BSOD working with 3dsmax, UDK and Unity3D opened.

[vikti]

Hi,

I had a new serie of BSOD last week (4 in one hour...) while I was working on a 3d project. I had :
- 3DSmax 2012
- Unity3d 3.5
- UDK editor

So a big load on memory access.

My configuration :
- 4 years old
- Windows 7 ultimate x64
- ASUSTeK P5K (Intel P35 Express)
- Intel Q6600 2.4ghz non overclocked
- 4go Kingston HyperX DDR2-SDRAM PC8500 CL5 - KHX8500D2K2/2G
- RADEON HD5700

I have built it on my own.

I ran :

- SFC /SCANNOW Command - System File Checker up to three times to fix all errors.
- Memtest86+
- Windows Memory Diagnostics Tool all week-end (at least 30 passes...)

No error for those tests.

I also ran Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs.

Result for my C: (ssd)

Nom du journal*:Application
Source*:       Microsoft-Windows-Wininit
Date*:         12/03/2012 10:11:16
ID de l’événement*:1001
Catégorie de la tâche*:Aucun
Niveau*:       Information
Mots clés*:    Classique
Utilisateur*:  N/A
Ordinateur*:   Hurlevent
Description*:


Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

WARNING!  I parameter specified.
Your drive may still be corrupt even after running CHKDSK.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  480512 file records processed.                                         

File verification completed.
  1152 large file records processed.                                   

  0 bad file records processed.                                     

  4 EA records processed.                                           

  138 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  928492 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  480512 file SDs/SIDs processed.                                        

Cleaning up 6415 unused index entries from index $SII of file 0x9.
Cleaning up 6415 unused index entries from index $SDH of file 0x9.
Cleaning up 6415 unused security descriptors.
CHKDSK is compacting the security descriptor stream
  68831 data files processed.                                           

CHKDSK is verifying Usn Journal...
  79656168 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  480496 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  5363241 free clusters processed.                                        

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

 125033860 KB total disk space.
 102737672 KB in 410115 files.
    213912 KB in 68834 indexes.
         0 KB in bad sectors.
    629308 KB in use by the system.
     65536 KB occupied by the log file.
  21452968 KB available on disk.

      4096 bytes in each allocation unit.
  31258465 total allocation units on disk.
   5363242 allocation units available on disk.

Internal Info:
00 55 07 00 e1 4e 07 00 0e 1e 0d 00 00 00 00 00  .U...N..........
19 05 00 00 8a 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.

XML de l’événement*:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-12T09:11:16.000000000Z" />
    <EventRecordID>33631</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Hurlevent</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

WARNING!  I parameter specified.
Your drive may still be corrupt even after running CHKDSK.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  480512 file records processed.                                         

File verification completed.
  1152 large file records processed.                                   

  0 bad file records processed.                                     

  4 EA records processed.                                           

  138 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  928492 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  480512 file SDs/SIDs processed.                                        

Cleaning up 6415 unused index entries from index $SII of file 0x9.
Cleaning up 6415 unused index entries from index $SDH of file 0x9.
Cleaning up 6415 unused security descriptors.
CHKDSK is compacting the security descriptor stream
  68831 data files processed.                                           

CHKDSK is verifying Usn Journal...
  79656168 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  480496 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  5363241 free clusters processed.                                        

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

 125033860 KB total disk space.
 102737672 KB in 410115 files.
    213912 KB in 68834 indexes.
         0 KB in bad sectors.
    629308 KB in use by the system.
     65536 KB occupied by the log file.
  21452968 KB available on disk.

      4096 bytes in each allocation unit.
  31258465 total allocation units on disk.
   5363242 allocation units available on disk.

Internal Info:
00 55 07 00 e1 4e 07 00 0e 1e 0d 00 00 00 00 00  .U...N..........
19 05 00 00 8a 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

Result for my D: (hdd)

Chkdsk a été exécuté en mode lecture-seule sur une capture instantanée de volume.  

Vérification du système de fichiers sur D:
Le nom de volume est Data.

