Bug Check 0x0000004e (0x0000009a, 0x00004ed5, 0x00000006, 0x00000002)

Posted on 2009-04-06
Last Modified: 2012-06-27
We have a client that had their server 2003SBS SP1 reboot. We didin't get to see the blue screen so all we have to go on is this bug check and mini dump. After researching, I've found that the cause of this is all over the place from bad memory, CPUs to bad video driver or antivirus software. Could some one please take a look at this mini dump and narrow it down for me?  It would be a big help.
BTW, it's been 5 days without a recurrance of a bue screen.

Question by:IronsideSecurity
  • 4
  • 2
  • 2
  • +1
LVL 23

Accepted Solution

ComputerTechie earned 250 total points
ID: 24081072
Here how to read the mini dump file.

Author Comment

ID: 24081343
That's great... now if I only knew how to use it...

Assisted Solution

qualchoice-it earned 250 total points
ID: 24081371
from the command prompt, just copy and paste it.

C:\Program Files\Debugging Tools for Windows (x86)>windbg -y srv*c:\symbols*http

:// -i c:\windows\i386 -z c:\windows\Memory.dmp


Just make sure you load the Windbg program first



Make sure you have your i386 file nested inside of C:\Windows


And place your memory dump in c:\Windows\"Memory.dmp"


at that point you should be able to export your dump file as a text file.
Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.


Expert Comment

ID: 24081391
oops left out this  !analyze -v

will give you detailed info of the debug

Author Comment

ID: 24115600
The problem is that I don't have the time to figure out how to use this program. I'm already working 12 to 15 hr days trying to fit all of my clients in to the schedule. That's whay I've posted here... to let the experts help me out with this.
I have a new memory dump with one different parameter. This is from the latest crash this morning.
If anyone can read this for me,  I'd really be thankfull.

Author Comment

ID: 24115932
Ok, I ran the tool but the results still seem to be inconclusive. Is it bad memory or a bad driver... who knows what the heck all of this means?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arg1: 0000009a,
Arg2: 0000849a
Arg3: 00000006
Arg4: 00000002

Debugging Details:





LAST_CONTROL_TRANSFER:  from 80888176 to 8087b71e

f78e20cc 80888176 0000004e 0000009a 0000849a nt!KeBugCheckEx+0x1b
f78e20e8 8089abf7 818c6e70 808b75c0 01745a00 nt!MiBadRefCount+0x33
f78e211c 8089c27a 8849a000 8849d000 8971a598 nt!MiFreePoolPages+0x5b9
f78e2174 f7266692 3966744e 00000000 f78e2378 nt!ExFreePoolWithTag+0x277
f78e2184 f7266561 897fdd88 8849a000 f726652e Ntfs!NtfsDeleteMdlAndBuffer+0x31
f78e2190 f726652e 8971a598 f78e2d30 00000000 Ntfs!NtfsCommonWrite+0x180b
f78e2378 f7264df7 f78e2388 8971a598 0108070a Ntfs!NtfsCommonWrite+0x17b1
f78e24f4 8083f9c0 8ab3a718 8971a598 8971a598 Ntfs!NtfsFsdWrite+0x16a
f78e2508 f731fd36 86474d68 8abef590 00000000 nt!IofCallDriver+0x45
f78e2534 8083f9c0 8aaf6180 8971a598 8971a598 fltmgr!FltpDispatch+0x152
f78e2548 f731fb43 8a33c470 8971a598 8a702008 nt!IofCallDriver+0x45
f78e256c f731fd03 f78e258c 8a33c470 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
f78e25a4 8083f9c0 8a33c470 8971a598 0035f000 fltmgr!FltpDispatch+0x11f
f78e25b8 8084953a 00000000 8abf0970 f78e25f4 nt!IofCallDriver+0x45
f78e25cc 8084914a 8abf0b09 f78e25f4 f78e26b0 nt!IoSynchronousPageWrite+0xaf
f78e26dc 8084d6b3 e166fd7c e166fd88 8abf0970 nt!MiFlushSectionInternal+0x67e
f78e2720 808308d2 8abf0938 f78e2800 00003000 nt!MmFlushSection+0x23f
f78e27a8 f7261443 8abf0bac f78e2854 00003000 nt!CcFlushCache+0x1ed
f78e2878 f7287366 e1613490 cb06c458 000000ce Ntfs!LfsFlushLfcb+0x229
f78e28cc f72864dd 01613490 cb06c458 000000ce Ntfs!LfsFlushToLsnPriv+0x199
f78e292c f7286314 e1613490 000000e0 00000001 Ntfs!LfsWriteLfsRestart+0x171
f78e2978 f72861de e15b83a0 00000068 f78e29d0 Ntfs!LfsWriteRestartArea+0x149
f78e2bf4 f72978f1 f78e2c28 8ab3a7f8 00000000 Ntfs!NtfsCheckpointVolume+0x1235
f78e2d80 8083f71e 00000000 00000000 8ab8bdb0 Ntfs!NtfsCheckpointAllVolumes+0xd2
f78e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80841a86 8083f661 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


80888176 cc              int     3


SYMBOL_NAME:  nt!MiBadRefCount+33

FOLLOWUP_NAME:  MachineOwner



IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

Followup: MachineOwner
LVL 23

Expert Comment

ID: 24116288
Need a bigger memory dump not enough data.
Go to my computer right click on it. select properties
select advance system  startup and recovery setting
select kernal memory dump.
then post here next memory dump.

Expert Comment

ID: 24123673

Let's see if we can track down the culprit here. What we want to use is a tool called Driver Verifier:

Fire up driver verifier by going start>run>verifier.exe

1. Create Custom Settings
2. Select individual settings from list
3. Check Special Pool
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Finish & reboot

Upload the dump next time the box crashes.

Brian Desmond
Active Directory MVP

Author Closing Comment

ID: 31567105
I decided to split the points since both of you steered me in the right direction with were to get the debugging tool and how to use it.  I had to call Microsoft to get them to debug the rest of the way. it turned out to be bad system memory.

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Power and BTU ratings calculation 13 86
RAID, not sure what Type ?? 14 147
Cannot see all of hard drive on HP Server 7 65
Dell PowerEdge 2950 crashing on a weekly basis 5 58
I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question