BSOD Challenge - PFN_LIST_CORRUPT and others

Toggle sidebar Toggle sidebar
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Hello all. Thank you for taking the time to read through this. I am finally putting my hands in there air on this one. I am an IT and like to think I have extensive knowledge, but in this case; not enough. Some background; I've purchased/built a new computer a few months ago now, which seems to run fine (with the exception of BSODing). Early on, when I got the blue screens they referenced Steam and it's processes, which I uninstalled, and seemed to resolve the problem for some time. Then I had a few more, pointing toward the program UnDelete for data recovery - which I uninstalled and seemed to resolve the problem, for a while. Now, half the time the computer doesn't even get time to dump a full report, and isn't pointing a specific process and I am lost. To alleviate future questions; I am over clocking. I have tested stability for 12+ hours and had no errors. Additionally, just to rule it out, I have set my PC back to stock settings. So far, there hasn't seem to have been rhym or reason why they've been happening (though, they tend to when I log out of (or in) RDP.

I have:


  • Ran Memtest86
    Replaced one stick of RAM at a time
    Tested with a different video card
    Tested with a different PSU
    Re-installed windows (on the same and different HDD/SSD though, that was a while ago)
    Scanned for maleware/rootkits
    Ran Furmark
    Ran Prime 95
    Ran Intel Burn Test
    Manually set RAM/CPU Voltage to factory settings instead of "auto"

There are a lot of dump files, so I'm just attaching the last three. If you'd like more, please just let me know. I haven't posted for BSOD help before, so please let me know if you need anything else.

System Specifications

PCPartPicker part list / Price breakdown by merchant

CPU: AMD FX-8320 3.5GHz 8-Core Processor
CPU Cooler: Corsair H100i 77.0 CFM Liquid CPU Cooler
Thermal Compound: Antec Formula 7 Nano Diamond 4g Thermal Paste
Motherboard: Asus Sabertooth 990FX R2.0 ATX AM3+ Motherboard
Memory: Corsair XMS3 12GB (3 x 4GB) DDR3-1333 Memory
Storage: PNY XLR8 240GB 2.5" Solid State Drive
Storage: Seagate Barracuda 1TB 3.5" 7200RPM Internal Hard Drive
Storage: Seagate Barracuda 1TB 3.5" 7200RPM Internal Hard Drive
Video Card: Gigabyte GeForce GTX 780 3GB WINDFORCE Video Card
Case: Thermaltake Core V71 ATX Full Tower Case
Power Supply: Corsair 1000W 80+ Platinum Certified Fully-Modular ATX Power Supply
Optical Drive: Asus BC-12B1ST/BLK/B/AS Blu-Ray Reader, DVD/CD Writer
Monitor: Asus VG248QE 144Hz 24.0" Monitor
Mouse: Mad Catz R.A.T. 7 Wired Laser Mouse
Headphones: Turtle Beach Ear Force DP11 Headset
Generated by PCPartPicker 2015-02-25 13:40 EST-0500


Minidump(s)

02/22/2015: http://s000.tinyupload.com/index.php?file_id=64983484516018457293

02/23/2015: http://s000.tinyupload.com/index.php?file_id=15542504966521726589

02/24/2015: http://s000.tinyupload.com/index.php?file_id=36709349887108474354

02/25/2015: http://s000.tinyupload.com/index.php?file_id=93083270748407457666

Full Large Memory Dump

02/25/2015: http://www.filedropper.com/memory

Thank you very much for your help in advance. I feel like I can fix every one else's problems, but mine never seem to end. Old build, new build, doesn't matter. Someone come take this black magic off me -_-.
 
Solution
J
need the actual memory dump file placed on a server with public access so I can look with the windows debugger.

Also, if you can change the memory dump type to kernel or full and run verifier.exe and set the flags and reboot and get a new kernel or full memory dump it would be very useful.

running verifier will make windows check the drivers for common driver errors and will force a bugcheck when it finds the first driver that screws up. (more than one driver can screw up)
How to run verifier:
http://www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html
Sort by date Sort by votes
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
need the actual memory dump file placed on a server with public access so I can look with the windows debugger.

Also, if you can change the memory dump type to kernel or full and run verifier.exe and set the flags and reboot and get a new kernel or full memory dump it would be very useful.

running verifier will make windows check the drivers for common driver errors and will force a bugcheck when it finds the first driver that screws up. (more than one driver can screw up)
How to run verifier:
http://www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html
 
Upvote 0 Downvote
Solution
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Johnbl, I have updated the original post with the Minidump LINKS available online. [strike]Also, I've made the adjustments in verifyer and am just waiting for it to crash next. Will update when it does.[/strike] I've updated with the full dump since it crashed (after setting up verifier).
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
just a guess: (I would fix the other problems, then see if i could get a update to this driver)
for the actual bugcheck I think it is going to be caused by your anticheat software
BEDaisy.sys
BattleEye anti-cheat driver Initially released on 8 January 2015
http://www.battleye.com/download.html
(I would also do a malwarebytes scan or rootkit scan)

I would start by:
remove
C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS Thu Jul 21 16:03:00 2011
C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS Tue Jul 12 14:00:01 2011
update:
\SystemRoot\system32\DRIVERS\Rt64win7.sys Wed Dec 26 09:17:50 2012
Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NI

from here: http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=13&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false

update your saitek driver from here if you can find updates: http://www.saitek.com/uk/down/drivers.php

BugCheck 5, {fffffa80098c4620, fffffa80098c0620, 0, fffffa800d56c280}

INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: fffffa80098c4620
Arg2: fffffa80098c0620
Arg3: 0000000000000000
Arg4: fffffa800d56c280

 
Upvote 0 Downvote
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Okay. So, Super Anti Spyware and Realtek drivers are culprits? I've remove them both now, including the Saitek drivers (not even sure how they got on there). I'm not sure what the rest of your message means following the Saitek section. Can you give me some details as to your conclusion? Thanks! I suppose from here we wait...
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
-guess your machine does have one BIOS update to fix issues with USB devices.