CHKDSK est en train de vérifier les fichiers (étape 1 sur 3)...
  311808 enregistrements de fichier traités.                              La vérification des fichiers est terminée.
  66 enregistrements de grand fichier traités.                          0 enregistrements de fichier incorrect traités.                      0 enregistrements EA traités.                                        0 enregistrements d’analyse traités.                               CHKDSK est en train de vérifier les index (étape 2 sur 3)...
La bitmap d’index $SII dans le fichier 0x9 est incorrecte.
Erreur détectée dans l’index $SII du fichier 9.
  414788 entrées d’index traitées.                                         La vérification des index est terminée.

Erreurs trouvées. CHKDSK ne peut pas continuer en mode lecture seule.

It is ok for c: but I can't repair errors on d: because chkdsk doesn't respond anymore after a while.

Any help wold be appreciated, thanks.

 

[zigzag3143]

Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads DuplexSecure - FAQ

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

Using MagicISO to create ISO image files

 

[vikti]

Ok, done.

I will restart working tomorrow on the project and see if it is solved.

 

[vikti]

Ok,

since my last post : no problem until... 5 minutes ago...

I was working into UDK and I had a BSOD.

Do you want the mini dmp file or the whole test folder ?

 

[writhziden]

Please upload the full test folder. I imagine since it has been a few weeks, some things may have changed on your system in that time.

 

[vikti]

Ok

so there are two report, one without running UDK and the other running it.

thx a lot

 

[writhziden]

Possible out of date drivers:

sncduvc	fffff880`07feb000	fffff880`07ff3c00	Tue Jul 15 20:59:31 2008 (487d6413)	0001070d		sncduvc.SYS
hxctlflt	fffff880`07c00000	fffff880`07c21000	Mon Feb 09 00:43:09 2009 (498fde8d)	0001baad		hxctlflt.sys
snp2uvc	fffff880`07c76000	fffff880`07fd9480	Wed Apr 22 01:46:04 2009 (49eecb3c)	0036b112		snp2uvc.sys

sncduvc.SYS
hxctlflt.sys
snp2uvc.sys
See if you can find updated drivers for your webcam. If not, I wouldn't worry about it too much. Webcam drivers are often out of date and still work fine in most cases.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\vikti\report with udk running\report with udk running\Windows_NT6_BSOD_jcgriff2\040612-8751-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0320f000 PsLoadedModuleList = 0xfffff800`03453650
Debug session time: Fri Apr  6 06:09:21.363 2012 (UTC - 6:00)
System Uptime: 0 days 4:57:21.189
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000108e38, ce700000814f0867, fffff68000108ef2}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3266c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000108e38
Arg3: ce700000814f0867
Arg4: fffff68000108ef2

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  UDKMobile.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003233c56 to fffff8000328bd40

STACK_TEXT:  
fffff880`0b5537a8 fffff800`03233c56 : 00000000`0000001a 00000000`00000403 fffff680`00108e38 ce700000`814f0867 : nt!KeBugCheckEx
fffff880`0b5537b0 fffff800`032bd137 : 00000000`00000000 fffff680`00108f00 fffffa80`047b4290 00000000`0000003f : nt! ?? ::FNODOBFM::`string'+0x3266c
fffff880`0b553960 fffff800`032784bf : fffffa80`00000000 00000000`211e0fff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`0b553b20 fffff800`0328afd3 : ffffffff`ffffffff 00000000`2ec6f780 00000000`2ec6f748 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0b553c20 00000000`76fc14fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`2ec6f6b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fc14fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+3266c
fffff800`03233c56 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+3266c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+3266c

BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+3266c

Followup: MachineOwner
---------

This crash is usually caused by memory problems or underlying driver conflicts.

• If you are overclocking any hardware, please stop.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. In Windows 7:

  • Click the Start Menu
  • Type verifier in Search programs and files (do not hit enter)
  • Right click verifier and click Run as administrator
  • Put a tick in Create custom settings (for code developers) and click next
  • Put a tick in Select individual settings from a full list and click next
  • Set up the individual settings as in the image and click next
    View attachment 206062
  • Put a tick in Select driver names from a list
  • Put a tick next to all non-Microsoft drivers.
  • Click Finish.
  • Restart your computer.

