BSOD - Happens randomly. "Bad Pool Header", "DRIVER_VERIFIER"

Page 1 of 2 12 LastLast

  1. Posts : 11
    Windows 7 ultimate x64
       #1

    BSOD - Happens randomly. "Bad Pool Header", "DRIVER_VERIFIER"


    Hi everyone,

    I recently have noticed more and more BSODs. I had this problem about 6 months ago and was able to track it down to drivers that came from Daemon tools. I cleared all that out and it fixed the issue. I don't think these new BSODs are related but they might be.

    This seems to be happening randomly. It happens roughly every 2 weeks and early in the morning (1am, 6am, 9am, etc.) but not at a consistent time. As far as I can tell, I am not doing anything or leaving open any specific program that triggers this. There doesn't seem to be a consistent pattern.

    I ran the DM Log Collector and uploaded the zip file here. Any help would be appreciated. Thanks!
      My Computer


  2. Posts : 15,026
    Windows 10 Home 64Bit
       #2

    Code:
    
    Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Downloads\MUSICMACHINE-Wed_10_22_2014_142816_61\102214-20108-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
    Machine Name:
    Kernel base = 0xfffff800`03013000 PsLoadedModuleList = 0xfffff800`03256670
    Debug session time: Wed Oct 22 00:31:30.751 2014 (UTC + 6:00)
    System Uptime: 6 days 13:12:26.826
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .....................................
    Loading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C4, {91, 2, fffffa80085ecb50, 0}
    
    Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+4884 )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
    A device driver attempting to corrupt the system has been caught.  This is
    because the driver was specified in the registry as being suspect (by the
    administrator) and the kernel has enabled substantial checking of this driver.
    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
    be among the most commonly seen crashes.
    Arguments:
    Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    	the operating system. The only supported way to extend a kernel
    	mode stack is by using KeExpandKernelStackAndCallout.
    Arg2: 0000000000000002
    Arg3: fffffa80085ecb50
    Arg4: 0000000000000000
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0xc4_91
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  WDDriveService
    
    CURRENT_IRQL:  2
    
    EXCEPTION_RECORD:  fffff8800b9aa708 -- (.exr 0xfffff8800b9aa708)
    ExceptionAddress: fffff8000335e612 (nt!PspThreadDelete+0x0000000000000002)
       ExceptionCode: c000001d (Illegal instruction)
      ExceptionFlags: 00000000
    NumberParameters: 0
    
    TRAP_FRAME:  fffff8800b9aa7b0 -- (.trap 0xfffff8800b9aa7b0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000007ef8f000 rbx=0000000000000000 rcx=fffff8800b9aa900
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8000335e612 rsp=fffff8800b9aa940 rbp=fffffa80085ecb50
     r8=fffffa800bc940e8  r9=0000000000000000 r10=fffffffffffffffd
    r11=fffff880009e7100 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    nt!PspThreadDelete+0x2:
    fffff800`0335e612 c4              ???
    Resetting default scope
    
    MISALIGNED_IP: 
    nt!PspThreadDelete+2
    fffff800`0335e612 c4              ???
    
