multiple BSOD on windows 7 OS please help.

[Ephram]

Just bought my pc a couple of weeks ago, and it's been giving me multiple BSODs quite often.

AMD Phenom II x455 3.2gHz
Asus M4A87TD/USB3 motherboard
Radeon HD 5850 1gig memory
OCZ 2x2gig memory
550w true power supply


I've attached the minidumps here in this zip file.

Can anyone help? I don't know how to resolve this.

 

[zigzag3143]

Just bought my pc a couple of weeks ago, and it's been giving me multiple BSODs quite often.

AMD Phenom II x455 3.2gHz
Asus M4A87TD/USB3 motherboard
Radeon HD 5850 1gig memory
OCZ 2x2gig memory
550w true power supply


I've attached the minidumps here in this zip file.

Can anyone help? I don't know how to resolve this.

There are two major causes for these crashes. Both point to memory. To test your memory you should download a 3rd party app called memtestx86, burn it to cd, and run it for at least 6 passes.

The second major cause of the crashes is your symantec antivirus. You should remove that and replace it with Microsoft Security Essentials. It is less likely to cause crashes.

Let us know if you need any further assistance

Ken

Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Mon Jul  5 16:53:44.498 2010 (GMT-4)
System Uptime: 0 days 0:02:11.137
BugCheck A, {1028, 2, 1, 82a3b0e9}
Probably caused by : memory_corruption ( nt!MiIdentifyPfn+1ed )
BUGCHECK_STR:  0xA
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Mon Jul  5 16:50:47.402 2010 (GMT-4)
System Uptime: 0 days 0:03:23.056
BugCheck A, {28, 2, 1, 82a400e9}
Probably caused by : memory_corruption ( nt!MiIdentifyPfn+1ed )
BUGCHECK_STR:  0xA
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Mon Jul  5 16:46:36.404 2010 (GMT-4)
System Uptime: 0 days 0:21:30.059
BugCheck A, {34a388, 2, 1, 82a4e0e9}
Probably caused by : memory_corruption ( nt!MiIdentifyPfn+1ed )
BUGCHECK_STR:  0xA
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Debug session time: Mon Jul  5 16:23:51.837 2010 (GMT-4)
System Uptime: 0 days 0:06:05.476
BugCheck A, {c032de08, 0, 0, 82ac4296}
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : SYMEVENT.SYS ( SYMEVENT+14559 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  wmpnetwk.exe

 

[Ephram]

Thanks ken,

i've ran a memtest through 5 passes on my first channel A (Dimm a1 and b1)
and it gave me 32 errors, 9 errors in test 6)

i tested each DIMM with one stick of ram and only DIMM B1 gave problems.

so now i've put my 2 sticks into channel B (DIMM A2 and B2)

i ran a memtest again and it showed no problems.

shortly after i booted to windows, stop error 0x000000a appeared.

why is this happening to me *arrrrrgh*

help please!!

thanks again mate.

 

[Ephram]

oh, and is there a way i can show you guys my memtest results? i think that will be more accurate.

 

[Davidxtux]

Can you upload the latest dump file?

 

[Ephram]

Ok, here are the latest dump files.

i don't know if this is certain, but individually, the rams work fine, computer does not crash. but when put together, they crash.

 

[Grbnike]

Ok, here are the latest dump files.

i don't know if this is certain, but individually, the rams work fine, computer does not crash. but when put together, they crash.

u didn't upload the latest dump

 

[Ephram]

oh oops, losing my mind over here.

ok here they are, please help this is soooo~ frustrating.

 

[DT Roberts]

Let's not overlook the basics,here.

8b225000 8b318000   sptd     sptd.sys     Sun Oct 11 16:54:02 2009 (4AD245EA)

sptd.sys, part of many virtual CD/DVD drive programs (Daemon Tools, Alcohol 120%, etc.) and is notorious for causing BSODs in Vista and Windows 7. Before we troubleshoot any further, uninstall any such software and see if BSODs persist. Good luck.

