BSOD, guessing driver, 0x5c

nemethv · 28 Nov 2012

Hi,

Newly installed computer, worked fine until updated all the Windows update things.
Ran memtest, passed 3 times. BSOD right after GUI loading up, not in safe mode, so I'm guessing it's a driver of some sort...
Can you have a look pls.
Thank you

bagavan · 28 Nov 2012

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {4441, 2, 0, fffff800035f7dd3}

*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+307e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000004441, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800035f7dd3, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExFreePoolWithTag+43
fffff800`035f7dd3 418b45f0        mov     eax,dword ptr [r13-10h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c610 -- (.trap 0xfffff80000b9c610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000004451
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800035f7dd3 rsp=fffff80000b9c7a0 rbp=fffffa800f8f00b0
 r8=0000000000000000  r9=0000000000000000 r10=fffffa800f8f0020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`035f7dd3 418b45f0        mov     eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034cb569 to fffff800034cbfc0

STACK_TEXT:  
fffff800`00b9c4c8 fffff800`034cb569 : 00000000`0000000a 00000000`00004441 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`034ca1e0 : 00000000`00000103 fffffa80`0ef3c6e0 fffffa80`0ef06000 fffffa80`0e46b170 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c610 fffff800`035f7dd3 : fffffa80`0f8f00b0 fffffa80`0dfbe1a0 fffffa80`0e5fd8d0 fffff880`07588f4e : nt!KiPageFault+0x260
fffff800`00b9c7a0 fffff880`01454845 : 00000000`00000000 00000000`00000000 fffffa80`0f8f5670 00000000`00004451 : nt!ExFreePoolWithTag+0x43
fffff800`00b9c850 fffff880`0742707e : fffffa80`0f8f00b0 fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 : ndis!NdisFreeMemory+0x15
fffff800`00b9c880 fffffa80`0f8f00b0 : fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 : VBoxNetFlt+0x307e
fffff800`00b9c888 fffffa80`0e46d8f0 : 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e : 0xfffffa80`0f8f00b0
fffff800`00b9c890 00000000`00000000 : fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e fffffa80`0f8f5600 : 0xfffffa80`0e46d8f0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
VBoxNetFlt+307e
fffff880`0742707e ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  VBoxNetFlt+307e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME:  VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  508ac17d

FAILURE_BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+307e

BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+307e

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000004441, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800035f7dd3, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExFreePoolWithTag+43
fffff800`035f7dd3 418b45f0        mov     eax,dword ptr [r13-10h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c610 -- (.trap 0xfffff80000b9c610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000004451
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800035f7dd3 rsp=fffff80000b9c7a0 rbp=fffffa800f8f00b0
 r8=0000000000000000  r9=0000000000000000 r10=fffffa800f8f0020
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ExFreePoolWithTag+0x43:
fffff800`035f7dd3 418b45f0        mov     eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034cb569 to fffff800034cbfc0

STACK_TEXT:  
fffff800`00b9c4c8 fffff800`034cb569 : 00000000`0000000a 00000000`00004441 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`034ca1e0 : 00000000`00000103 fffffa80`0ef3c6e0 fffffa80`0ef06000 fffffa80`0e46b170 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c610 fffff800`035f7dd3 : fffffa80`0f8f00b0 fffffa80`0dfbe1a0 fffffa80`0e5fd8d0 fffff880`07588f4e : nt!KiPageFault+0x260
fffff800`00b9c7a0 fffff880`01454845 : 00000000`00000000 00000000`00000000 fffffa80`0f8f5670 00000000`00004451 : nt!ExFreePoolWithTag+0x43
fffff800`00b9c850 fffff880`0742707e : fffffa80`0f8f00b0 fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 : ndis!NdisFreeMemory+0x15
fffff800`00b9c880 fffffa80`0f8f00b0 : fffffa80`0e46d8f0 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 : VBoxNetFlt+0x307e
fffff800`00b9c888 fffffa80`0e46d8f0 : 00000000`00000000 fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e : 0xfffffa80`0f8f00b0
fffff800`00b9c890 00000000`00000000 : fffffa80`0dce01a0 00000000`00000000 fffff880`0150e64e fffffa80`0f8f5600 : 0xfffffa80`0e46d8f0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
VBoxNetFlt+307e
fffff880`0742707e ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  VBoxNetFlt+307e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME:  VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  508ac17d

FAILURE_BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+307e

BUCKET_ID:  X64_0xC5_2_VBoxNetFlt+307e

Followup: MachineOwner
---------

please uninstall vbox and see if the error persists

nemethv · 28 Nov 2012

That was effective, thank you!!

bagavan · 28 Nov 2012

nemethv said:

That was effective, thank you!!

Glad I could help you..

If you still get BSOD then upload the dumps and we shall analyse it for you