Vista crashes with a BSOD always - Potential conflict with OneCare

G

Guest

Hi
I have been testing Windows Vista on my PC - Dell XPS 8400, 2GB memory,
500GB harddrive.

Since having One care enabled, I have been getting BSOD very frequently
(sometimes more than once). The stack trace from minidump always points to
Mmeng.exe - from Onecare, I suppose.

Here is analyze -v output from windbg on one of the dumps. Has anyone seen
this before, any fix from Onecare or Vista for this?




0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or
it
is pointing at freed memory.
Arguments:
Arg1: a3846004, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 81d861f3, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81d275a0
Unable to read MiSystemVaType memory at 81d08680
a3846004

FAULTING_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_RC

BUGCHECK_STR: 0x50

PROCESS_NAME: MsMpEng.exe

CURRENT_IRQL: 0

TRAP_FRAME: 97cf28b4 -- (.trap ffffffff97cf28b4)
ErrCode = 00000000
eax=00000000 ebx=9ffaca94 ecx=a3846000 edx=00000000 esi=a3846000 edi=a47370f8
eip=81d861f3 esp=97cf2928 ebp=97cf2928 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetBinMemAlloc+0x8:
81d861f3 034104 add eax,dword ptr [ecx+4]
ds:0023:a3846004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c49304 to 81c57535

STACK_TEXT:
97cf289c 81c49304 00000000 a3846004 00000000 nt!MmAccessFault+0x14b
97cf289c 81d861f3 00000000 a3846004 00000000 nt!KiTrap0E+0xdc
97cf2928 81e37c25 a47370f8 a47370f8 a0e04000 nt!HvpGetBinMemAlloc+0x8
97cf2948 81d757ea 97cf92dc 00000000 00000000 nt!HvpFreeAllocatedBins+0x7e
97cf299c 81d727f4 a47370f8 a47376ac a47370f8 nt!HvMapHive+0x1ff
97cf29b4 81e335ec a4737001 00000005 00000002 nt!HvInitializeHive+0x5b6
97cf2a34 81d753bc 97cf2a8c 00000005 00000000 nt!CmpInitializeHive+0x3df
97cf2ab0 81d769f3 97cf2cd8 00000000 97cf2b14 nt!CmpInitHiveFromFile+0x199
97cf2ae0 81d76e19 97cf2cd8 97cf2bb8 97cf2b3c nt!CmpCmdHiveOpen+0x29
97cf2bfc 81d77a6f 97cf2cb4 97cf2cd8 00000000 nt!CmLoadKey+0x389
97cf2d2c 81d77f0f 026ff3a0 00000000 00000000 nt!NtLoadKeyEx+0x559
97cf2d54 81c461fa 026ff3a0 026ff3b8 026ff3e8 nt!NtLoadKey+0x18
97cf2d54 77980f34 026ff3a0 026ff3b8 026ff3e8 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
026ff3e8 00000000 00000000 00000000 00000000 0x77980f34


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!HvpGetBinMemAlloc+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4549ad6c

FAILURE_BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

Followup: MachineOwner
 
D

Dustin Harper

Try shutting off MusicMatch [MusicMatch English (file name mmeng.exe] if you
have it. It seems that it may be conflicting with OneCare for something. If
the problem goes away, it may just be that MusicMatch has a problem. You
might check for a fix with them.

If you don't have MusicMatch, let me know. That is the only thing that came
up with the process name of mmeng.exe.

--
Dustin Harper
(e-mail address removed)
http://www.vistarip.com

--
venkat said:
Hi
I have been testing Windows Vista on my PC - Dell XPS 8400, 2GB memory,
500GB harddrive.

Since having One care enabled, I have been getting BSOD very frequently
(sometimes more than once). The stack trace from minidump always points
to
Mmeng.exe - from Onecare, I suppose.

Here is analyze -v output from windbg on one of the dumps. Has anyone
seen
this before, any fix from Onecare or Vista for this?