EDIT: I've never seen this before:

8b600000 8b61a000   Unknown_Module_8b600000 Unknown_Module_8b600000 Mon Jul 13 19:50:13 2009 (4A5BC835)
909ea000 909fb000   Unknown_Module_909ea000 Unknown_Module_909ea000 Mon Jul 13 19:12:47 2009 (4A5BBF6F)
91bf5000 91c00000   Unknown_Module_91bf5000 Unknown_Module_91bf5000 Mon Jul 13 19:45:08 2009 (4A5BC704)
95d98000 95da2000   Unknown_Module_95d98000 Unknown_Module_95d98000 Mon Jul 13 19:25:25 2009 (4A5BC265)
96e00000 96e1e000   Unknown_Module_96e00000 Unknown_Module_96e00000 unavailable (00000000)
9ba00000 9ba0a000   Unknown_Module_9ba00000 Unknown_Module_9ba00000 Wed Sep 13 09:18:32 2006 (45080528)
9bac0000 9bad2000   Unknown_Module_9bac0000 Unknown_Module_9bac0000 Mon Jul 13 19:52:52 2009 (4A5BC8D4)
9bad2000 9baf5000   Unknown_Module_9bad2000 Unknown_Module_9bad2000 Sat Feb 27 02:32:02 2010 (4B88CA72)
9bb30000 9bb4b000   Unknown_Module_9bb30000 Unknown_Module_9bb30000 Sat Feb 27 02:32:11 2010 (4B88CA7B)
9bb63000 9bbfa000   Unknown_Module_9bb63000 Unknown_Module_9bb63000 Mon Jul 13 20:35:44 2009 (4A5BD2E0)
9e6d9000 9e6f0000   Unknown_Module_9e6d9000 Unknown_Module_9e6d9000 Mon Jul 13 19:51:19 2009 (4A5BC877)

We'll look further into it if it proves to be necessary.

 

[Ephram]

Hi DT,

i'm really green when it comes to these things so forgive my naivety.

does this mean i can never use virtual drive programs ever on windows 7?

 

[DT Roberts]

I apologize for the double post, but I feel like this deserves its own post. Here's the latest minidump, bugcheck 0x4E:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Devin\AppData\Local\Temp\Rar$DI00.061\070610-26738-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a41000 PsLoadedModuleList = 0x82b89810
Debug session time: Tue Jul  6 10:22:04.141 2010 (GMT-4)
System Uptime: 0 days 11:16:14.436
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0001bf6f, page frame number
Arg3: 00000002, current page state
Arg4: 0001bd4d, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 82b2a6dc to 82b1dd10

STACK_TEXT:  
a49e2c10 82b2a6dc 0000004e 00000099 0001bf6f nt!KeBugCheckEx+0x1e
a49e2c28 82b01ee9 83f146a8 83f146a0 82a0fb48 nt!MiBadShareCount+0x24
a49e2c68 82b28673 00000000 82b28799 00000000 nt!MiRestoreTransitionPte+0x250
a49e2c70 82b28799 00000000 82b89bcc 000c7e8e nt!MiDiscardTransitionPte+0x9
a49e2ca8 82d66f3c 00000006 8d79bba0 00000000 nt!MiPurgeTransitionList+0xd2
a49e2d1c 82d60a7a a49e2d3c 00000000 854d66f8 nt!MmDuplicateMemory+0x957
a49e2d50 82c4f6bb 8d79bba0 97bc98af 00000000 nt!PopTransitionToSleep+0xce
a49e2d90 82b010f9 82d609ac 8d79bba0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+24
82b2a6dc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+24

