# Win7 x64 Frequent BSOD / PFN_LIST_CORRUPT



## scrupul0us (Aug 13, 2005)

Problem signature:
Problem Event Name:	BlueScreen
OS Version:	6.1.7600.2.0.0.256.48
Locale ID:	1033

Additional information about the problem:
BCCode:	4e
BCP1:	0000000000000099
BCP2:	00000000001B65D6
BCP3:	0000000000000002
BCP4:	00000000001B65D3
OS Version:	6_1_7600
Service Pack:	0_0
Product:	256_1

This is a relatively new install, ~2 weeks.

DMP attached.

I've performed 4 full sweeps with memtest86 and my RAM comes back spotless.

Any help is appreciated.

Happy New Year =)


----------



## usasma (Apr 11, 2009)

Try this first:


> H/W Diagnostics:
> Please start by running these hardware diagnostics:
> http://www.carrona.org/hddiag.html (read the details at the link)
> 
> Also, please run one of these free, independent online malware scans to ensure that your current protection hasn't been compromised: http://www.carrona.org/malware.html (read the details at the link)


Please update this driver: UltraMonUtility.sys Thu Nov 13 20:10:30 2008

Please run Driver Verifier according to these instructions:


> Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.
> 
> So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).
> 
> ...


Here's a summary of the BSOD:

```
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Thu Dec 31 21:29:29.764 2009 (GMT-5)
System Uptime: 0 days 8:16:36.888
BugCheck 4E, {99, 1b65d6, 2, 1b65d3}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  dwm.exe
```


----------



## scrupul0us (Aug 13, 2005)

another random reboot over night... crash dump attached

I uninstalled ultramon since there's no update for that sys file.


----------



## usasma (Apr 11, 2009)

This is a MEMORY_MANAGEMENT error. It blames the OS kernel (which is unlikely to be the problem).

Please enable Driver Verifier as per my request in my previous post.

Please conduct the tests that I asked for in my previous post.


----------



## scrupul0us (Aug 13, 2005)

SDA: (data storage/page file)
=== START OF INFORMATION SECTION ===
Model Family: Seagate Barracuda 7200.10 family
Device Model: ST3500630AS
Serial Number: 6QG2FT9E
Firmware Version: 3.AAK
User Capacity: 500,107,862,016 bytes
Device is: In smartctl database [for details use: -P show]
ATA Version is: 7
ATA Standard is: Exact ATA specification draft version not indicated
Local Time is: Sat Jan 02 10:52:42 2010 EST
SMART support is: Available - device has SMART capability.
Enabled status cached by OS, trying SMART RETURN STATUS cmd.
SMART support is: Enabled

```
=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   106   095   006    Pre-fail  Always       -       111722473
  3 Spin_Up_Time            0x0003   093   093   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   100   100   020    Old_age   Always       -       234
  5 Reallocated_Sector_Ct   0x0033   100   100   036    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   078   060   030    Pre-fail  Always       -       62774379
  9 Power_On_Hours          0x0032   083   083   000    Old_age   Always       -       15038
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       25
187 Reported_Uncorrect      0x0032   100   100   000    Old_age   Always       -       0
189 High_Fly_Writes         0x003a   100   100   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   069   045   045    Old_age   Always   In_the_past 31 (Lifetime Min/Max 25/33)
194 Temperature_Celsius     0x0022   031   055   000    Old_age   Always       -       31 (0 13 0 0)
195 Hardware_ECC_Recovered  0x001a   064   056   000    Old_age   Always       -       146208161
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       0
200 Multi_Zone_Error_Rate   0x0000   100   253   000    Old_age   Offline      -       0
202 Data_Address_Mark_Errs  0x0032   100   253   000    Old_age   Always       -       0
```
SDB: (system drive)
=== START OF INFORMATION SECTION ===
Model Family: Western Digital RE Serial ATA family
Device Model: WDC WD2500YD-01NVB1
Serial Number: WD-WMANK1707240
Firmware Version: 10.02E01
User Capacity: 251,000,193,024 bytes
Device is: In smartctl database [for details use: -P show]
ATA Version is: 7
ATA Standard is: Exact ATA specification draft version not indicated
Local Time is: Sat Jan 02 10:54:13 2010 EST
SMART support is: Available - device has SMART capability.
Enabled status cached by OS, trying SMART RETURN STATUS cmd.
SMART support is: Enabled


```
=== START OF READ SMART DATA SECTION ===
SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   200   200   051    Pre-fail  Always       -       0
  3 Spin_Up_Time            0x0003   214   206   021    Pre-fail  Always       -       4300
  4 Start_Stop_Count        0x0032   100   100   000    Old_age   Always       -       83
  5 Reallocated_Sector_Ct   0x0033   200   200   140    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   200   200   051    Pre-fail  Always       -       0
  9 Power_On_Hours          0x0032   061   061   000    Old_age   Always       -       28993
 10 Spin_Retry_Count        0x0013   100   253   051    Pre-fail  Always       -       0
 11 Calibration_Retry_Count 0x0012   100   253   051    Old_age   Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       75
190 Airflow_Temperature_Cel 0x0022   077   047   045    Old_age   Always       -       23
194 Temperature_Celsius     0x0022   127   097   000    Old_age   Always       -       23
196 Reallocated_Event_Count 0x0032   200   200   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0012   200   200   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   200   200   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   200   000    Old_age   Always       -       1
200 Multi_Zone_Error_Rate   0x0009   200   200   051    Pre-fail  Offline      -       0
```


