Solved

Bug Check 0x0000004e (0x0000009a, 0x00004ed5, 0x00000006, 0x00000002)

Posted on 2009-04-06
9
1,520 Views
Last Modified: 2012-06-27
We have a client that had their server 2003SBS SP1 reboot. We didin't get to see the blue screen so all we have to go on is this bug check and mini dump. After researching, I've found that the cause of this is all over the place from bad memory, CPUs to bad video driver or antivirus software. Could some one please take a look at this mini dump and narrow it down for me?  It would be a big help.
BTW, it's been 5 days without a recurrance of a bue screen.

Thanks
Mini040209-01.dmp.txt
0
Comment
Question by:IronsideSecurity
  • 4
  • 2
  • 2
  • +1
9 Comments
 
LVL 23

Accepted Solution

by:
ComputerTechie earned 250 total points
ID: 24081072
Here how to read the mini dump file.
http://www.microsoft.com/whdc/devtools/debugging/default.mspx
CT
 
0
 

Author Comment

by:IronsideSecurity
ID: 24081343
That's great... now if I only knew how to use it...
0
 
LVL 3

Assisted Solution

by:qualchoice-it
qualchoice-it earned 250 total points
ID: 24081371
from the command prompt, just copy and paste it.
 

C:\Program Files\Debugging Tools for Windows (x86)>windbg -y srv*c:\symbols*http

://msdl.microsoft.com/download/symbols -i c:\windows\i386 -z c:\windows\Memory.dmp


 

Just make sure you load the Windbg program first

 

 

Make sure you have your i386 file nested inside of C:\Windows

 

And place your memory dump in c:\Windows\"Memory.dmp"

 

at that point you should be able to export your dump file as a text file.
0
 
LVL 3

Expert Comment

by:qualchoice-it
ID: 24081391
oops left out this  !analyze -v

will give you detailed info of the debug
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 

Author Comment

by:IronsideSecurity
ID: 24115600
The problem is that I don't have the time to figure out how to use this program. I'm already working 12 to 15 hr days trying to fit all of my clients in to the schedule. That's whay I've posted here... to let the experts help me out with this.
I have a new memory dump with one different parameter. This is from the latest crash this morning.
If anyone can read this for me,  I'd really be thankfull.
Mini041009-01.dmp.txt
0
 

Author Comment

by:IronsideSecurity
ID: 24115932
Ok, I ran the tool but the results still seem to be inconclusive. Is it bad memory or a bad driver... who knows what the heck all of this means?

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000009a,
Arg2: 0000849a
Arg3: 00000006
Arg4: 00000002

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_9a

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 80888176 to 8087b71e

STACK_TEXT:  
f78e20cc 80888176 0000004e 0000009a 0000849a nt!KeBugCheckEx+0x1b
f78e20e8 8089abf7 818c6e70 808b75c0 01745a00 nt!MiBadRefCount+0x33
f78e211c 8089c27a 8849a000 8849d000 8971a598 nt!MiFreePoolPages+0x5b9
f78e2174 f7266692 3966744e 00000000 f78e2378 nt!ExFreePoolWithTag+0x277
f78e2184 f7266561 897fdd88 8849a000 f726652e Ntfs!NtfsDeleteMdlAndBuffer+0x31
f78e2190 f726652e 8971a598 f78e2d30 00000000 Ntfs!NtfsCommonWrite+0x180b
f78e2378 f7264df7 f78e2388 8971a598 0108070a Ntfs!NtfsCommonWrite+0x17b1
f78e24f4 8083f9c0 8ab3a718 8971a598 8971a598 Ntfs!NtfsFsdWrite+0x16a
f78e2508 f731fd36 86474d68 8abef590 00000000 nt!IofCallDriver+0x45
f78e2534 8083f9c0 8aaf6180 8971a598 8971a598 fltmgr!FltpDispatch+0x152
f78e2548 f731fb43 8a33c470 8971a598 8a702008 nt!IofCallDriver+0x45
f78e256c f731fd03 f78e258c 8a33c470 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
f78e25a4 8083f9c0 8a33c470 8971a598 0035f000 fltmgr!FltpDispatch+0x11f
f78e25b8 8084953a 00000000 8abf0970 f78e25f4 nt!IofCallDriver+0x45
f78e25cc 8084914a 8abf0b09 f78e25f4 f78e26b0 nt!IoSynchronousPageWrite+0xaf
f78e26dc 8084d6b3 e166fd7c e166fd88 8abf0970 nt!MiFlushSectionInternal+0x67e
f78e2720 808308d2 8abf0938 f78e2800 00003000 nt!MmFlushSection+0x23f
f78e27a8 f7261443 8abf0bac f78e2854 00003000 nt!CcFlushCache+0x1ed
f78e2878 f7287366 e1613490 cb06c458 000000ce Ntfs!LfsFlushLfcb+0x229
f78e28cc f72864dd 01613490 cb06c458 000000ce Ntfs!LfsFlushToLsnPriv+0x199
f78e292c f7286314 e1613490 000000e0 00000001 Ntfs!LfsWriteLfsRestart+0x171
f78e2978 f72861de e15b83a0 00000068 f78e29d0 Ntfs!LfsWriteRestartArea+0x149
f78e2bf4 f72978f1 f78e2c28 8ab3a7f8 00000000 Ntfs!NtfsCheckpointVolume+0x1235
f78e2d80 8083f71e 00000000 00000000 8ab8bdb0 Ntfs!NtfsCheckpointAllVolumes+0xd2
f78e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80841a86 8083f661 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiBadRefCount+33
80888176 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadRefCount+33

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  45ebe552

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

Followup: MachineOwner
0
 
LVL 23

Expert Comment

by:ComputerTechie
ID: 24116288
Need a bigger memory dump not enough data.
Go to my computer right click on it. select properties
select advance system settings.select  startup and recovery setting
select kernal memory dump.
then post here next memory dump.
CT
 
 
 
 
 
0
 
LVL 6

Expert Comment

by:bdesmond
ID: 24123673
Hi-

Let's see if we can track down the culprit here. What we want to use is a tool called Driver Verifier:

Fire up driver verifier by going start>run>verifier.exe

1. Create Custom Settings
2. Select individual settings from list
3. Check Special Pool
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Finish & reboot

Upload the dump next time the box crashes.

Thanks,
Brian Desmond
Active Directory MVP
0
 

Author Closing Comment

by:IronsideSecurity
ID: 31567105
I decided to split the points since both of you steered me in the right direction with were to get the debugging tool and how to use it.  I had to call Microsoft to get them to debug the rest of the way. it turned out to be bad system memory.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

More or less everybody in the IT market understands the basics of Networking, however when we start talking about Storage Networks, things get a bit dizzier, and this is where I would like to help.
Moving your enterprise fax infrastructure from in-house fax machines and servers to the cloud makes sense — from both an efficiency and productivity standpoint. But does migrating to a cloud fax solution mean you will no longer be able to send or re…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now