Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bad Pool Caller


  • Please log in to reply
17 replies to this topic

#1 Kitiara

Kitiara

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 08 April 2009 - 06:35 AM

Hi

I've had a run of bluescreens on my laptop lately. It happens when I bring it out of standby, and only shows for a second before it reboots. I managed to see the error line once, and it said 'BAD POOL CALLER'. It can happen 3-4 times before it manages to get Windows to run.

I've also had programs like internet explorer, office etc crash on me with a higher frequency than the normal random crashes.

I've run many different virusprograms, and it all seems clean. Spynomore is my standard antivirus.

I was recommended to restore Windows using an old system restore point, only to discover that this function was turned off on my computer... oops.

Help would be very appreciated :thumbsup:

Edited by Kitiara, 08 April 2009 - 08:22 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:26 AM

Posted 08 April 2009 - 07:48 AM

It helps if you post the exact detail of the blue screen error message.

Generally, these types of error seem to be caused (often) by drivers (which are probably corrupt/damaged), IMO.

Louis

#3 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 08 April 2009 - 08:22 AM

I can't see the exact detail, as it is only displayed for a fraction of a second before the reboot...

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:26 AM

Posted 08 April 2009 - 08:57 AM

To stop the blue screen reboot so that you can see the error message details: Disable Auto Reboot On System Crash - http://www.theeldergeek.com/auto_reboot_on_system_crash.htm

Louis

#5 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 08 April 2009 - 06:19 PM

Right, thanks. It has now stopped rebooting. I got a new bluescreen, without the laptop being in standby. This time it said DRIVER_IRQL_NOT_LESS_OR_EQUAL.

The technical info was

STOP:0x000000D1 (0x0186FCE2, 0x0000002, 0x0000000, 0xB8A506E4)
NETw5x32.sys - Address B8A506E4 base at B8A46000, Datestamp 49218c60


Also, when I rebooted and Windows came back on, I got the following message in a little error box: The system has recovered from a serious error. A log of this error has been created. Please tell Microsoft etc etc.

Asking for more info gave this error signature:
BCCode : 1a BCP1 : 00041284 BCP2 : D0A07001 BCP3 : 0000578B
BCP4 : C0E00000 OSVer : 5_1_2600 SP : 3_0 Product : 256_1


Don't know why I get different kind of bluescreens, but something is obviously not quite right...

Hope you can help :thumbsup:

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:26 AM

Posted 08 April 2009 - 06:46 PM

Nothing to lose by trying :thumbsup:.

First of all...you need to understand that there are varying situations which can cause this particular or similar error messages.

Background items to consider:

http://support.microsoft.com/kb/810980

http://www.prevx.com/filenames/71866157198...TW5X32.SYS.html

My interpretation of the above...is that your WiFi driver may be damaged...and needs to be removed (via Device Manager)....then, subsequently, reinstalled.

Just a guess...

Louis

#7 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 10 April 2009 - 02:00 AM

Did that

Brought it out of standby this morning to the following blue screen:

PFN LIST CORRUPT

Stop: 0x0000004E, 0x0000099, 0x0000027F, 0x00000000, 0x00000000

Rebooted, then got the IRQL one again, but it rebooted on it's own to fast to see if it was the same file.

#8 hamluis

hamluis

    Moderator


  • Moderator
  • 55,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:26 AM

Posted 10 April 2009 - 10:08 AM

FWIW:

0x0000004E: PFN_LIST_CORRUPT

This indicates that the memory management Page File Number list is corrupted. Can be caused by corrupt physical RAM, or by drivers passing bad memory descriptor lists.

I would try uninstalling the previously listed driver...not reinstalling...running the system to see if the problem persists. Only way that I know to eliminate something from contention.

Louis

#9 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 10 April 2009 - 03:05 PM

I might try that later - need my wireless atm to be online! But just got a different bluescreen. Seems to give me a new error every time...

PAGE FAULT IN NON PAGED AREA

STOP: 0x0000050 (0xC9084E6C, 0x0000000, 0x80505F17, 0x0000000) (last one might be something other than 0, the screen was twitching too much to be sure)


RAM issues? Do I need to buy new RAM, or could this be fixed?

#10 hamluis

hamluis

    Moderator


  • Moderator
  • 55,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:26 AM

Posted 10 April 2009 - 05:10 PM

All of the errors you've posted...either are or could be RAM issues.

