BSOD bad pool header

[armydude]

I just recently updated to windows 7 and I have only gotten this BSOD once but I am unsure why I got it and any help will be appreciated. This error happened while I was opening league of legends. Please let me know if I need to include anything else.

Attached is the minidump and a screen of the error windows gave me.

 

[Vir Gnarus]

This may be a bug from a March version of an Avast driver that you have. It looks to be making an illegal API call. See if there isn't an update you can install for it.

Typically, if a solitary BSOD or unusual symptom occurs, it's best to leave it be unless it repeats. Such hiccups can occur at times, and it's only with repeat offenses should one be concerned. Either way, go ahead and update Avast and be vigilant.

Analysts:

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa8003961770, the pool entry being checked.
Arg3: 6946657461657243, the read back flink freelist value (should be the same as 2).
Arg4: 775a071b006e6f69, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002daa4b3 to fffff80002c801c0

STACK_TEXT:  
fffff880`084046c8 fffff800`02daa4b3 : 00000000`00000019 00000000`00000003 fffffa80`03961770 69466574`61657243 : nt!KeBugCheckEx
fffff880`084046d0 fffff880`01081819 : 00000000`00000001 fffffa80`0413aa50 fffffa80`066dc850 fffffa80`00000000 : nt!ExDeferredFreePool+0xa53
fffff880`084047c0 fffff880`01611be3 : 00000000`00000000 00000000`00000000 fffffa80`04ad6108 fffffa80`04ad6108 : fltmgr!FltpReallocNameControl+0x39
fffff880`084047f0 fffff880`0107a035 : fffffa80`0466e3b0 fffff8a0`0a08f6f0 fffffa80`00000000 00000000`00000000 : luafv!LuafvGenerateFileName+0x9b
fffff880`08404820 fffff880`01079ead : fffff880`02fd3100 fffffa80`04ad6108 fffffa80`0466e3b0 fffff880`08404a14 : fltmgr!FltpCallOpenedFileNameHandler+0x75
fffff880`08404860 fffff880`01065b9d : [COLOR=Red]c00000bb[/COLOR]`00000000 00000000`00000000 fffffa80`06868b00 fffffa80`06868020 : fltmgr!FltpCreateFileNameInformation+0x17d
fffff880`084048c0 fffff880`0105fbf6 : fffffa80`04518100 fffffa80`06868010 fffffa80`04ad6108 fffff800`02c7ba10 : fltmgr![COLOR=Red]HandleStreamListNotSupported[/COLOR]+0x15d
fffff880`08404900 fffff880`01066b44 : fffffa80`066dc800 00000000`00000000 fffffa80`06868010 00000000`00000102 : fltmgr! ?? ::FNODOBFM::`string'+0x30f3
fffff880`08404980 fffff880`03e72717 : fffffa80`0466e3b0 fffffa80`0466f450 00000000`00000000 fffffa80`04ad6108 : fltmgr!FltGetFileNameInformation+0x184
fffff880`08404a10 fffffa80`0466e3b0 : fffffa80`0466f450 00000000`00000000 fffffa80`04ad6108 00610065`00650076 : [COLOR=Red]aswSnx[/COLOR]+0x3717
fffff880`08404a18 fffffa80`0466f450 : 00000000`00000000 fffffa80`04ad6108 00610065`00650076 00000000`00000000 : 0xfffffa80`0466e3b0
fffff880`08404a20 00000000`00000000 : fffffa80`04ad6108 00610065`00650076 00000000`00000000 fffffa80`04ad6108 : 0xfffffa80`0466f450

...

2: kd> lmvm [COLOR=Red]aswSnx[/COLOR]
start             end                 module name
fffff880`03e6f000 fffff880`03f3c000   aswSnx   T (no symbols)           
    Loaded symbol image file: aswSnx.SYS
    Image path: \SystemRoot\System32\Drivers\aswSnx.SYS
    Image name: aswSnx.SYS
    Timestamp:        Tue Mar 06 19:04:05 2012 (4F56A5F5)
    CheckSum:         000CF38B
    ImageSize:        000CD000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
2: kd> !error [COLOR=Red]c00000bb[/COLOR]
Error code: (NTSTATUS) 0xc00000bb (3221225659) - The request is not supported.

I may be reading this wrong, so take this analysis with a grain of salt. Best thing to do is to have client use Driver Verifier if the issue repeats.

Btw, when looking at the values given by Arg3 and Arg4 of the bugcheck:

2: kd> .formats 6946657461657243
Evaluate expression:
  Hex:     69466574`61657243
  Decimal: 7585862172876829251
  Octal:   0645063127214131271103
  Binary:  01101001 01000110 01100101 01110100 01100001 01100101 01110010 01000011
  Chars:   [COLOR=Red]iFetaerC[/COLOR]
  Time:    Mon Aug 22 21:41:27.682 25639 (UTC - 4:00)
  Float:   low 2.64534e+020 high 1.49904e+025
  Double:  1.33932e+199
2: kd> .formats 775a071b006e6f69
Evaluate expression:
  Hex:     775a071b`006e6f69
  Decimal: 8600194250970132329
  Octal:   0735320161540033467551
  Binary:  01110111 01011010 00000111 00011011 00000000 01101110 01101111 01101001
  Chars:   [COLOR=Red]wZ...noi[/COLOR]
  Time:    Sat Dec  6 08:44:57.013 28853 (UTC - 4:00)
  Float:   low 1.01419e-038 high 4.42213e+033
  Double:  8.39253e+266

No words I can think of, maybe foreign language? Anyways, they do appear to be parts of a character string (at least the first one does). I can't figure if it's code.

 

[armydude]

Thanks for the quick response, ill try to update and will use driver verifier if it keeps occuring.

 

[Vir Gnarus]

To use DV properly, you'll want to consult the article here. For the checks to run, select all except Low Resource Sim, Force Pending I/O Requests, and IRP Logging. Restart after everything is finished. Keep DV 'running' until you get a crash or two. You can turn it off in Safe Mode if you get a reboot loop after turning it on. Again, provide us the crashdumps.