Solved BSOD when idle Bad Pool Header

[Indianatone]

Hi,
I was actually looking at the forum on another screen and computer when this machine BSOD and rebooted. Winamp was open but not playing music. Nothing else was running other than system tasks and CCleaner which was wiping the free space on the C drive. It said it had about an hour to go. I have never seen this machine do this before. I have 3 versions of 7 on it, 2 x 64 bit Enterprise and a 32 bit for games etc.
The version that crashed was 64 bit Enterprise with classic desktop.I have attached dump file. Malwarebytes was run yesterday and other than some Nirsoft tools nothing was found, Spybot also finds nothing. I use Avast Free for Anti virus and have never had a problem with it.
I was actually gobsmacked when it did this. I am thinking it was most likely CCleaners drive wipe that messed with something.
Thanks,
Tony.

 

[koolkat77]

Hello Tony,

[FONT="Lucida Console"]fffff880`0a310ca8 fffff800`037c2be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0504011c : nt!KeBugCheckEx
fffff880`0a310cb0 fffff800`0366552b : 00000000`00000000 00000000`00000000 fffffa80`18ded490 fffffa80`18ded490 : nt!ExDeferredFreePool+0x1201
fffff880`0a310d60 fffff800`03665c52 : 00000000`00000000 fffff800`0366e611 00000000`00000000 00000000`43060000 : nt!MmPurgeSection+0x71b
fffff880`0a310e50 fffff880`012a453f : fffffa80`1905a548 00000000`00000000 fffff8a0`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`0a310ec0 fffff880`012c50c3 : fffff880`0a311730 fffff8a0`43d66010 fffff8a0`43cbc140 fffff880`0a3111c8 : Ntfs!NtfsDeleteFile+0x57b
fffff880`0a311140 fffff880`01233c99 : fffff980`c5ca6c00 fffff880`012d26b0 fffff880`0a311690 00000000`00006000 : Ntfs!NtfsCommonCleanup+0x1653
fffff880`0a311550 fffff800`036a3c48 : fffff880`0a311690 fffff880`0a311668 00000000`11a6f2f0 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`0a311580 fffff880`01233d12 : fffff880`01233c80 fffff800`0369c646 fffff880`0a311900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0a311660 fffff880`012d2a94 : fffff880`0a311730 fffff880`0a311730 fffff880`0a311730 fffffa80`1b0f4c60 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`0a3116d0 fffff880`01002bcf : fffff880`0a311730 fffffa80`1a907c10 fffffa80`1a907fb0 fffffa80`1b0f4bb0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`0a311940 fffff880`010016df : fffffa80`0dac1cb0 00000000`00000000 fffffa80`0d93bd00 fffffa80`1a907c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0a3119d0 fffff800`0399b5ef : fffffa80`1a907c10 fffffa80`0eec1b30 00000000`00000000 fffffa80`104b68c0 : fltmgr!FltpDispatch+0xcf
fffff880`0a311a30 fffff800`0398ad14 : 00000000`00000000 fffffa80`0eec1b30 fffffa80`1a900100 fffffa80`104b68c0 : nt!IopCloseFile+0x11f
fffff880`0a311ac0 fffff800`0398aad1 : fffffa80`0eec1b30 fffffa80`00000001 fffff8a0`16676520 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`0a311b40 fffff800`0398b094 : 00000000`0000032c fffffa80`0eec1b30 fffff8a0`16676520 00000000`0000032c : nt!ObpCloseHandleTableEntry+0xb1
fffff880`0a311bd0 fffff800`03697253 : fffffa80`1110a600 fffff880`0a311ca0 00000000`0481f600 00000000`00000020 : nt!ObpCloseHandle+0x94
fffff880`0a311c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13[/FONT]

Well there seem to be lot of NTFS errors. They can be caused by Antivirus programs.

RECOMMENDATIONS

I'd first suggest you to remove these programs with relevant removal tool by searching in google or use the free version of Revo uninstaller, uninstall in "Advanced Mode":

Start Menu\Programs\avast! Free Antivirus	Public:Start Menu\Programs\avast! Free Antivirus	Public
Start Menu\Programs\COMODO	Public:Start Menu\Programs\COMODO	Public
Start Menu\Programs\COMODO\COMODO Firewall	Public:Start Menu\Programs\COMODO\COMODO Firewall	Public
Start Menu\Programs\Spybot - Search & Destroy	Public:Start Menu\Programs\Spybot - Search & Destroy	Public
Start Menu\Programs\TuneUp Utilities 2012	Public:Start Menu\Programs\TuneUp Utilities 2012	Public
Start Menu\Programs\TuneUp Utilities 2012\All functions	Public:Start Menu\Programs\TuneUp Utilities 2012\All functions	Public
COMODO Internet Security	"c:\program files\comodo\comodo internet security\cfp.exe" -h	Public	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

• COMODO uninstall tool
• avast! Uninstall Utility | Download aswClear for avast! Removal
• How to uninstall | Spybot ©

System Optimisers

These programs can be cause of BSOD's. The windows 7 operating system does not require these registry cleaning software. They often tune-down rather than tune-up and can wreck the OS beyond repair. Microsoft have improved Windows 7 significantly and it is much better at organising and optimising itself than its predecessors. Check this, this and this thread for evidence.

If you feel the need to use a registry cleaning or optimisation software, most of us recommend the use of CCleaner but make sure you back up the registry before making letting ccleaner delete anything.

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Keep Microsoft Security Essentials - Microsoft Windows and Malware bytes. They're a good combination.

Hope that helps for now.

 

[Indianatone]

OK. Thanks for the info koolkat77. I am running CCleaner again to see if I can get the computer to BSOD again. I am wiping the freespace on the drive and have noticed this directory full of junk is being created. Could this be the NTFS corruption? I have run CheckDisk and it found nothing.

 

[koolkat77]

Well.

Scan the system for viruses:

• 
  http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[Indianatone]

Hi koolkat77.
This is more of an FYI. I think the issue of the blue screen I got last night (first one I have ever had on this machine) was caused by CCleaner writing a bunch of folders full of files and zipped files called zzzzzz etc.(like the image I posted). I am clearing up the freespace on the drive with the virtual machines on it and the same directory structure is being created.
I can find no errors in system files, no viruses. There are 3 OS on the machine and a bunch of virtual machine images for messing about with. I'll leave it a day or two and then close the post.
Thank you for your help,
Tony.

 

[koolkat77]

Good luck

 

[Indianatone]

The issue was caused by CCleaner. The version causing this was V3.24.1850. There is now a new version out to replace the old one (normal).