You can run a memory diagnostic program to get some ideas concerning such:

MemTest Manual - http://hcidesign.com/memtest/manual.html

Memtest86.com - Memory Diagnostic - http://www.memtest86.com/

Louis

#11 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 11 April 2009 - 03:33 PM

I ran the memtest (top link) for 24 h without errors. The program itself advised me to run two copies of it (for dual core), with 732 ram on each, which is what I did. They both got to about 2000% coverage before I stoped it. No errors, as I said...

#12 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 12 April 2009 - 04:40 AM

Right, brought it out of standby again, and first got a bluescreen that had no capital letters, just 'a problem has been detected and windows has to shut down to prevent damage to your computer'

STOP: 0x000008E (0xC0000005, 0x805C0959, 0x97D24970, 0x0000000)

Rebooted, then got the PFN list corrupt again:

STOP: 0x0000004E (0x0000099, 0x00042E8E, 0x00000000, 0x00000000)

Rebooted, got PFN yet again:

STOP: 0x0000004E (0x0000099, 0x000278C, 0x00000000, 0x00000000)


Getting a bit tired of it all, but if it's hardware, then reformating won't really help, will it...?

#13 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 12 April 2009 - 04:15 PM

Again, out of standby and first the non-specified fault:

STOP: 0x000008E (0xC0000005, 0x8054B10D, 0xBAAB736C, 0x0000000)

Rebooted, then got page fault in non paged area:

STOP: 0x0000050 (0xC888E6C, 0x0000000, 0x80505F17, 0x0000000)

Rebooted, then got it working for now.

Any hope?

#14 hamluis

hamluis

    Moderator


  • Moderator
  • 55,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:07:26 AM

Posted 12 April 2009 - 04:36 PM

It's up to you...there's an awful lot of guesswork that goes into troubleshooting STOP errors.

http://www.theeldergeek.com/stop_error_messages.htm

http://www.aumha.org/a/stop.htm

Help Diagnosing BSODs And Crashes (BC) - http://www.bleepingcomputer.com/forums/t/176011/how-to-receive-help-diagnosing-blue-screens-and-windows-crashes/

Louis

#15 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:01:26 PM

Posted 13 April 2009 - 03:33 AM

Right. Here is the dumpfile analysis:


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini041309-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Apr 13 09:37:35.781 2009 (GMT+2)
System Uptime: 0 days 0:00:39.484
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8054b0ba, af0b0bdc, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+b4 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b0ba, The address that the exception occurred at
Arg3: af0b0bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: af0b0bdc -- (.trap 0xffffffffaf0b0bdc)
ErrCode = 00000000
eax=00dd5c38 ebx=00000004 ecx=000001ff edx=8aa6a1f0 esi=8aa6a0a0 edi=8aa6a1f0
eip=8054b0ba esp=af0b0c50 ebp=af0b0c90 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0xb4:
8054b0ba 8b10 mov edx,dword ptr [eax] ds:0023:00dd5c38=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

STACK_TEXT:
af0b0c90 8054b75f 00000001 000002dc 0000001a nt!ExDeferredFreePool+0xb4
af0b0cd0 bf802a1d e31454d8 00000000 af0b0d1c nt!ExFreePoolWithTag+0x47f
af0b0ce0 bf82bac5 e31454d8 af0b0d64 0007d630 win32k!HeavyFreePool+0xbb
af0b0d1c 8054162c 0a010419 00000000 00000000 win32k!NtGdiSetDIBitsToDeviceInternal+0xe0
af0b0d1c 7c90e4f4 0a010419 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007d6b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b0ba, The address that the exception occurred at
Arg3: af0b0bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: af0b0bdc -- (.trap 0xffffffffaf0b0bdc)
ErrCode = 00000000
eax=00dd5c38 ebx=00000004 ecx=000001ff edx=8aa6a1f0 esi=8aa6a0a0 edi=8aa6a1f0
eip=8054b0ba esp=af0b0c50 ebp=af0b0c90 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0xb4:
8054b0ba 8b10 mov edx,dword ptr [eax] ds:0023:00dd5c38=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

STACK_TEXT:
af0b0c90 8054b75f 00000001 000002dc 0000001a nt!ExDeferredFreePool+0xb4
af0b0cd0 bf802a1d e31454d8 00000000 af0b0d1c nt!ExFreePoolWithTag+0x47f
af0b0ce0 bf82bac5 e31454d8 af0b0d64 0007d630 win32k!HeavyFreePool+0xbb
af0b0d1c 8054162c 0a010419 00000000 00000000 win32k!NtGdiSetDIBitsToDeviceInternal+0xe0
af0b0d1c 7c90e4f4 0a010419 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007d6b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b0ba, The address that the exception occurred at
Arg3: af0b0bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: af0b0bdc -- (.trap 0xffffffffaf0b0bdc)
ErrCode = 00000000
eax=00dd5c38 ebx=00000004 ecx=000001ff edx=8aa6a1f0 esi=8aa6a0a0 edi=8aa6a1f0
eip=8054b0ba esp=af0b0c50 ebp=af0b0c90 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0xb4:
8054b0ba 8b10 mov edx,dword ptr [eax] ds:0023:00dd5c38=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