    LAST_CONTROL_TRANSFER:  from fffff800030df4ea to fffff80003088c00
    
    STACK_TEXT:  
    fffff880`0b9a9808 fffff800`030df4ea : 00000000`000000c4 00000000`00000091 00000000`00000002 fffffa80`085ecb50 : nt!KeBugCheckEx
    fffff880`0b9a9810 fffff800`030b2153 : 00000000`00000000 00000000`00000000 00000000`00000003 0000007f`078f590c : nt! ?? ::FNODOBFM::`string'+0x4884
    fffff880`0b9a9850 fffff800`030c34d1 : fffff880`0b9aa708 fffff880`0b9aa460 fffff880`0b9aa7b0 fffff880`02985180 : nt!RtlDispatchException+0x33
    fffff880`0b9a9f30 fffff800`03088282 : fffff880`0b9aa708 fffffa80`0898cb50 fffff880`0b9aa7b0 fffffa80`083fcc10 : nt!KiDispatchException+0x135
    fffff880`0b9aa5d0 fffff800`030863df : fffff880`0b9aa7b0 fffff800`0308be02 fffffa80`00000000 fffffa80`00000000 : nt!KiExceptionDispatch+0xc2
    fffff880`0b9aa7b0 fffff800`0335e612 : fffffa80`083ecb50 fffffa80`081acb50 00000000`00400000 fffffa80`00a50003 : nt!KiInvalidOpcodeFault+0x11f
    fffff880`0b9aa940 fffffa80`083ecb50 : fffffa80`081acb50 00000000`00400000 fffffa80`00a50003 fffff880`00b87180 : nt!PspThreadDelete+0x2
    fffff880`0b9aa948 fffffa80`081acb50 : 00000000`00400000 fffffa80`00a50003 fffff880`00b87180 fffff800`038a39b0 : 0xfffffa80`083ecb50
    fffff880`0b9aa950 00000000`00400000 : fffffa80`00a50003 fffff880`00b87180 fffff800`038a39b0 ffffffff`ff6b7257 : 0xfffffa80`081acb50
    fffff880`0b9aa958 fffffa80`00a50003 : fffff880`00b87180 fffff800`038a39b0 ffffffff`ff6b7257 fffff880`00b87180 : 0x400000
    fffff880`0b9aa960 fffff880`00b87180 : fffff800`038a39b0 ffffffff`ff6b7257 fffff880`00b87180 fffffa80`0bd048b0 : 0xfffffa80`00a50003
    fffff880`0b9aa968 fffff800`038a39b0 : ffffffff`ff6b7257 fffff880`00b87180 fffffa80`0bd048b0 fffffa80`085ecc58 : 0xfffff880`00b87180
    fffff880`0b9aa970 ffffffff`ff6b7257 : fffff880`00b87180 fffffa80`0bd048b0 fffffa80`085ecc58 00000000`00000001 : 0xfffff800`038a39b0
    fffff880`0b9aa978 fffff880`00b87180 : fffffa80`0bd048b0 fffffa80`085ecc58 00000000`00000001 fffff880`0b9aabe0 : 0xffffffff`ff6b7257
    fffff880`0b9aa980 fffffa80`0bd048b0 : fffffa80`085ecc58 00000000`00000001 fffff880`0b9aabe0 fffff880`0b9aabc8 : 0xfffff880`00b87180
    fffff880`0b9aa988 fffffa80`085ecc58 : 00000000`00000001 fffff880`0b9aabe0 fffff880`0b9aabc8 fffffa80`0bd867c0 : 0xfffffa80`0bd048b0
    fffff880`0b9aa990 00000000`00000001 : fffff880`0b9aabe0 fffff880`0b9aabc8 fffffa80`0bd867c0 fffffa80`085ecb50 : 0xfffffa80`085ecc58
    fffff880`0b9aa998 fffff880`0b9aabe0 : fffff880`0b9aabc8 fffffa80`0bd867c0 fffffa80`085ecb50 00000000`00000000 : 0x1
    fffff880`0b9aa9a0 fffff880`0b9aabc8 : fffffa80`0bd867c0 fffffa80`085ecb50 00000000`00000000 00000525`d9bc3773 : 0xfffff880`0b9aabe0
    fffff880`0b9aa9a8 fffffa80`0bd867c0 : fffffa80`085ecb50 00000000`00000000 00000525`d9bc3773 fffff800`039901d3 : 0xfffff880`0b9aabc8
    fffff880`0b9aa9b0 fffffa80`085ecb50 : 00000000`00000000 00000525`d9bc3773 fffff800`039901d3 00000000`00b10002 : 0xfffffa80`0bd867c0
    fffff880`0b9aa9b8 00000000`00000000 : 00000525`d9bc3773 fffff800`039901d3 00000000`00b10002 fffffa80`0bba48b0 : 0xfffffa80`085ecb50
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt! ?? ::FNODOBFM::`string'+4884
    fffff800`030df4ea cc              int     3
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4884
    
    FOLLOWUP_NAME:  MachineOwner
    
    IMAGE_NAME:  hardware
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MODULE_NAME: hardware
    
    FAILURE_BUCKET_ID:  X64_IP_MISALIGNED
    
    BUCKET_ID:  X64_IP_MISALIGNED
    
    Followup: MachineOwner
    ---------
    
    If you are overclocking please stop.

