locked
BSOD - system_service_exception and pfn_list_corrupt RRS feed

  • Question

  • I've got these BSOD the last few days : system_service_exception and pfn_list_corrupt.

    What should I do?

    Here is a link to my .dmp files: https://onedrive.live.com/redir?resid=86C0D5E55BB3FBAE%21207

    Monday, December 29, 2014 2:58 PM

All replies

  • Paralgin

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier  first

    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!! 
     

    If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)

    I suggest that you first backup your data

    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\Ken\Desktop\New folder\122714-38281-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*h:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*h:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17328.amd64fre.winblue_r3.140827-1500
    Machine Name:
    Kernel base = 0xfffff802`c1e15000 PsLoadedModuleList = 0xfffff802`c20eb370
    Debug session time: Sat Dec 27 16:40:40.381 2014 (UTC - 5:00)
    System Uptime: 1 days 0:23:02.055
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ............................
    Loading User Symbols
    Loading unloaded module list
    ...............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 4E, {99, 100c8a, 0, a000000001ce98a}
    
    Probably caused by : memory_corruption ( nt!MiBadShareCount+4b )
    
    Followup: MachineOwner
    ---------
    
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc).  If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 0000000000000099, A PTE or PFN is corrupt
    Arg2: 0000000000100c8a, page frame number
    Arg3: 0000000000000000, current page state
    Arg4: 0a000000001ce98a, 0
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0x4E_99
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    PROCESS_NAME:  chrome.exe
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff802c2011573 to fffff802c1f641a0
    
    STACK_TEXT:  
    ffffd000`226e0c38 fffff802`c2011573 : 00000000`0000004e 00000000`00000099 00000000`00100c8a 00000000`00000000 : nt!KeBugCheckEx
    ffffd000`226e0c40 fffff802`c1f8812c : fffff580`00000002 00000000`00000000 fffff6fb`40000240 fffff580`00000000 : nt!MiBadShareCount+0x4b
    ffffd000`226e0c80 fffff802`c1e581e5 : ffffe000`a6a1c900 00000980`00000000 ffffc000`202a5cb8 00000000`000027ff : nt! ?? ::FNODOBFM::`string'+0x13a7c
    ffffd000`226e0d50 fffff802`c1eb4029 : ffffffff`ffffffff ffffffff`ffffffff ffffe000`a6a1cde8 ffffe000`a68e5800 : nt!MiDeleteAddressesInWorkingSet+0x3b5
    ffffd000`226e1650 fffff802`c21fa65f : 00000000`00040000 ffffd000`226e1800 ffffe000`a68e5800 ffffe000`a6a1c900 : nt!MiBeginProcessClean+0x101
    ffffd000`226e16a0 fffff802`c2247c28 : 00000000`00040000 ffffd000`226e1800 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x67
    ffffd000`226e1700 fffff802`c21f767b : ffffe000`a6a1c900 ffffc000`20bab060 ffffd000`226e1800 00000000`00000000 : nt!PspRundownSingleProcess+0xac
    ffffd000`226e1790 fffff802`c22c6fd0 : 00000000`c0000005 ffffe000`a68e5800 ffffd000`226e1b00 ffffe000`a68e58a8 : nt!PspExitThread+0x573
    ffffd000`226e18a0 fffff802`c1e92ecd : 00000000`00000000 fffff680`00000001 00000000`0000000f ffffe000`a44fbab8 : nt!KiSchedulerApcTerminate+0x18
    ffffd000`226e18d0 fffff802`c1f690c0 : 00000000`02a1ed40 ffffd000`226e1950 fffff802`c1ed2d04 00000000`00000000 : nt!KiDeliverApc+0x2dd
    ffffd000`226e1950 fffff802`c1f6fa5a : 00000000`00000208 00000000`02a1ed40 00000000`00000010 00000000`02b1fbf4 : nt!KiInitiateUserApc+0x70
    ffffd000`226e1a90 00007ffd`7db1316a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
    00000000`02a1e628 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`7db1316a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiBadShareCount+4b
    fffff802`c2011573 cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt!MiBadShareCount+4b
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  53fe6f2e
    