  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

 

[vikti]

Hi,

1) Memtest : no memory or disk problem. (running all week end)

2) Verifier : Here are two minidump files that I get when I have started Seven in normal mode. Windows didn't start (BSOD) but it created the dmp.
Have I to find a group that runs in normal mode ?

 

[writhziden]

Loading Dump File [D:\Kingston\BSODDmpFiles\vikti\041012-15818-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0324a000 PsLoadedModuleList = 0xfffff800`0348e650
Debug session time: Tue Apr 10 03:04:40.008 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:15.849
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 198, fffffa8006105b30, fffff88004841d86}

Unable to load image \??\C:\Program Files\NetLimiter 3\nltdi.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nltdi.sys
*** ERROR: Module load completed but symbols could not be loaded for nltdi.sys
Probably caused by : nltdi.sys ( nltdi+1d86 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000198, Handle value being referenced.
Arg3: fffffa8006105b30, Address of the current process.
Arg4: fffff88004841d86, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000374f3dc to fffff800032c6d40

STACK_TEXT:  
fffff880`067ba698 fffff800`0374f3dc : 00000000`000000c4 00000000`000000f6 00000000`00000198 fffffa80`06105b30 : nt!KeBugCheckEx
fffff880`067ba6a0 fffff800`03764ae4 : 00000000`00000198 fffffa80`06105b30 00000000`00000004 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`067ba6e0 fffff800`0351d1e0 : fffff8a0`017f3450 fffff880`067ba950 fffff880`067bab00 fffff880`067bacb8 : nt!VfCheckUserHandle+0x1b4
fffff880`067ba7c0 fffff800`0358bec5 : fffff8a0`017f3400 fffff800`00000008 fffffa80`039e8ed0 fffff8a0`017f3400 : nt! ?? ::NNGAKEGL::`string'+0x212ce
fffff880`067ba890 fffff800`032c5fd3 : 00000000`00000198 fffffa80`06cc0b60 fffff880`067bacb8 fffff8a0`017f34a0 : nt!NtQueryInformationToken+0x1f3
fffff880`067baa90 fffff800`032c2570 : fffff800`03754083 fffffa80`06d8c6d0 fffff980`03a78fb8 00000000`7617c963 : nt!KiSystemServiceCopyEnd+0x13
fffff880`067bac98 fffff800`03754083 : fffffa80`06d8c6d0 fffff980`03a78fb8 00000000`7617c963 fffff800`032c2570 : nt!KiServiceLinkage
fffff880`067baca0 fffff880`04841d86 : fffff880`067baf10 fffff980`03a78fb8 fffffa80`06d8c6d0 00000000`032f1da0 : nt!VfZwQueryInformationToken+0x63
fffff880`067bacf0 fffff880`067baf10 : fffff980`03a78fb8 fffffa80`06d8c6d0 00000000`032f1da0 fffff880`067bad28 : nltdi+0x1d86
fffff880`067bacf8 fffff980`03a78fb8 : fffffa80`06d8c6d0 00000000`032f1da0 fffff880`067bad28 00000000`00000000 : 0xfffff880`067baf10
fffff880`067bad00 fffffa80`06d8c6d0 : 00000000`032f1da0 fffff880`067bad28 00000000`00000000 00000000`00000198 : 0xfffff980`03a78fb8
fffff880`067bad08 00000000`032f1da0 : fffff880`067bad28 00000000`00000000 00000000`00000198 fffff880`067bae10 : 0xfffffa80`06d8c6d0
fffff880`067bad10 fffff880`067bad28 : 00000000`00000000 00000000`00000198 fffff880`067bae10 3a300000`03571860 : 0x32f1da0
fffff880`067bad18 00000000`00000000 : 00000000`00000198 fffff880`067bae10 3a300000`03571860 fffff800`035711c0 : 0xfffff880`067bad28


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nltdi+1d86
fffff880`04841d86 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  nltdi+1d86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nltdi

IMAGE_NAME:  nltdi.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c779fae

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_nltdi+1d86

BUCKET_ID:  X64_0xc4_f6_VRF_nltdi+1d86

Followup: MachineOwner
---------

You do not need to find a group that runs in normal mode. The fact that it is crashing on startup means you have an incompatible driver. It appears to be your NetLimiter software that is causing the crash on startup. Remove the software and see how the system responds. You may need to disable Verifier, remove the driver, and then re-enable Verifier using the steps in my previous post.

