BSOD- defective ram?

Discussion in 'Hardware' started by 449, Sep 26, 2009.

  1. 449

    449 Private E-2

    Hi

    I've been randomly getting the BSOD for about a month now. Sometimes it would happen again minutes after the restart, sometimes hours, sometimes, days. I don't think it's an issue with the hardware because I've reformatted XP about 4-5 times. I even tried install the Windows 7 release candidate and still got the BSOD with that.

    I've done the mem86 test and it came back clean after one run through. The crashes stop all together however when I am only using one stick of ram. I've tried every combination of ram slot switching so I'm assuming it's not the fault of the motherboard. What's weird is there is no bad stick of ram. Both run fine by themselves; whereas when they're both installed that's when the crashes happen.

    HITACHI 1TB 7200 RPM 16MB Cache SATA 3.0Gb/s 3.5"
    Crucial Ballistix 4GB 4GB (2 x 2GB) 240-Pin DDR2 SDRAM DDR2 800 (PC2 6400)
    GIGABYTE GA-EP45-UD3P LGA 775 Intel P45 ATX Intel Motherboard
    MSI N9400GT-MD1G GeForce 9400 GT 1GB 128-bit GDDR2
    Rosewill RP550-2 550W ATX12V v2.01 Power Supply

    .dmp files
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini092609-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Sep 26 07:57:51.218 2009 (GMT-4)
System Uptime: 0 days 1:23:23.937
Loading Kernel Symbols
...............................................................
.......................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a508410, 2, 0, 8050c9cc}

*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : eamon.sys ( eamon+507f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a508410, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8050c9cc, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0a508410 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MmCreateSection+14c
8050c9cc 8b4b20          mov     ecx,dword ptr [ebx+20h]

CUSTOMER_CRASH_COUNT:  3

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  ekrn.exe

LAST_CONTROL_TRANSFER:  from 804e57e9 to 8050c9cc

STACK_TEXT:  
b3e18a68 804e57e9 8a3194b8 00000007 00000000 nt!MmCreateSection+0x14c
b3e18ac8 b7e082fe 8a22d4a0 00002220 00000000 nt!CcInitializeCacheMap+0x241
b3e18ba0 b7e0800a 8a32f918 89644aa0 00000001 Ntfs!NtfsCommonRead+0xc68
b3e18c40 804ef19f 8a67a020 89644aa0 8a6b2a98 Ntfs!NtfsFsdRead+0x22d
b3e18c50 b7ea9459 b3e18c7c 804ef19f 8a6b3dd0 nt!IopfCallDriver+0x31
b3e18c58 804ef19f 8a6b3dd0 89644aa0 89644c78 sr!SrPassThrough+0x31
b3e18c68 b466807f 8a22d4a0 8a274f38 89644aa0 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
b3e18c7c 804ef19f 8a2ef198 89644aa0 806e6410 eamon+0x507f
b3e18c8c 8057f982 89644c54 89644aa0 8a22d4a0 nt!IopfCallDriver+0x31
b3e18ca0 8057c9e7 8a2ef198 89644aa0 8a22d4a0 nt!IopSynchronousServiceTail+0x70
b3e18d38 8054162c 000004c4 00000000 00000000 nt!NtReadFile+0x55d
b3e18d38 7c90e514 000004c4 00000000 00000000 nt!KiFastCallEntry+0xfc
00000000 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
eamon+507f
b466807f ??              ???

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  eamon+507f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: eamon

IMAGE_NAME:  eamon.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  498c37ad

FAILURE_BUCKET_ID:  0xA_eamon+507f

BUCKET_ID:  0xA_eamon+507f

Followup: MachineOwner
---------
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini092609-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Sep 26 06:33:18.093 2009 (GMT-4)
System Uptime: 0 days 0:51:20.812
Loading Kernel Symbols
...............................................................
.......................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {e49b0d30, 1, b7e4686b, 1}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsInsertCachedRun+1ad )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e49b0d30, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: b7e4686b, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  e49b0d30 

FAULTING_IP: 
Ntfs!NtfsInsertCachedRun+1ad
b7e4686b 66ff00          inc     word ptr [eax]