    IMAGE_VERSION:  6.3.9600.17328
    
    IMAGE_NAME:  memory_corruption
    
    BUCKET_ID_FUNC_OFFSET:  4b
    
    FAILURE_BUCKET_ID:  0x4E_99_nt!MiBadShareCount
    
    BUCKET_ID:  0x4E_99_nt!MiBadShareCount
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0x4e_99_nt!mibadsharecount
    
    FAILURE_ID_HASH:  {60e553e9-e4c5-ed08-9be6-c353e0011003}
    
    Followup: MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag

    Monday, December 29, 2014 3:13 PM
  • Thanks.. Have been trying things now so here is a link to two new .dmp hope it helps. https://onedrive.live.com/redir?resid=86C0D5E55BB3FBAE%21207
    Monday, December 29, 2014 8:45 PM
  • Paralgin

    Unfortunately you put the links in the folder not the DMPS themselves.  Try it again


    Wanikiya and Dyami--Team Zigzag

    Monday, December 29, 2014 8:48 PM
  • Ohh.. Lets try again. Having trouble .zipping them

    https://onedrive.live.com/redir?resid=86C0D5E55BB3FBAE%21207

    Monday, December 29, 2014 9:01 PM
  • Paralgin

    These were still related to memory corruption and driver verifier does not appear to have been enabled.  What happened when you ran Verifier /query

    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\Ken\Desktop\122914-54562-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*h:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*h:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17328.amd64fre.winblue_r3.140827-1500
    Machine Name:
    Kernel base = 0xfffff800`e7e13000 PsLoadedModuleList = 0xfffff800`e80e9370
    Debug session time: Mon Dec 29 15:28:07.299 2014 (UTC - 5:00)
    System Uptime: 0 days 0:27:13.025
    Loading Kernel Symbols
    .
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    ..............................................................
    ................................................................
    ............................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 109, {a3a01f58d895c5b9, b3b72bdf2b1308ec, fffff800e81e3a98, 1}
    
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    CRITICAL_STRUCTURE_CORRUPTION (109)
    This bugcheck is generated when the kernel detects that critical kernel code or
    data have been corrupted. There are generally three causes for a corruption:
    1) A driver has inadvertently or deliberately modified critical kernel code
     or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
    2) A developer attempted to set a normal kernel breakpoint using a kernel
     debugger that was not attached when the system was booted. Normal breakpoints,
     "bp", can only be set if the debugger is attached at boot time. Hardware
     breakpoints, "ba", can be set at any time.
    3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
    Arguments:
    Arg1: a3a01f58d895c5b9, Reserved
    Arg2: b3b72bdf2b1308ec, Reserved
    Arg3: fffff800e81e3a98, Failure type dependent information
    Arg4: 0000000000000001, Type of corrupted region, can be
    	0 : A generic data region
    	1 : Modification of a function or .pdata
    	2 : A processor IDT
    	3 : A processor GDT
    	4 : Type 1 process list corruption
    	5 : Type 2 process list corruption
    	6 : Debug routine modification
    	7 : Critical MSR modification
    
    Debugging Details:
    ------------------
    
    
    PG_MISMATCH:  400
    
    MEMORY_CORRUPTOR:  ONE_BIT
    
    FAULTING_IP: 
    nt!NtReleaseSemaphore+0
    fffff800`e81e3a98 48895c2408      mov     qword ptr [rsp+8],rbx
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  CODE_CORRUPTION
    
    BUGCHECK_STR:  0x109
    
    PROCESS_NAME:  csrss.exe
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    STACK_TEXT:  
    ffffd000`bedd3088 00000000`00000000 : 00000000`00000109 a3a01f58`d895c5b9 b3b72bdf`2b1308ec fffff800`e81e3a98 : nt!KeBugCheckEx
    
