Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen of Death


  • Please log in to reply
6 replies to this topic

#1 GeraldUK

GeraldUK

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 01 August 2009 - 06:55 AM

Over the last few months, I have been experiencing the BAD_POOL_CALLER_blue screen which informs me it has closed windows to prevent it being damaged. I can go for a few days between blue screen episodes and they seem to happen at random, even when I am not running an application.

I have sent the file to Microsoft, but they have been unable to give me the cause. I have however gone through the debugging steps they advise, except for starting my PC - running XP home - in safe mode as I cannot understand the reason for that step. Using this forum, I have at least got to the stage of using the MS debugger tool.


The STOP always seems to be 0X000000C2.

I should be grateful please assistance from those more computerate-literate than me.

At the moment, my PC always boots up again. As an aside in Event Viewer the Application error log is corrupt (as of yesteday I think), and I don't know how to clear it and enable a new log.








Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini080109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Aug 1 11:52:56.812 2009 (GMT+1)
System Uptime: 0 days 13:53:03.541
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, cd4, 2060006, 88f695a0}

Unable to load image vsdatant.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
Probably caused by : vsdatant.sys ( vsdatant+3f986 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 02060006, Memory contents of the pool block
Arg4: 88f695a0, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS: 88f695a0

FREED_POOL_TAG: TCPc

BUGCHECK_STR: 0xc2_7_TCPc

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8054b583 to 804f9f43

STACK_TEXT:
bacdfa34 8054b583 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
bacdfa84 b3581782 88f695a0 00000000 bacdfacc nt!ExFreePoolWithTag+0x2a3
bacdfa94 b3581450 88ebbe28 88ebbebc 88ebbe28 tcpip!TCPClose+0x16
bacdfacc b3485986 8a881118 88ebbe28 b348ae33 tcpip!TCPDispatch+0x101
WARNING: Stack unwind information not available. Following frames may be wrong.
bacdfb7c 8053580d bacdfc88 bafef640 e2b96838 vsdatant+0x3f986
bacdfb9c ba64f4c8 bafef640 88e667e0 00000066 nt!ExReleaseResourceLite+0x8d
bacdfc94 804ef19f 8a881118 88ebbe28 88ebbe28 Ntfs!NtfsCommonClose+0x430
bacdfd00 804ef19f 8a86a0f8 00000000 88ebbe28 nt!IopfCallDriver+0x31
bacdfd10 80583af8 88ddd430 00000000 00000000 nt!IopfCallDriver+0x31
bacdfd48 805bb472 00ddd448 00000000 88ddd448 nt!IopDeleteFile+0x132
bacdfd64 805bb8c4 88ddd448 00000001 80562f20 nt!ObpRemoveObjectRoutine+0xe0
bacdfd7c 8053877d 00000000 00000000 8adb8c98 nt!ObpProcessRemoveObjectQueue+0x36
bacdfdac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
bacdfddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
vsdatant+3f986
b3485986 ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: vsdatant+3f986

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: vsdatant

IMAGE_NAME: vsdatant.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 49990c8f

FAILURE_BUCKET_ID: 0xc2_7_TCPc_vsdatant+3f986

BUCKET_ID: 0xc2_7_TCPc_vsdatant+3f986

Followup: MachineOwner
---------

1: kd> lmvm vsdatant
start end module name
b3446000 b34b1000 vsdatant T (no symbols)
Loaded symbol image file: vsdatant.sys
Image path: vsdatant.sys
Image name: vsdatant.sys
Timestamp: Mon Feb 16 06:49:51 2009 (49990C8F)
CheckSum: 00056DE8
ImageSize: 0006B000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,246 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:12 AM

Posted 01 August 2009 - 09:29 AM

If someone asks you to run the system in safe mode...and you have BSODs...chances are they are trying to figure out if it's a driver problem or something else.

If it's a driver problem...it won't occur in safe mode and you will be able to access your XP. Only the most basic drivers load in safe mode.

Vsdatant.sys is the file I see pegged as the troublemaker. Info at http://www.file.net/process/vsdatant.sys.html

0x000000C2: BAD_POOL_CALLER
A kernel-mode process or driver incorrectly attempted to perform memory operations. Typically, a faulty driver or buggy software causes this.

I would suggest uninstalling then reinstalling whatever ZA programs you have installed. Upon reinstall, I would update said programs immediately.

Louis

#3 GeraldUK

GeraldUK
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 01 August 2009 - 11:31 AM

hamluis

Thanks for the reply.

Yes, I have ZoneAlarm (free) as my firewall, and I will do as you suggest.

Thanks

#4 GeraldUK

GeraldUK
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 02 August 2009 - 12:45 PM

hamluis

It all gets very difficult!

I uninstalled ZoneAlarm free having checked the build and that the files concerned actually had gone. I then reinstalled ZoneAlarm free, only to find it is exactly the same build, and I got a BSOD almost immediately. So I uninstalled and installed the Ashampoo free version. This proved not a success as it seemed to knock out my broadband internet connection. I did note that it said that it supported XP to SP2, and I am SP3 now. Anyway, to get Internet connectivity back, I uninstalled it.

I then thought about Kerio now Sunbelt Personal Firewall and then decided against as it fails the "Leak Test."

I had tried Comodo three or four months ago but it comflicted very badly with my AV - Kaspersky.

Slight lateral thinking. My broadband access is via my ISPs physical external modem. Am I correct in thinking that these have a firewall in them anyway? If so, of course, are they any good?

My gut feeling is that I do need a separate firewall and perhaps an earlier version of ZoneAlarm might be the answer?

Like to know your thoughts.

Thanks

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,246 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:12 AM

Posted 02 August 2009 - 02:16 PM

I have no idea what you are tallking about with these firewalls.

I've been using Kerio/Sunbelt Free (various versions, all free) for over 5 years now...and I've complete confidence in it.

I've also used Comodo Firewall and AV before with no known problems.

Now that I've bothered to look up what a leak test is supposed to be...I remain as I was. I'm not a fan of GRC or its statements, ideas, etc. In fact, I see them as being motivated by self-interest, but that's just my opinion.

Your options to choose a firewall for your system remain your own.

Louis

#6 GeraldUK

GeraldUK
  • Topic Starter

  • Members
  • 88 posts
  • OFFLINE
  •  
  • Local time:11:12 AM

Posted 14 August 2009 - 10:50 AM

Just to update people as a week or so has passed without any BSODs.

I got rid of Zonealarm free and the driver, and am using PC Tools Firewall.

No more BSODs - so thank you for your advice.

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,246 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:12 AM

Posted 14 August 2009 - 12:31 PM

Glad you were able to resolve it, happy computing :thumbsup:.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users