MM_INTERNAL_CODE:  1

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from b7e467f1 to b7e4686b

STACK_TEXT:  
b84df8b8 b7e467f1 0035002f 00355024 00000000 Ntfs!NtfsInsertCachedRun+0x1ad
b84df918 b7e322a9 8a6917a8 00355024 00000000 Ntfs!NtfsInsertCachedLcn+0x204
b84df938 b7e4662e b84dfc1c 8a691100 00355024 Ntfs!NtfsAddCachedRun+0x5d
b84df9bc b7e27629 b84dfc1c 8a691100 b84dfae8 Ntfs!NtfsFreeRecentlyDeallocated+0xe6
b84dfbe8 b7e28174 b84dfc1c 8a691100 00000000 Ntfs!NtfsCheckpointVolume+0xe75
b84dfd7c 8053877d 00000000 00000000 8a6f4d20 Ntfs!NtfsCheckpointAllVolumes+0xd2
b84dfdac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
b84dfddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsInsertCachedRun+1ad
b7e4686b 66ff00          inc     word ptr [eax]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsInsertCachedRun+1ad

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

FAILURE_BUCKET_ID:  0x50_Ntfs!NtfsInsertCachedRun+1ad

BUCKET_ID:  0x50_Ntfs!NtfsInsertCachedRun+1ad

Followup: MachineOwner
---------
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini092609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Sep 26 04:51:26.046 2009 (GMT-4)
System Uptime: 0 days 7:23:49.642
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {a3235620, 0, 0, 0}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiMakeSystemAddressValidPfnSystemWs+a6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a3235620, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 00000000, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  a3235620 

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8052037a to 804f9f43

STACK_TEXT:  
b84e3b8c 8052037a 00000050 a3235620 00000000 nt!KeBugCheckEx+0x1b
b84e3bf4 80517198 00000000 a3235620 00000000 nt!MmAccessFault+0x9a8
b84e3c24 8051b3db 89556008 8a6e3e60 806e6aa8 nt!MiMakeSystemAddressValidPfnSystemWs+0xa6
b84e3c64 8056a9cc cf5c4000 00bdaf88 00000000 nt!MmUnmapViewInSystemCache+0x27d
b84e3c7c 804e8239 8a6e3e60 89556008 00000000 nt!CcUnmapVacb+0x2a
b84e3cb0 804e5246 00000000 00000000 8955606c nt!CcUnmapVacbArray+0x117
b84e3ccc 804e5501 89556008 806e6a4c 89556008 nt!CcUnmapAndPurge+0x20
b84e3cfc 804e4b03 00000001 80559690 8a6a6ae0 nt!CcDeleteSharedCacheMap+0xc5
b84e3d34 804e70db 8a6ec298 80564820 8a6f4830 nt!CcWriteBehind+0x357
b84e3d7c 8053877d 8a6ec298 00000000 8a6f4830 nt!CcWorkerThread+0x12f
b84e3dac 805cff70 8a6ec298 00000000 00000000 nt!ExpWorkerThread+0xef
b84e3ddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiMakeSystemAddressValidPfnSystemWs+a6
80517198 3bc7            cmp     eax,edi

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!MiMakeSystemAddressValidPfnSystemWs+a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x50_nt!MiMakeSystemAddressValidPfnSystemWs+a6

BUCKET_ID:  0x50_nt!MiMakeSystemAddressValidPfnSystemWs+a6

Followup: MachineOwner
---------
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini092509-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri Sep 25 21:26:53.738 2009 (GMT-4)
System Uptime: 6 days 8:46:32.045
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
.....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {a1549448, 0, b7e05832, 0}


Could not read faulting driver name
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : eamon.sys ( eamon+564c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a1549448, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b7e05832, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  a1549448 

FAULTING_IP: 
Ntfs!NtfsAcquireResourceExclusive+8
b7e05832 6681380207      cmp     word ptr [eax],702h

