BSOD (dump attached)

badkarma11 said:

More dumps than staten island. Help?

Related to ctprxy2k.sys Creative Proxy Device Driver (WDM) from Creative Technology.

I would update it to newest at least or un-install to test.

It caused pool_corruption so I would also run memtest.

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program.

Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\060911-21730-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`0305a650
Debug session time: Thu Jun  9 07:35:37.062 2011 (GMT-4)
System Uptime: 0 days 0:21:54.841
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff8a0024df620, fffff8a0024df620, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+cbb )

Followup: Pool_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a0024df620, the pool entry being checked.
Arg3: fffff8a0024df620, the read back flink freelist value (should be the same as 2).
Arg4: 0000000000000000, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  lsass.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002fbf70f to fffff80002e94d00

STACK_TEXT:  
fffff880`09ed7878 fffff800`02fbf70f : 00000000`00000019 00000000`00000003 fffff8a0`024df620 fffff8a0`024df620 : nt!KeBugCheckEx
fffff880`09ed7880 fffff800`02fc11a1 : fffffa80`071c0880 fffff8a0`087359f0 00000000`00000000 00000000`000007ff : nt!ExDeferredFreePool+0xcbb
fffff880`09ed7910 fffff800`02e9eb1c : fffffa80`07b31060 00000000`00000000 fffff880`656b6f54 fffffa80`069a5f30 : nt!ExFreePoolWithTag+0x411
fffff880`09ed79c0 fffff800`0315db45 : fffff880`09ed7c60 00000000`00000000 fffff8a0`08735a50 00000000`00000001 : nt!ObfDereferenceObject+0xdc
fffff880`09ed7a20 fffff800`02e93f93 : 00000000`01c2e70c fffffa80`07b31060 00000000`01956610 00000000`01956610 : nt!NtSetInformationThread+0x254
fffff880`09ed7be0 00000000`779313ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01c2e618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779313ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+cbb
fffff800`02fbf70f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExDeferredFreePool+cbb

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+cbb

BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+cbb

Followup: Pool_corruption
---------

badkarma11 said:

Can't find that file anywhere on the machine... There's a ctprxy46.dll, 5/10/11 in the system32 folder
The link attached to the file name in your post is dead, BTW

That DLL may be malware disguising itself as a real file. Please DL malwarebytes and run it in safe mode.