BSOD using windows , error 0x0000004e

[was955]

hi

i bought new computer
QuadCore Intel Core i5-4430, 3000 MHz (30 x 100)
Gigabyte GA-H87M-D3H (2 PCI, 2 PCI-E x16, 4 DDR3 DIMM, Audi
2X4 Patriot Memory 1600 CL9 Series
Intel(R) HD Graphics 4600 (2112 MB)
WDC WD10EZEX-00RKKA0 ATA Device (1000 GB, 7200 RPM, SATA-III)


i installed windows with drivers and software and strat having bsod from evrey few days

today i had it and made format to see what is going on

here is the dump files.

also i did test memory using memtest+ and it is ok

 

[x BlueRobot]

[COLOR="Red"]BugCheck 4E[/COLOR], {[COLOR="Blue"]99[/COLOR], 15cf84, 2, 15cf82}

Probably caused by : [COLOR="red"]memory_corruption [/COLOR]( nt!MiBadShareCount+4c )

0: kd> [COLOR="SeaGreen"]!dpx[/COLOR]

Start memory scan  : 0xfffff8800939fda8 ($csp)
End memory scan    : 0xfffff880093a1000 (Stack Base)

               rsp : 0xfffff8800939fda8 : 0xfffff80002f090cc : nt!MiBadShareCount+0x4c
0xfffff8800939fda8 : 0xfffff80002f090cc : [COLOR="Red"]nt!MiBadShareCount+0x4c[/COLOR]
0xfffff8800939fe30 : 0xfffff80002e92078 : nt!KiFlushProcessTbWorker
0xfffff8800939fe78 : 0xfffff80002e52d53 : nt!MiDeleteAddressesInWorkingSet+0x307
0xfffff880093a0728 : 0xfffff80002e53e22 : nt!MmCleanProcessAddressSpace+0x96
0xfffff880093a0778 : 0xfffff800031546da : nt!PspExitThread+0x56a
0xfffff880093a07a0 : 0xfffff80002ff5e80 : nt!KiInitialPCR+0x180
0xfffff880093a07c8 : 0xfffff80002faefbd : [COLOR="red"]nt!ExFreePoolWithTag+0x22d[/COLOR]
0xfffff880093a0878 : 0xfffff80003137bdd : nt!PsExitSpecialApc+0x1d
0xfffff880093a08a8 : 0xfffff80002e75cda : nt!KiDeliverApc+0x2ca
0xfffff880093a08c8 : 0xfffff80003120cb3 : nt!AlpcpSendCloseMessage+0xdb
0xfffff880093a0928 : 0xfffff80002e76020 : nt!KiInitiateUserApc+0x70
0xfffff880093a0940 : 0xfffff80003137b50 : nt!PspExitNormalApc
0xfffff880093a0a68 : 0xfffff80002e824f7 : nt!KiSystemServiceExit+0x9c
0xfffff880093a0a80 : 0xfffff880093a0a88 : 0xfffff80003176144 : nt!ObpCloseHandle+0x94
0xfffff880093a0a88 : 0xfffff80003176144 : [COLOR="red"]nt!ObpCloseHandle+0x94[/COLOR]
0xfffff880093a0ad8 : 0xfffff80002e82453 : nt!KiSystemServiceCopyEnd+0x13
0xfffff880093a0ae0 : 0xfffffa800be86060 :  Trap @ fffff880093a0ae0

Okay this bugcheck indicates, that a PTE or PFN is corrupt, and is usually caused by drivers not properly handling MDLs. I'm guessing looking at the stack, that the reference count may be wrong, causing the system to bugcheck. The reference count may have not been updated accordingly, when a page has been freed and dereferenced.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

Do you require Java?

 

[was955]

right now i moved to windows 8.1 to see what will it be with all of this new hardware and software

 

[was955]

here is link with new bsod in windows 8.1

bsod again in windows 8.1

 

[x BlueRobot]

Okay, I'll request this thread to be marked solved, since you've moved the thread to the other forum and have installed Windows 8.1.