    
    STACK_COMMAND:  kb
    
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
        fffff800e81e3b9a - nt!NtReleaseSemaphore+102
    	[ 62:60 ]
    1 error : !nt (fffff800e81e3b9a)
    
    MODULE_NAME: memory_corruption
    
    IMAGE_NAME:  memory_corruption
    
    FOLLOWUP_NAME:  memory_corruption
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT
    
    BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:memory_corruption_one_bit
    
    FAILURE_ID_HASH:  {e3faf315-c3d0-81db-819a-6c43d23c63a7}
    
    Followup: memory_corruption
    ---------
    
    



    Wanikiya and Dyami--Team Zigzag

    Tuesday, December 30, 2014 12:13 AM
  • Hmm, that's odd. I'm trying it again now, so ill see if it will work. I was running memtest for 10 hours this night, and everything was good. Or do I need to run it longer?

    I started the verifier this morning, and restarted the PC, then i typed "verifier /query" and a list of .sys and stuff appeared. So I hope that's a good sign of it is running? 

    When I start the verifying process, my wifi card shut down, the screen comes and goes, is that normal? Had to run a wire trough the house.

    Tuesday, December 30, 2014 8:50 AM
  • New .dmp

    https://onedrive.live.com/redir?resid=86C0D5E55BB3FBAE%21207

    Tuesday, December 30, 2014 3:04 PM
  • Paralgin

    Driver verified and Related to wfplwfs.sys WFP NDIS 6.30 Lightweight Filter Driver from Microsoft Corporation.  Since it is an OS  file I would start by running a system file check

    Please run a system file check (SFC)

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.

    System file check (SFC) Scan and Repair System Files

    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\Ken\Desktop\123014-64218-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*h:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*h:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17328.amd64fre.winblue_r3.140827-1500
    Machine Name:
    Kernel base = 0xfffff802`80c07000 PsLoadedModuleList = 0xfffff802`80edd370
    Debug session time: Tue Dec 30 09:57:28.936 2014 (UTC - 5:00)
    System Uptime: 0 days 7:10:30.655
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C4, {91001, fffff80047134e40, ffffe001731c9740, ffffe001731c97c8}
    
    Probably caused by : wfplwfs.sys ( wfplwfs!LwfLowerOidRequest+6e )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
    A device driver attempting to corrupt the system has been caught.  This is
    because the driver was specified in the registry as being suspect (by the
    administrator) and the kernel has enabled substantial checking of this driver.
    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
    be among the most commonly seen crashes.
    Arguments:
    Arg1: 0000000000091001, ID of the 'NdisOidComplete' rule that was violated.
    Arg2: fffff80047134e40, A pointer to the string describing the violated rule condition.
    Arg3: ffffe001731c9740, Address of internal rule state (second argument to !ruleinfo).
    Arg4: ffffe001731c97c8, Address of supplemental states (third argument to !ruleinfo).
    
    Debugging Details:
    ------------------
    
    
    DV_VIOLATED_CONDITION:  This OID should only be completed with NDIS_STATUS_NOT_ACCEPTED, NDIS_STATUS_REQUEST_ABORTED, NDIS_STATUS_SUCCESS, or NDIS_STATUS_PENDING.
    
    DV_MSDN_LINK: http://go.microsoft.com/fwlink/?LinkId=278802
    
    DV_RULE_INFO: 0x91001
    
    BUGCHECK_STR:  0xc4_NdisOidComplete_XDV
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff8004712f487 to fffff80280d561a0
    
    STACK_TEXT:  
    ffffd000`258747b8 fffff800`4712f487 : 00000000`000000c4 00000000`00091001 fffff800`47134e40 ffffe001`731c9740 : nt!KeBugCheckEx
    ffffd000`258747c0 fffff800`4711e637 : ffffe001`731c9740 fffff800`4712f7ce ffffe001`731cabc0 ffffd000`25874930 : VerifierExt!SLIC_StatefulAbort+0x22b
    ffffd000`258748b0 fffff800`4711edb3 : ffffe001`731c9740 ffffffff`c000000d ffffcf80`370bcf44 ffffe001`731c9740 : VerifierExt!SLIC_XdvNdisMiniportOidRequestHandler_exit_NdisOidComplete+0xc7
    ffffd000`258748f0 fffff800`47b0e6e8 : ffffe001`733651a0 ffffcf80`370bcf10 ffffe001`733cf4d0 00000000`00000000 : VerifierExt!XdvNdisMiniportOidRequestHandler_wrapper+0x777
    ffffd000`25874960 fffff800`47a603a3 : ffffe001`733651a0 ffffd000`25874a19 ffffcf80`370bcf10 00000000`00000008 : ndis!ndisMInvokeOidRequest+0x2263c
    ffffd000`258749a0 fffff800`47a61324 : 00000000`00000000 ffffe001`733651a0 ffffcf80`370bcf58 00000000`00000000 : ndis!ndisMDoOidRequest+0x39b
    ffffd000`25874a80 fffff800`47a6175e : 00000000`67326c57 00000000`67326c57 fffff800`47a609a5 00000000`c0000001 : ndis!ndisQueueOidRequest+0x4c4
    ffffd000`25874c20 fffff800`47f8819e : ffffcf80`30b90f10 00000000`fd01010b ffffcf80`30b90f10 ffffe001`7392e570 : ndis!NdisFOidRequest+0xc2
    ffffd000`25874ce0 fffff800`47a608de : ffffcf80`370bcf10 ffffcf80`2bedcd70 00000000`00000000 ffffcf80`2cd7ad00 : wfplwfs!LwfLowerOidRequest+0x6e
    ffffd000`25874d10 fffff802`80cc2f46 : ffffd000`25875000 ffffd000`25870000 00000000`00000000 ffffcf80`30b90f10 : ndis!ndisFDoOidRequestInternal+0x2ee
    ffffd000`25874e10 fffff800`47a61131 : fffff800`47a605f0 ffffcf80`2cd7ac70 00000000`00000002 fffff800`47a609a5 : nt!KeExpandKernelStackAndCalloutInternal+0xe6
    ffffd000`25874f00 fffff800`47a6175e : 00000000`72636350 00000000`72636350 fffff800`47a609a5 00000000`c0000001 : ndis!ndisQueueOidRequest+0x2d1
    ffffd000`258750a0 fffff800`48202850 : ffffcf80`2ce04f20 00000000`fd01010b ffffcf80`2ce04f20 ffffd000`25875740 : ndis!NdisFOidRequest+0xc2
    ffffd000`25875160 fffff800`47a608de : ffffcf80`30b90f10 ffffcf80`2bfecd90 00000000`fd01010b 00000000`00000000 : pacer!PcFilterRequest+0x5c
    ffffd000`25875190 fffff802`80cc2f46 : ffffd000`25875480 ffffd000`25870000 00000000`00000000 ffffd000`25875740 : ndis!ndisFDoOidRequestInternal+0x2ee
    ffffd000`25875290 fffff800`47a61131 : fffff800`47a605f0 ffffcf80`2cd94c70 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0xe6
    ffffd000`25875380 fffff800`47a65e8a : ffffd000`25875740 ffffe001`733651a0 ffffe001`73366100 00000000`00000008 : ndis!ndisQueueOidRequest+0x2d1
    ffffd000`25875520 fffff800`47b1ce77 : ffffe001`733651a0 ffffe001`73366108 ffffd000`25875740 00000000`00010246 : ndis!ndisQuerySetMiniportEx+0x10e
    ffffd000`25875580 fffff800`47a8d3b0 : 00000000`00000001 ffffe001`733651a0 00000000`00000000 ffffd000`25875740 : ndis!ndisOidPMRemove+0x93
    ffffd000`258755c0 fffff800`47a60dbf : 00000000`00000001 ffffd000`25875740 00000000`00000000 00000000`00000004 : ndis!ndisOidPMAddRemove+0x11fa0
    ffffd000`25875600 fffff800`47caff67 : ffffe001`742d7300 ffffe001`742ca858 00000000`00000000 ffffe001`74b7c510 : ndis!ndisMOidRequest+0x22b
