second Bsod while updating BitDefender (a sign?)

timeless · 06 May 2010

Just had another BSOD, didnt get a reply on my previous thread.. however will upload both, the first one happened when returning to the computer this one happened as l manually updated my virus scanner BitDefender so lm wondering if its related.

using a program called blue screen view l found out the following on my first bsod.

Code:

Dump File         : 050410-31980-01.dmp
Crash Time        : 04/05/2010 23:57:13
Bug Check String  : MEMORY_MANAGEMENT
Bug Check Code    : 0x0000001a
Parameter 1       : 00000000`00041790
Parameter 2       : fffffa80`016c5390
Parameter 3       : 00000000`0000ffff
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70600
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7600.16539 (win7_gdr.100226-1909)
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\050410-31980-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7600
==================================================

the second one told me the following (tho there was mentions of ntoskrnl.exe

Code:

==================================================
Dump File         : 050610-33945-01.dmp
Crash Time        : 06/05/2010 19:48:59
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a1`0432e820
Parameter 2       : 00000000`00000000
Parameter 3       : fffff800`02e0600e
Parameter 4       : 00000000`00000005
Caused By Driver  : Ntfs.sys
Caused By Address : Ntfs.sys+9698e
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\050610-33945-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7600
==================================================

for help with diagnosing the issue please refer to attached dump files which were created

zigzag3143 · 06 May 2010

timeless said:

Just had another BSOD, didnt get a reply on my previous thread.. however will upload both, the first one happened when returning to the computer this one happened as l manually updated my virus scanner BitDefender so lm wondering if its related.

using a program called blue screen view l found out the following on my first bsod.

Code:

Dump File         : 050410-31980-01.dmp
Crash Time        : 04/05/2010 23:57:13
Bug Check String  : MEMORY_MANAGEMENT
Bug Check Code    : 0x0000001a
Parameter 1       : 00000000`00041790
Parameter 2       : fffffa80`016c5390
Parameter 3       : 00000000`0000ffff
Parameter 4       : 00000000`00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70600
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7600.16539 (win7_gdr.100226-1909)
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\050410-31980-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7600
==================================================

the second one told me the following (tho there was mentions of ntoskrnl.exe

Code:

==================================================
Dump File         : 050610-33945-01.dmp
Crash Time        : 06/05/2010 19:48:59
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff8a1`0432e820
Parameter 2       : 00000000`00000000
Parameter 3       : fffff800`02e0600e
Parameter 4       : 00000000`00000005
Caused By Driver  : Ntfs.sys
Caused By Address : Ntfs.sys+9698e
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\050610-33945-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7600
==================================================

for help with diagnosing the issue please refer to attached dump files which were created

Blue screen view is almost right. The first is of course memory management, the second pool_corruption.

I would download memtestx86 and run it for 5 passes to test your memory.
Just to be on the safe side I would also run a system file check
(type cmd in search>right click and run as admin>sfc /scannow)

Let us know the results.

Ken

timeless · 06 May 2010

memory should be fine, l came up clean when scanning a few days back (even if something were wrong l couldnt fix that at the moment as lm pretty cash strapped right now) [forgot to mention l ran it for at least 5 passes or more]

also l have run the suggested test and corruption was found, l have attached the log to this post.

still considering when things happened l can only point to BirDefender, the original BSOD happened while l was away from the computer.. l admit l was running bittorrent and IRC however my DB is set to update quietly every twelve hours, and the day l had my first BSOD just happened to be the same day a program update came out, never had a problem before that... the second BSOD happened when l right clicked and manually updated BD as it was installing the update so l can only assume thats where the issue resides, hence l was considering changing if that was the case, is Microsoft Security Essentials worth using?.

(on a side note: l have disabled some services, however l dont think they relate to the problem as they have been turned off for weeks, superfetch is the only one l can assume has any link to memory but l turned it off until l acquired more ram which may take some time however when l am able to get some new sticks it will be 8GB in my system then as l shall completely replace my ram, l will however note tho l know its not ideal that l have two brands of ram in my system which is corseair(sp?) and OCZ l believe.. l only intend this to be temporary as l currently only have 3gb)

going by your reply l dont assume its gfx driver related as l see allot of users with similar bugcheck codes, however my driver is only one down from the latest version on ATI (l run a Radeon HD 4650) on that note the rest of my drivers seem up to date.

=========
edit

l have been looking into blue screen viewer and its information, if lm reading correctly l see allot of bitdefender file references as previously mentioned this issue started on the same day l had a program update, and the second time while updating bitdefender (l usually check manually but have it set to auto update once every 12 hours.

l did notice another thread, it could just be coincidence and pure assumption bit another persons issue was posted a couple of days ago

https://www.sevenforums.com/crashes-debugging/82614-pc-shut-down-unexpectedly.html

just wondering if the issue could be related and find bitdefender is the culprit, l only really consider this because 2 days back when it started a program update happened and lve been having BSODs since around the times l assume the system anti virus has had updates.

a further addition to the thread, l ran scandisk which found issues, so l ran chkdisk /f and fixed the problems that were on the system lm also running another stest with sfc /scannow

finally finished the second sfc scan test, and its noted that its fixed some files tho lm not sure how to read properly to work out which ones, l assume they are the mentioned dll files tho as of yet lm unsure if they are related to the BSODs new log attached

timeless · 07 May 2010

another BSOD of the same type as my second, happened an hour after bd update, planning on reinstalling. this time without bitdefender and trying security essentials instead, lm extremely tired of it as it started after a bitdefender update, the third crash was when running firefox (which bitdefnder does hook into, and is known to cause issues with a few extensions which happens to me but never bothered me much)

Code:

==================================================
Dump File         : 050710-35037-01.dmp
Crash Time        : 07/05/2010 19:33:15
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : fffff940`c1d76230
Parameter 2       : 00000000`00000000
Parameter 3       : fffff960`000b41a2
Parameter 4       : 00000000`00000005
Caused By Driver  : win32k.sys
Caused By Address : win32k.sys+25e0c
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Computer Name     : 
Full Path         : C:\Windows\Minidump\050710-35037-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7600
==================================================

in addition to that, only course of action l can see is to format the drive and reinstall and try from scratch, its not like l dont have time to do it l guess lol so its worth a try.

Code:

System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [January 2010]

Installation date: ‎07/‎05/‎2010 19:41

Installation status: Failed

Error details: Code C0000005

Update type: Important

This tool is being offered because an inconsistency was found in the Windows servicing store which may prevent the successful installation of future updates, service packs, and software. This tool checks your computer for such inconsistencies and tries to resolve issues if found.

More information: 
http://support.microsoft.com/kb/947821

Help and Support: 
http://support.microsoft.com

timeless · 07 May 2010

im really starting to hate windows 7 at the second, tho lm beginning to think l have a ram issue which l sadly cant do anything about for a while.. on install l was met with a 0x80070570 error (which didnt happen the first time l installed, and it happened on both the burned 64bit disk and the 32bit OEM one l purchased) while installing the 64bit version l kept on experiencing the issue around 50% accompanied by a BSOD the second time around, l ended up only being able to install the 32bit version as altho l got the same "0x80070570" error the second time around it worked. the other annoyance l didnt notice was the fact that because of an issue related l dunno but l lost all bookmarks and passwords because it seems for some reason they werent saved even tho l specifically did it manually, lm just hoping things hold out until l have some actual ram and money.

zigzag3143 · 07 May 2010

timeless said:

im really starting to hate windows 7 at the second, tho lm beginning to think l have a ram issue which l sadly cant do anything about for a while.. on install l was met with a 0x80070570 error (which didnt happen the first time l installed, and it happened on both the burned 64bit disk and the 32bit OEM one l purchased) while installing the 64bit version l kept on experiencing the issue around 50% accompanied by a BSOD the second time around, l ended up only being able to install the 32bit version as altho l got the same "0x80070570" error the second time around it worked. the other annoyance l didnt notice was the fact that because of an issue related l dunno but l lost all bookmarks and passwords because it seems for some reason they werent saved even tho l specifically did it manually, lm just hoping things hold out until l have some actual ram and money.

Well the two DMP's one was memory management, the other pool_corruption (also memory).

You could at least download memtestx86b and run it to see which memory. The other thing most memory has life time warranty.

timeless · 07 May 2010

problem was l didnt pick up any issues when l ran it it was a good 8 passes as well.

