BSOD windows 7 when using browsers

fival01 · 29 Apr 2016

I have gotten several BSOD in the last month and most point to a bad driver. I have loaded WDK and have several mini-dumps and memory dumps. I have also installed Driver verifier. The majority of the dumps have Bad_Pool_Header as the cause of the crash. I have set up my machine to use Special pools and the last dump was DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL STOP: 0x000000d5 with "Caused by driver" ntoskrnl.exe although Wfpent8.sys showing up in several dumps too.

**axe0** · 29 Apr 2016

Hi fival01,

Welcome to the 7forums :)

Please lookup the details of the driver you mentioned, wfpent8.sys, located in %systemroot%\system32\drivers\

Please remove McAfee and replace it with Microsoft Security Essentials.
Please check Dell for driver updates for the USB drivers, it is possible that they are included in the chipset drivers.
Please remove all USB devices from your laptop.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, fffffa8000001000, 0, 0}

*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : Npfs.SYS ( Npfs!NpRemoveDataQueueEntry+a5 )

Followup:     MachineOwner


4: kd> lmvm wfpent8
Browse full module list
start             end                 module name
fffff880`0ad71000 fffff880`0ad95000   wfpent8  T (no symbols)           
    Loaded symbol image file: wfpent8.sys
    Image path: \SystemRoot\system32\DRIVERS\wfpent8.sys
    Image name: wfpent8.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Sep 23 16:09:58 2014 (54217F36)
    CheckSum:         0001E42E
    ImageSize:        00024000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4


4: kd> lmvm iusb3xhc
Browse full module list
start             end                 module name
fffff880`06c66000 fffff880`06d29000   iusb3xhc   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\iusb3xhc.sys
    Image name: iusb3xhc.sys
    Browse all global symbols  functions  data
    Timestamp:        Tue Mar 26 17:05:28 2013 (5151C748)
    CheckSum:         000CDDA1
    ImageSize:        000C3000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

fival01 · 29 Apr 2016

Not possible to remove Mcafee due to it is an enterprise solution in my office and I do not control McAfee.
I cannot find the vendor for wfpent8.sys. It just says unknown. If I stop it, it crashes and I have to do system restore.
It is hard to remove USB devices because it is a laptop and the mouse is a touch pad

**axe0** · 29 Apr 2016

Could you repair/reinstall McAfee?

No problem, then just update the drivers :)

What do you mean with 'stop it'? A driver can't be stopped unless you delete it.

fival01 · 29 Apr 2016

I am attaching the picture of how I "stop" it under Device Manager" > "View" > "Devices by connection" > "Show hidden devices"

**axe0** · 29 Apr 2016

As you probably now, that is a list of all real/emulated devices, when a crash occurs when disabling either of them means it is vital to software or a device.
Unfortunately if the details in device manager are the same as when you look it up via explorer then it'll be difficult to find what it belongs to if it isn't malware or something. Why I say 'malware' is because the search results aren't giving proper results about it, the only thing I know of that can have such results is malware.