BSOD Bad Pool Caller when rebooting

[drew22to375]

Hello,

I have recently setup new pc's for our programming staff. The pc's are HP 8300 Elite convertible minitower. 32GB of memory 500GB hard drives RAID 1 configuration, Nvidia 8400 GS. They are all setup with identical software and drivers, etc. out of 11 pc's 3 of them after a month of use get the Bad Pool Caller when rebooting the pc. all of them appear be be the same error. I am unable to use the SF diagnostic tool. So I will post the error what who crashed says.
Along with several of the mini dump files. The Bad Pool Caller is the most common error but I have also received Driver corrupted Expool. Any help troubleshooting these errors would be appreciated. Thanks Drew..


Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Tue 9/3/2013 8:01:07 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75B80)
Bugcheck code: 0xC2 (0x99, 0xFFFFFA801EE48E70, 0x0, 0x0)
Error: BAD_POOL_CALLER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the current thread is making a bad pool request.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

 

[x BlueRobot]

Why weren't you able to use the SF_Diagnostic Tool?

 

[drew22to375]

Why weren't you able to use the SF_Diagnostic Tool?

I get an error saying unable to create folder when selecting grab all. I think it's the Symantec endpoint may be blocking it. Our network engineer has it set so I can't disable endpoint.

 

[x BlueRobot]

Okay, we can gather the files manually, I'll post the instructions for the main two first:

Minidumps:

Please go to this folder (see below), and then check for any dump files, if so please place them into a zipped folder and then attach in your next post.

MSINFO32:

Start rb:
Type: msinfo32
File, Save
Place in the same zipped folder, and then upload in your next post.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[drew22to375]

File Uploaded.

 

[x BlueRobot]

[COLOR=Red]BugCheck C2[/COLOR], {[COLOR=Blue]99[/COLOR], [COLOR=SeaGreen]fffffa801ee48e70[/COLOR], 0, 0}

Probably caused by : [COLOR=Red]memory_corruption[/COLOR] ( nt!MiUnmapViewOfSection+295 )

Usual causes:  Device driver, Memory

This bugcheck indicates that the thread has attempted to free a pool page with a invalid memory address; the pool header could be corrupt too for the driver which exists within the page.

3: kd> [COLOR=Red][COLOR=SeaGreen]!pool fffffa801ee48e70[/COLOR][/COLOR]
Pool page fffffa801ee48e70 region is Nonpaged pool
 [COLOR=Red]fffffa801ee48000 size:  210 previous size:    0  (Allocated)  ALPC (Protected)[/COLOR]
 fffffa801ee48210 size:   30 previous size:  210  (Allocated)  ReSe
 fffffa801ee48240 size:   80 previous size:   30  (Free )  SeTl
 fffffa801ee482c0 size:   c0 previous size:   80  (Free )  EtwR (Protected)
 fffffa801ee48380 size:   20 previous size:   c0  (Allocated)  I200
 fffffa801ee483a0 size:   a0 previous size:   20  (Free )  Even (Protected)
 fffffa801ee48440 size:  1c0 previous size:   a0  (Free )  EtwG
 fffffa801ee48600 size:   10 previous size:  1c0  (Free)       CcSc
 fffffa801ee48610 size:   c0 previous size:   10  (Allocated)  EtwR (Protected)
 fffffa801ee486d0 size:   c0 previous size:   c0  (Allocated)  EtwR (Protected)
 fffffa801ee48790 size:   e0 previous size:   c0  (Allocated)  SASC
 fffffa801ee48870 size:   30 previous size:   e0  (Allocated)  ReEv
 fffffa801ee488a0 size:  100 previous size:   30  (Allocated)  Ntfx
 fffffa801ee489a0 size:   80 previous size:  100  (Free )  Sema (Protected)
 fffffa801ee48a20 size:   50 previous size:   80  (Allocated)  ViMm
 fffffa801ee48a70 size:   e0 previous size:   50  (Allocated)  IoCo (Protected)
 fffffa801ee48b50 size:  1e0 previous size:   e0  (Allocated)  MmCi
 [COLOR=Red]fffffa801ee48d30 size:  130 previous size:  1e0  (Allocated)  IE1Q[/COLOR]

3: kd> [COLOR=SeaGreen]!poolval fffffa801ee48000[/COLOR]
Pool page fffffa801ee48000 region is Nonpaged pool

Validating Pool headers for pool page: fffffa801ee48000

[COLOR=Red]Pool page [ fffffa801ee48000 ] is __inVALID.[/COLOR]

Analyzing linked list...
[ fffffa801ee48d30 --> fffffa801ee48ef0 (size = 0x1c0 bytes)]: Corrupt region


Scanning for single bit errors...

None found

3: kd> [COLOR=SeaGreen]dt nt!_POOL_HEADER fffffa801ee48d30[/COLOR]
   +0x000 PreviousSize     : 0y00011110 (0x1e)
   +0x000 PoolIndex        : 0y00000000 (0)
   +0x000 BlockSize        : 0y00010011 (0x13)
   +0x000 PoolType         : 0y00000010 (0x2)
   +0x000 Ulong1           : 0x213001e
   +0x004 PoolTag          : 0x51314549
   +0x008 ProcessBilled    : (null) 
   +0x008 AllocatorBackTraceIndex : 0
   +0x00a PoolTagHash      : 0

3: kd> [COLOR=SeaGreen]dt nt!_POOL_HEADER fffffa801ee48ef0[/COLOR]
   +0x000 PreviousSize     : 0y00001001 (0x9)
   +0x000 PoolIndex        : 0y00000000 (0)
   +0x000 BlockSize        : 0y00000001 (0x1)
   +0x000 PoolType         : 0y00000000 (0)
   +0x000 Ulong1           : 0x10009
   +0x004 PoolTag          : 0xee657645
   +0x008 ProcessBilled    : (null) 
   +0x008 AllocatorBackTraceIndex : 0
   +0x00a PoolTagHash      : 0

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

Select the Individual Settings option, and check all the boxes (especially Special Pool) apart from the Low Resources Simulation option.

 

[drew22to375]

OK I will give that a try. I will have to wait until this weekend to run it. I will report back on Monday.

Thanks

 

[x BlueRobot]

Okay thanks