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

Followup: MachineOwner
---------

0: kd> r
eax=82b7817c ebx=83d0f002 ecx=00000081 edx=00000000 esi=82b6ad20 edi=00000000
eip=82b1dd10 esp=a49e2bf8 ebp=a49e2c10 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000206
nt!KeBugCheckEx+0x1e:
82b1dd10 cc              int     3
0: kd> k
ChildEBP RetAddr  
a49e2c10 82b2a6dc nt!KeBugCheckEx+0x1e
a49e2c28 82b01ee9 nt!MiBadShareCount+0x24
a49e2c68 82b28673 nt!MiRestoreTransitionPte+0x250
a49e2c70 82b28799 nt!MiDiscardTransitionPte+0x9
a49e2ca8 82d66f3c nt!MiPurgeTransitionList+0xd2
a49e2d1c 82d60a7a nt!MmDuplicateMemory+0x957
a49e2d50 82c4f6bb nt!PopTransitionToSleep+0xce
a49e2d90 82b010f9 nt!PspSystemThreadStartup+0x9e
00000000 00000000 nt!KiThreadStartup+0x19
0: kd> kv
ChildEBP RetAddr  Args to Child              
a49e2c10 82b2a6dc 0000004e 00000099 0001bf6f nt!KeBugCheckEx+0x1e
a49e2c28 82b01ee9 83f146a8 83f146a0 82a0fb48 nt!MiBadShareCount+0x24 (FPO: [0,0,0])
a49e2c68 82b28673 00000000 82b28799 00000000 nt!MiRestoreTransitionPte+0x250
a49e2c70 82b28799 00000000 82b89bcc 000c7e8e nt!MiDiscardTransitionPte+0x9 (FPO: [0,0,0])
a49e2ca8 82d66f3c 00000006 8d79bba0 00000000 nt!MiPurgeTransitionList+0xd2
a49e2d1c 82d60a7a a49e2d3c 00000000 854d66f8 nt!MmDuplicateMemory+0x957
a49e2d50 82c4f6bb 8d79bba0 97bc98af 00000000 nt!PopTransitionToSleep+0xce
a49e2d90 82b010f9 82d609ac 8d79bba0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
0: kd> lmntsm
start    end        module name
8b347000 8b38f000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
8bb9e000 8bbf8000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
91a9d000 91aaf000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
91a4e000 91a87000   ali32tyl ali32tyl.SYS Tue Jul 14 17:12:41 2009 (4A5CF4C9)
90ded000 90dfe000   amdppm   amdppm.sys   Mon Jul 13 19:11:03 2009 (4A5BBF07)
8b4a7000 8b4b0000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
909d7000 909d86c0   ASACPI   ASACPI.sys   Wed Jul 15 23:28:28 2009 (4A5E9E5C)
90dcb000 90dcbfa0   AsIO     AsIO.sys     Mon Aug 03 03:02:32 2009 (4A768B88)
8b47b000 8b484000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
8b484000 8b4a7000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
90800000 9081e000   AtiHdmi  AtiHdmi.sys  Thu May 06 05:19:48 2010 (4BE289B4)
90e30000 913d3000   atikmdag atikmdag.sys Thu May 27 12:44:23 2010 (4BFEA167)
90c00000 90c38000   atikmpag atikmpag.sys Thu May 27 12:25:19 2010 (4BFE9CEF)
8ba3e000 8ba46000   AtiPcie  AtiPcie.sys  Tue May 05 11:00:16 2009 (4A005480)
96e20000 96e6d000   ATMFD    ATMFD.DLL    unavailable (00000000)
8bb32000 8bb6bb00   avgtdix  avgtdix.sys  Thu Jun 03 17:08:25 2010 (4C0819C9)
8b3e5000 8b3f0000   BATTC    BATTC.SYS    Mon Jul 13 19:19:15 2009 (4A5BC0F3)
8ba9e000 8baa5000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
90d83000 90d91000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
8b052000 8b05a000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
9baa7000 9bac0000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
9e6f0000 9e706000   cdfs     cdfs.sys     Mon Jul 13 19:11:14 2009 (4A5BBF12)
8ba78000 8ba97000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
8b09c000 8b147000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
8ba19000 8ba3e000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
8b05a000 8b09c000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
8b78b000 8b7e8000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
8b3dd000 8b3e5000   compbatt compbatt.sys Mon Jul 13 19:19:18 2009 (4A5BC0F6)
91a90000 91a9d000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
95dc4000 95dd1000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
90d07000 90d6b000   csc      csc.sys      Mon Jul 13 19:15:08 2009 (4A5BBFFC)
90d6b000 90d83000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
90cfb000 90d07000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
8b800000 8b811000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
913d3000 913ec000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
95df6000 95dff000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
95c00000 95c0b000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
90829000 908e0000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 20:48:33 2009 (4AC54DE1)
908e0000 90919000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:25:25 2009 (4A5BC265)
8b4e4000 8b4f5000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
8b4b0000 8b4e4000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
8b7f6000 8b7ff000   Fs_Rec   Fs_Rec.sys   unavailable (00000000)
8b000000 8b032000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
8b95b000 8b98c000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
90963000 90968280   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
82a0a000 82a41000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
90919000 90938000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
9e711000 9e71a000   hiber_atapi hiber_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
9e706000 9e711000   hiber_dumpata hiber_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
9e71a000 9e72b000   hiber_dumpfve hiber_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
95ddc000 95def000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
95def000 95df5480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
95dd1000 95ddc000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
9ba22000 9baa7000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
8b9ec000 8b9f4000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
91b44000 91b51000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
91a00000 91a0c000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
80b9b000 80ba3000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
91b60000 91b94000   ks       ks.sys       Mon Jul 13 19:45:13 2009 (4A5BC709)
8b778000 8b78b000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
8b200000 8b225000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
913ec000 913fc000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
8ba46000 8ba61000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
8b036000 8b041000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 19:13:13 2009 (4A5BBF89)
95da2000 95dad000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
91b51000 91b5e000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
8b465000 8b47b000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
9baf5000 9bb30000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
8baf7000 8bb02000   Msfs     Msfs.SYS     unavailable (00000000)
8b38f000 8b397000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
8b74d000 8b778000   msrpc    msrpc.sys    unavailable (00000000)
90cf1000 90cfb000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8b9dc000 8b9ec000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
8b4f5000 8b5ac000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
91ac7000 91ad2000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
91ad2000 91af4000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
909d9000 909ea000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
90c5b000 90c69000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
8bb6c000 8bb9e000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
8b5ac000 8b5ea000   NETIO    NETIO.SYS    Mon Jul 13 19:12:35 2009 (4A5BBF63)
8bb02000 8bb10000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
90ce7000 90cf1000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
82a41000 82e51000   nt       ntkrpamp.exe Sat Feb 27 02:33:35 2010 (4B88CACF)
8b61e000 8b74d000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
8ba97000 8ba9e000   Null     Null.SYS     unavailable (00000000)
91ba2000 91bb0a00   nusb3hub nusb3hub.sys Thu Jan 21 22:21:46 2010 (4B5919CA)
90938000 9095a180   nusb3xhc nusb3xhc.sys Thu Jan 21 22:21:48 2010 (4B5919CC)
90c3c000 90c5b000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
8b3cc000 8b3dd000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
8b3a2000 8b3cc000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
8b450000 8b457000   pciide   pciide.sys   Mon Jul 13 19:11:19 2009 (4A5BBF17)
8b457000 8b465000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
8b7e8000 8b7f6000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
90e00000 90e2f000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
8b041000 8b052000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
91aaf000 91ac7000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
91af4000 91b0c000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
91b0c000 91b23000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
91b23000 91b3a000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
90ca6000 90ce7000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
91b3a000 91b44000   rdpbus   rdpbus.sys   Mon Jul 13 20:02:40 2009 (4A5BCB20)