0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad
or
it
is pointing at freed memory.
Arguments:
Arg1: a3846004, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 81d861f3, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81d275a0
Unable to read MiSystemVaType memory at 81d08680
a3846004

FAULTING_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_RC

BUGCHECK_STR: 0x50

PROCESS_NAME: MsMpEng.exe

CURRENT_IRQL: 0

TRAP_FRAME: 97cf28b4 -- (.trap ffffffff97cf28b4)
ErrCode = 00000000
eax=00000000 ebx=9ffaca94 ecx=a3846000 edx=00000000 esi=a3846000
edi=a47370f8
eip=81d861f3 esp=97cf2928 ebp=97cf2928 iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
nt!HvpGetBinMemAlloc+0x8:
81d861f3 034104 add eax,dword ptr [ecx+4]
ds:0023:a3846004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c49304 to 81c57535

STACK_TEXT:
97cf289c 81c49304 00000000 a3846004 00000000 nt!MmAccessFault+0x14b
97cf289c 81d861f3 00000000 a3846004 00000000 nt!KiTrap0E+0xdc
97cf2928 81e37c25 a47370f8 a47370f8 a0e04000 nt!HvpGetBinMemAlloc+0x8
97cf2948 81d757ea 97cf92dc 00000000 00000000 nt!HvpFreeAllocatedBins+0x7e
97cf299c 81d727f4 a47370f8 a47376ac a47370f8 nt!HvMapHive+0x1ff
97cf29b4 81e335ec a4737001 00000005 00000002 nt!HvInitializeHive+0x5b6
97cf2a34 81d753bc 97cf2a8c 00000005 00000000 nt!CmpInitializeHive+0x3df
97cf2ab0 81d769f3 97cf2cd8 00000000 97cf2b14 nt!CmpInitHiveFromFile+0x199
97cf2ae0 81d76e19 97cf2cd8 97cf2bb8 97cf2b3c nt!CmpCmdHiveOpen+0x29
97cf2bfc 81d77a6f 97cf2cb4 97cf2cd8 00000000 nt!CmLoadKey+0x389
97cf2d2c 81d77f0f 026ff3a0 00000000 00000000 nt!NtLoadKeyEx+0x559
97cf2d54 81c461fa 026ff3a0 026ff3b8 026ff3e8 nt!NtLoadKey+0x18
97cf2d54 77980f34 026ff3a0 026ff3b8 026ff3e8 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
026ff3e8 00000000 00000000 00000000 00000000 0x77980f34


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!HvpGetBinMemAlloc+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4549ad6c

FAILURE_BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

Followup: MachineOwner
---------


--
--

Regards

Venkat
Click to expand...
 
C

Cougar

Out of courisity. Did you use the microsft driver for you large harddrive?


I have experienced this is use and resolved it by getting the correct driver
fromt he hard drive manufacture.

Cougar


Dustin Harper said:
Try shutting off MusicMatch [MusicMatch English (file name mmeng.exe] if
you have it. It seems that it may be conflicting with OneCare for
something. If the problem goes away, it may just be that MusicMatch has a
problem. You might check for a fix with them.

If you don't have MusicMatch, let me know. That is the only thing that
came up with the process name of mmeng.exe.

--
Dustin Harper
(e-mail address removed)
http://www.vistarip.com

--
venkat said:
Hi
I have been testing Windows Vista on my PC - Dell XPS 8400, 2GB memory,
500GB harddrive.

Since having One care enabled, I have been getting BSOD very frequently
(sometimes more than once). The stack trace from minidump always points
to
Mmeng.exe - from Onecare, I suppose.

Here is analyze -v output from windbg on one of the dumps. Has anyone
seen
this before, any fix from Onecare or Vista for this?




