BSOD Windows 7 x64 BAD_POOL_CALLER ntoskrnl.exe

[remundial]

Hi there,

I've had a serious problem of BSOD since I first installed Windows 7 (x86 and x64) on this laptop; a couple of years ago I upgraded RAM from 2 GB to 4 GB (a pair of sticks from a brand called SUPER TALENT), I was hoping I could use Windows 7 x64, but I had a lot of BSOD related with ntoskrnl.exe, I got tired looking for a fix but I could find any, so I bought a pair of Dell Certified memory sticks some days ago (2 GB each) because I thought the other sticks were damaged... For a couple of days Windows 7 seemed to work fine till some hours ago, BSODs returned.

I have installed Windows 7 x32/x64 several times, and I cannot avoid BSODs to appear. Windows XP works fine, and Ubuntu x86 PAE both run smoothly on this laptop, but now I need to migrate to Windows 7 and I'm not able to do it because of continuous BSODs.

==================================================
Dump File : 051713-13244-01.dmp
Crash Time : 2013-05-17 19:32:49
Bug Check String : BAD_POOL_CALLER
Bug Check Code : 0x000000c2
Parameter 1 : 00000000`00000007
Parameter 2 : 00000000`0000109b
Parameter 3 : 00000000`00000000
Parameter 4 : fffff8a0`12467010
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+75c00
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.18113 (win7sp1_gdr.130318-1533)
Processor : x64
Crash Address : ntoskrnl.exe+75c00
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\051713-13244-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7601
Dump File Size : 276.960
==================================================

Thank you very much for your help.

Best regards.

 

[remundial]

I must add all my drivers are (or at least seem to be) up-to-date, I use Drivermax. I ran verifier.exe, enabled non-Microsoft drivers, restarted and got BSODs before "Welcome" screen, I got to go through Safe Mode and disable this in order to have access to Win7 again. There seems to be another issue with igdkmd64.sys but I don't know how to fix it.

Thank you again.

 

[Arc]

Your crash dump is not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes clean, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.
_____________________________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[URL="http://www.carrona.org/bsodindx.html#0x000000C2"]BugCheck C2[/URL], {7, 109b, 0, fffff8a012467010}

GetPointerFromAddress: unable to read from fffff80002eb1100
GetUlongFromAddress: unable to read from fffff80002eb11c0
GetUlongFromAddress: unable to read from fffff80002e1fa38
GetUlongFromAddress: unable to read from fffff80002e1fa38
Probably caused by : memory_corruption ( nt!MiDeleteSegmentPages+112 )

Followup: MachineOwner
---------

 

[remundial]

Thanks for your response.

This laptop has a Dell app called "PC Checkup", months ago I ran some tests on memory and I always got a bunch of errors, that's why I bought Dell Certified memory sticks, but just after I installed those new modules I ran other tests and get the same errors I had in the past, fortunately I saved a report; some minutes ago I ran other test and it didn't find any error, I read both reports and I've found this on the old one:

"Evaluating state: The hardware was modified since the last assessment. The results belong to an earlier evaluation." (I've translated the reports into English, some text is not show when opened in browsers, I had to modify some things on MS Word, you can find the reports in attached file).

Months ago I also ran memtest86+, I had some clean tests and other were halted by BSODs, the process is very time consuming and I don't know if it's worth the time. I have serious suspicion on graphic card drivers, everytime I install Win7 I struggle some minutes trying to make graphics to work, it crashes 2 or 3 times before I'm able to install drivers; although graphics seem to be ok, maybe there's something inherently wrong or incompatible with Win7 about this graphic card, but I've read other Dell Vostro 1700s run smoothly on Win7 so I don't know what's all about...

Thank you again.

 

[Arc]

Here is some failure report.

[RIGHT][RIGHT][LEFT][FONT=&quot] [B]2048 MB         DDR2-SDRAM (PC2-6400/800 MHz)[/B][/FONT]
[FONT=&quot]Origin:[/FONT] [FONT=&quot]SPD[/FONT]
[FONT=&quot]Memory Size:[/FONT] [FONT=&quot]2.00 GB[/FONT]
[FONT=&quot] Memory Type:[/FONT] [FONT=&quot]DDR2-SDRAM (PC2-6400/800 MHz)[/FONT]
[FONT=&quot]Manufacturer of memory:[/FONT] [FONT=&quot]Kingston[/FONT]
[FONT=&quot]Memory Part Code:[/FONT] [FONT=&quot]9905295-051.A00LF[/FONT]
[FONT=&quot] Memory Serial Number:[/FONT] [FONT=&quot]1F09D348[/FONT]

