Win XP SP3 BSOD caused by jqs.exe and other stuff

[Mistiqe]

Hello,

i'm struggling with BSODs lately. I opened the dump files in windbg to check what's going on but honestly - this time it's a black magic to me. Can you please take a look at it?

Dump #1

Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, d49f2001, 4f3c, c0c00000}
Probably caused by : memory_corruption ( nt!MiLocateWsle+c0 )
Followup: MachineOwner

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: d49f2001
Arg3: 00004f3c
Arg4: c0c00000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80529e59 to 8053767a

STACK_TEXT:
f896abec 80529e59 0000001a 00041284 d49f2001 nt!KeBugCheckEx+0x1b
f896ac24 804f49d5 00004f3c 821ea008 823b98c0 nt!MiLocateWsle+0xc0
f896ac64 805709ac d49f2000 81e524e8 00000000 nt!MmUnmapViewInSystemCache+0xc2
f896ac7c 804f48c0 823b98c0 821ea008 00000000 nt!CcUnmapVacb+0x2a
f896acb0 804f4dce 00000000 00000000 821ea06c nt!CcUnmapVacbArray+0x117
f896accc 804f4d40 821ea008 80701a4c 821ea008 nt!CcUnmapAndPurge+0x20
f896acfc 804ed964 00000001 8055f690 8201e3f8 nt!CcDeleteSharedCacheMap+0xc5
f896ad34 804e67c8 823c81f0 8056a5c0 823c7c98 nt!CcWriteBehind+0x357
f896ad7c 804e23b5 823c81f0 00000000 823c7c98 nt!CcWorkerThread+0x12f
f896adac 80575723 823c81f0 00000000 00000000 nt!ExpWorkerThread+0xef
f896addc 804ec6d9 804e22f1 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiLocateWsle+c0
80529e59 006a00 add byte ptr [edx],ch
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiLocateWsle+c0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 498c19b5
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c0
BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c0
Followup: MachineOwner

Dump #2

Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {80000018, 0, 80512f54, 0}
Could not read faulting driver name
Probably caused by : sr.sys ( sr!SrCleanup+b3 )
Followup: MachineOwner

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 80000018, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80512f54, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

READ_ADDRESS: 80000018
FAULTING_IP:
nt!FsRtlCheckOplock+22
80512f54 837f1801 cmp dword ptr [edi+18h],1
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: jqs.exe
LAST_CONTROL_TRANSFER: from f82af918 to 80512f54

STACK_TEXT:
ba4098b0 f82af918 e1822b88 82124518 ba409ae4 nt!FsRtlCheckOplock+0x22
ba409ac8 f82afd4d ba409ae4 82124518 822840d8 Ntfs!NtfsCommonCleanup+0xec7
ba409c40 804e13d9 82284770 82124518 82319b98 Ntfs!NtfsFsdCleanup+0xcf
ba409c50 f8332bbf 81edf548 82124528 ba409ca0 nt!IopfCallDriver+0x31
ba409c60 804e13d9 82284020 82124518 82124518 sr!SrCleanup+0xb3
ba409c70 8057b32f 81edf530 00000038 823ebca0 nt!IopfCallDriver+0x31
ba409ca0 8056f9a2 81f13540 82284020 00120089 nt!IopCloseFile+0x26b
ba409cd4 8056faf5 81f13540 00000001 823ebca0 nt!ObpDecrementHandleCount+0xd8
ba409cfc 8056fa1b e2e63970 81edf548 000003b4 nt!ObpCloseHandleTableEntry+0x14d
ba409d44 8056fa65 000003b4 00000001 00000000 nt!ObpCloseHandle+0x87
ba409d58 804dd99f 000003b4 00befc4c 7c90e514 nt!NtClose+0x1d
ba409d58 7c90e514 000003b4 00befc4c 7c90e514 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00befc4c 00000000 00000000 00000000 00000000 0x7c90e514

STACK_COMMAND: kb
FOLLOWUP_IP:
sr!SrCleanup+b3
f8332bbf 5f pop edi
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: sr!SrCleanup+b3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: sr
IMAGE_NAME: sr.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 480252c2
FAILURE_BUCKET_ID: 0x50_sr!SrCleanup+b3
BUCKET_ID: 0x50_sr!SrCleanup+b3
Followup: MachineOwner

Dump #3

Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 1722d, 7, 0}
Probably caused by : memory_corruption ( nt!MiDecrementShareCount+4f )
Followup: MachineOwner

