BSOD - Happens randomly. "Bad Pool Header", "DRIVER_VERIFIER"

[ryanesta]

BSOD - Happens randomly. "Bad Pool Header", "DRIVER_VERIFIER"

Hi everyone,

I recently have noticed more and more BSODs. I had this problem about 6 months ago and was able to track it down to drivers that came from Daemon tools. I cleared all that out and it fixed the issue. I don't think these new BSODs are related but they might be.

This seems to be happening randomly. It happens roughly every 2 weeks and early in the morning (1am, 6am, 9am, etc.) but not at a consistent time. As far as I can tell, I am not doing anything or leaving open any specific program that triggers this. There doesn't seem to be a consistent pattern.

I ran the DM Log Collector and uploaded the zip file here. Any help would be appreciated. Thanks!

 

[koolkat77]

[FONT="Lucida Console"]
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Downloads\MUSICMACHINE-Wed_10_22_2014_142816_61\102214-20108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`03013000 PsLoadedModuleList = 0xfffff800`03256670
Debug session time: Wed Oct 22 00:31:30.751 2014 (UTC + 6:00)
System Uptime: 6 days 13:12:26.826
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 2, fffffa80085ecb50, 0}

Probably caused by : hardware ( nt! ?? ::FNODOBFM::`string'+4884 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
	the operating system. The only supported way to extend a kernel
	mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffffa80085ecb50
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  WDDriveService

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8800b9aa708 -- (.exr 0xfffff8800b9aa708)
ExceptionAddress: fffff8000335e612 (nt!PspThreadDelete+0x0000000000000002)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

TRAP_FRAME:  fffff8800b9aa7b0 -- (.trap 0xfffff8800b9aa7b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000007ef8f000 rbx=0000000000000000 rcx=fffff8800b9aa900
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000335e612 rsp=fffff8800b9aa940 rbp=fffffa80085ecb50
 r8=fffffa800bc940e8  r9=0000000000000000 r10=fffffffffffffffd
r11=fffff880009e7100 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!PspThreadDelete+0x2:
fffff800`0335e612 c4              ???
Resetting default scope

MISALIGNED_IP: 
nt!PspThreadDelete+2
fffff800`0335e612 c4              ???

LAST_CONTROL_TRANSFER:  from fffff800030df4ea to fffff80003088c00

STACK_TEXT:  
fffff880`0b9a9808 fffff800`030df4ea : 00000000`000000c4 00000000`00000091 00000000`00000002 fffffa80`085ecb50 : nt!KeBugCheckEx
fffff880`0b9a9810 fffff800`030b2153 : 00000000`00000000 00000000`00000000 00000000`00000003 0000007f`078f590c : nt! ?? ::FNODOBFM::`string'+0x4884
fffff880`0b9a9850 fffff800`030c34d1 : fffff880`0b9aa708 fffff880`0b9aa460 fffff880`0b9aa7b0 fffff880`02985180 : nt!RtlDispatchException+0x33
fffff880`0b9a9f30 fffff800`03088282 : fffff880`0b9aa708 fffffa80`0898cb50 fffff880`0b9aa7b0 fffffa80`083fcc10 : nt!KiDispatchException+0x135
fffff880`0b9aa5d0 fffff800`030863df : fffff880`0b9aa7b0 fffff800`0308be02 fffffa80`00000000 fffffa80`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0b9aa7b0 fffff800`0335e612 : fffffa80`083ecb50 fffffa80`081acb50 00000000`00400000 fffffa80`00a50003 : nt!KiInvalidOpcodeFault+0x11f
fffff880`0b9aa940 fffffa80`083ecb50 : fffffa80`081acb50 00000000`00400000 fffffa80`00a50003 fffff880`00b87180 : nt!PspThreadDelete+0x2
fffff880`0b9aa948 fffffa80`081acb50 : 00000000`00400000 fffffa80`00a50003 fffff880`00b87180 fffff800`038a39b0 : 0xfffffa80`083ecb50
fffff880`0b9aa950 00000000`00400000 : fffffa80`00a50003 fffff880`00b87180 fffff800`038a39b0 ffffffff`ff6b7257 : 0xfffffa80`081acb50
fffff880`0b9aa958 fffffa80`00a50003 : fffff880`00b87180 fffff800`038a39b0 ffffffff`ff6b7257 fffff880`00b87180 : 0x400000
fffff880`0b9aa960 fffff880`00b87180 : fffff800`038a39b0 ffffffff`ff6b7257 fffff880`00b87180 fffffa80`0bd048b0 : 0xfffffa80`00a50003
fffff880`0b9aa968 fffff800`038a39b0 : ffffffff`ff6b7257 fffff880`00b87180 fffffa80`0bd048b0 fffffa80`085ecc58 : 0xfffff880`00b87180
fffff880`0b9aa970 ffffffff`ff6b7257 : fffff880`00b87180 fffffa80`0bd048b0 fffffa80`085ecc58 00000000`00000001 : 0xfffff800`038a39b0
fffff880`0b9aa978 fffff880`00b87180 : fffffa80`0bd048b0 fffffa80`085ecc58 00000000`00000001 fffff880`0b9aabe0 : 0xffffffff`ff6b7257
fffff880`0b9aa980 fffffa80`0bd048b0 : fffffa80`085ecc58 00000000`00000001 fffff880`0b9aabe0 fffff880`0b9aabc8 : 0xfffff880`00b87180
fffff880`0b9aa988 fffffa80`085ecc58 : 00000000`00000001 fffff880`0b9aabe0 fffff880`0b9aabc8 fffffa80`0bd867c0 : 0xfffffa80`0bd048b0
fffff880`0b9aa990 00000000`00000001 : fffff880`0b9aabe0 fffff880`0b9aabc8 fffffa80`0bd867c0 fffffa80`085ecb50 : 0xfffffa80`085ecc58
fffff880`0b9aa998 fffff880`0b9aabe0 : fffff880`0b9aabc8 fffffa80`0bd867c0 fffffa80`085ecb50 00000000`00000000 : 0x1
fffff880`0b9aa9a0 fffff880`0b9aabc8 : fffffa80`0bd867c0 fffffa80`085ecb50 00000000`00000000 00000525`d9bc3773 : 0xfffff880`0b9aabe0
fffff880`0b9aa9a8 fffffa80`0bd867c0 : fffffa80`085ecb50 00000000`00000000 00000525`d9bc3773 fffff800`039901d3 : 0xfffff880`0b9aabc8
fffff880`0b9aa9b0 fffffa80`085ecb50 : 00000000`00000000 00000525`d9bc3773 fffff800`039901d3 00000000`00b10002 : 0xfffffa80`0bd867c0
fffff880`0b9aa9b8 00000000`00000000 : 00000525`d9bc3773 fffff800`039901d3 00000000`00b10002 fffffa80`0bba48b0 : 0xfffffa80`085ecb50


