Strange BSOD

[RoboX]

stable system for a lifetime, I have had a BSOD while doing nothing:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\013113-48843-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\Windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`04454000 PsLoadedModuleList = 0xfffff800`04698670
Debug session time: Thu Jan 31 13:41:35.092 2013 (UTC + 1:00)
System Uptime: 0 days 3:05:39.935
Loading Kernel Symbols
...............................................................
................................................................
..............................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {2, 7435f, 13ffff, 1}

Probably caused by : memory_corruption ( nt!MiUnlinkPageFromLockedList+8d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000002, A list entry was corrupt
Arg2: 000000000007435f, entry in list being removed
Arg3: 000000000013ffff, highest physical page number
Arg4: 0000000000000001, reference count of entry being removed

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  prevx.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800044e367d to fffff800044d2fc0

STACK_TEXT:  
fffff880`0adcf2b8 fffff800`044e367d : 00000000`0000004e 00000000`00000002 00000000`0007435f 00000000`0013ffff : nt!KeBugCheckEx
fffff880`0adcf2c0 fffff800`04515c8b : 00000000`00000000 00000000`00000000 00000000`00000000 fffff8a0`117ff000 : nt!MiUnlinkPageFromLockedList+0x8d
fffff880`0adcf340 fffff800`045147d8 : fffff8a0`117fe400 fffff8a0`117ff000 fffffa80`0a71f700 fffffa80`0a71f700 : nt!MiFlushSectionInternal+0x6bb
fffff880`0adcf570 fffff800`04513d3c : 00000000`00000000 fffff980`074b2200 00000000`00000000 fffff880`018f428a : nt!MmFlushSection+0x1f4
fffff880`0adcf630 fffff880`018c26f4 : fffffa80`0a6c4858 00000000`00000000 fffff8a0`00000000 00000000`00000001 : nt!CcFlushCache+0x7bc
fffff880`0adcf730 fffff880`018b84e3 : 00000000`00000000 fffff8a0`0fe4c140 00000000`00000000 00000000`00000001 : Ntfs!NtfsFlushUserStream+0xb4
fffff880`0adcf7b0 fffff880`018c0fc9 : fffffa80`04388220 fffffa80`07108180 00000000`00120101 00000000`00000000 : Ntfs!NtfsFlushVolume+0x2c7
fffff880`0adcf8e0 fffff880`018c16d0 : fffffa80`04388220 fffffa80`0ae01480 fffffa80`0ad72f20 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`0adcf9c0 fffff880`01335bcf : fffffa80`0ae017d8 fffffa80`0ae01480 fffffa80`04388220 fffff880`0adcf9e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`0adcfa30 fffff880`013346df : fffffa80`06f969e0 00000000`00000001 fffffa80`06f96900 fffffa80`0ae01480 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0adcfac0 fffff800`047d6dfb : 00000000`00000002 fffffa80`0ad72f20 00000000`00000001 fffffa80`0ae01480 : fltmgr!FltpDispatch+0xcf
fffff880`0adcfb20 fffff800`0476b9f1 : fffffa80`0ae01480 fffffa80`09c30060 fffffa80`0ad72f20 fffff800`04645e80 : nt!IopSynchronousServiceTail+0xfb
fffff880`0adcfb90 fffff800`044d2253 : fffffa80`09c30060 00000000`026f2f80 fffffa80`06f969e0 fffffa80`0ad72f20 : nt!NtFlushBuffersFile+0x171
fffff880`0adcfc20 00000000`77b317ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0151f288 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b317ca


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnlinkPageFromLockedList+8d
fffff800`044e367d cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiUnlinkPageFromLockedList+8d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_2_nt!MiUnlinkPageFromLockedList+8d

BUCKET_ID:  X64_0x4E_2_nt!MiUnlinkPageFromLockedList+8d

Followup: MachineOwner
---------

 

[brandonwh64]

prevx.exe is malware. I would suggest cleaning your system as soon as you can

Prevx bills itself as the answer to just about everything which it isn't.

Prevx.exe is I believe malware according to a very reliable source, but to be sure you should run the free version of both of these tools and let them clean everything they find.

http://www.superantispyware.com/superantispywarefreevspro.html

http://www.malwarebytes.org/mbam.php

Meanwhile, what is your operating system and service pack and are you totally up to date?

Meanwhile it is only Prevx that finds Imagereader1x as malware as far as I can gather.

https://community.mcafee.com/message/36195

 

[jgunning]

prevx.exe is malware. I would suggest cleaning your system as soon as you can



https://community.mcafee.com/message/36195

I have seen this exact same thing.It is malware ^ +1
=)