Windows 7 BSOD PFN_LIST_CORRUPT ntoskrnl.exe

[alig]

Hi,

Can someone help please, before I smash up my PC.

Its a windows 7 home premium.
Keep getting blue screen with message PFN_LIST_CORRUPT ntoskrnl.exe

I have attached the dump file.

Thanks
Ali

 

[Trouble]

Hello and welcome to the forum.
A single dump file, blaming memory corruption.

BugCheck 4E, {99, 878da, 2, 878d8}
[COLOR=#ff0000][U][B]Probably caused by : memory_corruption[/B][/U][/COLOR] ( nt!MiBadShareCount+4c )
PFN_LIST_CORRUPT (4e)
[COLOR=#ff0000][U][B]Typically caused by drivers passing bad memory descriptor lists[/B][/U][/COLOR] (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000878da, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000878d8, 0

You need to update your motherboard's chipset driver.
nvm62x64.sys 10/17/2008 Nvidia Ethernet Networking Driver part of your nForce chipset driver from here Drivers - Download NVIDIA Drivers
and while you are at it update this as well
NuidFltr.sys 5/8/2009 Microsoft Mouse Driver from here Link Removed
If Blue Screens persist;
First make sure your machine is configured properly to facilitate the collection of .dmp files.

Go to Start and type in sysdm.cpl and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Ensure that Automatically restart is unchecked
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump << where your .dmp files can be found later
Click OK twice to exit the dialogs, then reboot for the changes to take effect.

Then:
Please read the first post in this sticky thread here Link Removed
Do your best to accumulate the data required.
Run the SF Diagnostic tool (download and right click the executable and choose run as administrator)
Download and run CPUz. Use the Windows snipping tool to gather images from all tabs including all slots populated with memory under the SPD tab.
Likewise RAMMon. Export the html report, put everything into a desktop folder that you've created for this purpose, zip it up and attach it to your next post (right click it and choose send to, compressed (zipped) folder.
Additionally, if you haven’t already, please take some time and fill out your system specs in your forum profile area Link Removed .
Good luck
Randy

 

[alig]

Hi Randy,

Thanks for taking the time to help,
I updated the drivers as you suggested.

I am still getting the BSOD, so I have attached the files you asked for.

Thanks
Regards
Ali

 

[Trouble]

OK out of the six memory dump files that you've attached, it would seem that most are indicating issues with memory in one form or another.
First recommendation is to monitor your temperatures. Use something like Core Temp or whatever you might prefer.
Second Download Memtest86+ from this location here. Burn the ISO to a CD and boot the computer from the CD from a cold boot after leaving it off for an hour or more.
Ideally let it run for at least 7 passes / 6-8 hours. If errors appear before that you can stop that particular test. Any time Memtest86+ reports errors, it can be either bad RAM or a bad Mobo slot. Perform the test RAM sticks individually as well as all possible combinations. When you find a good one then test it in all slots. Post back with the results.
See this Guide to using Memtest 86+
Third since there seems to be some pagefile involvement run the native Check Disk utility and see what it comes up with.
From an elevated command prompt type
chkdsk C: /R
hit enter
answer yes "Y" when prompted and reboot.
Let it run all five stages and take a look at the results. Event Viewer, Windows Logs, Application, right click "Find" chkdsk
If you are using any USB drives as ReadyBoost devices, discontinue that for the time being.

BugCheck 4E, {99, 15d708, 2, 15dd07}
[COLOR=#ff0000][U][B]Probably caused by : memory_corruption[/B][/U][/COLOR] ( nt!MiBadShareCount+4c )
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000015d708, page frame number
Arg3: 0000000000000002, current page state
Arg4: 000000000015dd07, 0

BugCheck 1A, {403, fffff68000011410, f4d00001648b9867, fffff6fc00b245c8}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )
[COLOR=#ff0000][U][B]MEMORY_MANAGEMENT (1a)[/B][/U][/COLOR]
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000011410
Arg3: f4d00001648b9867
Arg4: fffff6fc00b245c8

BugCheck 50, {fffffa8086b08380, 0, fffff8800115c37e, 5}
Could not read faulting driver name
Probably caused by : fltmgr.sys ( fltmgr!FltpAllocateIrpCtrl+4e )
[COLOR=#ff0000][U][B]PAGE_FAULT_IN_NONPAGED_AREA (50)[/B][/U][/COLOR]
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8086b08380, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800115c37e, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

BugCheck 4E, {99, 1a6a9e, 2, 1a589d}
[COLOR=#ff0000][U][B]Probably caused by : memory_corruption[/B][/U][/COLOR] ( nt!MiBadShareCount+4c )
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000001a6a9e, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000001a589d, 0

BugCheck 1A, {403, fffff683ff7890d8, 45b00001a34e0025, fffff6fc00d1a700}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3266c )
[COLOR=#ff0000][U][B]MEMORY_MANAGEMENT (1a)[/B][/U][/COLOR]
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff683ff7890d8
Arg3: 45b00001a34e0025
Arg4: fffff6fc00d1a700

BugCheck 4E, {99, 878da, 2, 878d8}
[COLOR=#ff0000][U][B]Probably caused by : memory_corruption[/B][/U][/COLOR] ( nt!MiBadShareCount+4c )
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000878da, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000878d8, 0

If still no joy you may have to resort to Driver Verifier to zero in on what might still be the offending driver, cause I'm not seeing anything jumping out at me now. So if you decide that you need to go the Driver Verifier route, post back and I'll dig up some links as it is not generally something you want to use unless you are certain you have the requisite skill set and know how to start it, how to configure it and how to stop it. Here is one I suggest you read carefully, completely and make sure you understand before proceeding Link Removed - Invalid URL
Regards
Randy

 

[Saltgrass]

Just some comments after looking through your Event Log.

You seem to have many of these errors. I do not believe they are causing your Blue Screens, but you might see if you can get them to stop.

"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Link Removed

You also seem to have some errors associated with .Net 2....

.NET Runtime version 2.0.50727.5420 - Fatal Execution Engine Error (000007FEEF39AF0E) (80131506)

Are you running a Parallel printer or USB to parallel device?

I see this one once, but since I do not not what Easy Tune is, I really cannot comment.

Product: Easy Tune 6 B11.0722.1 -- Error 1935.An error occurred during the installation of assembly 'Microsoft.VC80.ATL,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86"'. Please refer to Help and Support for more information. HRESULT: 0x8007054F. assembly interface: IAssemblyCacheItem, function: Commit, component: {97F81AF1-0E47-DC99-A01F-C8B3B9A1E18E}

Found this, and saw some solutions from resetting the CMOS to changing the RAM timing.

Faulting application name: svchost.exe_SysMain, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: sysmain.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c9db

Maybe something is hiding in here that you and Trouble can figure out.

Edit: Is your Windows Update working normally? You seem to have some updates, which I cannot find out what they are for, not being allowed to download.