Jonathan_King · 07 May 2010

Please upload any new dmps for analysis.

timeless · 07 May 2010

will do, hopefully my system can hold out until lm able to obtain new ram (l dont know how long that will be) l did run sfc /scannow thing and it did find corrupt files annoyingly but l guess l cant do much about that since it doesnt want to fix them at the moment.

zigzag3143 · 07 May 2010

timeless said:

will do, hopefully my system can hold out until lm able to obtain new ram (l dont know how long that will be) l did run sfc /scannow thing and it did find corrupt files annoyingly but l guess l cant do much about that since it doesnt want to fix them at the moment.

For the SFC a restore install would help.

for the two dumps

I would test them one at a time, and one slot at a time.

Let us know if we can help

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\050610-33945-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c62000 PsLoadedModuleList = 0xfffff800`02e9fe50
Debug session time: Thu May  6 14:47:43.684 2010 (GMT-4)
System Uptime: 1 days 19:51:04.292
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a10432e820, 0, fffff80002e0600e, 5}


Could not read faulting driver name
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+182 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a10432e820, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e0600e, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0a0e0
 fffff8a10432e820 

FAULTING_IP: 
nt!ExDeferredFreePool+182
fffff800`02e0600e 4c3910          cmp     qword ptr [rax],r10

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002f9d6c0 -- (.trap 0xfffff88002f9d6c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a10432e820 rbx=0000000000000000 rcx=fffffa8002443b20
rdx=fffff8a0039a47f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e0600e rsp=fffff88002f9d850 rbp=0000000000000000
 r8=fffff8a008fba800  r9=fffff8a0039a4620 r10=fffff8a0039a4630
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExDeferredFreePool+0x182:
fffff800`02e0600e 4c3910          cmp     qword ptr [rax],r10 ds:0030:fffff8a1`0432e820=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d51801 to fffff80002cd2600

STACK_TEXT:  
fffff880`02f9d558 fffff800`02d51801 : 00000000`00000050 fffff8a1`0432e820 00000000`00000000 fffff880`02f9d6c0 : nt!KeBugCheckEx
fffff880`02f9d560 fffff800`02cd06ee : 00000000`00000000 00000000`00000000 fffffa80`0477f000 fffffa80`0351a1a0 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`02f9d6c0 fffff800`02e0600e : fffffa80`02c42f20 00000000`00000000 fffffa80`02c42f20 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`02f9d850 fffff800`02e074c1 : fffff880`0101b710 fffff8a0`0c272000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x182
fffff880`02f9d8e0 fffff800`02cbc8f0 : fffffa80`053a63d0 00000000`00000000 00000000`74536d4d 00000000`00000000 : nt!ExFreePoolWithTag+0x411
fffff880`02f9d990 fffff800`02fc4203 : fffffa80`053a63d0 00000000`00000011 00000000`0008c081 fffff8a0`0008c081 : nt!MiDeleteSegmentPages+0x35c
fffff880`02f9da40 fffff800`02cd77b4 : 00000000`00000000 00000000`00000002 fffffa80`02503660 fffffa80`02503660 : nt!MiSegmentDelete+0x7b
fffff880`02f9da80 fffff800`02cc21f0 : 00000000`00000002 fffffa80`02c42f20 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`02f9dae0 fffff800`02cc5c1c : fffffa80`02d3b3b0 00000000`00000011 fffffa80`02d3b3b0 fffff800`00000000 : nt!CcDeleteSharedCacheMap+0x1bc
fffff880`02f9db50 fffff800`02cc641c : fffff800`02ed9100 fffff880`02f9dc58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`02f9dc00 fffff800`02cdf861 : fffffa80`024feaf0 fffff800`02cc6254 fffff800`02ed9140 00000000`00000003 : nt!CcWorkerThread+0x1c8
fffff880`02f9dcb0 fffff800`02f77a86 : 00000000`00000000 fffffa80`0250b1a0 00000000`00000080 fffffa80`024f2890 : nt!ExpWorkerThread+0x111
fffff880`02f9dd40 fffff800`02cb0b06 : fffff880`009e6180 fffffa80`0250b1a0 fffff880`009f0f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02f9dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+182
fffff800`02e0600e 4c3910          cmp     qword ptr [rax],r10

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExDeferredFreePool+182

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!ExDeferredFreePool+182

BUCKET_ID:  X64_0x50_nt!ExDeferredFreePool+182

Followup: Pool_corruption
---------

0: kd> lmvm Pool_Corruption
start             end                 module name