Windows 7: Random BSOD

r4vemaster · 28 Oct 2013

Hi SevenForums,

I've been experience this random BSOD lately. Sometimes it shows Bad Pool Header.. Any solution??? thanks in advance :)

Arc · 28 Oct 2013

Hello r4vemaster.

Uninstall the Huawei Mobile connect software. Then update driver and firmware from Support - Downloads - Huawei Consumer BG.

Also, you need to uninstall your VPN Cliants.

Let us know the results.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffff800038626c0, fffff80003862f20, 58626c0}

*** WARNING: Unable to verify timestamp for ewusbnet.sys
*** ERROR: Module load completed but symbols could not be loaded for ewusbnet.sys
Probably caused by : ewusbnet.sys ( ewusbnet+24b5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffff800038626c0, The pool entry we were looking for within the page.
Arg3: fffff80003862f20, The next pool entry.
Arg4: 00000000058626c0, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff8000390a100
GetUlongFromAddress: unable to read from fffff8000390a1c0
 fffff800038626c0 Nonpaged pool

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003805cae to fffff800036dafc0

STACK_TEXT:  
fffff880`042857e8 fffff800`03805cae : 00000000`00000019 00000000`00000020 fffff800`038626c0 fffff800`03862f20 : nt!KeBugCheckEx
fffff880`042857f0 fffff880`01c38845 : 00000000`00000000 fffffa80`0aa4ce01 00000000`7ffff800 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`042858a0 fffff880`04e9a4b5 : fffffa80`05c57810 00000000`00000001 fffffa80`05c57810 fffffa80`0aa4a000 : ndis!NdisFreeMemory+0x15
fffff880`042858d0 fffffa80`05c57810 : 00000000`00000001 fffffa80`05c57810 fffffa80`0aa4a000 fffffa80`05c57810 : ewusbnet+0x24b5
fffff880`042858d8 00000000`00000001 : fffffa80`05c57810 fffffa80`0aa4a000 fffffa80`05c57810 fffff800`036de9c1 : 0xfffffa80`05c57810
fffff880`042858e0 fffffa80`05c57810 : fffffa80`0aa4a000 fffffa80`05c57810 fffff800`036de9c1 fffffa80`05c57b23 : 0x1
fffff880`042858e8 fffffa80`0aa4a000 : fffffa80`05c57810 fffff800`036de9c1 fffffa80`05c57b23 00000000`00000000 : 0xfffffa80`05c57810
fffff880`042858f0 fffffa80`05c57810 : fffff800`036de9c1 fffffa80`05c57b23 00000000`00000000 fffffa80`0aa4ce02 : 0xfffffa80`0aa4a000
fffff880`042858f8 fffff800`036de9c1 : fffffa80`05c57b23 00000000`00000000 fffffa80`0aa4ce02 fffff880`04eb17ba : 0xfffffa80`05c57810
fffff880`04285900 fffff880`04eadc03 : 00000000`4d4f4351 fffffa80`05c57800 fffffa80`05c57b20 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`042859f0 00000000`4d4f4351 : fffffa80`05c57800 fffffa80`05c57b20 00000000`00000000 00000000`00000020 : ewusbnet+0x15c03
fffff880`042859f8 fffffa80`05c57800 : fffffa80`05c57b20 00000000`00000000 00000000`00000020 fffff880`04e9a375 : 0x4d4f4351
fffff880`04285a00 fffffa80`05c57b20 : 00000000`00000000 00000000`00000020 fffff880`04e9a375 fffffa80`0b99d140 : 0xfffffa80`05c57800
fffff880`04285a08 00000000`00000000 : 00000000`00000020 fffff880`04e9a375 fffffa80`0b99d140 00000000`00000001 : 0xfffffa80`05c57b20


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ewusbnet+24b5
fffff880`04e9a4b5 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ewusbnet+24b5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ewusbnet

IMAGE_NAME:  ewusbnet.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bdabd9c

FAILURE_BUCKET_ID:  X64_0x19_20_ewusbnet+24b5

BUCKET_ID:  X64_0x19_20_ewusbnet+24b5

Followup: MachineOwner
---------

2: kd> lmvm ewusbnet
start             end                 module name
fffff880`04e98000 fffff880`04eda000   ewusbnet T (no symbols)           
    Loaded symbol image file: ewusbnet.sys
    Image path: \SystemRoot\system32\DRIVERS\ewusbnet.sys
    Image name: ewusbnet.sys
    Timestamp:        Fri Apr 30 16:53:08 2010 (4BDABD9C)
    CheckSum:         0004BAF2
    ImageSize:        00042000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa8005225e30, fffff800053113d8, fffffa80053a5a50}

Unable to load image \SystemRoot\system32\DRIVERS\Neo_0062.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Neo_0062.sys
*** ERROR: Module load completed but symbols could not be loaded for Neo_0062.sys
Probably caused by : ntkrnlmp

Followup: MachineOwner
---------

0: kd> lmvm Neo_0062
start             end                 module name
fffff880`059ea000 fffff880`059ef500   Neo_0062 T (no symbols)           
    Loaded symbol image file: Neo_0062.sys
    Image path: \SystemRoot\system32\DRIVERS\Neo_0062.sys
    Image name: Neo_0062.sys
    Timestamp:        Mon Sep 16 09:18:00 2013 (52367F70)
    CheckSum:         000095E7
    ImageSize:        00005500
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

r4vemaster · 28 Oct 2013

Hi Arc,

Thanks for the quick reply !

Both are successfully uninstalled . I'll wait about 1-2 days to see if the BSOD still occur or not. Thank you again :)

r4vemaster · 02 Nov 2013

hi Arc,

it seems that the BSOD occured when I tried to put my laptop on sleep mode. Any idea? Thanks :)

Arc · 02 Nov 2013

The VPN client. Description here: What is neo_0062.sys ? | System Explorer

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa8005226700, fffff800053083d8, fffffa8005c55010}

Unable to load image \SystemRoot\system32\DRIVERS\Neo_0062.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Neo_0062.sys
*** ERROR: Module load completed but symbols could not be loaded for Neo_0062.sys
Probably caused by : ntkrnlmp

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8005226700, Physical Device Object of the stack
Arg3: fffff800053083d8, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa8005c55010, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  ntkrnlmp

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: ntkrnlmp

FAULTING_MODULE: fffff880052e7000 Neo_0062

DEVICE_OBJECT: fffffa8008991050

DRIVER_OBJECT: fffffa800895e3e0

IRP_ADDRESS:  fffffa8005c55010

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

TAG_NOT_DEFINED_c000000f:  FFFFF8000530EFB0

STACK_TEXT:  
fffff800`05308388 fffff800`036f16d2 : 00000000`0000009f 00000000`00000003 fffffa80`05226700 fffff800`053083d8 : nt!KeBugCheckEx
fffff800`05308390 fffff800`03691c3c : fffff800`053084c0 fffff800`053084c0 00000000`00000000 00000000`00000003 : nt! ?? ::FNODOBFM::`string'+0x33ac0
fffff800`05308430 fffff800`03691ad6 : fffffa80`0b4dfc58 fffffa80`0b4dfc58 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`053084a0 fffff800`036919be : 00000013`ed07cd02 fffff800`05308b18 00000000`00085ef1 fffff800`037fe0a8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`05308af0 fffff800`036917a7 : 00000004`a8e7a9c9 00000004`00085ef1 00000004`a8e7a96b 00000000`000000f1 : nt!KiTimerExpiration+0x1be
fffff800`05308b90 fffff800`0367ecca : fffff800`037f9e80 fffff800`03807cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`05308c40 00000000`00000000 : fffff800`05309000 fffff800`05303000 fffff800`05308c00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp

BUCKET_ID:  X64_0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp

Followup: MachineOwner
---------

0: kd> lmvm Neo_0062
start             end                 module name
fffff880`052e7000 fffff880`052ec500   Neo_0062 T (no symbols)           
    Loaded symbol image file: Neo_0062.sys
    Image path: \SystemRoot\system32\DRIVERS\Neo_0062.sys
    Image name: Neo_0062.sys
    Timestamp:        Mon Sep 16 09:18:00 2013 (52367F70)
    CheckSum:         000095E7
    ImageSize:        00005500
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

You told you have uninstalled it?

r4vemaster · 21 Nov 2013

hi Arc,

thank you for your effort. Yes I have uninstalled it but my brother install it again because he use it often.

But, aside from that recently my laptop is having another BSOD, but it will only occur when I play games like NBA2k14. Idea ? Thanks again !!

Arc · 21 Nov 2013

Are you overclocking? As you are getting BSODs, you should stop overclocking and run all the hardware components like CPU, GPU and RAM to their default settings.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If memtest comes to be free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.