    MSINFO32:
    • Please go to Start and type in "msinfo32.exe" (without the quotes) and press Enter.
    • Save the report as an .nfo file, then zip up the .nfo file and upload/attach the .zip file with your next post.
    • Also, save a copy as a .txt file and include it also (it's much more difficult to read, but we have greater success in getting the info from it).

    Perform a Clean boot:

    Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

    Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
    • Click on the
    • Type CMD on Search
    • Left click and Run as Administrator
    • Type SFC /scannow

    Full tutorial here:
      My Computer


  3. Posts : 11
    Windows 7 ultimate x64
    Thread Starter
       #3

    I have attached the MSINFO32 file to this post. I also went through msconfig.exe and disabled a few startup services that didn't need to be there.

    Thank you for your help! I really appreciate it! :)
      My Computer


  4. Posts : 15,026
    Windows 10 Home 64Bit
       #4

    Thanks.

    Post if you have further BSOD's/.
      My Computer


  5. Posts : 11
    Windows 7 ultimate x64
    Thread Starter
       #5

    Hi,

    I have been having more BSODs lately. I recently had to install drivers for a wireless USB adapter but uninstalled it before getting the most recent BSODs. Also - I noticed the drivers for my display adapter had never been updated, so I updated them to the latest and greatest - still receiving BSODs. The latest ones gave me the following errors:

    PFN_LIST_CORRUPT
    IRQL_NOT_LESS_OR_EQUAL
    DRIVER_IRQL_NOT_LESS_OR_EQUAL

    Do I need to re-upload a new batch of DM Log Collector logs? Thanks
      My Computer


  6. Posts : 15,026
    Windows 10 Home 64Bit
       #6

    ryanesta said:

    Do I need to re-upload a new batch of DM Log Collector logs? Thanks
    Yes
      My Computer


  7. Posts : 11
    Windows 7 ultimate x64
    Thread Starter
       #7

    I have attached a new DM Log collection to this post. Thank you for your time/help/patience!
      My Computer


  8. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #8

    Code:
    BugCheck 4E, {99, 168350, 2, 141905}
    
    Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
    
    Followup: MachineOwner
    ---------
    Test your RAM modules for possible errors.Run memtest86+ for at least 8 consecutive passes.

    If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

    Let us know the result.
      My Computer


  9. Posts : 11
    Windows 7 ultimate x64
    Thread Starter
       #9

    I let the MemTest run for a long long time to do 8 passes and some errors did in fact pop up. I attached a screenshot showing the errors.

    Does this mean I should replace the memory on this machine? Thanks
      My Computer


  10. Arc
    Posts : 35,373
    Microsoft Windows 10 Pro Insider Preview 64-bit
       #10

    ryanesta said:
    I let the MemTest run for a long long time to do 8 passes and some errors did in fact pop up. I attached a screenshot showing the errors.

    Does this mean I should replace the memory on this machine? Thanks
    Seeing you after a long gap. Hope everything is fine there with you.

    Now follow the "Part 3: If You Have Errors:" of How to Test and Diagnose RAM Issues with Memtest86+

    Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

    How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
    How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:
    No code has to be inserted here.
    It is a RAM, a bad RAM.

    But if you have got a result like that:
    No code has to be inserted here.
    It is a motherboard issue. The particular slot is bad.

    If it is a bad RAM, you need to change the RAM. Take the other existing (good) RAM to the shop and get one of the exactly same specification. The best is, get a totally new RAM KIT.

    If it is a bad slot, it is a motherboard issue. But changing the motherboard needs a preparation for most of us; so dont populate that slot for the time being.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 00:55.
Find Us