 

[was955]

again

hi

sorry for all this delay

I tried windows 8.1 and the same problems

so I went back to windows 7

now I replaced a lot of thing in the computer as it is still new 1 month only

the current system is :

Motherboard: CPU Type QuadCore Intel Core i5-4440, 3100 MHz (31 x 100) Motherboard Name Gigabyte GA-Z87-HD3 (2 PCI, 2 PCI-E x1, 2 PCI-E x16, 4 DDR3 DIMM, Audio, Video, Gigabit LAN) Motherboard Chipset Intel Lynx Point Z87, Intel Haswell System Memory 8080 MB (DDR3-1600 DDR3 SDRAM) DIMM2: Patriot Memory 1600 CL9 Series 4 GB DDR3-1600 DDR3 SDRAM (9-9-9-24 @ 800 MHz) (8-8-8-22 @ 711 MHz) (7-7-7-19 @ 622 MHz) (6-6-6-16 @ 533 MHz) (5-5-5-14 @ 444 MHz) DIMM4: Patriot Memory 1600 CL9 Series 4 GB DDR3-1600 DDR3 SDRAM (9-9-9-24 @ 800 MHz) (8-8-8-22 @ 711 MHz) (7-7-7-19 @ 622 MHz) (6-6-6-16 @ 533 MHz) (5-5-5-14 @ 444 MHz) BIOS Type AMI (08/03/2013) Communication Port Communications Port (COM1) Communication Port Printer Port (LPT1) Display: Video Adapter Intel(R) HD Graphics 4600 (2112 MB) Video Adapter Intel(R) HD Graphics 4600 (2112 MB) Video Adapter Intel(R) HD Graphics 4600 (2112 MB) 3D Accelerator Intel HD Graphics 4600 Monitor Generic PnP Monitor [NoDB] (2110507468094) Multimedia: Audio Adapter Realtek ALC892 @ Intel Lynx Point PCH - High Definition Audio Controller [C-1] Storage: IDE Controller Intel(R) 8 Series/C220 Series SATA AHCI Controller - 8C02 Disk Drive WD Elements 10A8 USB Device (931 GB, USB) Disk Drive WDC WD1002FAEX-00Z3A0 ATA Device (1000 GB, 7200 RPM, SATA-III) SMART Hard Disks Status OK Partitions: C: (NTFS) 472.0 GB (421.4 GB free) F: (NTFS) 931.5 GB (773.0 GB free) Total Size 1403.5 GB (1194.5 GB free) Input: Keyboard HID Keyboard Device Mouse HID-compliant mouse Network: Primary IP Address 10.0.0.2 Primary MAC Address 94-DE-80-B8-00-0A Network Adapter Realtek PCIe GBE Family Controller (10.0.0.2) Peripherals: Printer Adobe PDF Printer Fax Printer Microsoft XPS Document Writer USB2 Controller Intel Lynx Point PCH - USB 2.0 EHCI Host Controller 1 [C-1] USB2 Controller Intel Lynx Point PCH - USB 2.0 EHCI Host Controller 2 [C-1] USB3 Controller Intel Lynx Point PCH - USB 3.0 xHCI Host Controller [C-1] USB Device Generic USB Hub USB Device Generic USB Hub USB Device Microsoft Hardware USB Keyboard USB Device Microsoft Hardware USB Mouse USB Device Microsoft Mouse and Keyboard Detection Driver (USB) USB Device USB Input Device USB Device USB Mass Storage Device DMI: DMI BIOS Vendor American Megatrends Inc. DMI BIOS Version F6 DMI System Manufacturer Gigabyte Technology Co., Ltd. DMI System Product Z87-HD3 DMI System Version To be filled by O.E.M. DMI System Serial Number To be filled by O.E.M. DMI System UUID 9402DE03-8004B805-00060A07-00080009 DMI Motherboard Manufacturer Gigabyte Technology Co., Ltd. DMI Motherboard Product Z87-HD3 DMI Motherboard Version x.x DMI Motherboard Serial Number To be filled by O.E.M. DMI Chassis Manufacturer Gigabyte Technology Co., Ltd. DMI Chassis Version To Be Filled By O.E.M. DMI Chassis Serial Number To Be Filled By O.E.M. DMI Chassis Asset Tag To Be Filled By O.E.M. DMI Chassis Type Desktop Case

***************************************************************************

I changed motherboard to GA-Z87-HD3

cpu changed also to i5-4440

hard drive changed to : WDC WD1002FAEX-00Z3A0 ATA Device (1000 GB, 7200 RPM, SATA-III)

ram changed to : 2 stick of 4 gb Patriot Memory 1600 CL9 Series

today after new windows installion I had my first DUMP

attached

and it is

IRQL_NOT_LESS_OR_EQUAL ntoskrnl.exe

 

[x BlueRobot]

Could you post the Windows 8 thread?

