Windows 7 Troubleshooting Bad Pool Header BSOD: Need Help Analyzing Crash Dump File

K

killit

New Member
Joined
Jul 18, 2017
Messages
12
Hi, I have been having a bad pool header bsod lately. I have been trying the process of elimination to find out why but no luck yet. So here is the crash dump file hoping some with more knowledge than me to help analyze it. Thank you
 

Attachments

Solution
K
Sort by date Sort by votes
Code: 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff800034557d0, ffffffffffffd, fffff800034557d0}

Probably caused by : Pool_Corruption ( nt!ExFreePool+503 )

Followup:     Pool_corruption
Hi,
the above means a driver is causing memory corruption (virtual) although I can't see anything named in the dump file.

Looking at your current drivers and one driver literally jumped off the page:
BS_I2cIo.sys Mon Dec 11 07:48:39 2006: BIOSTAR I2C I/O driver Found in BIOSTAR BIOS Flash Utility. Please either update the flash utility or uninstall. You can find a later version on your moBos support page:
Link Removed

Try running the Link Removed. This stress your drivers on start up and if any are bsod prone then they will likely bsod there and then. This produces a dump with the culprits name attached so worth doing.

Please attach any new dump files.
 
Upvote 0 Downvote
So when you run the verifier does the machine actually blue screen on start up? In fact have you had any blue screens at all?

Post any new dump files please.
 
Upvote 0 Downvote
The pool entry is within the memory address range of ntkrnlmp.exe which is part of the kernel. The pool header is at the beginning address of the memory allocated to a driver. If the driver before it wrote to more memory than allocated it would override the header of the next driver. The driver before the kernel is hal which it's unlikely it did that. This could be due to physical memory problems. I would run memtest86 for at least 10 full passes.
 
Upvote 0 Downvote
Yeah i'll be surprised if it's the actual memory, personally i feel it's more of a driver issue but still see how your scans go.
 
Upvote 0 Downvote
kemical said:
Yeah i'll be surprised if it's the actual memory, personally i feel it's more of a driver issue but still see how your scans go.
Click to expand...

Hi tryed the memtest86 but it turn off my computer halfway through test i think do to over heating will try it again tonight.
I did make it get the bsod by turning off csrss.exe in task manager.
 

Attachments

Upvote 0 Downvote
There should only be one csrss.exe process running per logged in user, if there are more then it's probably a malicious process
 
Upvote 0 Downvote
Code: 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8008ee2b10, fffffa8008ee2df0, fffff80003589600}

ETW minidump data unavailable
Probably caused by : csrss.exe

Followup:     MachineOwner
Hi,
as you already know the above was created due to you turning off the csrss.exe process. I did take the opportunity to have a quick look through the dump file as it displays other helpful data too.
I see that this driver is still in the system. If you have an application for flashing the bios please remove.

BS_I2cIo.sys Mon Dec 11 07:48:39 2006: BIOSTAR I2C I/O driver Found in BIOSTAR BIOS Flash Utility.

I see your running Bullguard:

BdSpy.sys Wed Sep 23 09:06:34 2015: BullGuard File Monitor, part of the Bullguard security suite. We ask users to remove any third party AV suites and just use Windows Defender or Link Removed until the source of the bsod is found. You can always install it again but it just cuts down on the variables.

You mentioned that the machine possibly overheated when using memtest86?

It doesn't usually create a huge amount of heat so are you overclocking? If so please return to default values.

If you try running memtest86 again and the same thing happens try running one the one stick and test them individually.

Please post any new dump files.
 
Upvote 0 Downvote
csrss.exe is the client side interface of the Win32 system console and some GUI functionality. It's marked as a critical process so yes killing it will cause a bsod.
 
Upvote 0 Downvote
Code: 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89cf9eb03, b3b7465eef76ba29, fffff8000359b900, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!SeQuerySecurityDescriptorInfo+0 )

Followup:     MachineOwner

Hi,
please remove these drivers:
BS_I2cIo.sys Mon Dec 11 07:48:39 2006: BIOSTAR I2C I/O driver Found in BIOSTAR BIOS Flash Utility.

I see your running Bullguard:

BdSpy.sys Wed Sep 23 09:06:34 2015: BullGuard File Monitor, part of the Bullguard security suite. We ask users to remove any third party AV suites and just use Windows Defender or Link Removed until the source of the bsod is found. You can always install it again but it just cuts down on the variables.

Did you use the DDU when updating your graphics card?

You mentioned that the machine possibly overheated when using memtest86?

It doesn't usually create a huge amount of heat so are you overclocking? If so please return to default values.

If you try running memtest86 again and the same thing happens try running one the one stick and test them individually.
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

M
  • Solved
Windows 7 Troubleshooting Persistent BSODs: Help Analyzing Crash Dumps for Solutions
Replies
2
Views
2K
kemical
Windows 7 Troubleshooting BSOD Issues: Need Help Analyzing Crash Dumps
Replies
1
Views
790
Fixer1234
F
J
  • Question Question
Windows 7 Continuous BSOD Issues: Need Assistance Analyzing Crash Dump Files
Replies
5
Views
1K
juniorIT
J