Bug Check 0x0000004e (0x0000009a, 0x00004ed5, 0x00000006, 0x00000002)

Posted on 2009-04-06
Last Modified: 2012-06-27
We have a client that had their server 2003SBS SP1 reboot. We didin't get to see the blue screen so all we have to go on is this bug check and mini dump. After researching, I've found that the cause of this is all over the place from bad memory, CPUs to bad video driver or antivirus software. Could some one please take a look at this mini dump and narrow it down for me?  It would be a big help.
BTW, it's been 5 days without a recurrance of a bue screen.

Question by:IronsideSecurity
  • 4
  • 2
  • 2
  • +1
LVL 23

Accepted Solution

ComputerTechie earned 250 total points
Comment Utility
Here how to read the mini dump file.

Author Comment

Comment Utility
That's great... now if I only knew how to use it...

Assisted Solution

qualchoice-it earned 250 total points
Comment Utility
from the command prompt, just copy and paste it.

C:\Program Files\Debugging Tools for Windows (x86)>windbg -y srv*c:\symbols*http

:// -i c:\windows\i386 -z c:\windows\Memory.dmp


Just make sure you load the Windbg program first



Make sure you have your i386 file nested inside of C:\Windows


And place your memory dump in c:\Windows\"Memory.dmp"


at that point you should be able to export your dump file as a text file.

Expert Comment

Comment Utility
oops left out this  !analyze -v

will give you detailed info of the debug
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.


Author Comment

Comment Utility
The problem is that I don't have the time to figure out how to use this program. I'm already working 12 to 15 hr days trying to fit all of my clients in to the schedule. That's whay I've posted here... to let the experts help me out with this.
I have a new memory dump with one different parameter. This is from the latest crash this morning.
If anyone can read this for me,  I'd really be thankfull.

Author Comment

Comment Utility
Ok, I ran the tool but the results still seem to be inconclusive. Is it bad memory or a bad driver... who knows what the heck all of this means?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arg1: 0000009a,
Arg2: 0000849a
Arg3: 00000006
Arg4: 00000002

Debugging Details:





LAST_CONTROL_TRANSFER:  from 80888176 to 8087b71e

f78e20cc 80888176 0000004e 0000009a 0000849a nt!KeBugCheckEx+0x1b
f78e20e8 8089abf7 818c6e70 808b75c0 01745a00 nt!MiBadRefCount+0x33
f78e211c 8089c27a 8849a000 8849d000 8971a598 nt!MiFreePoolPages+0x5b9
f78e2174 f7266692 3966744e 00000000 f78e2378 nt!ExFreePoolWithTag+0x277
f78e2184 f7266561 897fdd88 8849a000 f726652e Ntfs!NtfsDeleteMdlAndBuffer+0x31
f78e2190 f726652e 8971a598 f78e2d30 00000000 Ntfs!NtfsCommonWrite+0x180b
f78e2378 f7264df7 f78e2388 8971a598 0108070a Ntfs!NtfsCommonWrite+0x17b1
f78e24f4 8083f9c0 8ab3a718 8971a598 8971a598 Ntfs!NtfsFsdWrite+0x16a
f78e2508 f731fd36 86474d68 8abef590 00000000 nt!IofCallDriver+0x45
f78e2534 8083f9c0 8aaf6180 8971a598 8971a598 fltmgr!FltpDispatch+0x152
f78e2548 f731fb43 8a33c470 8971a598 8a702008 nt!IofCallDriver+0x45
f78e256c f731fd03 f78e258c 8a33c470 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
f78e25a4 8083f9c0 8a33c470 8971a598 0035f000 fltmgr!FltpDispatch+0x11f
f78e25b8 8084953a 00000000 8abf0970 f78e25f4 nt!IofCallDriver+0x45
f78e25cc 8084914a 8abf0b09 f78e25f4 f78e26b0 nt!IoSynchronousPageWrite+0xaf
f78e26dc 8084d6b3 e166fd7c e166fd88 8abf0970 nt!MiFlushSectionInternal+0x67e
f78e2720 808308d2 8abf0938 f78e2800 00003000 nt!MmFlushSection+0x23f
f78e27a8 f7261443 8abf0bac f78e2854 00003000 nt!CcFlushCache+0x1ed
f78e2878 f7287366 e1613490 cb06c458 000000ce Ntfs!LfsFlushLfcb+0x229
f78e28cc f72864dd 01613490 cb06c458 000000ce Ntfs!LfsFlushToLsnPriv+0x199
f78e292c f7286314 e1613490 000000e0 00000001 Ntfs!LfsWriteLfsRestart+0x171
f78e2978 f72861de e15b83a0 00000068 f78e29d0 Ntfs!LfsWriteRestartArea+0x149
f78e2bf4 f72978f1 f78e2c28 8ab3a7f8 00000000 Ntfs!NtfsCheckpointVolume+0x1235
f78e2d80 8083f71e 00000000 00000000 8ab8bdb0 Ntfs!NtfsCheckpointAllVolumes+0xd2
f78e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80841a86 8083f661 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


80888176 cc              int     3


SYMBOL_NAME:  nt!MiBadRefCount+33

FOLLOWUP_NAME:  MachineOwner



IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

Followup: MachineOwner
LVL 23

Expert Comment

Comment Utility
Need a bigger memory dump not enough data.
Go to my computer right click on it. select properties
select advance system  startup and recovery setting
select kernal memory dump.
then post here next memory dump.

Expert Comment

Comment Utility

Let's see if we can track down the culprit here. What we want to use is a tool called Driver Verifier:

Fire up driver verifier by going start>run>verifier.exe

1. Create Custom Settings
2. Select individual settings from list
3. Check Special Pool
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Finish & reboot

Upload the dump next time the box crashes.

Brian Desmond
Active Directory MVP

Author Closing Comment

Comment Utility
I decided to split the points since both of you steered me in the right direction with were to get the debugging tool and how to use it.  I had to call Microsoft to get them to debug the rest of the way. it turned out to be bad system memory.

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
File Server backup 7 50
Trust relationship SBS2011 - > Windows 2003 3 29
Server guidance IBM X3500 M4 1 21
Raid 6 or Raid 10? 19 49
INTRODUCTION The purpose of this document is to demonstrate the Installation and configuration, of the HP EVA 4400 SAN Storage. The name , IP and the WWN ID’s used here are not the real ones. ABOUT THE STORAGE For most of you reading this, you …
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now