Windows 7: Random "Bad Pool Header" and "System Service Exception" BSODs

tsdrews · 16 Apr 2012

I have been getting these "Bad Pool Header" and "System Service Exception" BSODs for about a day now (the "Bad Pool Header" one tends to pop up more often then the other btw). I ran a registry cleaner which didn't work and ran memtest this morning and it showed that my memory was fine. The BSODs tend to occur more often when I am playing a game or running some program that uses a bit more memory but it also happens when I am just on the internet. On the other hand, last night I did nothing but surf YouTube for 3 hours and didn't get a BSOD at all. However, since then I haven't been able to do anything for more than 10 minutes (without being in safe mode) without it crashing, and this morning it completely froze until I turned it off. My OS is Windows 7 Home Premium 64bit. It came preinstalled from the manufacturer and unfortunately I do not have the install disc. The entire laptop is less than 2 years old and there have been no major hardware changes and I have never reinstalled the OS.

tsdrews · 16 Apr 2012

UPDATE: Another BSOD just happened after I left the computer idle for a couple of hours except this one said something about Asdsm.sys.

writhziden · 18 Apr 2012

Problem Devices:

Code:

BT-253	USB\VID_0B05&PID_1751\0025D3B091E8	This device is disabled.
Security Processor Loader Driver	ROOT\LEGACY_SPLDR\0000	This device is not present, is not working properly, or does not have all its drivers installed.
sptd	ROOT\LEGACY_SPTD\0000	This device is not present, is not working properly, or does not have all its drivers installed.
VMware VMCI Host Device	ROOT\VMWVMCIHOSTDEV\0000	This device is disabled.

Please remove any CD/DVD virtualization software, such as Daemon Tools/Alcohol 120%, as they use a driver called sptd.sys that is known to cause BSODs. Use add/remove programs to remove the software. After removing the software, use the sptd.sys uninstaller to remove sptd.sys from the system.

I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.

Security Software: ??? I recommend either of these two setups:

Download and install the security setup of your choice, update the software, and then run a full scan of your system for viruses and malware. If you only install MSE, I would also suggest installing and updating Malwarebytes : Free anti-malware, anti-virus and spyware removal download, but do not start the free trial/full version of Malwarebytes. Run a full scan with Malwarebytes after updating it. Post back the results.

Asus Data Security Manager caused the latest crash if Asdsm.sys was to blame.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\tsdrews\Windows_NT6_BSOD_jcgriff2\041612-26208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`03459000 PsLoadedModuleList = 0xfffff800`0369d650
Debug session time: Mon Apr 16 09:23:23.758 2012 (UTC - 6:00)
System Uptime: 0 days 0:12:41.851
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, 5c, fffff8a00e835010}

GetPointerFromAddress: unable to read from fffff80003707100
GetUlongFromAddress: unable to read from fffff80003675a18
GetUlongFromAddress: unable to read from fffff80003675a18
Probably caused by : ntkrnlmp.exe ( nt!AlpcpSecurityDestroyProcedure+10e )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 000000000000005c, Memory contents of the pool block
Arg4: fffff8a00e835010, Address of the block of pool being deallocated

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80003675a18
GetUlongFromAddress: unable to read from fffff80003675a18

POOL_ADDRESS:  fffff8a00e835010 

BUGCHECK_STR:  0xc2_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003602be9 to fffff800034d5c80

STACK_TEXT:  
fffff880`0acfaa68 fffff800`03602be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0000005c : nt!KeBugCheckEx
fffff880`0acfaa70 fffff800`034deefc : 00000000`00000000 00000000`0000000f fffffa80`04e8ac50 fffffa80`04e8ac50 : nt!ExDeferredFreePool+0x1201
fffff880`0acfab20 fffff800`037a964a : 00000000`0000000f fffff8a0`0e778800 fffff8a0`0e7787e0 00000000`ffffffff : nt!ObfDereferenceObject+0xdc
fffff880`0acfab80 fffff800`03773b61 : fffff8a0`0e778800 fffff800`03648d80 00000000`00000000 00000000`00000000 : nt!AlpcpSecurityDestroyProcedure+0x10e
fffff880`0acfabb0 fffff800`034d4f13 : fffffa80`058c0b60 fffff880`0acfaca0 00000000`00000000 fffffa80`0de5ad10 : nt!NtAlpcDeleteSecurityContext+0x151
fffff880`0acfac20 00000000`77711aea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`06d1f2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77711aea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!AlpcpSecurityDestroyProcedure+10e
fffff800`037a964a 488b4b10        mov     rcx,qword ptr [rbx+10h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!AlpcpSecurityDestroyProcedure+10e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4f558b55

FAILURE_BUCKET_ID:  X64_0xc2_7_nt!AlpcpSecurityDestroyProcedure+10e

BUCKET_ID:  X64_0xc2_7_nt!AlpcpSecurityDestroyProcedure+10e

Followup: MachineOwner
---------

Your crashes are all over the map, which generally indicates a hardware fault. However, since this just happened within the past couple days, I suspect something else at work. Did you change any hardware or software before this started occurring?

If you cannot determine the cause and the virus/malware scans do not reveal anything, you could backup all your important data and proceed with the factory image recovery: ASUSTeK Computer Inc. -Support- Troubleshooting G51J: How to Recover Your Notebook PC

tsdrews · 18 Apr 2012

Thanks for the help but I actually ended up finding my OS disc and just reinstalled Windows 7, it seemed like a more expedient solution than tracking down some buggy driver. I haven't got any crashes so far so it looks like it worked.

writhziden · 18 Apr 2012

Good to see! A fresh install of Windows is always a good troubleshooting step. Nice work.