[FONT=&quot][B]
Advanced Test Pattern[/B][/FONT]
[/LEFT]
[/RIGHT]
[/RIGHT]
  [FONT=&quot]Test begun[/FONT]
[FONT=&quot]10/05/2013 19:10:47[/FONT]  [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:10:55[/FONT]  [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:10:58[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:04[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:06[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:08[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:11[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:13[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:15[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:18[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:20[/FONT]   [FONT=&quot]Error message:[/FONT]  [FONT=&quot]Read-write error at       physical address 000000001FFFF000H memory.[/FONT]
[FONT=&quot]10/05/2013 19:11:22[/FONT]   [FONT=&quot]Error message:[/FONT]
                     [FONT=&quot]       Too many errors.[/FONT]
                     [FONT=&quot]       10/05/2013 19:11:22[/FONT]
                         [FONT=&quot]Test completed:[/FONT]
                     [FONT=&quot]       [COLOR=red]Failed (Error Code: WME02-I6N)[/COLOR][/FONT]
                     [FONT=&quot]       10/05/2013 19:11:23[/FONT]

We will need to run memtest on that module, at least. But better you run memtest with both the modules connected at first. Let us know the situation.

 

[remundial]

Yes, there's a failure report showing that but as I wrote before ""Evaluating state: The hardware was modified since the last assessment. The results belong to an earlier evaluation.", with new Dell Certified memory sticks there's no error shown (please see second report), and I still have BSODs.

 

[Arc]

I will wait for memtest86+ report first, and then if memtest comes to be free from errors, for the DV enavled crashdumps.

and I still have BSODs.

 

[remundial]

Ok, I will run 8 passes of memtest86+, I'm already running the first one and send results ASAP. I've realized the memtest I ran before was not "86+", just "memtest", this one runs outside Win7.

Is there any reason why there are BSODs with Driver Verifier enabled (before reaching "Welcome" screen) if it is not a driver issue?

Thank you.

 

[Arc]

Is there any reason why there are BSODs with Driver Verifier enabled (before reaching "Welcome" screen) if it is not a driver issue?

Thank you.

Yes, there are many a reasons. To determine this, we need the full SF DIAG TOOL output files. And, if DV is not enabled properly (dont forget to uncheck all drivers provided by "microsoft" and "unknown" in the list) this may happen, too.

But it is not determined yet that it is not a driver related issue.

 

[remundial]

There have been completed 8 passes with memtest86+, not a single error reported. I enabled DV again, according to the indications given here, Windows 7 tried to start up 5 consecutive times and it didn't manage to come to "Welcome" screen, a less than a second BSOD appeared every time, automatically reset, I went through Safe Mode, and reset DV. No new minidumps have been saved. What's the next step without this information? Trying to individualize the driver that's causing problems with DV?

Thank you.

 

[Arc]

Upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

Something is to be checked there before passing the next instruction.

 

[remundial]

Please find attached MSINFO32.nfo.

Thank you.

 

[Arc]

OK, free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus (you dont have any?)
5. Apply > OK
6. Accept then restart.

Also, as you have no AV installed, scan the system for possible virus infection with the following programs.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Uninstall Advanced System Care. It does not care the system, but causes some damages which are beyond repair.

Now try DV again. Dont select any driver provider by "microsoft" or "unknown" in the list.

Hopefully it will be able to reach the desktop now before crashing, and we will get the needed crash dump.

 

[remundial]

Yes, I do have Avast! AV (IS) and Malwarebytes as some sort of back-up, should I scan the system with these programs before enabling DV?

DV asks to select at least one driver, what should I select?

 

[remundial]

Finally I enabled igdkmd64.sys, there were three attempts to initialize Win7, the first one had a less than a second BSOD, the second one had a 3 to 5 seconds BSOD, and the third one was successful. I ran SF Diagnostic Tool, the second BSOD was recorded but seems like there's no valuable information there, not much different from the first one I reported yesterday, this to my amateur eyes.

I attach SF Diagnostic Tool report. View attachment 268723

Thank you.

 

[Arc]

Scan the system for possible virus infection with the following programs only.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Next apply DV.

For applying DV, follow http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Select all the drivers other than those supplied by "microsoft".

Let us know the situation. BTW, what about the memtest?
_______________________________________________________________________
BSOD ANALYSIS:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1f0, 2, 0, fffff80002e9aa55}

Probably caused by : CI.dll ( CI!A_SHAUpdate+60 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000001f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e9aa55, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd100
GetUlongFromAddress: unable to read from fffff800030bd1c0
 00000000000001f0 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae5
fffff800`02e9aa55 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88002ff5350 -- (.trap 0xfffff88002ff5350)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000065f4 rbx=0000000000000000 rcx=fffff88002ff563c
rdx=fffff98002ac1000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000d1eca0 rsp=fffff88002ff54e0 rbp=0000000000000034
 r8=000000000000000c  r9=0000000000000001 r10=0000000000006234
r11=000000000000000c r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
CI!A_SHAUpdate+0x60:
fffff880`00d1eca0 488b02          mov     rax,qword ptr [rdx] ds:fffff980`02ac1000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e851a9 to fffff80002e85c00

STACK_TEXT:  
fffff880`02ff4d98 fffff800`02e851a9 : 00000000`0000000a 00000000`000001f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02ff4da0 fffff800`02e83e20 : 00000000`00000000 fffff800`02e6ccbb 00000000`00000000 fffff980`02514ee0 : nt!KiBugCheckDispatch+0x69
fffff880`02ff4ee0 fffff800`02e9aa55 : fffff780`c0000000 00000000`00000001 00000000`00000400 fffffa80`057ce6c0 : nt!KiPageFault+0x260
fffff880`02ff5070 fffff800`02e78617 : 00000000`00000001 fffffa80`0372c040 fffff880`02ff5100 fffff800`00000000 : nt!IopCompleteRequest+0xae5
fffff880`02ff5140 fffff800`02e33ee5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`02ff51c0 fffff800`02e9385c : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000980`00000000 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`02ff51f0 fffff800`02e83d2e : 00000000`00000000 fffff980`02ac1000 00000000`00000000 00000000`00006200 : nt!MmAccessFault+0x1a3c
fffff880`02ff5350 fffff880`00d1eca0 : 00000000`00000000 fffffa80`0370e0d0 00000000`00000000 fffff800`02eed216 : nt!KiPageFault+0x16e
fffff880`02ff54e0 fffff880`00cdb830 : fffff980`02ac0000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!A_SHAUpdate+0x60
fffff880`02ff5520 fffff880`00cd3b38 : fffff980`02ac0190 00000000`00000000 00000000`00000400 00000006`00001000 : CI!HashpHashBytes+0x40
fffff880`02ff5550 fffff880`00cd3281 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!CipImageGetImageHash+0x310
fffff880`02ff5730 fffff880`00cd1fbb : 00000000`00000001 fffff880`02ff59f0 fffff880`02ff59f0 00000000`00000000 : CI!CipValidateFileHash+0x211
fffff880`02ff58a0 fffff800`030f5c64 : 00000000`0000000d 00000000`000fffff fffffa80`057ce6c0 00000000`00000000 : CI!CiValidateImageHeader+0x213
fffff880`02ff5980 fffff800`030f5a6a : 00000000`00000000 00000000`00000080 fffffa80`057d07d0 00000000`00000000 : nt!SeValidateImageHeader+0x58
fffff880`02ff59c0 fffff800`031851a6 : fffffa80`057ce6c0 fffffa80`057d07d0 00000000`00000001 00000000`0000000d : nt!MiValidateImageHeader+0x21a
fffff880`02ff5a90 fffff800`031617ae : fffff880`02ff5ce0 fffff880`02ff5e00 fffff880`02ff5f98 00000000`00000001 : nt!MmCreateSection+0x966
fffff880`02ff5c90 fffff800`02e84e93 : fffffa80`0372c040 fffff880`02ff5f38 fffff880`02ff5d28 00000000`00000000 : nt!NtCreateSection+0x171
fffff880`02ff5d10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CI!A_SHAUpdate+60
fffff880`00d1eca0 488b02          mov     rax,qword ptr [rdx]

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  CI!A_SHAUpdate+60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CI

IMAGE_NAME:  CI.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7c944

FAILURE_BUCKET_ID:  X64_0xA_VRF_CI!A_SHAUpdate+60

BUCKET_ID:  X64_0xA_VRF_CI!A_SHAUpdate+60

Followup: MachineOwner
---------

 

[remundial]

• Memtest86+: 8 passes, 0 errors
• Anti-rootkit utility TDSSKiller: Full options, No threats found
• Windows Defender Offline: Quick scan on Windows 7 partition, No threats found (I'm already running a full scan but seems it will take a lot of time to complete).

I kept DV enabled just with igdkmd64.sys, the system has frozen two times (without BSOD), on one restart the Windows 7 logo stayed active for more than 3 minutes (before "Welcome" screen) so I reset manually. When I get a complete scan with WDO, I'm gonna reset DV and enable non Microsoft drivers again and see what happens.

I have uninstalled ASC and disabled all but AV on MSCONFIG start-up list.

 

[remundial]

Windows Defender Online full scan found 6 threats in other partition, I removed 4 (Trojan, Hacks). I enabled DV, non Microsoft drivers, did 10 attempts to initialize Win7, none of them successful (less than a second BSOD). This caused a temporary problem with laptop screen, it didn't work even at BIOS phase of start-up, it went directly to the monitor and that's quite weird; laptop screen didn't work on Win7 nor WinXP, on Ubuntu it worked. The problem seem to disappear after a few restarts.

I had other "Starting Windows" screen with active Windows logo lasting more than 10 minutes, it never went to "Welcome" screen, I had to reset manually.

At this point DV is disabled, and I won't have the chance to run new tests for a few days...

Thank you.

 

[Arc]

Windows Defender Online full scan found 6 threats in other partition, I removed 4 (Trojan, Hacks). I enabled DV, non Microsoft drivers, did 10 attempts to initialize Win7, none of them successful (less than a second BSOD).

Have you free up the startup entries as suggested earlier?

 

[remundial]

Yes, I have...