BSOD Windows 7 x64 BAD_POOL_CALLER ntoskrnl.exe

Arc · 19 May 2013

Upload your MSINFO32.nfo file.

Click on the start button
Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
Give the time for processing, it will save a .nfo file on your desktop.
Zip it, and upload it following the instruction.

Something is to be checked there before passing the next instruction.

remundial · 19 May 2013

Please find attached MSINFO32.nfo.

Thank you.

Arc · 19 May 2013

OK, free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus (you dont have any?)
Apply > OK
Accept then restart.

Also, as you have no AV installed, scan the system for possible virus infection with the following programs.

Uninstall Advanced System Care. It does not care the system, but causes some damages which are beyond repair.

Now try DV again. Dont select any driver provider by "microsoft" or "unknown" in the list.

Hopefully it will be able to reach the desktop now before crashing, and we will get the needed crash dump.

remundial · 19 May 2013

Yes, I do have Avast! AV (IS) and Malwarebytes as some sort of back-up, should I scan the system with these programs before enabling DV?

DV asks to select at least one driver, what should I select?

remundial · 19 May 2013

Finally I enabled igdkmd64.sys, there were three attempts to initialize Win7, the first one had a less than a second BSOD, the second one had a 3 to 5 seconds BSOD, and the third one was successful. I ran SF Diagnostic Tool, the second BSOD was recorded but seems like there's no valuable information there, not much different from the first one I reported yesterday, this to my amateur eyes.

I attach SF Diagnostic Tool report. Attachment 268723

Thank you.

Arc · 19 May 2013

Scan the system for possible virus infection with the following programs only.

Next apply DV.

For applying DV, follow Driver Verifier - Enable and Disable

Select all the drivers other than those supplied by "microsoft".

Let us know the situation. BTW, what about the memtest?
_______________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1f0, 2, 0, fffff80002e9aa55}

Probably caused by : CI.dll ( CI!A_SHAUpdate+60 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000001f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e9aa55, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd100
GetUlongFromAddress: unable to read from fffff800030bd1c0
 00000000000001f0 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae5
fffff800`02e9aa55 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88002ff5350 -- (.trap 0xfffff88002ff5350)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000065f4 rbx=0000000000000000 rcx=fffff88002ff563c
rdx=fffff98002ac1000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000d1eca0 rsp=fffff88002ff54e0 rbp=0000000000000034
 r8=000000000000000c  r9=0000000000000001 r10=0000000000006234
r11=000000000000000c r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
CI!A_SHAUpdate+0x60:
fffff880`00d1eca0 488b02          mov     rax,qword ptr [rdx] ds:fffff980`02ac1000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e851a9 to fffff80002e85c00

STACK_TEXT:  
fffff880`02ff4d98 fffff800`02e851a9 : 00000000`0000000a 00000000`000001f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02ff4da0 fffff800`02e83e20 : 00000000`00000000 fffff800`02e6ccbb 00000000`00000000 fffff980`02514ee0 : nt!KiBugCheckDispatch+0x69
fffff880`02ff4ee0 fffff800`02e9aa55 : fffff780`c0000000 00000000`00000001 00000000`00000400 fffffa80`057ce6c0 : nt!KiPageFault+0x260
fffff880`02ff5070 fffff800`02e78617 : 00000000`00000001 fffffa80`0372c040 fffff880`02ff5100 fffff800`00000000 : nt!IopCompleteRequest+0xae5
fffff880`02ff5140 fffff800`02e33ee5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`02ff51c0 fffff800`02e9385c : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000980`00000000 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`02ff51f0 fffff800`02e83d2e : 00000000`00000000 fffff980`02ac1000 00000000`00000000 00000000`00006200 : nt!MmAccessFault+0x1a3c
fffff880`02ff5350 fffff880`00d1eca0 : 00000000`00000000 fffffa80`0370e0d0 00000000`00000000 fffff800`02eed216 : nt!KiPageFault+0x16e
fffff880`02ff54e0 fffff880`00cdb830 : fffff980`02ac0000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!A_SHAUpdate+0x60
fffff880`02ff5520 fffff880`00cd3b38 : fffff980`02ac0190 00000000`00000000 00000000`00000400 00000006`00001000 : CI!HashpHashBytes+0x40
fffff880`02ff5550 fffff880`00cd3281 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!CipImageGetImageHash+0x310
fffff880`02ff5730 fffff880`00cd1fbb : 00000000`00000001 fffff880`02ff59f0 fffff880`02ff59f0 00000000`00000000 : CI!CipValidateFileHash+0x211
fffff880`02ff58a0 fffff800`030f5c64 : 00000000`0000000d 00000000`000fffff fffffa80`057ce6c0 00000000`00000000 : CI!CiValidateImageHeader+0x213
fffff880`02ff5980 fffff800`030f5a6a : 00000000`00000000 00000000`00000080 fffffa80`057d07d0 00000000`00000000 : nt!SeValidateImageHeader+0x58
fffff880`02ff59c0 fffff800`031851a6 : fffffa80`057ce6c0 fffffa80`057d07d0 00000000`00000001 00000000`0000000d : nt!MiValidateImageHeader+0x21a
fffff880`02ff5a90 fffff800`031617ae : fffff880`02ff5ce0 fffff880`02ff5e00 fffff880`02ff5f98 00000000`00000001 : nt!MmCreateSection+0x966
fffff880`02ff5c90 fffff800`02e84e93 : fffffa80`0372c040 fffff880`02ff5f38 fffff880`02ff5d28 00000000`00000000 : nt!NtCreateSection+0x171
fffff880`02ff5d10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CI!A_SHAUpdate+60
fffff880`00d1eca0 488b02          mov     rax,qword ptr [rdx]

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  CI!A_SHAUpdate+60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CI

IMAGE_NAME:  CI.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c944

FAILURE_BUCKET_ID:  X64_0xA_VRF_CI!A_SHAUpdate+60

BUCKET_ID:  X64_0xA_VRF_CI!A_SHAUpdate+60

Followup: MachineOwner
---------

remundial · 19 May 2013

Memtest86+: 8 passes, 0 errors
Anti-rootkit utility TDSSKiller: Full options, No threats found
Windows Defender Offline: Quick scan on Windows 7 partition, No threats found (I'm already running a full scan but seems it will take a lot of time to complete).

I kept DV enabled just with igdkmd64.sys, the system has frozen two times (without BSOD), on one restart the Windows 7 logo stayed active for more than 3 minutes (before "Welcome" screen) so I reset manually. When I get a complete scan with WDO, I'm gonna reset DV and enable non Microsoft drivers again and see what happens.

I have uninstalled ASC and disabled all but AV on MSCONFIG start-up list.

remundial · 20 May 2013

Windows Defender Online full scan found 6 threats in other partition, I removed 4 (Trojan, Hacks). I enabled DV, non Microsoft drivers, did 10 attempts to initialize Win7, none of them successful (less than a second BSOD). This caused a temporary problem with laptop screen, it didn't work even at BIOS phase of start-up, it went directly to the monitor and that's quite weird; laptop screen didn't work on Win7 nor WinXP, on Ubuntu it worked. The problem seem to disappear after a few restarts.

I had other "Starting Windows" screen with active Windows logo lasting more than 10 minutes, it never went to "Welcome" screen, I had to reset manually.

At this point DV is disabled, and I won't have the chance to run new tests for a few days...

Thank you.

Arc · 21 May 2013

remundial said:

Windows Defender Online full scan found 6 threats in other partition, I removed 4 (Trojan, Hacks). I enabled DV, non Microsoft drivers, did 10 attempts to initialize Win7, none of them successful (less than a second BSOD).

Have you free up the startup entries as suggested earlier?

remundial · 21 May 2013

Yes, I have...