BSOD on startup of custom laptop. Referenced Pool Error


  1. Posts : 1
    Windows Server 2008R2
       #1

    BSOD on startup of custom laptop. Referenced Pool Error


    A client's computer has been behaving strangely the last couple days. He had a BSOD this morning and I was able to get the minidump file. The BSOD referenced a pool error.
    Any insight on what might have caused this?
      My Computer


  2. Posts : 15,026
    Windows 10 Home 64Bit
       #2

    Welcome to the forum.

    Caused by Malwarebytes. Please uninstall it to test.

    Code:
    Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\USER\Downloads\Compressed\123014-25630-01\123014-25630-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
    Machine Name:
    Kernel base = 0xfffff800`03409000 PsLoadedModuleList = 0xfffff800`0364c670
    Debug session time: Wed Dec 31 00:01:13.438 2014 (UTC + 6:00)
    System Uptime: 0 days 1:43:15.484
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ......................................................
    Loading User Symbols
    Loading unloaded module list
    ...............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 19, {20, fffffa8007ce5440, fffffa8007ce5460, 4020044}
    
    *** WARNING: Unable to verify timestamp for mwac.sys
    *** ERROR: Module load completed but symbols could not be loaded for mwac.sys
    Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 0000000000000020, a pool block header size is corrupt.
    Arg2: fffffa8007ce5440, The pool entry we were looking for within the page.
    Arg3: fffffa8007ce5460, The next pool entry.
    Arg4: 0000000004020044, (reserved)
    
    Debugging Details:
    ------------------
    
    
    BUGCHECK_STR:  0x19_20
    
    POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b6100
    GetUlongFromAddress: unable to read from fffff800036b61c0
     fffffa8007ce5440 Nonpaged pool
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  mbamservice.ex
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from fffff800035b1cae to fffff8000347ec00
    
    STACK_TEXT:  
    fffff880`0c357258 fffff800`035b1cae : 00000000`00000019 00000000`00000020 fffffa80`07ce5440 fffffa80`07ce5460 : nt!KeBugCheckEx
    fffff880`0c357260 fffff880`01928c9d : 00000000`00000008 00000000`00000008 00000000`676e7049 fffff880`05e6d024 : nt!ExDeferredFreePool+0x12da
    fffff880`0c357310 fffff880`0153004a : 00000000`00000000 fffff880`0152c0c3 00000000`00000000 fffffa80`03a17620 : tcpip!IppInspectBuildHeaders+0x65d
    fffff880`0c3575f0 fffff880`0842912d : 00000000`00000000 00000000`00000014 00000000`00000000 fffffa80`04624b50 : fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+0x20a
    fffff880`0c357690 00000000`00000000 : 00000000`00000014 00000000`00000000 fffffa80`04624b50 fffffa80`04624b64 : mwac+0x612d
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
    fffff880`0153004a 85c0            test    eax,eax
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: fwpkclnt
    
    IMAGE_NAME:  fwpkclnt.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  50e4f5c8
    
    FAILURE_BUCKET_ID:  X64_0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
    
    BUCKET_ID:  X64_0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+20a
    
    Followup: MachineOwner
    ---------
    Revo Uninstaller:

    Use Revo Uninstaller to uninstall stubborn software.

      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:51.
Find Us