Note:The only other really questionable driver was Daemon Tools driver dtsoftbus01.sys
but it was very current Fri Feb 21 01:49:36 2014. (older versions tended to bugcheck windows 7)
guess there is a update for dcrypt.sys Tue Jul 08 23:42:01 2014
https://diskcryptor.net/wiki/Main_Page

the super anti spyware was just old, the realtek ethernet drivers were old and had some unrelated bugs. Just update them. Some of the older Saitek drivers tended to corrupt memory. People plug in a controller, later remove it and the device driver stays on the machine causing problems. Remove it if you don't use it.

I am guessing at the bugcheck being related to the anti cheat software. Something attached itself to a process and caused the bugcheck. it is something a debugger would do, or maybe malware, a virus, or virus scanner. I guess it is the first time i came across this anticheat software and they may be hooking in to scan for cheats then not unhooking correctly. Just a guess but I would check with them for a update. Maybe scan for malware with malwarebytes.

Oh, I guess I could look at one of your minidumps and see if any software modified the core windows files.
Nope, don't see any corrupted windows core files in memory of your minidump.



 
Upvote 0 Downvote
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Thanks for following up! I've Uninstaller Super Anti Spyware and the Saitek drivers and updated Realtek.

The Battle Eye Anti Cheat is used for Arms online pla. Or more commonly, DayZ. They update every week or so, but it is very buggy so who knows on that one. I'll wait while and repost if it happens again.
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
ya, the bugcheck you got indicates that something attached to a process, but attached again for some reason and that is not allowed and called a bugcheck. Maybe something attached to a process on one processor and another thread on another processor. That would also cause a bugcheck. Also certain threads can not be attached to if they are attached to another process.



 
Upvote 0 Downvote
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Well, dammit. I guess that didn't solve it. I was remotely connected, so I couldn't see what screen came up, but no mini dump or MEMORY.dmp files was produced. The computer just crashed and restarted. Also, I was not running Battle Eye when this happened.
 
Upvote 0 Downvote
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Alright, this happened again. Basically, the computer "crashed". It didn't receive a BSOD or memory dump (or mini dump for that matter) but it lost all internet connection, and had no display at all, but the computer was turned on. If it weren't for the LED's and fans, I wouldn't have even known it was on. Not really sure how to troubleshoot this.
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
in a case like that you would want to trigger a keyboard induced memory dump.
google how to force a memory dump via keyboard to find out how to make the registry settings.
you should also run verifier.exe to set debug flags, and make sure you do a full memory dump.

This will save the state of your machine and allow the debugger to see why it is not responding.




 
Upvote 0 Downvote
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Alright, I've tested the manual dump and set it up. Next time it happens I'll initiate it. Also, is there a reason my full memory dumps are so huge? Seriously, the test one I just did was 12GB.
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
Yep they do a bit by bit copy of your memory in your system. even all of the junk windows loads in to standby memory.
you can run rammap.exe and empty the stanby lists and working sets to tell windows not to preload old programs into memory before you request it.
https://technet.microsoft.com/en-us/library/ff700229.aspx

you may be shocked at what gets preloaded when you have a lot of ram on your system. In my case, I have entire games that I have not run for months being preloaded.

Use the RAMMAP.exe "empty" menu sub items to clear out the various lists. It should make the memory dump a lot smaller when you do a full memory dump.

windows just fills up all unused memory with programs you have previously used. Then when/if you need them again it does not have to go to storage. It just marks the moves the memory listing form standby to active.




 
Upvote 0 Downvote
D

dageek

Honorable
Feb 2, 2014
22
0
10,510
Alright, I finally got another one last night. It was a little different than what I've ever seen (and hopefully narrows it down). It was a quick flash of BSOD and scrolling text, then immediately rebooted. Advice?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
did it generate any dump file, even a partial one?



 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
looks like you are overclocking your CPU to 4.5 GHz from 3.5GHZ
remove overclock and see if you still bugcheck.

BugCheck 19, BAD_POOL_HEADER
basically something corrupted kernel memory.

I would update
Asmedia 106x SATA Host Controller Driver
\SystemRoot\system32\DRIVERS\asahci64.sys Wed Jan 04 21:08:19 2012

update your network driver
Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC
\SystemRoot\system32\DRIVERS\Rt64win7.sys Wed Dec 26 09:17:50 2012
http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=13&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false


you might remove all of these drivers:
\SystemRoot\system32\drivers\SaiBus.sys Tue Apr 16 10:17:23 2013
\SystemRoot\system32\DRIVERS\SaiK1708.sys Thu Sep 20 03:03:56 2012
\SystemRoot\system32\DRIVERS\SaiMini.sys Tue Apr 16 10:17:23 2013
\SystemRoot\system32\DRIVERS\SaiU1708.sys Thu Sep 20 03:03:52 2012
maybe get a update from here if you still need the device:
http://www.saitek.com/uk/down/drivers.php

you have a driver 0358481a-e6c
I have no idea what it is, I would do a rootkit and malwarebytes scan.

machine info:
BIOS Release Date 01/06/2014
BIOS Version 2301
Manufacturer ASUSTeK COMPUTER INC.
Product SABERTOOTH 990FX R2.0
Version Rev 1.xx
Processor Version AMD FX(tm)-8320 Eight-Core Processor
Processor Voltage 8dh - 1.3V
External Clock 200MHz
Max Speed 4500MHz
Current Speed 4500MHz








 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom