Bsod bad_pool_header (19)

I have four BSODs bad_pool_header(19) since June 18. Everything I have read about this BSOD points to an outdated device driver. How can I use windbg on the minidumps and/or full dumps to determine what device driver caused each of the four BSODs? Note that I spent 25+ years working with IBM mainframe operating systems reading/debugging dumps. I do not know the internals of Windows 7, so I do not know where to look in the dump to get the information. And right now I do not know if the same device driver caused each of the four BSODs. I have attached the zip output of the SF_Diagnostic tool; the output contains a number of minidumps. I want to debug/diagnose each minidump, so I am starting with this BSOD before I diagnose the other BSODs. The OS is Windows 7 Pro 32-bit.

I read the "BSOD - Posting Instructions" document. It mentions a "Crashes and Debugging" section of the foiums. I do not see that, but I originally opened my problem in a section "BSOD Help and Support" , and I assume that that is the correct sub-section of the forum web site. The posting document also explains to use the SF diagnostics tool to produce a zip file. If I remember correctly, I did that and attached that bsfinkel.zip file to my original problem report. Please let me know if that was not attached to my initial posting. I have just attached that file to this posting, (I assume).
--Barry Finkel

This is the right section, they changed the name of the sub-section to make it clearer for users, since many people were posting in the General Discussion section and weren't receiving help. You haven't uploaded the zip file.

I just uploaded the zip file. I guess I did not wait long enough the first time.
--Barry Finkel

Where is it?

Did you follow this tutorial? Screenshots and Files - Upload and Post in Seven Forums

I clicked "Post Reply". Then near the bottom of the page I click the blue "Manage Attachments" button. "Broswe.. No file selected." Click "Browse". Select bsfinkel.zip from my desktop. Click the blue "Upload" button. "Uploading File(s) - Please Wait" . "Current Attachments (1.94 MB) bsfinkel.zip". I now see two "Submit Reply" buttons, one at "Reply to Thread" and one in "Additional Options". Last time I clicked the "Reply to Thread" "Submit Reply". Now I will click the lower button.
--Barry Finkel

Code:

BugCheck 19, {3, 85900bd8, 85900bd8, 85900b40}

Probably caused by : ntkrpamp.exe ( nt!ExAllocatePoolWithTag+682 )

Code:

Usual causes:  Device driver

It seems we are dealing with corrupt pool freelist, the blink freelist address seems to be corrupt for some reason.

Code:

0: kd> dt nt!_POOL_HEADER 85900bd8
   +0x000 PreviousSize     : 0y100101000 (0x128)
   +0x000 PoolIndex        : 0y0111100 (0x3c)
   +0x002 BlockSize        : 0y101111101 (0x17d)
   +0x002 PoolType         : 0y1011001 (0x59)
   +0x000 Ulong1           : 0xb37d7928
   +0x004 PoolTag          : 0xb37d7928 <-- Owner of the Pool Allocation
   +0x004 AllocatorBackTraceIndex : 0x7928
   +0x006 PoolTagHash      : 0xb37d

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• Driver Verifier - Enable and Disable

   Information

Additional Help - Using Driver Verifier to identify issues with Drivers

You may need to enable the Special Pool option too.

Remove:

Code:

Start Menu\Programs\Advanced SystemCare 6

Windows 7 doesn't require any programs which make changes to the operating system and registry, these programs tend to cause problems by modifying and deleting files.

• Registry Cleaner Tests - Why NOT To Use One!

Windows is a closed source system. Developers of registry cleaners do not have the core code of Windows 7 and are not working on definitive information, but rather they are going on past knowledge and experience. Automatic cleaners will usually have to do some guesswork.

Modifying registry keys incorrectly can cause Windows instability, or make Windows unbootable. No registry cleaner is completely safe and the potential is ever present to cause more problems than they claim to fix.

Registry cleaners cannot distinguish between good and bad. If you run a registry cleaner, it will delete all those keys which are obsolete and sitting idle; but in reality, those keys may well be needed by some programs or windows at a later time.

Windows 7 is much more efficient at managing the registry than previous Windows versions. If you run any other registry cleaner and do not know precisely what you are doing, you will have problems down the road. There are no gains to be had from using a registry cleaner and the risk is great.

Remove:

Code:

Start Menu\Programs\IObit Malware Fighter

Having two real-time anti-virus programs can cause serious conflicts and crashes with your computer such as BSODs. Please remove IOBit program, which is known to cause BSODs, and keep MSE along with the other program listed below.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• Good and Free system security combination.

Update BIOS (if possible):

Code:

0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.4, DMIVersion 36, Size=1794]
BiosMajorRelease = 0
BiosMinorRelease = 0
FirmwareMajorRelease = 0
FirmwareMinorRelease = 0
BiosVendor = Intel Corp.
BiosVersion = MQ96510J.86A.1715.2007.1202.0001
BiosReleaseDate = 12/02/2007
SystemManufacturer =                                 
SystemProductName =                                 
SystemVersion =                         
BaseBoardManufacturer = Intel Corporation
BaseBoardProduct = DP965LT
BaseBoardVersion = AAD41694-302

Remember to find the exact version and revision of your motherboard, in order to flash the BIOS with the correct version, otherwise you could irreversibility corrupt your BIOS.

Reduce the number of programs at startup, to avoid any driver or program conflicts:

• Troubleshoot Application Conflicts by Performing a Clean Startup
• Startup Programs - Change

Remove:

Code:

0: kd> lmvm CBUFS
start    end        module name
8c379000 8c3bd000   CBUFS    T (no symbols)           
    Loaded symbol image file: CBUFS.sys
    Image path: \SystemRoot\system32\drivers\CBUFS.sys
    Image name: CBUFS.sys
    Timestamp:        Mon Jan 14 12:27:18 2013 (50F3F9A6)
    CheckSum:         0004B8FC
    ImageSize:        00044000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Comodo seems to be causing problems, please remove the program completely with the Comodo Removal Tool.

First, I went to verifier.exe and selected all non-MS products. Then verfifier told me I had to reboot. I closed Firefox,Thunderbird, and other applications, and I rebooted through the Start menu. I immediately received a BSOD BAD_POOL_HEADER (19), and the machine would crash upon reboot. I had to go to system repair to get the machine to reboot. I do not know what system repair did; I have not looked for any log. So, I do not know what happened with verifer.exe.

I did remove IObit Malware Fighter. I am installing Malwarebytes Anti-Malware, and I will run it. I am not sure why you want me to not run IObit but run Malwarebytes. What is the difference?

As for cbufs.exe, I am unsure whether to delete it. I use Comodo Backup Utility as my backup. The web page to which you point talks about Comodo Internet Security removal, and I do not have that product installed. I do not want to disable my backups (and potential restores) by deleting a file that Comodo Backup might need.

I will ruin Malewarebytes and report when it has finished.
--Barry Finkel