help with bluescreen error, hardware issue?

[writhziden]

http://www.sevenforums.com/tutorials/73828-imaging-free-macrium.html

and

http://www.sevenforums.com/tutorials/663-backup-complete-computer-create-image-backup.html?ltr=B

are both good. I use the first one, myself.

 

[beagrie07]

I got another blue screen just now, I haven't gotten round to uninstalling Norton Ghost 15.0 yet but is it the same problem as before?

Thanks

EDIT: My backups are scheduled every Monday and today is Wednesday, I don't see how it can cause a blue screen?

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\BSODDmpFiles\beagrie07\Windows_NT6_BSOD_jcgriff2\021512-9609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03008000 PsLoadedModuleList = 0xfffff800`0324d670
Debug session time: Wed Feb 15 13:20:28.315 2012 (GMT-7)
System Uptime: 0 days 0:43:30.079
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 176265, 2, 175cf8}

Unable to load image \SystemRoot\system32\DRIVERS\symsnap.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for symsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for symsnap.sys
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000176265, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000175cf8, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  vegas100.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000310dd7c to fffff80003084c40

STACK_TEXT:  
fffff880`0aa27008 fffff800`0310dd7c : 00000000`0000004e 00000000`00000099 00000000`00176265 00000000`00000002 : nt!KeBugCheckEx
fffff880`0aa27010 fffff800`03019a53 : fffffa80`0462e730 fffff800`031b31de 28400001`77b2b963 00000000`00006fd5 : nt!MiBadShareCount+0x4c
fffff880`0aa27050 fffff800`030d27ad : 00000000`00000002 fffff800`00000001 fffffa80`0462e730 fffffa80`0464c700 : nt! ?? ::FNODOBFM::`string'+0x11d18
fffff880`0aa270e0 fffff800`030b19bc : 00000000`00000000 00000000`00000000 fffff880`0aa271c0 ffffffff`ffffffff : nt!MiRemoveLowestPriorityStandbyPage+0x1d5
fffff880`0aa27160 fffff800`030ade3e : fffff980`13416000 00000000`83d54308 fffff880`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0xe50
fffff880`0aa27350 fffff800`030ae3f4 : fffffa80`0a6338e0 00000000`83d54308 fffff880`0aa27490 00000000`00000000 : nt!CcMapAndCopyInToCache+0x20e
fffff880`0aa27440 fffff880`01623bf6 : 00000000`00000000 fffff880`0aa276b0 fffffa80`09afd010 00000000`00000000 : nt!CcCopyWrite+0x194
fffff880`0aa274d0 fffff880`016241a3 : fffffa80`09afd010 fffffa80`06c28670 fffff880`0aa27601 fffff880`0aa27600 : Ntfs!NtfsCommonWrite+0x3390
fffff880`0aa27680 fffff880`01131bcf : fffffa80`06c28aa0 fffffa80`06c28670 fffffa80`09930d30 00000000`00000001 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`0aa27740 fffff880`011306df : fffffa80`073b28e0 fffffa80`073cddb0 fffffa80`073b2800 fffffa80`06c28670 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0aa277d0 fffff880`0119dab6 : fffffa80`06c28670 ffffffff`00000000 00000000`00000000 fffffa80`06c28670 : fltmgr!FltpDispatch+0xcf
fffff880`0aa27830 fffffa80`06c28670 : ffffffff`00000000 00000000`00000000 fffffa80`06c28670 fffffa80`073cdc60 : symsnap+0xeab6
fffff880`0aa27838 ffffffff`00000000 : 00000000`00000000 fffffa80`06c28670 fffffa80`073cdc60 fffffa80`06c28670 : 0xfffffa80`06c28670
fffff880`0aa27840 00000000`00000000 : fffffa80`06c28670 fffffa80`073cdc60 fffffa80`06c28670 00000001`00000003 : 0xffffffff`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`0310dd7c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

symsnap (Norton) is on the stack during the crash. Norton is known to cause blue screen crashes on some systems. We say this a lot for a reason; and many of us have it built into our repertoire of quick troubleshooting steps of first things to check for and recommend. I usually do not mention it unless a crash or series of crashes point to it as a likely cause.

 

[beagrie07]

Ok, a few days on, Norton Ghost is uninstalled but I'm still getting BSOD's. I've uploaded the zip.

Its something to do with ntoskrnl.exe ( nt+7cc40 ). Memory is ruled out because I've run memtest already with no errors.

I've read its something to do with booting?

Cheers

 

[writhziden]

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\beagrie07\Windows_NT6_BSOD_jcgriff2\022012-12901-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0300c000 PsLoadedModuleList = 0xfffff800`03251670
Debug session time: Mon Feb 20 07:05:01.047 2012 (GMT-7)
System Uptime: 0 days 0:22:39.890
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 15e5c2, 2, 163341}

Unable to load image \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AVGIDSFilter.Sys
*** ERROR: Module load completed but symbols could not be loaded for AVGIDSFilter.Sys
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000015e5c2, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000163341, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003111d7c to fffff80003088c40

STACK_TEXT:  
fffff880`0a8580e8 fffff800`03111d7c : 00000000`0000004e 00000000`00000099 00000000`0015e5c2 00000000`00000002 : nt!KeBugCheckEx
fffff880`0a8580f0 fffff800`0301da53 : fffffa80`0102e730 f8a00d87`36b80400 fffffa80`06a389b0 fffff800`031b7fbd : nt!MiBadShareCount+0x4c
fffff880`0a858130 fffff800`030d67ad : 00000000`00000002 fffff800`00000001 fffffa80`0102e730 fffffa80`019a9700 : nt! ?? ::FNODOBFM::`string'+0x11d18
fffff880`0a8581c0 fffff800`030b59bc : 00000000`00000000 00000000`00000000 fffff880`0a858280 ffffffff`ffffffff : nt!MiRemoveLowestPriorityStandbyPage+0x1d5
fffff880`0a858240 fffff800`030b1e3e : fffff980`15edc000 00000000`0260c040 fffff880`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0xe50
fffff880`0a858430 fffff800`030b23f4 : fffffa80`07540a00 00000000`0260c040 fffff880`0a858570 fffff880`00000000 : nt!CcMapAndCopyInToCache+0x20e
fffff880`0a858520 fffff880`016a7c18 : 00000000`01f20000 fffffa80`07550500 fffff880`0a858610 fffffa80`00010000 : nt!CcCopyWrite+0x194
fffff880`0a8585b0 fffff880`0118b102 : fffffa80`07550550 fffff880`0118e4f2 fffffa80`00010000 00000000`00010001 : Ntfs!NtfsCopyWriteA+0x208
fffff880`0a8587b0 fffff880`0118e8ba : fffff880`0a858880 fffffa80`0a50cdf8 00000000`02600000 00000000`00010000 : fltmgr!FltpPerformFastIoCall+0xf2
fffff880`0a858810 fffff880`011ac83e : 00000000`00010000 00000000`00000000 fffffa80`07550550 fffff880`0a858a00 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0a858850 fffff880`075771a1 : ffff0000`0b9fe921 fffff800`033912a0 fffff880`0757703c fffffa80`07550550 : fltmgr!FltpFastIoWrite+0x1ce
fffff880`0a8588f0 ffff0000`0b9fe921 : fffff800`033912a0 fffff880`0757703c fffffa80`07550550 00000000`00000000 : AVGIDSFilter+0x31a1
fffff880`0a8588f8 fffff800`033912a0 : fffff880`0757703c fffffa80`07550550 00000000`00000000 00000000`02600040 : 0xffff0000`0b9fe921
fffff880`0a858900 fffff800`0339ba4e : fffffa80`075505c4 fffff880`0a858b60 00000000`00000000 fffffa80`0751a001 : nt!IopSynchronousServiceTail+0x180
fffff880`0a858970 fffff800`03087ed3 : ffffffff`ffffff01 00000000`000003c0 00000000`00000000 00000000`03acb888 : nt!NtWriteFile+0x5ad
fffff880`0a858a70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`03111d7c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Points to AVG. Use the AVG Remover and replace with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows firewall.


Did removing AVG solve the problem?

 

[beagrie07]

Actually I kept it installed and updated bios and a few other things, I'm not sure what I did but I haven't had a blue screen for a few weeks.

Hopefully it stays that way!

Thanks for the help

 

[writhziden]

No problem. Thanks for posting back. BIOS updates can resolve crashes depending on what they fix. Many times, they provide better RAM or CPU support resulting in a stable system.

 

[alessandrocar88]

Actually I kept it installed and updated bios and a few other things, I'm not sure what I did but I haven't had a blue screen for a few weeks.

Hopefully it stays that way!

Thanks for the help

what's the "few other things"?

My friend's new pc has the same problem and it's driving me crazy...so far i've run memtest for 9hours (with 0 errors), update all the drivers, done checkdisk, and now i'm changing the antivirus.

I'll try as well with the BIOS update!

p.s. the minidump of this morning:

041212-18018-01.dmp 12/04/2012 09:50:24 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 00000000`00000040 00000000`00000002 00000000`00000001 fffff800`02ae5188 ntoskrnl.exe ntoskrnl.exe+7cc80 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17790 (win7sp1_gdr.120305-1505) x64 C:\Windows\Minidump\041212-18018-01.dmp 4 15 7601 282.880

041212-15740-01.dmp 12/04/2012 09:47:34 IRQL_NOT_LESS_OR_EQUAL 0x0000000a ffffa280`69fd4110 00000000`00000002 00000000`00000001 fffff800`02abfa5d ntoskrnl.exe ntoskrnl.exe+7cc80 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17790 (win7sp1_gdr.120305-1505) x64 C:\Windows\Minidump\041212-15740-01.dmp 4 15 7601 262.192


ntoskrnl.exe ntoskrnl.exe+27740 fffff800`02a5a000 fffff800`03042000 0x005e8000 0x4f558b55 06/03/2012 05:58:13 Microsoft® Windows® Operating System NT Kernel & System 6.1.7601.17790 (win7sp1_gdr.120305-1505) Microsoft Corporation C:\Windows\system32\ntoskrnl.exe

 

[writhziden]

See how the BIOS update goes. If you still have problems with your friend's system, I would recommend starting a new thread and following the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to provide us with more information so we can give specific troubleshooting steps to that system since not all systems are the same.

 

[alessandrocar88]

same thing after bios update
I'll start a new thread later, thanks!