When you are ready to disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type the following command and then Enter:

verifier /reset​

-> Restart your computer.

 

[vikti]

Hi,

since a few days and after Nelimiter was removed I haven't got any crash until yestarday.
I was on rendez-vous when I heard my computer restarted. I had only gmail (chrome) running and the usual background tasks (the same as my old post)

So for now I got only one *.dmp and I am waiting for few next.

I have uploaded it just in case.

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\vikti\041712-14242-01\041712-14242-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345e650
Debug session time: Tue Apr 17 04:13:52.433 2012 (UTC - 6:00)
System Uptime: 0 days 2:50:13.755
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 5ac00, 2, 6b5ff}

Unable to load image \SystemRoot\system32\DRIVERS\vsflt61.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vsflt61.sys
*** ERROR: Module load completed but symbols could not be loaded for vsflt61.sys
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000005ac00, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000006b5ff, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  rundll32.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000331f10c to fffff80003296c80

STACK_TEXT:  
fffff880`08b0f0d8 fffff800`0331f10c : 00000000`0000004e 00000000`00000099 00000000`0005ac00 00000000`00000002 : nt!KeBugCheckEx
fffff880`08b0f0e0 fffff800`032f22f5 : fffffa80`01035f60 00000000`00000001 00000000`00000000 00000000`00000080 : nt!MiBadShareCount+0x4c
fffff880`08b0f120 fffff800`0334fafe : 00000000`00000002 fffff880`00000001 fffffa80`01035f60 fffff800`034cbcf0 : nt! ?? ::FNODOBFM::`string'+0x11848
fffff880`08b0f1b0 fffff800`033c220a : 2aaaaaaa`aaaaaaab fffff880`08b0f280 fffffa80`03901c00 00000000`00000000 : nt!MiRemoveLowestPriorityStandbyPage+0x21e
fffff880`08b0f230 fffff800`032b6bb0 : 00000000`00001000 fffff800`03420340 00000000`00000000 00000000`00000000 : nt!MiAllocatePoolPages+0xb8a
fffff880`08b0f370 fffff800`033c490e : 00000000`00000000 fffff8a0`18488000 fffff8a0`00000000 00000000`00001000 : nt!ExpAllocateBigPool+0xb0
fffff880`08b0f460 fffff800`033973e4 : 00000000`00000000 00000000`00001000 00000000`00000000 fffff800`032c1c80 : nt!ExAllocatePoolWithTag+0x82e
fffff880`08b0f550 fffff800`033975b6 : fffffa80`04a0e000 fffff800`034cb540 fffff6fc`0001aa08 00000000`00000009 : nt!MiAllocateAccessLog+0xb4
fffff880`08b0f580 fffff800`03397c90 : 00000003`00000000 ffffffff`ffffffff 00000000`00000002 fffff800`034cb540 : nt!MiLogPageAccess+0x46
fffff880`08b0f5d0 fffff800`033992b7 : fffffa80`04d769f0 00000000`00000001 00000000`00000000 ffffffff`ffffffff : nt!MiEmptyWorkingSet+0x220
fffff880`08b0f680 fffff800`03736261 : 00000000`00000000 fffff880`00e35202 fffff980`63fe6d80 00000000`00000040 : nt!MiTrimAllSystemPagableMemory+0x218
fffff880`08b0f6e0 fffff800`037363bf : fffff880`00e35202 fffffa80`0395d9d0 fffffa80`0395d9d0 00000000`00000040 : nt!MmVerifierTrimMemory+0xf1
fffff880`08b0f710 fffff800`03736b14 : fffff880`00e35288 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ViKeRaiseIrqlSanityChecks+0xcf
fffff880`08b0f750 fffff880`00e244c3 : fffffa80`62696c6b fffff880`00e35270 fffff980`63fe6d80 00000000`00000000 : nt!VerifierKeAcquireSpinLockRaiseToDpc+0x54
fffff880`08b0f7b0 fffffa80`62696c6b : fffff880`00e35270 fffff980`63fe6d80 00000000`00000000 fffff880`00e35250 : vsflt61+0xd4c3
fffff880`08b0f7b8 fffff880`00e35270 : fffff980`63fe6d80 00000000`00000000 fffff880`00e35250 fffff880`00e2cdcb : 0xfffffa80`62696c6b
fffff880`08b0f7c0 fffff980`63fe6d80 : 00000000`00000000 fffff880`00e35250 fffff880`00e2cdcb 00000000`00003600 : vsflt61+0x1e270
fffff880`08b0f7c8 00000000`00000000 : fffff880`00e35250 fffff880`00e2cdcb 00000000`00003600 fffffa80`05597d98 : 0xfffff980`63fe6d80


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0331f10c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4f558b55

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_VRF_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_VRF_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

The above crash was Verifier enabled. The latest crash was caused by Acronis Virtual Disk.

I suspect the above crash is not detrimental, and I would recommend disabling Verifier with the steps in my previous post. See how the system responds for a while without Verifier enabled. We may have already determined the cause of your other crashes as the Netlimiter software. I do not think Acronis Virtual Disk needs to be removed at this time.

 

[vikti]

Ho ok, thx, I did not understand that I had to disable Verifier.

I do it right now.

 

[writhziden]

Ho ok, thx, I did not understand that I had to disable Verifier.

I do it right now.

I actually realized after I posted that I had told you to re-enable it, so you did nothing wrong. I had wanted to check if there were further underlying problems. It appears things are clean now, but we'll have to wait a bit to see if that is true or not.

 

[vikti]

Ok, so I leave it activated for a while ?

 

[writhziden]

Deactivate it for a while. Verifier will make the system less stable. We need to see if it will be stable running normally. Best wishes it will be stable now!

Sorry for the confusion. I was less than clear in my last few posts.

 

[vikti]

No problem. It is now desactivated. I will run the system normally for a couple of week and I will (hope) close this thread !
Thanks you very much !

 

[writhziden]

You're welcome. Look forward to hearing back in a couple weeks how the system responds.

 

[vikti]

Hi,

a couple of weeks later ...

I had those two BSOD. The last was on backuping my entire D:\

Any advice ? Thx.

 

[writhziden]

Your latest crash was due to your Atheros Network driver being corrupted. Download the Vista 64bit version from ASUS - Motherboards- ASUS P5K LAN devices and do the following steps.

1. Click Start Menu
2. Right Click My Computer/Computer
3. Click Manage
4. Click Device Manager from the list on the left
5. Expand Network adapters
6. Right click the Atheros network device
7. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
8. Put a tick in Delete driver software for this device and hit OK
9. Do not restart your computer
10. Install the downloaded driver for the Atheros network device.

Alternatively:

1. Login as an adminstrative user.
2. Click Start Menu
3. Click Control Panel
4. Click Hardware and Sound
5. Click Device Manager (the last link under Devices and Printers)
6. Expand Network adapters
7. Right click the Atheros network device
8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
9. Put a tick in Delete driver software for this device and hit OK
10. Do not restart your computer
11. Install the downloaded driver for the Atheros network device.

To install the downloaded driver, use http://www.sevenforums.com/tutorials/98073-drivers-install-vista-drivers-windows-7-a.html


I should also warn you that you are likely to continue to have corruption related crashes due to incompatible hardware. Your motherboard may be too old to properly support the SSD you are using. Incompatible hardware with SSDs often results in data corruption that leads to crashes.

 

[vikti]

Ok, I tried to take the driver on the asus web site but it seams to not be compatible with win7 (even with compatibilities mode)
I have installed this one TousLesDrivers.com - Téléchargement gratuit de mises à jour PC (drivers, bios, firmwares) but still got BSOD.

Could you check if the new driver is the cause of those BSOD ?

Thx