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4884
fffff800`030df4ea cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4884

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------
[/FONT]

If you are overclocking please stop.

MSINFO32:

• Please go to Start and type in "msinfo32.exe" (without the quotes) and press Enter.
• Save the report as an .nfo file, then zip up the .nfo file and upload/attach the .zip file with your next post.
• Also, save a copy as a .txt file and include it also (it's much more difficult to read, but we have greater success in getting the info from it).

Perform a Clean boot:

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

• How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[ryanesta]

I have attached the MSINFO32 file to this post. I also went through msconfig.exe and disabled a few startup services that didn't need to be there.

Thank you for your help! I really appreciate it!

 

[koolkat77]

Thanks.

Post if you have further BSOD's/.

 

[ryanesta]

Hi,

I have been having more BSODs lately. I recently had to install drivers for a wireless USB adapter but uninstalled it before getting the most recent BSODs. Also - I noticed the drivers for my display adapter had never been updated, so I updated them to the latest and greatest - still receiving BSODs. The latest ones gave me the following errors:

PFN_LIST_CORRUPT
IRQL_NOT_LESS_OR_EQUAL
DRIVER_IRQL_NOT_LESS_OR_EQUAL

Do I need to re-upload a new batch of DM Log Collector logs? Thanks

 

[koolkat77]

Do I need to re-upload a new batch of DM Log Collector logs? Thanks

Yes

 

[ryanesta]

I have attached a new DM Log collection to this post. Thank you for your time/help/patience!

 

[Arc]

BugCheck 4E, {99, 168350, 2, 141905}

[COLOR=Red]Probably caused by : memory_corruption[/COLOR] ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

Test your RAM modules for possible errors.

How to Test and Diagnose RAM Issues with Memtest86+
​

Run memtest86+ for at least 8 consecutive passes.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

Let us know the result.

 

[ryanesta]

I let the MemTest run for a long long time to do 8 passes and some errors did in fact pop up. I attached a screenshot showing the errors.

Does this mean I should replace the memory on this machine? Thanks

 

[Arc]

I let the MemTest run for a long long time to do 8 passes and some errors did in fact pop up. I attached a screenshot showing the errors.

Does this mean I should replace the memory on this machine? Thanks

Seeing you after a long gap. Hope everything is fine there with you.

Now follow the "Part 3: If You Have Errors:" of How to Test and Diagnose RAM Issues with Memtest86+

Errors/red lines means one or more RAM is faulty. But the fault may occur due to a faulty DIMM slot, too, which is a motherboard component. Using memtest86+, you can discriminate between a faulty RAM and a faulty motherboard.

How? Say you have two RAM sticks and two DIMM slots. You obtained errors at the test with all RAM sticks installed. Now, remove all the sticks but one. Test it in all the available slots, one by one. Continue the same procedure for all the available sticks.
How to make the inference that is it a RAM issue or it is a motherboard issue? Suppose you have got the result like that:

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

If it is a bad RAM, you need to change the RAM. Take the other existing (good) RAM to the shop and get one of the exactly same specification. The best is, get a totally new RAM KIT.

If it is a bad slot, it is a motherboard issue. But changing the motherboard needs a preparation for most of us; so dont populate that slot for the time being.

 

[ryanesta]

Hi!

I went through the lengthy process of testing out all 3 sticks of RAM memory on all 4 of my slots on my motherboard. I didn't get a single error message this time. My oldest stick of RAM (that I thought might be the issue) I did 100+ passes on! The others I did a minimum of 10 passes on each slot. Not one error.

It's a bit odd since I did get some errors when I had all 3 of them plugged in (which I uploaded in a previous screenshot). So what should I do now? Thanks!

 

[Arc]

So you have different RAM sticks?

Use only matching RAM sticks came in a same KIT.

 

[ryanesta]

Ah okay. I have a 4GB stick and a pair of two matching 2GB sticks. I guess I will just suck it up and get a different kit and see how that goes. Thanks