8badf000 8bae7000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
8bae7000 8baef000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
8baef000 8baf7000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
8b1c6000 8b1f3000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
8ba61000 8ba74000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
91a0d000 91a4e000   Rt86win7 Rt86win7.sys Mon Feb 08 22:41:47 2010 (4B70D97B)
8b321000 8b347000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
909cd000 909d7000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
90c69000 90c83000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
8b9d4000 8b9dc000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
8b225000 8b318000   sptd     sptd.sys     Sun Oct 11 16:54:02 2009 (4AD245EA)
9e688000 9e6d9000   srv      srv.sys      Tue Dec 08 03:05:37 2009 (4B1E08D1)
9e639000 9e688000   srv2     srv2.sys     Mon Jul 13 19:14:52 2009 (4A5BBFEC)
9e60b000 9e62c000   srvnet   srvnet.sys   Tue Dec 08 03:05:06 2009 (4B1E08B2)
91b5e000 91b5f380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
8b812000 8b95b000   tcpip    tcpip.sys    Mon Jul 13 19:13:18 2009 (4A5BBF8E)
9e62c000 9e639000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
8bb27000 8bb32000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
8bb10000 8bb27000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
90c96000 90ca6000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
971c0000 971c9000   TSDDD    TSDDD.dll    unavailable (00000000)
90dcc000 90ded000   tunnel   tunnel.sys   Mon Jul 13 19:54:03 2009 (4A5BC91B)
91b94000 91ba2000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
8b600000 8b61a000   Unknown_Module_8b600000 Unknown_Module_8b600000 Mon Jul 13 19:50:13 2009 (4A5BC835)
909ea000 909fb000   Unknown_Module_909ea000 Unknown_Module_909ea000 Mon Jul 13 19:12:47 2009 (4A5BBF6F)
91bf5000 91c00000   Unknown_Module_91bf5000 Unknown_Module_91bf5000 Mon Jul 13 19:45:08 2009 (4A5BC704)
95d98000 95da2000   Unknown_Module_95d98000 Unknown_Module_95d98000 Mon Jul 13 19:25:25 2009 (4A5BC265)
96e00000 96e1e000   Unknown_Module_96e00000 Unknown_Module_96e00000 unavailable (00000000)
9ba00000 9ba0a000   Unknown_Module_9ba00000 Unknown_Module_9ba00000 Wed Sep 13 09:18:32 2006 (45080528)
9bac0000 9bad2000   Unknown_Module_9bac0000 Unknown_Module_9bac0000 Mon Jul 13 19:52:52 2009 (4A5BC8D4)
9bad2000 9baf5000   Unknown_Module_9bad2000 Unknown_Module_9bad2000 Sat Feb 27 02:32:02 2010 (4B88CA72)
9bb30000 9bb4b000   Unknown_Module_9bb30000 Unknown_Module_9bb30000 Sat Feb 27 02:32:11 2010 (4B88CA7B)
9bb63000 9bbfa000   Unknown_Module_9bb63000 Unknown_Module_9bb63000 Mon Jul 13 20:35:44 2009 (4A5BD2E0)
9e6d9000 9e6f0000   Unknown_Module_9e6d9000 Unknown_Module_9e6d9000 Mon Jul 13 19:51:19 2009 (4A5BC877)
95dad000 95dc4000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
9095b000 9095c700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
909be000 909cd000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
9095d000 90963000   usbfilter usbfilter.sys Wed Oct 07 03:43:57 2009 (4ACC46BD)
91bb1000 91bf5000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
90969000 90973000   usbohci  usbohci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
90973000 909be000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
8b397000 8b3a2000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
8baa5000 8bab1000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
95c13000 95d98000   viahduaa viahduaa.sys Tue Mar 02 06:27:26 2010 (4B8CF61E)
8bab1000 8bad2000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
8b98c000 8b995000   vmstorfl vmstorfl.sys unavailable (00000000)
8b3f0000 8b400000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8b405000 8b450000   volmgrx  volmgrx.sys  unavailable (00000000)
8b995000 8b9d4000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
90c83000 90c96000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
8bad2000 8badf000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
8b147000 8b1b8000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
8b1b8000 8b1c6000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8bbf8000 8bbff000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
96f60000 971aa000   win32k   win32k.sys   unavailable (00000000)
91a87000 91a90000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:19:16 2009 (4A5BC0F4)
8b318000 8b321000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)

