1. Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Need help with BSOD Vista 32 bit SP2

Discussion in 'General Hardware' started by weskes, Dec 20, 2009.

  1. weskes New Member

    Joined:
    Dec 3, 2005
    Messages:
    10 (0.00/day)
    Thanks Received:
    0
    Location:
    NL
    Hi,

    I'm trying to help my father in law to get rid of the bsod. He's running vista 32 bit /sp2 on an asus mobo p5p800, intel pentium 4 3.0 ghz. BSOD appears random, I uninstalled atk utility knowing it can cause problems. It appeard to solve the problem, but this is the second time I'm trying to write this thread due to BSOD. I'll try to attach the minidump if the BSOD doesn't appear before it.


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\Frans\Desktop\Mini111609-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6000.16901.x86fre.vista_gdr.090805-0102
    Machine Name:
    Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ad0
    Debug session time: Mon Nov 16 10:28:00.074 2009 (GMT+1)
    System Uptime: 0 days 0:33:58.000
    Loading Kernel Symbols
    .

    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.

    ..............................................................
    ................................................................
    .....................
    Loading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {b23ffffc, 2, 0, 8185ceff}

    Probably caused by : memory_corruption ( nt!MiIdentifyPfn+900 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: b23ffffc, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8185ceff, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: GetPointerFromAddress: unable to read from 819275a0
    Unable to read MiSystemVaType memory at 819086a0
    b23ffffc

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!MiIdentifyPfn+900
    8185ceff 8b7914 mov edi,dword ptr [ecx+14h]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: svchost.exe

    TRAP_FRAME: 964d37fc -- (.trap 0xffffffff964d37fc)
    ErrCode = 00000000
    eax=01ffffff ebx=832e0080 ecx=b23fffe8 edx=01ffffff esi=0000002f edi=01ffffff
    eip=8185ceff esp=964d3870 ebp=964d38c0 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!MiIdentifyPfn+0x900:
    8185ceff 8b7914 mov edi,dword ptr [ecx+14h] ds:0023:b23ffffc=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 8185ceff to 81849314

    STACK_TEXT:
    964d37fc 8185ceff badb0d00 01ffffff 00000000 nt!KiTrap0E+0x2ac
    964d38c0 81832195 964d3880 022e0080 832e0000 nt!MiIdentifyPfn+0x900
    964d38f4 819b84ba 964d8278 964d3980 00000006 nt!MmQueryPfnList+0x130
    964d3938 81a0203c 00000001 964d82e8 00000014 nt!PfpPfnPrioRequest+0xdc
    964d39a8 819d0011 00000000 00000001 964d3d30 nt!PfQuerySuperfetchInformation+0xea
    964d3d4c 8184603a 0000004f 0165f170 00000014 nt!NtQuerySystemInformation+0x21ee
    964d3d4c 76f30f34 0000004f 0165f170 00000014 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0165f13c 00000000 00000000 00000000 00000000 0x76f30f34


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiIdentifyPfn+900
    8185ceff 8b7914 mov edi,dword ptr [ecx+14h]

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!MiIdentifyPfn+900

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a7965d1

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0xA_nt!MiIdentifyPfn+900

    BUCKET_ID: 0xA_nt!MiIdentifyPfn+900

    Followup: MachineOwner
    ---------

    Windows solution screen:
    Probleemhandtekening:
    Gebeurtenisnaam van probleem: BlueScreen
    Versie van besturingssysteem: 6.0.6002.2.2.0.768.3
    Landinstelling-id: 1043

    Aanvullende informatie over dit probleem:
    BCCode: 4e
    BCP1: 00000099
    BCP2: 00007E62
    BCP3: 00000002
    BCP4: 0003A321
    OS Version: 6_0_6002
    Service Pack: 2_0
    Product: 768_1

    Bestanden die helpen bij het beschrijven van het probleem:
    C:\Windows\Minidump\Mini122009-07.dmp
    C:\Users\Frans\AppData\Local\Temp\WER-86796-0.sysdata.xml
    C:\Users\Frans\AppData\Local\Temp\WER6DA4.tmp.version.txt

    Lees onze privacyverklaring:
    http://go.microsoft.com/fwlink/?link...3&clcid=0x0413


    Loading Dump File [C:\Users\Frans\Desktop\Mini122009-05.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6002.18082.x86fre.vistasp2_gdr.090803-2339
    Machine Name:
    Kernel base = 0x81c0f000 PsLoadedModuleList = 0x81d1c930
    Debug session time: Sun Dec 20 12:52:29.279 2009 (GMT+1)
    System Uptime: 0 days 0:03:25.173
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 9289, 3, 12d5c}