----------



## scrupul0us (Aug 13, 2005)

usasma said:


> This is a MEMORY_MANAGEMENT error. It blames the OS kernel (which is unlikely to be the problem).
> 
> Please enable Driver Verifier as per my request in my previous post.
> 
> Please conduct the tests that I asked for in my previous post.


My apologies, didn't have a chance yesterday to read the articles you posted.

I'll get the verification setup and the rest of the tests done.

EDIT: Verifier is now running


----------



## usasma (Apr 11, 2009)

I'm unsure of the results of the hard drive test - but IMO they don't look good.
Try the Hitachi Drive Fitness Test to see what it says.


----------



## scrupul0us (Aug 13, 2005)

Verifier blew up my system ALOT... attached are the two dumps from today after verifier was enabled (now disabled)

I'll do the fitness test ASAP

thanks for all the help thus far


----------



## scrupul0us (Aug 13, 2005)

I'll get a chance to run that fitness test tomorrow but in regards to the SMART tests, smartctl gave a PASS for both drives although that could simply be due to the fact that none of the stats are in a fail state...

let me know if those dumps help you out and as stated I'll get you the results of the test tomm.

Trendmicro scan came back clean...

The only thing installed is AVG, pidgin, FF, Chrome, AutoCAD MEP 2009, Pandora Desktop App and the slew of windows updates

Firefox and Pidgin are the only two programs I leave running all the time along with ProbeII which comes with my ASUS motherboard for monitoring mobo/proc info...


----------



## scrupul0us (Aug 13, 2005)

OK, DFT results are in...

DFT was unable to detect my system drive even when I provided it with the serial number (both my drives are SATA)

DFT detected and scanned my 500 gb media drive that contains the paging/swap and came back successful with a disposition code of 0x00


----------



## usasma (Apr 11, 2009)

If DFT couldn't find the drive - there's something wrong.
Have you checked the drive to ensure it's connected and is getting power?

If all that's OK, then try the bootable Seagate Seatools for DOS to see if it detects the drive.
Run the Advanced test - it will tell you if the drive Passed or Failed.

FWIW - at work we try DFT first and Seatools for DOS second. If neither detect the drive, then we assume the drive is bad and replace it. Replacing the drive has fixed the problem every time that I can recall.

As for the dump files. The Verifier enabled dump file blames ntoskrnl.exe - so we suspect either a Windows corruption or a hardware failure. Due to what we've seen with the hard drive tests, I'd have to believe that it's a hardware failure - but the SeaTools for DOS should make it obvious.


----------



## scrupul0us (Aug 13, 2005)

usasma said:


> Have you checked the drive to ensure it's connected and is getting power?


It's the drive containing windows and it boots just fine so the drive is operational to the point that windows "works"

If I wanted to replace that drive (which it's sounding like I should) what tool what you recommend I use to clone the data onto the new drive?

I'll give that SeaTools a run a little later this afternoon and report back what it finds... Also, would you recommend trying "sfc /scannow" ?

Again, thanks a bunch


----------



## usasma (Apr 11, 2009)

Have you physically looked at the drive and wiggled both ends of both the connections to the drive (with the computer unplugged from the wall)?

As for cloning tools for data - it depends on how the drive is working. I've been using this tool for a couple of years and I really like it (about $33 US): http://www.cooldrives.com/saandidehadr1.html

Running other tests all depends on the status of the drive. If it's failing (as I suspect), then there's a limited amount of time left to recover the data. The more that you use it, the more likely it is to die completely.

Backup your data first - then you can try all the different tests that you'd like.


----------



## scrupul0us (Aug 13, 2005)

usasma said:


> Have you physically looked at the drive and wiggled both ends of both the connections to the drive (with the computer unplugged from the wall)?


Yes, I'm using the computer as we "speak"... If the drive wasn't plugged in properly I would think the PC wouldn't run

Maybe I'll buy the drive and install windows fresh onto it and just bring in the couple things I need from the current drive (rule out any corrupt files, etc)


----------



## scrupul0us (Aug 13, 2005)

For what it's worth... Ever since I uninstalled Ultramon and ran verifier (knock on wood) I've had no BSOD's or other unpleasant experiences


----------