    ffffd000`25875710 fffff800`47d356ed : ffffd000`25875920 00000000`c0000056 00000000`fd01010b ffffe001`7398aab0 : tcpip!FlpNdisRequestUnderReference+0x8f
    ffffd000`25875880 fffff800`47d6c890 : ffffe001`7398aab0 00000000`00000000 ffffe001`7398a8f0 ffffe001`7398adac : tcpip!FlpNdisRequest+0x6d
    ffffd000`258758d0 fffff800`47d3e04a : 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 : tcpip!FlpCleanupWolHandle+0x30
    ffffd000`25875920 fffff800`47d3d3dc : ffffd000`258759c0 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!FlpDisableWakeup+0x4a
    ffffd000`25875950 fffff800`47d3d1da : 00000000`00000000 00000000`0000000a ffffe001`7429e1d0 00000000`00000000 : tcpip!FlSetInterface+0xffffffff`fffff2bc
    ffffd000`258759a0 fffff800`47d3e2eb : ffffe001`7429e1e8 ffffe001`7490b980 00000000`00000001 fffff802`80c878d6 : tcpip!IppSetWolOnInterface+0x42
    ffffd000`25875a10 fffff800`47d4ad78 : fffff780`00000000 00000000`00000000 00000000`00000000 fffff800`47b791f0 : tcpip!IppSetWolParametersWorker+0xdb
    ffffd000`25875a60 fffff800`47b79225 : ffffe001`7429e1d0 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!InetNsiWorkQueueRoutine+0x15
    ffffd000`25875a90 fffff802`80c76d63 : ffffe001`7392d120 ffff6c99`0057c230 ffffe001`733ca2f0 0000000c`b669d008 : NETIO!NetiopIoWorkItemRoutine+0x35
    ffffd000`25875ae0 fffff802`80c765e3 : fffff802`810aefc8 fffff802`80c76c68 ffffd000`25875bd0 ffffe001`7490b880 : nt!IopProcessWorkItem+0xfb
    ffffd000`25875b50 fffff802`80d05e70 : ffffd000`25875c30 ffffe001`7490b880 ffffe001`7490b880 ffffe001`71a48900 : nt!ExpWorkerThread+0x293
    ffffd000`25875c00 fffff802`80d5c7c6 : ffffd000`cd31c180 ffffe001`7490b880 ffffd000`cd3282c0 00000000`00000000 : nt!PspSystemThreadStartup+0x58
    ffffd000`25875c60 00000000`00000000 : ffffd000`25876000 ffffd000`25870000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    wfplwfs!LwfLowerOidRequest+6e
    fffff800`47f8819e bb03010000      mov     ebx,103h
    
    SYMBOL_STACK_INDEX:  8
    
    SYMBOL_NAME:  wfplwfs!LwfLowerOidRequest+6e
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: wfplwfs
    
    IMAGE_NAME:  wfplwfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  531ae165
    
    IMAGE_VERSION:  6.3.9600.17042
    
    BUCKET_ID_FUNC_OFFSET:  6e
    
    FAILURE_BUCKET_ID:  0xc4_NdisOidComplete_XDV_VRF_wfplwfs!LwfLowerOidRequest
    
    BUCKET_ID:  0xc4_NdisOidComplete_XDV_VRF_wfplwfs!LwfLowerOidRequest
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0xc4_ndisoidcomplete_xdv_vrf_wfplwfs!lwfloweroidrequest
    
    FAILURE_ID_HASH:  {49dbb057-371a-cacb-a812-a729cc032602}
    
    Followup: MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag

    Tuesday, December 30, 2014 3:30 PM
  • Did run that and it did not find any integrity violations. 

    Any thing else i should do? 

    Tuesday, December 30, 2014 3:35 PM
  • Paralgin

    I suspect the fastest thing to do is a refresh of the system.


    Wanikiya and Dyami--Team Zigzag

    Tuesday, December 30, 2014 3:37 PM