[COLOR=Red]BugCheck A[/COLOR], {0, 2, 1, fffff80002e6c6bf}

Probably caused by : ntkrnlmp.exe ( nt!KeSetEventBoostPriority+3f )

3: kd> [COLOR=SeaGreen]k[/COLOR]
Child-SP          RetAddr           Call Site
fffff880`08e222d8 fffff800`02e8c169 nt!KeBugCheckEx
fffff880`08e222e0 fffff800`02e8ade0 nt!KiBugCheckDispatch+0x69
fffff880`08e22420 fffff800`02e6c6bf [COLOR=Red]nt!KiPageFault[/COLOR]+0x260
fffff880`08e225b0 fffff800`02e8220f [COLOR=Red]nt!KeSetEventBoostPriority[/COLOR]+0x3f
fffff880`08e22620 fffff800`031a4e15 nt!ExpReleaseResourceForThreadLite+0x2bf
fffff880`08e22680 fffff800`031862a3 nt!ObCheckObjectAccess+0x155
fffff880`08e22720 fffff800`03177bf9 nt!ObpCreateHandle+0x523
fffff880`08e22830 fffff800`03166e54 nt!ObOpenObjectByPointerWithTag+0x109
fffff880`08e22a50 fffff800`02e8be53 nt!NtOpenProcessTokenEx+0x114
fffff880`08e22ae0 00000000`7790227a nt!KiSystemServiceCopyEnd+0x13
00000000`0543e278 00000000`00000000 0x7790227a

The main issue here, is the illegal page fault, at IRQL Level 2 only non-paged pool is accessible and therefore any references to paged pool will result in page faults which will not be serviced correctly.

I'm not sure why the KeSetEventBoostPriority function is being blamed, since this is used to give a thread which has been waiting upon a Event object, a higher thread priority in order to reduce quite a few problems.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[was955]

i am running now the Driver Verifier

if I got bsod what to do?

and also as u can see I change all the internal components

what u suggest to change more!!!

and could it be the Microsoft wireless 2000 driver when I am using the most recent Microsoft driver?


and could windows 8.1 solve the problems?

u requested the windows 8 thread here u go:

http://www.eightforums.com/bsod-crashes-debugging/31821-bsod-again-windows-8-1-a.html

 

[was955]

didn't take much time

I thought stress gpu so I start playing Chicken Invaders 4 - Ultimate Omelette

attached new dump

bluescreenview says:

110913-18501-01.dmp 11/9/2013 10:19:01 PM DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL 0x000000d5 fffff980`33636fe0 00000000`00000000 fffffa80`0952f606 00000000`00000000 em018_64.dat em018_64.dat+9e6a x64 ntoskrnl.exe+75bc0 C:\Windows\Minidump\110913-18501-01.dmp 4 15 7601 281,704 11/9/2013 10:20:48 PM

 

[was955]

I have uninstall nod32 version 7

and installed Microsoft Security Essentials

 

[was955]

can I anyone help me please

 

[x BlueRobot]

[COLOR="Red"]BugCheck D5[/COLOR], {fffff98033636fe0, 0, fffffa800952f606, 0}

Could not read faulting driver name
Probably caused by : [COLOR="Red"]em018_64.dat[/COLOR] ( em018_64+3d606 )

0: kd> [COLOR="SeaGreen"]lmvm em018_64[/COLOR]
start             end                 module name
fffffa80`094f2000 fffffa80`09564000   em018_64 T (no symbols)           
    Loaded symbol image file: em018_64.dat
    Image path: C:\Program Files\ESET\ESET NOD32 Antivirus\em018_64.dat
    Image name: em018_64.dat
    Timestamp:        [COLOR="Red"]Thu Oct 24 11:34:08 2013 [/COLOR](5268F7A0)
    CheckSum:         00000000
    ImageSize:        00072000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This bugcheck was caused by the faulting driver (listed above), referencing freed special pool and then causing a page fault.

The problem was clearly caused by ESET, which you have now removed. Disable Driver Verifier if you haven't already. Instructions on how to do so, are provided with the Driver Verifier links in my previous post.

 

[was955]

again

hi

i was holding on for 12 days and today it was back

i removed nod32 as it seems it was the problem now i don't what is the new problem

please can anyone help

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1000007E[/COLOR], {[COLOR="SeaGreen"]ffffffffc0000005[/COLOR], fffff80002f667f2, fffff8800b2be858, fffff8800b2be0b0}

Probably caused by : ntkrnlmp.exe ( nt!RtlInterlockedClearBitRunEx+b2 )

fffff8800b2be858 -- ([COLOR="SeaGreen"].exr 0xfffff8800b2be858[/COLOR])
ExceptionAddress: fffff80002f667f2 (nt!RtlInterlockedClearBitRunEx+0x00000000000000b2)
   ExceptionCode: [COLOR="Blue"]c0000005 (Access violation)[/COLOR]
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

0: kd> [COLOR="SeaGreen"]k[/COLOR]
 # Child-SP          RetAddr           Call Site
00 fffff880`0b2bea98 fffff800`031163db nt!RtlInterlockedClearBitRunEx+0xb2
01 fffff880`0b2beaa0 fffff800`0311abb5 [COLOR="Red"]nt!MmDuplicateMemory[/COLOR]+0x8bb <-- Hibernation File Write?
02 fffff880`0b2beb90 fffff800`031692ea [COLOR="Red"]nt!PopTransitionToSleep[/COLOR]+0xd5 
03 fffff880`0b2bec00 fffff800`02ebd8e6 nt!PspSystemThreadStartup+0x5a
04 fffff880`0b2bec40 00000000`00000000 nt!KxStartSystemThread+0x16

Okay, there is clearly a problem, when the computer is set to sleep and the contents of memory are written to a possible hibernation file. This seems to be more of a driver issue, or possibly a hardware issue with the flipped bit within the r10 register.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 fffff8800b2be0b0 -- (.cxr 0xfffff8800b2be0b0)
rax=00000000fffffffe rbx=ffffffffffffffff rcx=0000000000000000
rdx=fffff80003056180 rsi=fffff80003056180 rdi=0000058000000000
rip=fffff80002f667f2 rsp=fffff8800b2bea98 rbp=fffe7a8091024800
 r8=0000000000000000  r9=0000000000000001 r10=[COLOR="Red"]1[/COLOR]ffff9800b282c40
r11=fffff80003056180 r12=0000000000000000 r13=0000000000000001
r14=fffff8800b2bebc0 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!RtlInterlockedClearBitRunEx+0xb2:
fffff800`02f667f2 f0412102        lock and dword ptr [COLOR="Red"][r10][/COLOR],eax ds:002b:1ffff980`0b282c40=????????

Run the Small FFT's, Large FFT's and Blend Test for a few hours each. Do not let the temperature exceed 80*C.

• http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html

Enable "Round off checking" before the test (see first post below tutorial).

 

[was955]

do u say if i stop using sleep and hibernate i will not see this bsod or it is beeter to do drive verifer with a lot of sleep and hibernate to know what driver is the problem or hardware?

 

[x BlueRobot]

When running Driver Verifier, just use your computer as you normally would. Disabling sleep or hibernate would be more of a work around, rather than a solution in my opinion, but you could try and see if it helps.

 

[was955]

again

well
here it is a new hot dump

crashed now after a restart and didn't want to get into windows keept showinf this bsod

so i got into safe mode and disabled verifier

well we know what driver is causing the problems this time

and will new clean windows help?!

maybe this new chipset and haswell cpu need windows 8

 

[x BlueRobot]

It's not produced by Driver Verifier, and have you tried disabling Sleep or Hibernate? Personally, I don't use them at all, since Windows booting fast enough for me.

[COLOR=Red]BugCheck 50[/COLOR], {fffff901c066f94c, 0, [COLOR="Orange"]fffff960000bcc73[/COLOR], 5}

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!bLoadFontFile+1f3 )

1: kd> [COLOR=SeaGreen]!irql[/COLOR]
Debugger saved IRQL for processor 0x1 -- 0 (LOW_LEVEL)

The page fault wasn't a result of a bad IRQL level, it leads me to believe it may be more of a miscalled instruction.

1: kd> [COLOR="SeaGreen"]k[/COLOR]
Child-SP          RetAddr           Call Site
fffff880`025990f8 fffff800`02f0f5b3 nt!KeBugCheckEx
fffff880`02599100 fffff800`02e90cee nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`02599260 [COLOR="Orange"]fffff960`000bcc73 [/COLOR][COLOR="Red"]nt!KiPageFault[/COLOR]+0x16e
fffff880`025993f0 fffff960`000bca37 [COLOR="Red"]win32k!bLoadFontFile[/COLOR]+0x1f3
fffff880`025994e0 fffff960`000bb69e win32k!ttfdSemLoadFontFile+0x6b
fffff880`02599540 fffff960`000bb58c win32k!PDEVOBJ::LoadFontFile+0x7e
fffff880`025995d0 fffff960`000bbc67 win32k!vLoadFontFileView+0x4bc
fffff880`02599660 fffff960`000be92c win32k!PUBLIC_PFTOBJ::bLoadFonts+0x587
fffff880`02599790 fffff960`000be7d1 win32k!GreAddFontResourceWInternal+0x114
fffff880`02599820 fffff800`02e91e53 win32k!NtGdiAddFontResourceW+0x151
fffff880`025999d0 000007fe`fd5aa86a nt!KiSystemServiceCopyEnd+0x13
00000000`00d5f868 00000000`00000000 0x000007fe`fd5aa86a

1: kd> [COLOR="SeaGreen"]uf win32k!bLoadFontFile+0x1f3[/COLOR]
win32k!bLoadFontFile:
fffff960`000bca80 6644894c2420    mov     word ptr [rsp+20h],r9w
fffff960`000bca86 4489442418      mov     dword ptr [rsp+18h],r8d
fffff960`000bca8b 48894c2408      mov     qword ptr [rsp+8],rcx
fffff960`000bca90 53              push    rbx
fffff960`000bca91 56              push    rsi
fffff960`000bca92 57              push    rdi
fffff960`000bca93 4154            push    r12
fffff960`000bca95 4155            push    r13
fffff960`000bca97 4156            push    r14
fffff960`000bca99 4157            push    r15
fffff960`000bca9b 4881ecb0000000  sub     rsp,0B0h
fffff960`000bcaa2 418bf8          mov     edi,r8d
fffff960`000bcaa5 4c8bf2          mov     r14,rdx
fffff960`000bcaa8 33db            xor     ebx,ebx
fffff960`000bcaaa 895c244c        mov     dword ptr [rsp+4Ch],ebx
fffff960`000bcaae 4c8bac2418010000 mov     r13,qword ptr [rsp+118h]
fffff960`000bcab6 49895d00        mov     qword ptr [r13],rbx
fffff960`000bcaba 4c8bfb          mov     r15,rbx
fffff960`000bcabd 8bc3            mov     eax,ebx
fffff960`000bcabf 895c2440        mov     dword ptr [rsp+40h],ebx
fffff960`000bcac3 8b8c2410010000  mov     ecx,dword ptr [rsp+110h]
fffff960`000bcaca 3bcb            [COLOR="Blue"]cmp[/COLOR]     ecx,ebx
fffff960`000bcacc 7427            [COLOR="Blue"]je[/COLOR]      win32k!bLoadFontFile+0x75 (fffff960`000bcaf5)

So, it will jump to a certain function when the condition is true, hence the reason for the cmp instruction between the ecx and ebx register.

[COLOR="Red"]win32k!bLoadFontFile+0x75:[/COLOR]
fffff960`000bcaf5 be01000000      mov     esi,1
fffff960`000bcafa 448ba42410010000 mov     r12d,dword ptr [rsp+110h]
fffff960`000bcb02 4489642450      mov     dword ptr [rsp+50h],r12d

This function mostly moves data between registers.

It again, seems like drivers referencing bad addresses to me. Turn off hibernation and sleep for now.

 

[was955]

so u are saying u can't find the drive that is making the problem
u know this is not a good solutions to turn off sleep and hibernate

also i don't use hibernate at all only automatic sleep when i am away from computer

can u suggest what to do other than verifier?

how we can solve this problem

 

[was955]

another dump

well here is new dump with diffrent error

this is shown after installing BlueStacks (android emulator for pc)

i feel that the video card the onboard need a relief by installing new vga card with it's own memory

what u say about that?