Error signature: BCCode

[Smarthy]

Hello, my win2003 server crashes often lately.

Can anyone help me solve this problem.
The signature is:
BCCode : 4e BCP1 : 0000009A BCP2 : 00007E76 BCP3 : 00000006
BCP4 : 00000006 OSVer : 5_2_3790 SP : 2_0 Product : 16_3

Attached are the minidump files
Thx for your help.

 

[Smarthy]

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000009a,
Arg2: 00007e76
Arg3: 00000006
Arg4: 00000006

Debugging Details:
------------------

Unable to load image nlem32nt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nlem32nt.sys
*** ERROR: Module load completed but symbols could not be loaded for nlem32nt.sy
s
Unable to load image appguard.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for appguard.sys
*** ERROR: Module load completed but symbols could not be loaded for appguard.sy
s

BUGCHECK_STR: 0x4E_9a

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8086598b to 80827c83

STACK_TEXT:
f78c65a4 8086598b 0000004e 0000009a 00007e76 nt!KeBugCheckEx+0x1b
f78c65c0 80891779 816dd4e8 808aeae0 021029f8 nt!MiBadRefCount+0x33
f78c65f8 808925bb 87e76000 87e78000 896ebcf0 nt!MiFreePoolPages+0x5c9
f78c6650 f71947d9 3966744e 00000000 f78c6854 nt!ExFreePoolWithTag+0x277
f78c6660 f7194817 891f2668 87e76000 f7199f4b Ntfs!NtfsDeleteMdlAndBuffer+0x31
f78c66fc f71972c7 e15c5a40 f78c67b8 f71d971b Ntfs!NtfsCommonWrite+0x180b
f78c6854 f71987d0 f78c6864 896ebcf0 0108070a Ntfs!LfsReleaseLch+0x1f
f78c69d0 8081df85 8b51f020 896ebcf0 8b67e260 Ntfs!NtfsFsdWrite+0x16a
f78c69e4 f724fc45 8b67e260 8b5a2380 00000000 nt!IofCallDriver+0x45
f78c6a0c 8081df85 8b521850 896ebcf0 8b6dda18 fltmgr!FltpDispatch+0x6f
f78c6a20 f7732d48 8b5a2380 8b6dda18 8b51cef0 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may be wrong.
f78c6a9c f7733f12 8b783580 896ebcf0 88571d00 nlem32nt+0x3d48
f78c6ad4 8081df85 8b783580 896ebcf0 8b6dd780 nlem32nt+0x4f12
f78c6ae8 f750c2f4 8081df85 8b51cef0 896ebcf0 nt!IofCallDriver+0x45
f78c6b00 8081e69f 00000000 f78c6b3c 8b680548 appguard+0x52f4
f78c6b14 80836446 8b5a230e f78c6b3c f78c6c04 nt!IoSynchronousPageWrite+0xaf
f78c6c30 8083782b e173a858 e173a868 8b680548 nt!MiFlushSectionInternal+0x6ba
f78c6c74 8080f8fe 8b51e578 f78c6c00 00002000 nt!MmFlushSection+0x211
f78c6cfc 8080fc77 00002000 00000000 00000001 nt!CcFlushCache+0x3a6
f78c6d40 808127c2 8b77db40 808ae5c0 8b77c280 nt!CcWriteBehind+0x11b
f78c6d80 80880469 8b77c280 00000000 8b77db40 nt!CcWorkerThread+0x15a
f78c6dac 80949b7c 8b77c280 00000000 00000000 nt!ExpWorkerThread+0xeb
f78c6ddc 8088e092 8088037e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nlem32nt+3d48
f7732d48 ?? ???

SYMBOL_STACK_INDEX: b

SYMBOL_NAME: nlem32nt+3d48

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nlem32nt

IMAGE_NAME: nlem32nt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3fbb84b9

FAILURE_BUCKET_ID: 0x4E_9a_nlem32nt+3d48

BUCKET_ID: 0x4E_9a_nlem32nt+3d48

Followup: MachineOwner
---------

3: kd>

 

[kimsland]

Can you locate nlem32nt.sys through search
And rename it to nlem32nt.old

Or locate any HardDrive (or flash drive) USB software and uninstall it
Then restart

 

[Smarthy]

Ok I've renamed nlem32nt.sys to .old but after that a financial application stopped working. So I've replaced the driver with one from another server and thats what stopped the server from crashing on this driver.
But, now the problem with this server is:
https://www.techspot.com/vb/topic115255.html
https://www.techspot.com/vb/topic116606.html