BSOD System Service Exception and Bad pool header

Ok, here is dump from

C:\Windows\Minidump
I opened it, and tried see what is wrong

i saw:

Code:

BugCheck 1A, {41287, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+454f5 )

And i searched for ntkrnlmp.exe here Driver Reference Table

Is that mean that problem is in Windows Update ?
That Windows Update downloaded corrupted driver ?

Code:

0: kd> .time
Debug session time: Mon Aug 12 08:57:28.880 2013 (UTC + 1:00)
System Uptime: 2 days 6:19:19.740

It's still the same dump file from yesterday, here I would suggest configuring Minidumps to be saved, and then running Driver Verifier again, upon the next BSOD please upload the files.

To answer your question, ntkrnlmp.exe is the NT Kernel module and is not the problem at all. Windows lists it as the possible cause when it can't find any third-party driver which caused the problem or the real cause of the problem.

Ok, I switched to minidump.

I think last crash was not registered by logs, because when i woke up i saw "funny" blured colours on my display, and computer was still running. Didn't restart, like in most cases with bsod

I had to, manually turn off and on.

I set up again driver verifier.

Can you tell me about that file ntkrnlmp.exe, from the last crash, is it related with Windows Update ?

It's the Windows Kernel - Architecture of Windows NT - Wikipedia, the free encyclopedia

Thanks , now i undersand that a bit better.

Few moments ago, i had another crash, but standard bsod didn't displayed.
It was same like before, blur screen, i made photo to show you.

I attached aslso logs from SF Diagnostic Tool, but what i checked there is no dump including present crash.

Code:

0: kd> .time
Debug session time: Mon Aug 12 09:57:28.880 2013 (UTC + 2:00)
System Uptime: 2 days 6:19:19.740

So, sine i got driver verifier working, i had 2 crashes, which were not registered by system ?

Nope, it's because the BSODs are happening before, the all the necessary data structures have been loaded.

Run some hard-drive diagnostics and follow these steps:

• Hard Drive Diagnostic Procedure

Find your hard-drive manufacturer and run their tests.

Additional Tests:

• SeaTools for DOS | Seagate
• CrystalDiskInfo - Software - Crystal Dew World

Post a screenshot of Crystal Disk Info summary:

• Screenshots and Files - Upload and Post in Seven Forums

writhziden said:

If you have an SSD, make sure the following are up to date:

• SSD firmware
• BIOS Version
• Chipset Drivers
• Hard disk controller drivers/SATA drivers
• If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Check for any file system errors and bad sectors using Option #2 of:

• Disk Check

Use this command with Disk Check:

Code:

chkdsk C: /f /r

Code:

BugCheck 1A, {5003, fffff70001080000, 17fd8, 17c420002feb0}

Probably caused by : win32k.sys ( win32k!fnHkINLPMSG+28b )

Okay, this bugcheck is slightly different, it indicates that the working set free list has become corrupt, this is usually due to hardware error.

• RAM - Test with Memtest86+

Run Memtest86+ for least 9-10 passes, and preferably overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

Arc said:

No code has to be inserted here. It is a RAM, a bad RAM.

But if you have got a result like that:
No code has to be inserted here. It is a motherboard issue. The particular slot is bad.

I tested all possibilities, about 10-11 times

I decide to use for now only one stick (for testing)

I had about one week uptime, without any errors

But yesterday and today i had few crashes.

I'm sending dumps.

Code:

BugCheck C2, {7, 109b, 81d3aa0, fffffa8006b8cb00}

GetPointerFromAddress: unable to read from fffff800034f8100
GetUlongFromAddress: unable to read from fffff800034f81c0

fffffa8006b8caf0 doesn't look like a valid small pool allocation, checking to see
if the entire page is actually part of a large page allocation...

GetUlongFromAddress: unable to read from fffff80003466a38

fffffa8006b8caf0 doesn't look like a valid small pool allocation, checking to see
if the entire page is actually part of a large page allocation...

GetUlongFromAddress: unable to read from fffff80003466a38
Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+c4 )

Code:

Usual causes:  Device driver, Memory

Code:

0: kd> !pool fffffa8006b8c000
Pool page fffffa8006b8c000 region is Nonpaged pool
*fffffa8006b8c000 size:  150 previous size:    0  (Allocated) *File (Protected)
		Pooltag File : File objects
 fffffa8006b8c150 size:   40 previous size:  150  (Allocated)  WfpF
 fffffa8006b8c190 size:   c0 previous size:   40  (Allocated)  FMsl
 fffffa8006b8c250 size:   20 previous size:   c0  (Free)       NSIk
 fffffa8006b8c270 size:  150 previous size:   20  (Allocated)  File (Protected)
 fffffa8006b8c3c0 size:  150 previous size:  150  (Allocated)  UdpA
 fffffa8006b8c510 size:   80 previous size:  150  (Free)       Even
 fffffa8006b8c590 size:  160 previous size:   80  (Allocated)  Ntfx
 fffffa8006b8c6f0 size:   50 previous size:  160  (Allocated)  VadS
 fffffa8006b8c740 size:   80 previous size:   50  (Allocated)  SeTl
 fffffa8006b8c7c0 size:   80 previous size:   80  (Allocated)  SeTl
 fffffa8006b8c840 size:   10 previous size:   80  (Free)       Even
 fffffa8006b8c850 size:  220 previous size:   10  (Allocated)  Nb07
 fffffa8006b8ca70 size:   80 previous size:  220  (Allocated)  Even (Protected)

The pool allocation within the pool page which has caused the corruption, this a file object, a file object can either correspond to a I/O device or a open file.

The I/O device seems to more likely due to other errors earlier.

Code:

0: kd> k
Child-SP          RetAddr           Call Site
fffff880`082be8e8 fffff800`033f3be9 nt!KeBugCheckEx
fffff880`082be8f0 fffff800`032c9e5c nt!ExDeferredFreePool+0x1201
fffff880`082be9a0 fffff800`035b9054 nt!ObfDereferenceObject+0xdc
fffff880`082bea00 fffff800`035b9604 nt!ObpCloseHandleTableEntry+0xc4
fffff880`082bea90 fffff800`032bfe13 nt!ObpCloseHandle+0x94
fffff880`082beae0 00000000`770913aa nt!KiSystemServiceCopyEnd+0x13
00000000`00eef9d8 00000000`00000000 0x770913aa

The current thread has attempted to free a pool allocation which has already been freed, we can see from the call stack the general process of freeing a object.

Other bugcheck is same as the other one in my last post:

Code:

BugCheck 1A, {5003, fffff70001080000, 1dbf4, 1c4540003b6e8}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+45f7d )

Code:

0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.7, DMIVersion 39, Size=2355]
BiosMajorRelease = 21
BiosMinorRelease = 240
BiosVendor = Acer
BiosVersion = V1.21
BiosReleaseDate = 08/09/2012
SystemManufacturer = Acer
SystemProductName = Aspire 7750G
SystemFamily =  
SystemVersion = V1.21
SystemSKU =  
BaseBoardManufacturer = Acer
BaseBoardProduct = JE70_HR
BaseBoardVersion = Base Board Version

Have you checked for any BIOS updates from your motherboard/model support page? Ensure if your going to update the BIOS, then you make sure you update with the BIOS version directly intended for your motherboard, as you irreversibility corrupt your BIOS.