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0001722d, page frame number
Arg3: 00000007, current page state
Arg4: 00000000, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: jqs.exe
LAST_CONTROL_TRANSFER: from 80529c49 to 8053767a

STACK_TEXT:
b99ec7b8 80529c49 0000004e 00000099 0001722d nt!KeBugCheckEx+0x1b
b99ec7e4 804f20f3 02501fff c0009408 82030be0 nt!MiDecrementShareCount+0x4f
b99ec87c 804f2067 ffffffa4 00000010 82030be0 nt!MiProcessValidPteList+0x86
b99ecca0 80571899 02502000 c0009404 00000080 nt!MiDecommitPages+0x328
b99ecd4c 804dd99f ffffffff 00befb38 00befb3c nt!NtFreeVirtualMemory+0x588
b99ecd4c 7c90e514 ffffffff 00befb38 00befb3c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00befae4 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiDecrementShareCount+4f
80529c49 f6400401 test byte ptr [eax+4],1
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiDecrementShareCount+4f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 498c19b5
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount+4f
BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount+4f
Followup: MachineOwner

Dump #4

Use !analyze -v to get detailed debugging information.
BugCheck 100000BE, {b9a488e8, 1fabe121, f8976c3c, a}
Probably caused by : wdmaud.sys ( wdmaud!RemoveMdlFromList+41 )
Followup: MachineOwner

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: b9a488e8, Virtual address for the attempted write.
Arg2: 1fabe121, PTE contents.
Arg3: f8976c3c, (reserved)
Arg4: 0000000a, (reserved)

Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from b9a3d5bf to b9a3d711

STACK_TEXT:
f8976cc0 b9a3d5bf 81b17580 81b90748 f8976ce0 wdmaud!RemoveMdlFromList+0x41
f8976cd0 b9a3d7f1 81b17580 81b7f6b0 f8976cf4 wdmaud!wdmaudUnmapBuffer+0x13
f8976ce0 b9a3d7c5 81b90748 82072153 82072008 wdmaud!UnmapWriteContext+0x11
f8976cf4 b9a3d758 81b90748 00000000 82072008 wdmaud!CleanupWriteContext+0x16
f8976d10 804e18ff 00000000 82072008 81b90748 wdmaud!wqWriteWaveCallBack+0x1d
f8976d40 b918e3a0 82072008 f8976d64 b917d943 nt!IopfCompleteRequest+0xa2
f8976d4c b917d943 82072008 81f21148 81b180b0 kmixer!MxCompleteRequest+0x20
f8976d64 f79af7ee 81b18008 81f21128 8056a5c0 kmixer!FreeDeadIrps+0x43
f8976d7c 804e23b5 81f21128 00000000 823c72b8 ks!WorkerThread+0x45
f8976dac 80575723 81f21128 00000000 00000000 nt!ExpWorkerThread+0xef
f8976ddc 804ec6d9 804e22f1 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb
FOLLOWUP_IP:
wdmaud!RemoveMdlFromList+41
b9a3d711 8908 mov dword ptr [eax],ecx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: wdmaud!RemoveMdlFromList+41
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: wdmaud
IMAGE_NAME: wdmaud.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48025c3e
FAILURE_BUCKET_ID: 0xBE_wdmaud!RemoveMdlFromList+41
BUCKET_ID: 0xBE_wdmaud!RemoveMdlFromList+41
Followup: MachineOwner

The last dump should be easy to fix but i'm more interested in the previous 3. What is wrong with my computer? Could someone help me? I would highly appreciate any help.

I attach those dump file for further investigation.

 

[OLBY]

i never understood that bluescreen

 

[Mistiqe]

i never understood that bluescreen

Then don't spam this thread with unnecessary posts. Thank you.

 

[superty12]

jqs.exe

http://www.ghacks.net/2008/12/15/jqsexe/
That is what jqs.exe is.

 

[orondf]

Maybe you sould use memtest
www[DOT]memtest.org

 

[Mistiqe]

That is what jqs.exe is.

I know what jqs.exe is. That doesn't solve my problem, does it? When you check the debug info you will see Driver_fault, that's what is causing the BSOD. The problem is that i have no idea what driver is causing it.

Maybe you sould use memtest
www[DOT]memtest.org

That was the second thing i did. No errors. Tested both RAM modules separately.

 

[orondf]

try updating your drivers

 

[Route44]

How long did you test with Memtest? The rule is a minimum of 7 Passes. One of your errors is 0x0000004E: PFN_LIST_CORRUPT and this error is a very strong indicator of corrupted memory.