STACK_TEXT:
af0b0c90 8054b75f 00000001 000002dc 0000001a nt!ExDeferredFreePool+0xb4
af0b0cd0 bf802a1d e31454d8 00000000 af0b0d1c nt!ExFreePoolWithTag+0x47f
af0b0ce0 bf82bac5 e31454d8 af0b0d64 0007d630 win32k!HeavyFreePool+0xbb
af0b0d1c 8054162c 0a010419 00000000 00000000 win32k!NtGdiSetDIBitsToDeviceInternal+0xe0
af0b0d1c 7c90e4f4 0a010419 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007d6b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b0ba, The address that the exception occurred at
Arg3: af0b0bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: af0b0bdc -- (.trap 0xffffffffaf0b0bdc)
ErrCode = 00000000
eax=00dd5c38 ebx=00000004 ecx=000001ff edx=8aa6a1f0 esi=8aa6a0a0 edi=8aa6a1f0
eip=8054b0ba esp=af0b0c50 ebp=af0b0c90 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0xb4:
8054b0ba 8b10 mov edx,dword ptr [eax] ds:0023:00dd5c38=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

STACK_TEXT:
af0b0c90 8054b75f 00000001 000002dc 0000001a nt!ExDeferredFreePool+0xb4
af0b0cd0 bf802a1d e31454d8 00000000 af0b0d1c nt!ExFreePoolWithTag+0x47f
af0b0ce0 bf82bac5 e31454d8 af0b0d64 0007d630 win32k!HeavyFreePool+0xbb
af0b0d1c 8054162c 0a010419 00000000 00000000 win32k!NtGdiSetDIBitsToDeviceInternal+0xe0
af0b0d1c 7c90e4f4 0a010419 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007d6b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b0ba, The address that the exception occurred at
Arg3: af0b0bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: af0b0bdc -- (.trap 0xffffffffaf0b0bdc)
ErrCode = 00000000
eax=00dd5c38 ebx=00000004 ecx=000001ff edx=8aa6a1f0 esi=8aa6a0a0 edi=8aa6a1f0
eip=8054b0ba esp=af0b0c50 ebp=af0b0c90 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0xb4:
8054b0ba 8b10 mov edx,dword ptr [eax] ds:0023:00dd5c38=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

STACK_TEXT:
af0b0c90 8054b75f 00000001 000002dc 0000001a nt!ExDeferredFreePool+0xb4
af0b0cd0 bf802a1d e31454d8 00000000 af0b0d1c nt!ExFreePoolWithTag+0x47f
af0b0ce0 bf82bac5 e31454d8 af0b0d64 0007d630 win32k!HeavyFreePool+0xbb
af0b0d1c 8054162c 0a010419 00000000 00000000 win32k!NtGdiSetDIBitsToDeviceInternal+0xe0
af0b0d1c 7c90e4f4 0a010419 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007d6b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054b0ba, The address that the exception occurred at
Arg3: af0b0bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

TRAP_FRAME: af0b0bdc -- (.trap 0xffffffffaf0b0bdc)
ErrCode = 00000000
eax=00dd5c38 ebx=00000004 ecx=000001ff edx=8aa6a1f0 esi=8aa6a0a0 edi=8aa6a1f0
eip=8054b0ba esp=af0b0c50 ebp=af0b0c90 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExDeferredFreePool+0xb4:
8054b0ba 8b10 mov edx,dword ptr [eax] ds:0023:00dd5c38=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: logonui.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b0ba

STACK_TEXT:
af0b0c90 8054b75f 00000001 000002dc 0000001a nt!ExDeferredFreePool+0xb4
af0b0cd0 bf802a1d e31454d8 00000000 af0b0d1c nt!ExFreePoolWithTag+0x47f
af0b0ce0 bf82bac5 e31454d8 af0b0d64 0007d630 win32k!HeavyFreePool+0xbb
af0b0d1c 8054162c 0a010419 00000000 00000000 win32k!NtGdiSetDIBitsToDeviceInternal+0xe0
af0b0d1c 7c90e4f4 0a010419 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007d6b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+b4
8054b0ba 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+b4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+b4

Followup: Pool_corruption
---------




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users