Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


Bug Check 0x0000004e (0x0000009a, 0x00004ed5, 0x00000006, 0x00000002)

Posted on 2009-04-06
Medium Priority
Last Modified: 2012-06-27
We have a client that had their server 2003SBS SP1 reboot. We didin't get to see the blue screen so all we have to go on is this bug check and mini dump. After researching, I've found that the cause of this is all over the place from bad memory, CPUs to bad video driver or antivirus software. Could some one please take a look at this mini dump and narrow it down for me?  It would be a big help.
BTW, it's been 5 days without a recurrance of a bue screen.

Question by:IronsideSecurity
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
  • 2
  • +1
LVL 23

Accepted Solution

ComputerTechie earned 750 total points
ID: 24081072
Here how to read the mini dump file.

Author Comment

ID: 24081343
That's great... now if I only knew how to use it...

Assisted Solution

qualchoice-it earned 750 total points
ID: 24081371
from the command prompt, just copy and paste it.

C:\Program Files\Debugging Tools for Windows (x86)>windbg -y srv*c:\symbols*http

:// -i c:\windows\i386 -z c:\windows\Memory.dmp


Just make sure you load the Windbg program first



Make sure you have your i386 file nested inside of C:\Windows


And place your memory dump in c:\Windows\"Memory.dmp"


at that point you should be able to export your dump file as a text file.
What Is Blockchain Technology?

Blockchain is a technology that underpins the success of Bitcoin and other digital currencies, but it has uses far beyond finance. Learn how blockchain works and why it is proving disruptive to other areas of IT.


Expert Comment

ID: 24081391
oops left out this  !analyze -v

will give you detailed info of the debug

Author Comment

ID: 24115600
The problem is that I don't have the time to figure out how to use this program. I'm already working 12 to 15 hr days trying to fit all of my clients in to the schedule. That's whay I've posted here... to let the experts help me out with this.
I have a new memory dump with one different parameter. This is from the latest crash this morning.
If anyone can read this for me,  I'd really be thankfull.

Author Comment

ID: 24115932
Ok, I ran the tool but the results still seem to be inconclusive. Is it bad memory or a bad driver... who knows what the heck all of this means?

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arg1: 0000009a,
Arg2: 0000849a
Arg3: 00000006
Arg4: 00000002

Debugging Details:





LAST_CONTROL_TRANSFER:  from 80888176 to 8087b71e

f78e20cc 80888176 0000004e 0000009a 0000849a nt!KeBugCheckEx+0x1b
f78e20e8 8089abf7 818c6e70 808b75c0 01745a00 nt!MiBadRefCount+0x33
f78e211c 8089c27a 8849a000 8849d000 8971a598 nt!MiFreePoolPages+0x5b9
f78e2174 f7266692 3966744e 00000000 f78e2378 nt!ExFreePoolWithTag+0x277
f78e2184 f7266561 897fdd88 8849a000 f726652e Ntfs!NtfsDeleteMdlAndBuffer+0x31
f78e2190 f726652e 8971a598 f78e2d30 00000000 Ntfs!NtfsCommonWrite+0x180b
f78e2378 f7264df7 f78e2388 8971a598 0108070a Ntfs!NtfsCommonWrite+0x17b1
f78e24f4 8083f9c0 8ab3a718 8971a598 8971a598 Ntfs!NtfsFsdWrite+0x16a
f78e2508 f731fd36 86474d68 8abef590 00000000 nt!IofCallDriver+0x45
f78e2534 8083f9c0 8aaf6180 8971a598 8971a598 fltmgr!FltpDispatch+0x152
f78e2548 f731fb43 8a33c470 8971a598 8a702008 nt!IofCallDriver+0x45
f78e256c f731fd03 f78e258c 8a33c470 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
f78e25a4 8083f9c0 8a33c470 8971a598 0035f000 fltmgr!FltpDispatch+0x11f
f78e25b8 8084953a 00000000 8abf0970 f78e25f4 nt!IofCallDriver+0x45
f78e25cc 8084914a 8abf0b09 f78e25f4 f78e26b0 nt!IoSynchronousPageWrite+0xaf
f78e26dc 8084d6b3 e166fd7c e166fd88 8abf0970 nt!MiFlushSectionInternal+0x67e
f78e2720 808308d2 8abf0938 f78e2800 00003000 nt!MmFlushSection+0x23f
f78e27a8 f7261443 8abf0bac f78e2854 00003000 nt!CcFlushCache+0x1ed
f78e2878 f7287366 e1613490 cb06c458 000000ce Ntfs!LfsFlushLfcb+0x229
f78e28cc f72864dd 01613490 cb06c458 000000ce Ntfs!LfsFlushToLsnPriv+0x199
f78e292c f7286314 e1613490 000000e0 00000001 Ntfs!LfsWriteLfsRestart+0x171
f78e2978 f72861de e15b83a0 00000068 f78e29d0 Ntfs!LfsWriteRestartArea+0x149
f78e2bf4 f72978f1 f78e2c28 8ab3a7f8 00000000 Ntfs!NtfsCheckpointVolume+0x1235
f78e2d80 8083f71e 00000000 00000000 8ab8bdb0 Ntfs!NtfsCheckpointAllVolumes+0xd2
f78e2dac 8092ccff 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
f78e2ddc 80841a86 8083f661 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


80888176 cc              int     3


SYMBOL_NAME:  nt!MiBadRefCount+33

FOLLOWUP_NAME:  MachineOwner



IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

BUCKET_ID:  0x4E_9a_nt!MiBadRefCount+33

Followup: MachineOwner
LVL 23

Expert Comment

ID: 24116288
Need a bigger memory dump not enough data.
Go to my computer right click on it. select properties
select advance system  startup and recovery setting
select kernal memory dump.
then post here next memory dump.

Expert Comment

ID: 24123673

Let's see if we can track down the culprit here. What we want to use is a tool called Driver Verifier:

Fire up driver verifier by going start>run>verifier.exe

1. Create Custom Settings
2. Select individual settings from list
3. Check Special Pool
4. Select drivers from a list
5. Click the provider heading to sort
6. Check everything that doesn't have Microsoft as the provider
7. Finish & reboot

Upload the dump next time the box crashes.

Brian Desmond
Active Directory MVP

Author Closing Comment

ID: 31567105
I decided to split the points since both of you steered me in the right direction with were to get the debugging tool and how to use it.  I had to call Microsoft to get them to debug the rest of the way. it turned out to be bad system memory.

Featured Post

Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
New style of hardware planning for Microsoft Exchange server.
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA:…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question