BSOD - WORKER THREAD RETURNED AT BAD IRQL ntoskrnl.exe

TheAngelGuy · 22 Nov 2012

Hi, there,

Thanks for the help.

Can't seem to find what can resolve this.

Happens once per day randomly.

Thanks for any advice or support.

You guys are the best.

- Paul

Arc · 23 Nov 2012

Welcome aboard.

So much network error

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, 4040051, fffffa800db4ae50}

GetPointerFromAddress: unable to read from fffff80003509100
GetUlongFromAddress: unable to read from fffff800035091c0
Probably caused by : HTTP.sys ( HTTP!UxpWskCloseSocket+5d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 0000000004040051, Memory contents of the pool block
Arg4: fffffa800db4ae50, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffffa800db4ae50 Nonpaged pool

FREED_POOL_TAG:  Flng

BUGCHECK_STR:  0xc2_7_Flng

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003404be9 to fffff800032d9fc0

STACK_TEXT:  
fffff880`072c9038 fffff800`03404be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`04040051 : nt!KeBugCheckEx
fffff880`072c9040 fffff880`01b03c58 : 00000000`00000002 00000000`00000000 fffffa80`0db4ae50 fffffa80`095e77c0 : nt!ExDeferredFreePool+0x1201
fffff880`072c90f0 fffff880`01ae6cea : fffffa80`0fa41470 fffffa80`11b387c0 fffffa80`1771ebe8 00000000`00000000 : tcpip!FlpEtDeleteEndpoint+0x28
fffff880`072c9120 fffff880`01aa2f6c : fffffa80`0fa41470 fffffa80`0fc6b3c0 00000000`00000000 00000000`00000000 : tcpip!WfpAlepNotifyEndpointDeletion+0x3a
fffff880`072c9170 fffff880`01a6615f : fffffa80`1771ebe8 fffffa80`0fc6b3c0 fffffa80`1771ebe8 fffffa80`0fc6b3c0 : tcpip! ?? ::FNODOBFM::`string'+0x1e535
fffff880`072c91d0 fffff880`01a08efd : fffffa80`1771ebe8 00000000`00000002 80000004`00000000 00000000`00000000 : tcpip!WfpAleEndpointTeardownHandler+0x6f
fffff880`072c9200 fffff880`01a29f80 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!TcpCleanupListenerWorkQueueRoutine+0xad
fffff880`072c9270 fffff880`01a08dfe : fffffa80`153b2530 fffff880`072c9b60 fffffa80`0fc6b3c0 00000000`00000000 : tcpip!TcpDereferenceListener+0x20
fffff880`072c92a0 fffff880`01a08e19 : fffffa80`09d7dec0 00000000`00000000 00000000`00000001 00000000`00000002 : tcpip!TcpCloseListener+0x6e
fffff880`072c92f0 fffff880`03f0280d : 00000000`00000000 00000000`00000001 fffffa80`14f05740 fffffa80`14f05758 : tcpip!TcpTlListenerCloseEndpoint+0x9
fffff880`072c9320 fffff880`03f02888 : fffff880`072c9300 00000000`000007ff 00000000`00000b00 fffff880`072c9b60 : afd!WskProCoreCloseSocket+0xbd
fffff880`072c93a0 fffff880`080ffbcd : fffffa80`0b117650 00000000`00000000 00000000`00000001 00000000`00000000 : afd!WskProIRPCloseSocket+0x38
fffff880`072c93d0 fffff880`0810f24a : fffffa80`1724da40 fffff880`072c962a 00000000`00000100 fffff800`03570faa : HTTP!UxpWskCloseSocket+0x5d
fffff880`072c9440 fffff880`080afed4 : fffff8a0`02624010 fffffa80`17b4f6c0 00000000`00000001 fffff800`03405350 : HTTP!UxpWskCloseListenSocket+0x2a
fffff880`072c9470 fffff880`08127348 : fffff880`072c9b60 fffffa80`17ae47b0 fffffa80`00000001 00000000`06281d10 : HTTP!UxpTlCloseListenEndpoint+0x14
fffff880`072c94a0 fffff880`080aff4e : fffffa80`176dfd10 fffff8a0`0e1c6890 00000000`00100010 fffff8a0`14626316 : HTTP!UxpTlDisassociateListenEndpoints+0x28
fffff880`072c94d0 fffff880`080b011d : 00000000`00000000 00000000`00000001 fffff8a0`028523c0 fffffa80`1881c0d0 : HTTP!UxpTlCloseAddressEndpoint+0xe
fffff880`072c9500 fffff880`080b0c12 : fffff8a0`02624010 fffff880`081130b5 fffff880`072c9500 fffff880`0000000f : HTTP!UxTlCloseEndpointRequest+0x3d
fffff880`072c9530 fffff880`08127c2e : fffff8a0`02624010 fffff8a0`0e1c6890 00000000`00000000 00000000`00000002 : HTTP!UlRemoveSiteFromEndpointList+0x12
fffff880`072c9560 fffff880`08127e6c : 00000000`00000000 fffff880`072c9b60 00000000`00000000 fffff8a0`02697cd0 : HTTP!UlpTreeDeleteRegistration+0x5e
fffff880`072c9590 fffff880`0812874e : fffffa80`17d7bbc0 fffff8a0`146262f0 fffff8a0`028523c0 00000000`00000000 : HTTP!UlRemoveUrlFromConfigGroup+0x12c
fffff880`072c9680 fffff800`035f0687 : fffffa80`0e2617d0 fffff880`072c9b60 fffffa80`0e2617d0 fffffa80`1881c0d0 : HTTP!UlRemoveUrlFromUrlGroupIoctl+0x1ae
fffff880`072c98d0 fffff800`035f0ee6 : fffff8a0`0271a8d0 00000000`0000066c 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`072c9a00 fffff800`032d9253 : fffffa80`14ddd2a0 00000000`05cef7c8 fffff880`072c9a88 00000000`05cef888 : nt!NtDeviceIoControlFile+0x56
fffff880`072c9a70 00000000`77a5138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`05ceeac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a5138a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
HTTP!UxpWskCloseSocket+5d
fffff880`080ffbcd 3d03010000      cmp     eax,103h

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  HTTP!UxpWskCloseSocket+5d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: HTTP

IMAGE_NAME:  HTTP.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce793ce

FAILURE_BUCKET_ID:  X64_0xc2_7_Flng_HTTP!UxpWskCloseSocket+5d

BUCKET_ID:  X64_0xc2_7_Flng_HTTP!UxpWskCloseSocket+5d

Followup: MachineOwner
---------

Uninstall McAfee Using McAfee Removal Tool.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Download and install those, and then run full system scans with both of them, one by one.

Let us know the results.