Random BSOD PFN_List_Corrupt


  1. Posts : 10
    Windows 7
       #1

    Random BSOD PFN_List_Corrupt


    Hi,

    Getting some random BSOD all of a sudden within the past 2 days, progressively gotten worse tends to be happening every 30 minutes now.

    I've attached the mini dump

    Any help would be great

    Thanks
      My Computer


  2. Posts : 15,026
    Windows 10 Home 64Bit
       #2

    The cause of your crash is very straight forward - a driver belonging to kaspersky.

    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 4E, {2, 52471c, 83ffff, 1}
    
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+1bd4e )
    
    Followup: MachineOwner
    ---------
    
    8: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc).  If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 0000000000000002, A list entry was corrupt
    Arg2: 000000000052471c, entry in list being removed
    Arg3: 000000000083ffff, highest physical page number
    Arg4: 0000000000000001, reference count of entry being removed
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0x4E_2
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  consent.exe
    
    CURRENT_IRQL:  2
    
    TRAP_FRAME:  fffff88016f57cf0 -- (.trap 0xfffff88016f57cf0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fff6fafbfff6fafb rbx=0000000000000000 rcx=0000000003310000
    rdx=0000000000fa0000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff960000f5960 rsp=fffff88016f57e88 rbp=fffff88016f57f60
     r8=0000000000002800  r9=00000000000000c0 r10=fff6fafbfff6fafb
    r11=000000000330f000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    win32k!memmove+0xb0:
    fffff960`000f5960 488b040a        mov     rax,qword ptr [rdx+rcx] ds:00000000`042b0000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002a9b2ed to fffff80002a8ac00
    
    STACK_TEXT:  
    fffff880`16f57e88 fffff960`000bd23d : fffffa80`1c866370 fffff800`02bbed0e fffffa80`1d844060 fffffa80`1ccd4190 : win32k!memmove+0xb0
    fffff880`16f57e90 fffff960`000b7315 : 00000000`00000001 00000000`00000000 00000000`00000000 fffff880`16f58220 : win32k!vSrcCopyS32D32Identity+0x71
    fffff880`16f57ec0 fffff960`00204c46 : fffff900`c06795c8 fffff900`c241da48 00000000`00000000 00000000`00000000 : win32k!EngCopyBits+0x915
    fffff880`16f581d0 fffff960`0021af3c : 00000000`40cc0020 fffff880`16f58580 00000000`40cc0020 fffff800`02a971f8 : win32k!bSpDwmValidateSurface+0xe02
    fffff880`16f584e0 fffff960`00229002 : fffffa80`198cf4a0 fffff800`02bbed0e 00000000`00000000 00000000`ffffffff : win32k!GreStretchBltInternal+0x168
    fffff880`16f58780 fffff960`000bb407 : 00000000`010110b9 00000000`00000000 00000000`00000640 00000000`40cc0020 : win32k!NtGdiBitBltInternal+0xa2
    fffff880`16f58960 fffff880`020e7d4e : fffffa80`1a203d40 00000000`00000640 00000000`40cc0020 00000000`00000000 : win32k!NtGdiBitBlt+0x5b
    fffff880`16f589d0 fffffa80`1a203d40 : 00000000`00000640 00000000`40cc0020 00000000`00000000 fffff900`00000640 : klif+0x1bd4e
    fffff880`16f589d8 00000000`00000640 : 00000000`40cc0020 00000000`00000000 fffff900`00000640 00000000`470110a1 : 0xfffffa80`1a203d40
    fffff880`16f589e0 00000000`40cc0020 : 00000000`00000000 fffff900`00000640 00000000`470110a1 00000000`00000000 : 0x640
    fffff880`16f589e8 00000000`00000000 : fffff900`00000640 00000000`470110a1 00000000`00000000 fffff960`00000000 : 0x40cc0020
    
    
    STACK_COMMAND:  .trap 0xfffff88016f57cf0 ; kb
    
    FOLLOWUP_IP: 
    klif+1bd4e
    fffff880`020e7d4e ??              ???
    
    SYMBOL_STACK_INDEX:  7
    
    SYMBOL_NAME:  klif+1bd4e
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: klif
    
    IMAGE_NAME:  klif.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5151b9b5
    
    FAILURE_BUCKET_ID:  X64_0x4E_2_klif+1bd4e
    
    BUCKET_ID:  X64_0x4E_2_klif+1bd4e
    
    Followup: MachineOwner
    ---------
    
    8: kd> lmvm klif
    start             end                 module name
    fffff880`020cc000 fffff880`02171000   klif     T (no symbols)           
        Loaded symbol image file: klif.sys
        Image path: klif.sys
        Image name: klif.sys
        Timestamp:        Tue Mar 26 21:07:33 2013 (5151B9B5)
        CheckSum:         000A60C2
        ImageSize:        000A5000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Security App

    Crashes indicate Kaspersky being a possible cause. Remove Kasperky and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

    Microsoft Security Essentials and Malwarebytes, both recommended from a strict BSOD perspective.

    Microsoft Security Essentials, Free antivirus for windows

    Malwarebytes Anti-Malware Free


       Information
    DO NOT start the free trial of MalwareBytes. Deselect the option when prompted.


    Please run these tests and report back the results

    1. SFC /scannow to check windows for corruption - SFC /SCANNOW Command - System File Checker
    2. Disk check for errors on the hard drive - Disk Check
    3. Troubleshoot applications by a clean boot - Troubleshoot Application Conflicts by Performing a Clean Startup
    4. Memtest86+ paying close attention to part 3 - RAM - Test with Memtest86+
    5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure
      My Computer


  3. Posts : 10
    Windows 7
    Thread Starter
       #3

    ran memtest, found one of my memory sticks is giving me over 15000 errors.

    I tested them all individually in different slots.

    Thanks for the help
      My Computer


  4. Posts : 15,026
    Windows 10 Home 64Bit
       #4

    You're welcome.

    Mark the thread as solved when you are ready.
       Tip

    • If your problem is solved please use the Mark this thread as solved link at the top of your thread or down on the left corner

      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:38.
Find Us