Bug Check 0x0000004e (0x0000009a, 0x00004ed5, 0x00000006, 0x00000002)

Posted on 2009-04-06
Last Modified: 2012-06-27
We have a client that had their server 2003SBS SP1 reboot. We didin't get to see the blue screen so all we have to go on is this bug check and mini dump. After researching, I've found that the cause of this is all over the place from bad memory, CPUs to bad video driver or antivirus software. Could some one please take a look at this mini dump and narrow it down for me?  It would be a big help.
BTW, it's been 5 days without a recurrance of a bue screen.

Question by:IronsideSecurity
  • 4
  • 2
  • 2
  • +1
LVL 23

Accepted Solution

ComputerTechie earned 250 total points
ID: 24081072
Here how to read the mini dump file.

Author Comment

ID: 24081343
That's great... now if I only knew how to use it...

Assisted Solution

qualchoice-it earned 250 total points
ID: 24081371
from the command prompt, just copy and paste it.

C:\Program Files\Debugging Tools for Windows (x86)>windbg -y srv*c:\symbols*http

:// -i c:\windows\i386 -z c:\windows\Memory.dmp


Just make sure you load the Windbg program first



Make sure you have your i386 file nested inside of C:\Windows


And place your memory dump in c:\Windows\"Memory.dmp"


at that point you should be able to export your dump file as a text file.
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.


Expert Comment

ID: 24081391
oops left out this  !analyze -v

will give you detailed info of the debug

Author Comment

ID: 24115600
The problem is that I don't have the time to figure out how to use this program. I'm already working 12 to 15 hr days trying to fit all of my clients in to the schedule. That's whay I've posted here... to let the experts help me out with this.
I have a new memory dump with one different parameter. This is from the latest crash this morning.
If anyone can read this for me,  I'd really be thankfull.

Author Comment

ID: 24115932
Ok, I ran the tool but the results still seem to be inconclusive. Is it bad memory or a bad driver... who knows what the heck all of this means?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arg1: 0000009a,
Arg2: 0000849a
Arg3: 00000006
Arg4: 00000002

Debugging Details:





LAST_CONTROL_TRANSFER:  from 80888176 to 8087b71e

f78e20cc 80888176 0000004e 0000009a 0000849a nt!KeBugCheckEx+0x1b
f78e20e8 8089abf7 818c6e70 808b75c0 01745a00 nt!MiBadRefCount+0x33
f78e211c 8089c27a 8849a000 8849d000 8971a598 nt!MiFreePoolPages+0x5b9
f78e2174 f7266692 3966744e 00000000 f78e2378 nt!ExFreePoolWithTag+0x277
f78e2184 f7266561 897fdd88 8849a000 f726652e Ntfs!NtfsDeleteMdlAndBuffer+0x31
f78e2190 f726652e 8971a598 f78e2d30 00000000 Ntfs!NtfsCommonWrite+0x180b
f78e2378 f7264df7 f78e2388 8971a598 0108070a Ntfs!NtfsCommonWrite+0x17b1
f78e24f4 8083f9c0 8ab3a718 8971a598 8971a598 Ntfs!NtfsFsdWrite+0x16a
f78e2508 f731fd36 86474d68 8abef590 00000000 nt!IofCallDriver+0x45
f78e2534 8083f9c0 8aaf6180 8971a598 8971a598 fltmgr!FltpDispatch+0x152
f78e2548 f731fb43 8a33c470 8971a598 8a702008 nt!IofCallDriver+0x45
f78e256c f731fd03 f78e258c 8a33c470 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
f78e25a4 8083f9c0 8a33c470 8971a598 0035f000 fltmgr!FltpDispatch+0x11f
f78e25b8 8084953a 00000000 8abf0970 f78e25f4 nt!IofCallDriver+0x45
f78e25cc 8084914a 8abf0b09 f78e25f4 f78e26b0 nt!IoSynchronousPageWrite+0xaf
f78e26dc 8084d6b3 e166fd7c e166fd88 8abf0970 nt!MiFlushSectionInternal+0x67e
f78e2720 808308d2 8abf0938 f78e2800 00003000 nt!MmFlushSection+0x23f
f78e27a8 f7261443 8abf0bac f78e2854 00003000 nt!CcFlushCache+0x1ed
f78e2878 f7287366 e1613490 cb06c458 000000ce Ntfs!LfsFlushLfcb+0x229
f78e28cc f72864dd 01613490 cb06c458 000000ce Ntfs!LfsFlushToLsnPriv+0x199
f78e292c f7286314 e1613490 000000e0 00000001 Ntfs!LfsWriteLfsRestart+0x171
f78e2978 f72861de e15b83a0 00000068 f78e29d0 Ntfs!LfsWriteRestartArea+0x149
f78e2bf4 f72978f1 f78e2c28 8ab3a7f8 00000000 Ntfs!NtfsCheckpointVolume+0x1235
f78e2d80 8083f71e 00000000 00000000 8ab8bdb0 Ntfs!NtfsCheckpointAllVolumes+0xd2
f78e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80841a86 8083f661 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


80888176 cc              int     3


SYMBOL_NAME:  nt!MiBadRefCount+33

FOLLOWUP_NAME:  MachineOwner



IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

Followup: MachineOwner
LVL 23

Expert Comment

ID: 24116288
Need a bigger memory dump not enough data.
Go to my computer right click on it. select properties
select advance system  startup and recovery setting
select kernal memory dump.
then post here next memory dump.

Expert Comment

ID: 24123673

Let's see if we can track down the culprit here. What we want to use is a tool called Driver Verifier:

Fire up driver verifier by going start>run>verifier.exe

1. Create Custom Settings
2. Select individual settings from list
3. Check Special Pool
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Finish & reboot

Upload the dump next time the box crashes.

Brian Desmond
Active Directory MVP

Author Closing Comment

ID: 31567105
I decided to split the points since both of you steered me in the right direction with were to get the debugging tool and how to use it.  I had to call Microsoft to get them to debug the rest of the way. it turned out to be bad system memory.

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
HP DL 160 G6 wont boot 5 43
Is MSDN subscription the answer? 4 62
Disk Configuration - Dell R620 6 100
Windows Server 2003 Policy Preventing Updates 6 41
Usually shares are where we want them for our users and we tend to take them for granted. There are times, however, when those shares may disappear causing difficulty for your users. One of the first things to try is searching for files that shou…
Hyper-convergence systems have taken the IT world by storm and have quickly started to change our point of view of how the data center should and could be architected. In this article, I’ll explain the benefits of employing a hyper-converged system …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit If you want to manage em…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question