Unloaded modules:
90d97000 90dcb000   avgldx86.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
90d91000 90d97000   avgmfx86.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9bb4b000 9bb63000   parport.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ba46000 8ba53000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ba53000 8ba5e000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ba5e000 8ba67000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8ba67000 8ba78000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

Bugcheck 0x4E means that the page frame number (PFN) list is corrupted. going by the information given by MSDN: Bug Check 0x4E: PFN_LIST_CORRUPT

Because the first parameter was 0x99, parameter two defines the page that threw the exception and parameter three is defines the current state of the page. In simpler terms, the system throws exception 0x4E because a driver executes commands incorrectly or in a way that Windows doesn't appreciate. This is very common with sptd.sys, as I mentioned earlier. Let us know how you're doing once you take care of that driver.

 

[DT Roberts]

Hi DT,

i'm really green when it comes to these things so forgive my naivety.

does this mean i can never use virtual drive programs ever on windows 7?

Well, sort-of; some virtual drive programs don't use the SPTD format so they are fine. I'm not sure off of the top of my head which ones don't though.

 

[CarlTR6]

Hi Ephram, I looked at all six dumps. Everyone of them points to memory corruption however one of them points directly to Symantec (Norton). Ken suggested that you uninstall Norton and replace it with Microsoft Security Essentials. Norton is a know cause of BSOD's on some Win 7 systems. This is not speculation; it is well documented. Use this removal tool to completely uninstall Norton > Info > Tool (Note: Removes all Norton products).[FONT=&quot]

Here the two stop error codes found in these six dumps one 4E and 5 A's:
[/FONT]

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory
[FONT=&quot]

[/FONT]STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Note the usual causes and you see drivers, memory, and virus scanner.

Here are two of the dmp files, one from each error code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\070510-40950-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL]http://msdl.microsoft.com/download/symbols[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a4f000 PsLoadedModuleList = 0x82b97810
Debug session time: Mon Jul  5 16:23:51.837 2010 (GMT-4)
System Uptime: 0 days 0:06:05.476
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c032de08, 0, 0, 82ac4296}

*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
[COLOR=Red]Probably caused by : SYMEVENT.SYS[/COLOR] ( SYMEVENT+14559 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c032de08, memory referenced
Arg2: 00000000, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82ac4296, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82bb7718
Unable to read MiSystemVaType memory at 82b97160
 c032de08 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiPageMightBeZero+d
82ac4296 8b08            mov     ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  wmpnetwk.exe

TRAP_FRAME:  a9bd55bc -- (.trap 0xffffffffa9bd55bc)
ErrCode = 00000000
eax=c032de08 ebx=1bdf4404 ecx=00000000 edx=83f0c6b0 esi=c03ade08 edi=83f0c6b0
eip=82ac4296 esp=a9bd5630 ebp=a9bd5638 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
nt!MiPageMightBeZero+0xd:
82ac4296 8b08            mov     ecx,dword ptr [eax]  ds:0023:c032de08=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82ac4296 to 82a9582b

STACK_TEXT:  
a9bd55bc 82ac4296 badb0d00 83f0c6b0 00000001 nt!KiTrap0E+0x2cf
a9bd5638 82ac45b7 00000473 8920fd48 876e9c98 nt!MiPageMightBeZero+0xd
a9bd5860 82ac56a6 876e9c98 a9bd5890 ffffffff nt!MiFreeWsleList+0x1c4
a9bd5918 82d6b3b1 876e9c98 00000001 82b8fe28 nt!MiEmptyWorkingSet+0x1f7
a9bd5948 82c3afd2 ffffffff 00000000 ffffff00 nt!MmAdjustWorkingSetSizeEx+0x70
a9bd5a28 82c9c86e 00ffffff 01000038 0020fd01 nt!PspSetQuotaLimits+0x25f
a9bd5c88 91580559 ffffffff 00000001 00b6f668 nt!NtSetInformationProcess+0x424
WARNING: Stack unwind information not available. Following frames may be wrong.
a9bd5d1c 82a9244a ffffffff 00000001 00b6f668 [COLOR=Red]SYMEVENT[/COLOR]+0x14559
a9bd5d1c 0000003b ffffffff 00000001 00b6f668 nt!KiFastCallEntry+0x12a
00000001 00000000 00000000 00000000 00000000 0x3b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SYMEVENT+14559
91580559 ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  SYMEVENT+14559

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME:  [COLOR=Red]SYMEVENT.SYS[/COLOR]

DEBUG_FLR_IMAGE_TIMESTAMP:  4a849231

FAILURE_BUCKET_ID:  0xA_[COLOR=Red]SYMEVENT[/COLOR]+14559

BUCKET_ID:  0xA_SYMEVENT+14559

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\070610-26738-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL]http://msdl.microsoft.com/download/symbols[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a41000 PsLoadedModuleList = 0x82b89810
Debug session time: Tue Jul  6 10:22:04.141 2010 (GMT-4)
System Uptime: 0 days 11:16:14.436
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1bf6f, 2, 1bd4d}

Probably caused by : memory_corruption ( nt!MiBadShareCount+24 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0001bf6f, page frame number
Arg3: 00000002, current page state
Arg4: 0001bd4d, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 82b2a6dc to 82b1dd10

STACK_TEXT:  
a49e2c10 82b2a6dc 0000004e 00000099 0001bf6f nt!KeBugCheckEx+0x1e
a49e2c28 82b01ee9 83f146a8 83f146a0 82a0fb48 nt!MiBadShareCount+0x24
a49e2c68 82b28673 00000000 82b28799 00000000 nt!MiRestoreTransitionPte+0x250
a49e2c70 82b28799 00000000 82b89bcc 000c7e8e nt!MiDiscardTransitionPte+0x9
a49e2ca8 82d66f3c 00000006 8d79bba0 00000000 nt!MiPurgeTransitionList+0xd2
a49e2d1c 82d60a7a a49e2d3c 00000000 854d66f8 nt!MmDuplicateMemory+0x957
a49e2d50 82c4f6bb 8d79bba0 97bc98af 00000000 nt!PopTransitionToSleep+0xce
a49e2d90 82b010f9 82d609ac 8d79bba0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+24
82b2a6dc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+24

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

Followup: MachineOwner
---------

Symevent.sys is a driver for Symantec Event Library and belongs to the software SYMEVENT by Symantec Corporation (www.symantec.com).

DT Roberts is spot on about SPTD. It is another well know and documented cause of BSOD's in Win7

@DT Roberts: I was typing while you were posting and I did not realize you had posted.

 

[DT Roberts]

Hi Ephram, I looked at all six dumps. Everyone of them points to memory corruption however one of them points directly to Symantec (Norton). Ken suggested that you uninstall Norton and replace it with Microsoft Security Essentials. Norton is a know cause of BSOD's on some Win 7 systems. This is not speculation; it is well documented. Use this removal tool to completely uninstall Norton > Info > Tool (Note: Removes all Norton products).[FONT=&quot]

Here the two stop error codes found in these six dumps one 4E and 5 A's:
[/FONT]

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory
[FONT=&quot]

[/FONT]STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Note the usual causes and you see drivers, memory, and virus scanner.

Here are two of the dmp files, one from each error code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\070510-40950-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a4f000 PsLoadedModuleList = 0x82b97810
Debug session time: Mon Jul  5 16:23:51.837 2010 (GMT-4)
System Uptime: 0 days 0:06:05.476
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c032de08, 0, 0, 82ac4296}

*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
[COLOR=Red]Probably caused by : SYMEVENT.SYS[/COLOR] ( SYMEVENT+14559 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c032de08, memory referenced
Arg2: 00000000, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82ac4296, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82bb7718
Unable to read MiSystemVaType memory at 82b97160
 c032de08 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiPageMightBeZero+d
82ac4296 8b08            mov     ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  wmpnetwk.exe

TRAP_FRAME:  a9bd55bc -- (.trap 0xffffffffa9bd55bc)
ErrCode = 00000000
eax=c032de08 ebx=1bdf4404 ecx=00000000 edx=83f0c6b0 esi=c03ade08 edi=83f0c6b0
eip=82ac4296 esp=a9bd5630 ebp=a9bd5638 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
nt!MiPageMightBeZero+0xd:
82ac4296 8b08            mov     ecx,dword ptr [eax]  ds:0023:c032de08=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82ac4296 to 82a9582b

STACK_TEXT:  
a9bd55bc 82ac4296 badb0d00 83f0c6b0 00000001 nt!KiTrap0E+0x2cf
a9bd5638 82ac45b7 00000473 8920fd48 876e9c98 nt!MiPageMightBeZero+0xd
a9bd5860 82ac56a6 876e9c98 a9bd5890 ffffffff nt!MiFreeWsleList+0x1c4
a9bd5918 82d6b3b1 876e9c98 00000001 82b8fe28 nt!MiEmptyWorkingSet+0x1f7
a9bd5948 82c3afd2 ffffffff 00000000 ffffff00 nt!MmAdjustWorkingSetSizeEx+0x70
a9bd5a28 82c9c86e 00ffffff 01000038 0020fd01 nt!PspSetQuotaLimits+0x25f
a9bd5c88 91580559 ffffffff 00000001 00b6f668 nt!NtSetInformationProcess+0x424
WARNING: Stack unwind information not available. Following frames may be wrong.
a9bd5d1c 82a9244a ffffffff 00000001 00b6f668 [COLOR=Red]SYMEVENT[/COLOR]+0x14559
a9bd5d1c 0000003b ffffffff 00000001 00b6f668 nt!KiFastCallEntry+0x12a
00000001 00000000 00000000 00000000 00000000 0x3b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SYMEVENT+14559
91580559 ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  SYMEVENT+14559