    Probably caused by : memory_corruption ( nt!MiBadShareCount+24 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00009289, page frame number
    Arg3: 00000003, current page state
    Arg4: 00012d5c, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 5

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    PROCESS_NAME: PavFnSvr.exe

    CURRENT_IRQL: ca

    TRAP_FRAME: 9d47c664 -- (.trap 0xffffffff9d47c664)
    ErrCode = 00000000
    eax=7fff0000 ebx=839bea98 ecx=00000023 edx=04d3fd24 esi=000002cc edi=00000000
    eip=81e26c26 esp=9d47c6d8 ebp=9d47cd08 iopl=0 nv up ei ng nz na pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
    nt!PspInitializeThunkContext+0xc7:
    81e26c26 8a02 mov al,byte ptr [edx] ds:0023:04d3fd24=??
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 81cd7985 to 81cca899

    STACK_TEXT:
    9d47c518 81cd7985 0000004e 00000099 00009289 nt!KeBugCheckEx+0x1e
    9d47c530 81cb5f82 81d1d1e0 82cc5598 00008391 nt!MiBadShareCount+0x24
    9d47c564 81cbd11d 80410000 831ffb80 ffffffff nt!MiRestoreTransitionPte+0x31b
    9d47c578 81c861b2 40000008 98c60b60 00000000 nt!MiRemoveStandbyPage+0x9d
    9d47c5a4 81c994e3 00000008 98c60b60 0000004c nt!MiRemoveAnyPage+0x247
    9d47c5dc 81c80db0 00000000 04d3fd24 c00134fc nt!MiResolveDemandZeroFault+0x266
    9d47c64c 81c69ab4 00000000 04d3fd24 00000000 nt!MmAccessFault+0x133b
    9d47c64c 81e26c26 00000000 04d3fd24 00000000 nt!KiTrap0E+0xdc
    9d47cd08 81e26b52 ca567415 00000000 00000000 nt!PspInitializeThunkContext+0xc7
    9d47cd50 81c9e66e 00000000 77715e58 00000001 nt!PspUserThreadStartup+0x16b
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiBadShareCount+24
    81cd7985 cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!MiBadShareCount+24

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a77fead

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

    BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

    Followup: MachineOwner

    ---------

    Third:


    Loading Dump File [C:\Users\Frans\Desktop\Mini122009-03.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6002.18082.x86fre.vistasp2_gdr.090803-2339
    Machine Name:
    Kernel base = 0x81c1e000 PsLoadedModuleList = 0x81d2b930
    Debug session time: Sun Dec 20 12:45:29.385 2009 (GMT+1)
    System Uptime: 0 days 0:05:09.323
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ......................
    Loading User Symbols
    Loading unloaded module list
    .........................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 1054e, 2, 2a82a}

    Probably caused by : memory_corruption ( nt!MiBadShareCount+24 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 0001054e, page frame number
    Arg3: 00000002, current page state
    Arg4: 0002a82a, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: svchost.exe

    CURRENT_IRQL: ba

    LAST_CONTROL_TRANSFER: from 81ce6985 to 81cd9899

    STACK_TEXT:
    9d6d9c18 81ce6985 0000004e 00000099 0001054e nt!KeBugCheckEx+0x1e
    9d6d9c30 81cc4f82 81d2c1e0 82dfd400 00015380 nt!MiBadShareCount+0x24
    9d6d9c64 81ccc11d 806f1000 831ffb80 ffffffff nt!MiRestoreTransitionPte+0x31b
    9d6d9c78 81c951b2 4000001d 8b307758 00000000 nt!MiRemoveStandbyPage+0x9d
    9d6d9ca4 81ca84e3 0000001d 8b307758 00000074 nt!MiRemoveAnyPage+0x247
    9d6d9cdc 81c8fdb0 00000001 07755000 c001dd54 nt!MiResolveDemandZeroFault+0x266
    9d6d9d4c 81c78ab4 00000001 07755000 00000001 nt!MmAccessFault+0x133b
    9d6d9d4c 76939d8f 00000001 07755000 00000001 nt!KiTrap0E+0xdc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    06b9f698 00000000 00000000 00000000 00000000 0x76939d8f


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiBadShareCount+24
    81ce6985 cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!MiBadShareCount+24

