BSOD on multiple computers - unable to recreate

Pusbum · 14 May 2015

We have multiple computers all the same hardware and the same build. Some but not all get a BSOD when running Adobe Reader or Microsoft Word (potentially other cases but these are the ones we have noticed). Once a computer has Blue Screened we are unable to "make" it happen again no matter how hard we try. Would really like to work out what is causing the BSOD but so far I have failed.

Log files attached.

Thanks in advance for any advice.

ICIT2LOL · 17 May 2015

Hello and welcome Pusbum mate try running these first as there appears to be some corruption in the filing system/s and some possibility that there is malware present.

https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
https://www.sevenforums.com/tutorials/433-disk-check.html < if necessary include the /f and /r in the command line as per Option2
http://www.superantispyware.com/
http://www.malwarebytes.org/products/malwarebytes_free/
http://www.bleepingcomputer.com/download/adwcleaner/
ADW download from bleeping computer delete any rubbish found with the malware scans
(NB If one is running Kaspersky security it may rant about ADW - just ignore it or disable Kaspersky while the ADW is being used)

Boozad · 17 May 2015

Hello pusbum. After following John's advice can you please enable Driver Verifier by following the instructions below. Post up any resulting BSODs you encounter while DV is enabled.

Code:

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000021, the data following the pool block being freed is corrupt.  Typically this means the consumer (call stack ) has overrun the block.
Arg2: fffff900c1f06000, The pool pointer being freed.
Arg3: 0000000000001060, The number of bytes allocated for the pool block.
Arg4: 0000000000000000, The corrupted value found following the pool block.

Diagnostic Test

DRIVER VERIFIER

Driver Verifier will stress your drivers and cause BSODs if any fail. Follow this tutorial to enable/disable it. Driver Verifier - Enable and Disable

Enable Driver Verifier but only enable these options:

Standard settings and IRP logging step 3.
Don't enable Force Pending I/O Requests

Warning

Make a System Restore point before enabling Driver Verifier.

Note

Your system will act very sluggishly while DV is enabled, this is normal as your drivers will be being subjected to heavy testing in order to make them crash.

Post any resulting dump files.