_IRQL: 2 TRAP_FRAME: fffff88016f57cf0 -- (.trap 0xfffff88016f57cf0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fff6fafbfff6fafb rbx=0000000000000000 rcx=0000000003310000 rdx=0000000000fa0000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff960000f5960 rsp=fffff88016f57e88 rbp=fffff88016f57f60 r8=0000000000002800 r9=00000000000000c0 r10=fff6fafbfff6fafb r11=000000000330f000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc win32k!memmove+0xb0: fffff960`000f5960 488b040a mov rax,qword ptr [rdx+rcx] ds:00000000`042b0000=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002a9b2ed to fffff80002a8ac00 STACK_TEXT: fffff880`16f57e88 fffff960`000bd23d : fffffa80`1c866370 fffff800`02bbed0e fffffa80`1d844060 fffffa80`1ccd4190 : win32k!memmove+0xb0 fffff880`16f57e90 fffff960`000b7315 : 00000000`00000001 00000000`00000000 00000000`00000000 fffff880`16f58220 : win32k!vSrcCopyS32D32Identity+0x71 fffff880`16f57ec0 fffff960`00204c46 : fffff900`c06795c8 fffff900`c241da48 00000000`00000000 00000000`00000000 : win32k!EngCopyBits+0x915 fffff880`16f581d0 fffff960`0021af3c : 00000000`40cc0020 fffff880`16f58580 00000000`40cc0020 fffff800`02a971f8 : win32k!bSpDwmValidateSurface+0xe02 fffff880`16f584e0 fffff960`00229002 : fffffa80`198cf4a0 fffff800`02bbed0e 00000000`00000000 00000000`ffffffff : win32k!GreStretchBltInternal+0x168 fffff880`16f58780 fffff960`000bb407 : 00000000`010110b9 00000000`00000000 00000000`00000640 00000000`40cc0020 : win32k!NtGdiBitBltInternal+0xa2 fffff880`16f58960 fffff880`020e7d4e : fffffa80`1a203d40 00000000`00000640 00000000`40cc0020 00000000`00000000 : win32k!NtGdiBitBlt+0x5b fffff880`16f589d0 fffffa80`1a203d40 : 00000000`00000640 00000000`40cc0020 00000000`00000000 fffff900`00000640 : klif+0x1bd4e fffff880`16f589d8 00000000`00000640 : 00000000`40cc0020 00000000`00000000 fffff900`00000640 00000000`470110a1 : 0xfffffa80`1a203d40 fffff880`16f589e0 00000000`40cc0020 : 00000000`00000000 fffff900`00000640 00000000`470110a1 00000000`00000000 : 0x640 fffff880`16f589e8 00000000`00000000 : fffff900`00000640 00000000`470110a1 00000000`00000000 fffff960`00000000 : 0x40cc0020 STACK_COMMAND: .trap 0xfffff88016f57cf0 ; kb FOLLOWUP_IP: klif+1bd4e fffff880`020e7d4e ?? ??? SYMBOL_STACK_INDEX: 7 SYMBOL_NAME: klif+1bd4e FOLLOWUP_NAME: MachineOwner MODULE_NAME: klif IMAGE_NAME: klif.sys DEBUG_FLR_IMAGE_TIMESTAMP: 5151b9b5 FAILURE_BUCKET_ID: X64_0x4E_2_klif+1bd4e BUCKET_ID: X64_0x4E_2_klif+1bd4e Followup: MachineOwner --------- 8: kd> lmvm klif start end module name fffff880`020cc000 fffff880`02171000 klif T (no symbols) Loaded symbol image file: klif.sys Image path: klif.sys Image name: klif.sys Timestamp: Tue Mar 26 21:07:33 2013 (5151B9B5) CheckSum: 000A60C2 ImageSize: 000A5000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Crashes indicate Kaspersky being a possible cause. Remove Kasperky and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase
Microsoft Security Essentials and Malwarebytes, both recommended from a strict BSOD perspective.
Microsoft Security Essentials, Free antivirus for windows
Malwarebytes Anti-Malware Free
InformationDO NOT start the free trial of MalwareBytes. Deselect the option when prompted.
Please run these tests and report back the results
1. SFC /scannow to check windows for corruption - SFC /SCANNOW Command - System File Checker
2. Disk check for errors on the hard drive - Disk Check
3. Troubleshoot applications by a clean boot - Troubleshoot Application Conflicts by Performing a Clean Startup
4. Memtest86+ paying close attention to part 3 - RAM - Test with Memtest86+
5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure
ran memtest, found one of my memory sticks is giving me over 15000 errors.
I tested them all individually in different slots.
Thanks for the help
You're welcome.
Mark the thread as solved when you are ready.
Tip
- If your problem is solved please use the Mark this thread as solved link at the top of your thread or down on the left corner