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a77fead

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

    BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

    Followup: MachineOwner
    ---------


    Loading Dump File [C:\Users\Frans\Desktop\Mini122009-07.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6002.18082.x86fre.vistasp2_gdr.090803-2339
    Machine Name:
    Kernel base = 0x81c4b000 PsLoadedModuleList = 0x81d58930
    Debug session time: Sun Dec 20 14:28:26.021 2009 (GMT+1)
    System Uptime: 0 days 0:19:09.023
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............................
    Loading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 7e62, 2, 3a321}

    Probably caused by : memory_corruption ( nt!MiBadShareCount+24 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00007e62, page frame number
    Arg3: 00000002, current page state
    Arg4: 0003a321, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 7

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    PROCESS_NAME: pavjobs.exe

    CURRENT_IRQL: 8a

    LAST_CONTROL_TRANSFER: from 81d13985 to 81d06899

    STACK_TEXT:
    a56a6c60 81d13985 0000004e 00000099 00007e62 nt!KeBugCheckEx+0x1e
    a56a6c78 81cf1f82 81d591f0 830846f8 000302f5 nt!MiBadShareCount+0x24
    a56a6cac 81cf911d 806f1000 831ffb80 ffffffff nt!MiRestoreTransitionPte+0x31b
    a56a6cc0 81cc21b2 40000036 00000000 839cea80 nt!MiRemoveStandbyPage+0x9d
    a56a6cec 81cbd06d 00000036 0b734000 0a834000 nt!MiRemoveAnyPage+0x247
    a56a6d4c 81ca5ab4 00000001 0b734000 00000001 nt!MmAccessFault+0x15f8
    a56a6d4c 7c342eee 00000001 0b734000 00000001 nt!KiTrap0E+0xdc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    001294b0 00000000 00000000 00000000 00000000 0x7c342eee


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiBadShareCount+24
    81d13985 cc int 3

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!MiBadShareCount+24

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a77fead

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

    BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

    Followup: MachineOwner
    ---------

    Please, I need help or instructions.

    BTW I've tested te mem with memtest on the vista CD
     
  2. Kreij

    Kreij Senior Monkey Moderator Staff Member

    Joined:
    Feb 6, 2007
    Messages:
    13,881 (4.93/day)
    Thanks Received:
    5,616
    Location:
    Cheeseland (Wisconsin, USA)
    Im not sure what memory tester is on the Vista CD, but you may want to try this one.
     
  3. weskes New Member

    Joined:
    Dec 3, 2005
    Messages:
    10 (0.00/day)
    Thanks Received:
    0
    Location:
    NL
    Ok, I'll do that now, but I dont think it's the ram. In safe mode there are no problems.
     
  4. 95Viper

    95Viper

    Joined:
    Oct 12, 2008
    Messages:
    4,415 (2.01/day)
    Thanks Received:
    1,613
    Location:
    στο άλφα έως ωμέγα
    Possibly Panda Software mis-behaving.
    Try uninstalling Panda and see what happens. If, it is Panda; try a different AV solution for a while. Kaspersky, Avira, or one of the others.

    Or, like Kreij said, try the newer mem test. It is possible the older version in Vista is not catching a bad one.
     
    Last edited: Dec 20, 2009
  5. weskes New Member

    Joined:
    Dec 3, 2005
    Messages:
    10 (0.00/day)
    Thanks Received:
    0
    Location:
    NL
    I saw that, but it also gave other directions. svhost/winproxy. I'm testing the ram at the moment, will try uninstalling and reinstalling panda.
     
  6. weskes New Member

    Joined:
    Dec 3, 2005
    Messages:
    10 (0.00/day)
    Thanks Received:
    0
    Location:
    NL
    Memtest 86+ version 4.00 just finished without errors. Just removed panda and restarted. It's running without BSOD for now.
     
  7. 95Viper

    95Viper

    Joined:
    Oct 12, 2008
    Messages:
    4,415 (2.01/day)
    Thanks Received:
    1,613
    Location:
    στο άλφα έως ωμέγα
    You can try re-installing it, but if the bsod returns, try a different A/V solution. Panda is OK, but it ain't in my top ten list. Just my opinion.
     
  8. weskes New Member

    Joined:
    Dec 3, 2005
    Messages:
    10 (0.00/day)
    Thanks Received:
    0
    Location:
    NL
    I understand, we have been using it for several years now, and I must say I never had any problems with it. As they have paid for the license I'll have to try. But thanks for pointing it out. I'm glad it's not a hardware issue. Thanks a lot.
     

Currently Active Users Viewing This Thread: 1 (0 members and 1 guest)

Share This Page