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  firefox.exe

LAST_CONTROL_TRANSFER:  from b7e257b1 to b7e05832

STACK_TEXT:  
b27546e4 b7e257b1 8a548a40 a1549448 8a548a00 Ntfs!NtfsAcquireResourceExclusive+0x8
b2754708 b7e2982e 8a548a00 a1549448 00000000 Ntfs!NtfsAcquireExclusiveFcb+0x42
b2754734 b7e29d89 8a548a40 a1549448 00000002 Ntfs!NtfsAcquireFcbWithPaging+0x74
b2754768 b7e2903f 8a548a40 0000002c e1560d20 Ntfs!NtfsFindPrefixHashEntry+0x2ec
b27548d4 b7e2af2d 8a548a40 8924f720 b275492c Ntfs!NtfsCommonCreate+0xb39
b27549b8 804ef19f 8a626020 8924f720 8a685838 Ntfs!NtfsFsdCreate+0x1dc
b27549c8 b7eae90e b4719e8c 8a570f38 897ce0d8 nt!IopfCallDriver+0x31
b2754a14 804ef19f 8a685838 00000002 8924f8d4 sr!SrCreate+0x1e8
b2754a24 b466864c 8924f730 8a372be0 8931e498 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
b2754a5c 804ef19f 897ce020 8924f720 8924f720 eamon+0x564c
b2754a6c 805831fa 8a572578 8a70360c b2754c04 nt!IopfCallDriver+0x31
b2754b4c 805bf450 8a572590 00000000 8a703568 nt!IopParseDevice+0xa12
b2754bc4 805bb9dc 00000000 b2754c04 00000040 nt!ObpLookupObjectName+0x53c
b2754c18 80576033 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
b2754c94 805769aa 0012f018 00100001 0012efd8 nt!IopCreateFile+0x407
b2754cf0 805790b4 0012f018 00100001 0012efd8 nt!IoCreateFile+0x8e
b2754d30 8054162c 0012f018 00100001 0012efd8 nt!NtCreateFile+0x30
b2754d30 7c90e514 0012f018 00100001 0012efd8 nt!KiFastCallEntry+0xfc
0012f010 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
eamon+564c
b466864c ??              ???

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  eamon+564c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: eamon

IMAGE_NAME:  eamon.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  498c37ad

FAILURE_BUCKET_ID:  0x50_eamon+564c

BUCKET_ID:  0x50_eamon+564c

Followup: MachineOwner
---------
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini090709-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Sep  7 19:22:52.093 2009 (GMT-4)
System Uptime: 0 days 2:19:47.823
Loading Kernel Symbols
...............................................................
......................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, b3da61d4, b3da5ed0, 805efce9}

Unable to load image eamon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsAccessCheck+176 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: b3da61d4
Arg3: b3da5ed0
Arg4: 805efce9

Debugging Details:
------------------


EXCEPTION_RECORD:  b3da61d4 -- (.exr 0xffffffffb3da61d4)
ExceptionAddress: 805efce9 (nt!SepAccessCheck+0x0000013b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000018
Attempt to read from address 00000018

CONTEXT:  b3da5ed0 -- (.cxr 0xffffffffb3da5ed0)
eax=00000014 ebx=00000080 ecx=00000004 edx=00000000 esi=00000000 edi=e33c3470
eip=805efce9 esp=b3da629c ebp=b3da6310 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!SepAccessCheck+0x13b:
805efce9 66397004        cmp     word ptr [eax+4],si      ds:0023:00000018=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  2

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000018

READ_ADDRESS:  00000018 

FOLLOWUP_IP: 
Ntfs!NtfsAccessCheck+176
b7e28ac3 8845d4          mov     byte ptr [ebp-2Ch],al

FAULTING_IP: 
nt!SepAccessCheck+13b
805efce9 66397004        cmp     word ptr [eax+4],si

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 805f0abc to 805efce9

STACK_TEXT:  
b3da6310 805f0abc e33c3470 00000000 e2051850 nt!SepAccessCheck+0x13b
b3da6364 b7e28ac3 e33c3470 8a065ad4 00000001 nt!SeAccessCheck+0x12c
b3da6454 b7e288aa b3da6850 e12d74c0 e1817c58 Ntfs!NtfsAccessCheck+0x176
b3da6488 b7e2a08a b3da6850 8a00de48 e12d7720 Ntfs!NtfsCheckExistingFile+0x9a
b3da64b8 b7e29497 b3da6850 8a00dcb8 8a00de48 Ntfs!NtfsOpenExistingAttr+0xd1
b3da65c4 b7e299b8 b3da6850 8a00dcb8 8a00de48 Ntfs!NtfsOpenAttributeInExistingFile+0x3f3
b3da66ac b7e29151 b3da6850 8a00dcb8 8a00de48 Ntfs!NtfsOpenExistingPrefixFcb+0x253
b3da682c b7e2a042 b3da6850 8a00dcb8 b3da6980 Ntfs!NtfsCommonCreate+0x134a
b3da69d8 b7eb0f70 8a00dcb8 b3da6c00 8af4c020 Ntfs!NtfsNetworkOpenCreate+0x8a
b3da69f8 b4637292 8a00dcb8 b3da6c00 8af48dd0 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
b3da6a18 805830fe 8a00dcb8 b3da6c00 8a24bc38 eamon+0x6292
b3da6b04 805bf450 8ae33368 00000000 8a065ab8 nt!IopParseDevice+0x916
b3da6b7c 805bb9dc 00000000 b3da6bbc 00000040 nt!ObpLookupObjectName+0x53c
b3da6bd0 80576fc7 00000000 00000000 e56c6901 nt!ObOpenObjectByName+0xea
b3da6d54 8054162c 01e3bec8 01e3bea0 01e3bef4 nt!NtQueryAttributesFile+0xf1
b3da6d54 7c90e514 01e3bec8 01e3bea0 01e3bef4 nt!KiFastCallEntry+0xfc
01e3bef4 00000000 00000000 00000000 00000000 0x7c90e514


SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsAccessCheck+176

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

STACK_COMMAND:  .cxr 0xffffffffb3da5ed0 ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsAccessCheck+176

BUCKET_ID:  0x24_Ntfs!NtfsAccessCheck+176

Followup: MachineOwner
---------
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini090709-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Sep  7 17:02:23.343 2009 (GMT-4)
System Uptime: 0 days 22:50:08.067
Loading Kernel Symbols
...............................................................
.......................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, efa13, 0, 0}

Probably caused by : memory_corruption ( nt!MiDecrementShareCount+3a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 000efa13, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  uTorrent.exe

LAST_CONTROL_TRANSFER:  from 80522ddc to 804f9f43

STACK_TEXT:  
b3d2cba8 80522ddc 0000004e 00000099 000efa13 nt!KeBugCheckEx+0x1b
b3d2cbd8 80511a55 c0883d98 00000027 88cb8218 nt!MiDecrementShareCount+0x3a
b3d2cbfc 805b0253 7c90b001 88cb8020 007ffff8 nt!MiDeleteValidAddress+0x177
b3d2cc1c 805134f7 88cb8020 88cb8158 88cb8020 nt!MiDeleteAddressesInWorkingSet+0x65
b3d2cc50 805d2712 00cb8020 89a4d800 c0000005 nt!MmCleanProcessAddressSpace+0x193
b3d2ccf0 805d27f5 c0000005 b3d2cd4c 804ff94f nt!PspExitThread+0x680
b3d2ccfc 804ff94f 89a4d800 b3d2cd48 b3d2cd3c nt!PsExitSpecialApc+0x23
b3d2cd4c 80541ef6 00000001 00000000 b3d2cd64 nt!KiDeliverApc+0x1af
b3d2cd4c 7c8095b3 00000001 00000000 b3d2cd64 nt!Kei386EoiHelper+0x3a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00e7ff3c 00000000 00000000 00000000 00000000 0x7c8095b3


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDecrementShareCount+3a
80522ddc ff4e08          dec     dword ptr [esi+8]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiDecrementShareCount+3a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiDecrementShareCount+3a

BUCKET_ID:  0x4E_99_nt!MiDecrementShareCount+3a

Followup: MachineOwner
---------
     
    449, Sep 26, 2009
    #1
  2. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    Hi

    You are getting random ones first one links to your AntiVirus in ESET, second is ntfs.sys, third is utorrent.


    I would be checking ram and use this http://majorgeeks.com/Memtest86_d4226.html and test with only one stick of ram at a time.
     
    DavidGP, Sep 27, 2009
    #2
  3. 449

    449 Private E-2

    I tried running the single stick I already have in and it started getting errors as soon as the test started. I tried the second stick of ram in the same slot on the mobo, and the test made two passes flawlessly. Is it safe to assume that I have a bad stick of ram? Is there anything I could have done to caused this? Did I just get an unlucky batch?

    Thanks.
     
    449, Sep 27, 2009
    #3
  4. jeepdriver

    jeepdriver Private E-2

    Just for the record, I have had same prob. with Crucial Ballistix. Random BSOD's. Bugcheck pointing to different problems, (ESET. corrupt memory, ntfs.sys. etc.) Memory would pass all tests. Replaced memory with different brand and problem solved.
     
    jeepdriver, Sep 28, 2009
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds