Solved Random BSOD PFN_List_Corrupt

[Arthurde]

Hi,

Getting some random BSOD all of a sudden within the past 2 days, progressively gotten worse tends to be happening every 30 minutes now.

I've attached the mini dump

Any help would be great

Thanks

 

[koolkat77]

The cause of your crash is very straight forward - a driver belonging to kaspersky.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {2, 52471c, 83ffff, 1}

*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+1bd4e )

Followup: MachineOwner
---------

8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000002, A list entry was corrupt
Arg2: 000000000052471c, entry in list being removed
Arg3: 000000000083ffff, highest physical page number
Arg4: 0000000000000001, reference count of entry being removed

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  consent.exe

CURRENT_IRQL:  2

TRAP_FRAME:  fffff88016f57cf0 -- (.trap 0xfffff88016f57cf0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fff6fafbfff6fafb rbx=0000000000000000 rcx=0000000003310000
rdx=0000000000fa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000f5960 rsp=fffff88016f57e88 rbp=fffff88016f57f60
 r8=0000000000002800  r9=00000000000000c0 r10=fff6fafbfff6fafb
r11=000000000330f000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
win32k!memmove+0xb0:
fffff960`000f5960 488b040a        mov     rax,qword ptr [rdx+rcx] ds:00000000`042b0000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a9b2ed to fffff80002a8ac00

STACK_TEXT:  
fffff880`16f57e88 fffff960`000bd23d : fffffa80`1c866370 fffff800`02bbed0e fffffa80`1d844060 fffffa80`1ccd4190 : win32k!memmove+0xb0
fffff880`16f57e90 fffff960`000b7315 : 00000000`00000001 00000000`00000000 00000000`00000000 fffff880`16f58220 : win32k!vSrcCopyS32D32Identity+0x71
fffff880`16f57ec0 fffff960`00204c46 : fffff900`c06795c8 fffff900`c241da48 00000000`00000000 00000000`00000000 : win32k!EngCopyBits+0x915
fffff880`16f581d0 fffff960`0021af3c : 00000000`40cc0020 fffff880`16f58580 00000000`40cc0020 fffff800`02a971f8 : win32k!bSpDwmValidateSurface+0xe02
fffff880`16f584e0 fffff960`00229002 : fffffa80`198cf4a0 fffff800`02bbed0e 00000000`00000000 00000000`ffffffff : win32k!GreStretchBltInternal+0x168
fffff880`16f58780 fffff960`000bb407 : 00000000`010110b9 00000000`00000000 00000000`00000640 00000000`40cc0020 : win32k!NtGdiBitBltInternal+0xa2
fffff880`16f58960 fffff880`020e7d4e : fffffa80`1a203d40 00000000`00000640 00000000`40cc0020 00000000`00000000 : win32k!NtGdiBitBlt+0x5b
fffff880`16f589d0 fffffa80`1a203d40 : 00000000`00000640 00000000`40cc0020 00000000`00000000 fffff900`00000640 : klif+0x1bd4e
fffff880`16f589d8 00000000`00000640 : 00000000`40cc0020 00000000`00000000 fffff900`00000640 00000000`470110a1 : 0xfffffa80`1a203d40
fffff880`16f589e0 00000000`40cc0020 : 00000000`00000000 fffff900`00000640 00000000`470110a1 00000000`00000000 : 0x640
fffff880`16f589e8 00000000`00000000 : fffff900`00000640 00000000`470110a1 00000000`00000000 fffff960`00000000 : 0x40cc0020


STACK_COMMAND:  .trap 0xfffff88016f57cf0 ; kb

FOLLOWUP_IP: 
klif+1bd4e
fffff880`020e7d4e ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  klif+1bd4e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: klif

IMAGE_NAME:  klif.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5151b9b5

FAILURE_BUCKET_ID:  X64_0x4E_2_klif+1bd4e

BUCKET_ID:  X64_0x4E_2_klif+1bd4e

Followup: MachineOwner
---------

8: kd> lmvm klif
start             end                 module name
fffff880`020cc000 fffff880`02171000   klif     T (no symbols)           
    Loaded symbol image file: klif.sys
    Image path: klif.sys
    Image name: klif.sys
    Timestamp:        Tue Mar 26 21:07:33 2013 (5151B9B5)
    CheckSum:         000A60C2
    ImageSize:        000A5000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Security App

Crashes indicate Kaspersky being a possible cause. Remove Kasperky and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Microsoft Security Essentials and Malwarebytes, both recommended from a strict BSOD perspective.

Microsoft Security Essentials, Free antivirus for windows

Malwarebytes Anti-Malware Free

   Information

DO NOT start the free trial of MalwareBytes. Deselect the option when prompted.

Please run these tests and report back the results

1. SFC /scannow to check windows for corruption - http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
2. Disk check for errors on the hard drive - http://www.sevenforums.com/tutorials/433-disk-check.html
3. Troubleshoot applications by a clean boot - http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html
4. Memtest86+ paying close attention to part 3 - http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure

 

[Arthurde]

ran memtest, found one of my memory sticks is giving me over 15000 errors.

I tested them all individually in different slots.

Thanks for the help

 

[koolkat77]

You're welcome.

Mark the thread as solved when you are ready.

   Tip

• If your problem is solved please use the
  
  Mark this thread as solved link at the top of your thread or down on the left corner