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME:  [COLOR=Red]SYMEVENT.SYS[/COLOR]

DEBUG_FLR_IMAGE_TIMESTAMP:  4a849231

FAILURE_BUCKET_ID:  0xA_[COLOR=Red]SYMEVENT[/COLOR]+14559

BUCKET_ID:  0xA_SYMEVENT+14559

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\Downloads\070610-26738-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82a41000 PsLoadedModuleList = 0x82b89810
Debug session time: Tue Jul  6 10:22:04.141 2010 (GMT-4)
System Uptime: 0 days 11:16:14.436
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1bf6f, 2, 1bd4d}

Probably caused by : memory_corruption ( nt!MiBadShareCount+24 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0001bf6f, page frame number
Arg3: 00000002, current page state
Arg4: 0001bd4d, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 82b2a6dc to 82b1dd10

STACK_TEXT:  
a49e2c10 82b2a6dc 0000004e 00000099 0001bf6f nt!KeBugCheckEx+0x1e
a49e2c28 82b01ee9 83f146a8 83f146a0 82a0fb48 nt!MiBadShareCount+0x24
a49e2c68 82b28673 00000000 82b28799 00000000 nt!MiRestoreTransitionPte+0x250
a49e2c70 82b28799 00000000 82b89bcc 000c7e8e nt!MiDiscardTransitionPte+0x9
a49e2ca8 82d66f3c 00000006 8d79bba0 00000000 nt!MiPurgeTransitionList+0xd2
a49e2d1c 82d60a7a a49e2d3c 00000000 854d66f8 nt!MmDuplicateMemory+0x957
a49e2d50 82c4f6bb 8d79bba0 97bc98af 00000000 nt!PopTransitionToSleep+0xce
a49e2d90 82b010f9 82d609ac 8d79bba0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+24
82b2a6dc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+24

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

Followup: MachineOwner
---------

Symevent.sys is a driver for Symantec Event Library and belongs to the software SYMEVENT by Symantec Corporation (www.symantec.com).

DT Roberts is spot on about SPTD. It is another well know and documented cause of BSOD's in Win7

@DT Roberts: I was typing while you were posting and I did realize you had posted.

No problem at all, Carl. Not to undermine your thoughts, but though it's possible, I usually see bugcheck 0x9F when a third-party firewall (Norton Internet Security in this case) is in question. Regardless, I still prefer Microsoft Security Essentials over NIS anyway; it seems to run much lighter and take up less system resources.

 

[CarlTR6]

Yes, I agree and since Norton is know to cause problems on some systems (not all), it makes sense to run MSE, at least, while trouble shooting to eliminate one more possible conflict.

The only combination I can think of worse than SPTD and Norton would be SPTD and ZA!

 

[Ephram]

so this has nothing to do with my RAM as previously stated in my first post?

from elimination, i think my DIMM is faulty not my RAM, but after switching my 2 ram sticks to the 2nd channel, i still get BSODs.

oh btw, i've removed norton AV and DTools as well.

 

[DT Roberts]

I think it's software-related instead. Let us know how running without those programs works out for you.

 

[CarlTR6]

I think memtest did find errors with your RAM. As far as memory corruption goes in stop errors, RAM is only part of the equation. Driver, incompatible programs, incompatible hardware, outdated or corrupt BIOS can all cause memory corruption. Finding the cause is a process of elimination. Sometime we hit it lucky and a BSOD will give us a direct cause. Sometimes there are several causes at once.

Glad you uninstalled Norton and SPTD. Run your system and see what happens. Your RAM may still give you problems.