0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad
or
it
is pointing at freed memory.
Arguments:
Arg1: a3846004, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 81d861f3, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81d275a0
Unable to read MiSystemVaType memory at 81d08680
a3846004

FAULTING_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_RC

BUGCHECK_STR: 0x50

PROCESS_NAME: MsMpEng.exe

CURRENT_IRQL: 0

TRAP_FRAME: 97cf28b4 -- (.trap ffffffff97cf28b4)
ErrCode = 00000000
eax=00000000 ebx=9ffaca94 ecx=a3846000 edx=00000000 esi=a3846000
edi=a47370f8
eip=81d861f3 esp=97cf2928 ebp=97cf2928 iopl=0 nv up ei pl zr na
pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetBinMemAlloc+0x8:
81d861f3 034104 add eax,dword ptr [ecx+4]
ds:0023:a3846004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c49304 to 81c57535

STACK_TEXT:
97cf289c 81c49304 00000000 a3846004 00000000 nt!MmAccessFault+0x14b
97cf289c 81d861f3 00000000 a3846004 00000000 nt!KiTrap0E+0xdc
97cf2928 81e37c25 a47370f8 a47370f8 a0e04000 nt!HvpGetBinMemAlloc+0x8
97cf2948 81d757ea 97cf92dc 00000000 00000000 nt!HvpFreeAllocatedBins+0x7e
97cf299c 81d727f4 a47370f8 a47376ac a47370f8 nt!HvMapHive+0x1ff
97cf29b4 81e335ec a4737001 00000005 00000002 nt!HvInitializeHive+0x5b6
97cf2a34 81d753bc 97cf2a8c 00000005 00000000 nt!CmpInitializeHive+0x3df
97cf2ab0 81d769f3 97cf2cd8 00000000 97cf2b14 nt!CmpInitHiveFromFile+0x199
97cf2ae0 81d76e19 97cf2cd8 97cf2bb8 97cf2b3c nt!CmpCmdHiveOpen+0x29
97cf2bfc 81d77a6f 97cf2cb4 97cf2cd8 00000000 nt!CmLoadKey+0x389
97cf2d2c 81d77f0f 026ff3a0 00000000 00000000 nt!NtLoadKeyEx+0x559
97cf2d54 81c461fa 026ff3a0 026ff3b8 026ff3e8 nt!NtLoadKey+0x18
97cf2d54 77980f34 026ff3a0 026ff3b8 026ff3e8 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
026ff3e8 00000000 00000000 00000000 00000000 0x77980f34


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!HvpGetBinMemAlloc+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4549ad6c

FAILURE_BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

Followup: MachineOwner
---------


--
--

Regards

Venkat
Click to expand...
Click to expand...
 
G

Guest

Sorry, the process name is MsMpEng.exe - I misspelt. This seems to be from
MS OneCare. I don't have music match on my system (I uninstalled it before).
Also, I have two hard disks in a RAID-0 configuration (150MB each and
another 200GB hard disk) for a total of 500GB. Sorry for the confusion!

Thanks for the help

--
--

Regards

Venkat


Cougar said:
Out of courisity. Did you use the microsft driver for you large harddrive?


I have experienced this is use and resolved it by getting the correct driver
fromt he hard drive manufacture.

Cougar


Dustin Harper said:
Try shutting off MusicMatch [MusicMatch English (file name mmeng.exe] if
you have it. It seems that it may be conflicting with OneCare for
something. If the problem goes away, it may just be that MusicMatch has a
problem. You might check for a fix with them.

If you don't have MusicMatch, let me know. That is the only thing that
came up with the process name of mmeng.exe.

--
Dustin Harper
(e-mail address removed)
http://www.vistarip.com

--
venkat said:
Hi
I have been testing Windows Vista on my PC - Dell XPS 8400, 2GB memory,
500GB harddrive.

Since having One care enabled, I have been getting BSOD very frequently
(sometimes more than once). The stack trace from minidump always points
to
Mmeng.exe - from Onecare, I suppose.

Here is analyze -v output from windbg on one of the dumps. Has anyone
seen
this before, any fix from Onecare or Vista for this?




0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain bad
or
it
is pointing at freed memory.
Arguments:
Arg1: a3846004, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 81d861f3, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81d275a0
Unable to read MiSystemVaType memory at 81d08680
a3846004

FAULTING_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_RC

BUGCHECK_STR: 0x50

PROCESS_NAME: MsMpEng.exe

CURRENT_IRQL: 0

TRAP_FRAME: 97cf28b4 -- (.trap ffffffff97cf28b4)
ErrCode = 00000000
eax=00000000 ebx=9ffaca94 ecx=a3846000 edx=00000000 esi=a3846000
edi=a47370f8
eip=81d861f3 esp=97cf2928 ebp=97cf2928 iopl=0 nv up ei pl zr na
pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetBinMemAlloc+0x8:
81d861f3 034104 add eax,dword ptr [ecx+4]
ds:0023:a3846004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c49304 to 81c57535

STACK_TEXT:
97cf289c 81c49304 00000000 a3846004 00000000 nt!MmAccessFault+0x14b
97cf289c 81d861f3 00000000 a3846004 00000000 nt!KiTrap0E+0xdc
97cf2928 81e37c25 a47370f8 a47370f8 a0e04000 nt!HvpGetBinMemAlloc+0x8
97cf2948 81d757ea 97cf92dc 00000000 00000000 nt!HvpFreeAllocatedBins+0x7e
97cf299c 81d727f4 a47370f8 a47376ac a47370f8 nt!HvMapHive+0x1ff
97cf29b4 81e335ec a4737001 00000005 00000002 nt!HvInitializeHive+0x5b6
97cf2a34 81d753bc 97cf2a8c 00000005 00000000 nt!CmpInitializeHive+0x3df
97cf2ab0 81d769f3 97cf2cd8 00000000 97cf2b14 nt!CmpInitHiveFromFile+0x199
97cf2ae0 81d76e19 97cf2cd8 97cf2bb8 97cf2b3c nt!CmpCmdHiveOpen+0x29
97cf2bfc 81d77a6f 97cf2cb4 97cf2cd8 00000000 nt!CmLoadKey+0x389
97cf2d2c 81d77f0f 026ff3a0 00000000 00000000 nt!NtLoadKeyEx+0x559
97cf2d54 81c461fa 026ff3a0 026ff3b8 026ff3e8 nt!NtLoadKey+0x18
97cf2d54 77980f34 026ff3a0 026ff3b8 026ff3e8 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
026ff3e8 00000000 00000000 00000000 00000000 0x77980f34


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetBinMemAlloc+8
81d861f3 034104 add eax,dword ptr [ecx+4]

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!HvpGetBinMemAlloc+8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4549ad6c

FAILURE_BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

BUCKET_ID: 0x50_nt!HvpGetBinMemAlloc+8

Followup: MachineOwner
---------


--
--

Regards

Venkat
Click to expand...
Click to expand...
Click to expand...
 
S

StephenB

venkat said:
Sorry, the process name is MsMpEng.exe - I misspelt. This seems to be from
MS OneCare. I don't have music match on my system (I uninstalled it before).
Also, I have two hard disks in a RAID-0 configuration (150MB each and
another 200GB hard disk) for a total of 500GB. Sorry for the confusion!

Thanks for the help
Click to expand...
It sure seems like a driver crash based on the reported fault and it also
appears that the OneCare active scanning engine is involved.
I strongly suggest reporting this to OneCare support - How to reach support -
http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=1183028&SiteID=2

And, the link above puts you in the OneCare forums. Posting the problem there in
the a/v or antispyware topic folders would be very helpful.
-steve
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

BSOD problem - BugCheck 50, {c258e758, 0, 89a47e26, 2} 4
VISTA BSOD - Please Help!!!!! 1
Blue screen when trying to wake up from sleep 1
Irda.sys bsod 10
Vista BSOD and debug 3
Get BSOD error and shut down when loading blank CD/DVD media 2
BSOD and random restarts 1
Random STOP error 7e - help reading WinDbg analysis of full dump 3

Top