TechSpot

Bad Pool Caller svchost.exe?

By P!M
Mar 4, 2009
Topic Status:
Not open for further replies.
  1. Hello I am getting allot of BSOD lately mostly if I play games. Here is what I get in windbg:

    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    WARNING: Whitespace at end of path element
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
    Machine Name:
    Kernel base = 0x81e1e000 PsLoadedModuleList = 0x81f35c70
    Debug session time: Wed Mar 4 19:26:45.942 2009 (GMT+1)
    System Uptime: 0 days 0:23:51.732
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
    Loading unloaded module list
    ........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {d, ff522860, 69707355, 8713c868}

    Page 7644b not present in the dump file. Type ".hh dbgerr004" for details
    Page 7644b not present in the dump file. Type ".hh dbgerr004" for details
    PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
    PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
    Probably caused by : win32k.sys ( win32k!UserDeleteW32Process+6b )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_CALLER (c2)
    The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arguments:
    Arg1: 0000000d, type of pool violation the caller is guilty of.
    Arg2: ff522860
    Arg3: 69707355
    Arg4: 8713c868

    Debugging Details:
    ------------------

    Page 7644b not present in the dump file. Type ".hh dbgerr004" for details
    Page 7644b not present in the dump file. Type ".hh dbgerr004" for details
    PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
    PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details

    FAULTING_IP:
    win32k!UserDeleteW32Process+6b
    96786428 8b0d241b8c96 mov ecx,dword ptr [win32k!gpHandleFlagsMutex (968c1b24)]

    BUGCHECK_STR: 0xc2_d

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: svchost.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from 81e6360a to 81eeb0e3

    STACK_TEXT:
    9bfbabac 81e6360a 000000c2 0000000d ff522860 nt!KeBugCheckEx+0x1e
    9bfbabc8 81f0c5c6 81f0be8d ff522860 00000000 nt!ExpReleasePoolQuota+0x33
    9bfbac28 96786428 ff522860 00000000 ff522860 nt!ExFreePoolWithTag+0x738
    9bfbac48 96786496 ff522860 00000000 9bfbac70 win32k!UserDeleteW32Process+0x6b
    9bfbac58 96786731 ff522860 893cfd80 879da020 win32k!DereferenceW32Process+0x1d
    9bfbac70 8202cec3 879da020 00000000 c8064249 win32k!W32pProcessCallout+0x7d
    9bfbacdc 82003331 c0000005 87821928 87821901 nt!PspExitThread+0x4a0
    9bfbacf4 81e6015c 87f48ac8 9bfbad20 9bfbad2c nt!PsExitSpecialApc+0x22
    9bfbad4c 81e75ac6 00000001 00000000 9bfbad64 nt!KiDeliverApc+0x1dc
    9bfbad4c 77129a94 00000001 00000000 9bfbad64 nt!KiServiceExit+0x56
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0178fe90 00000000 00000000 00000000 00000000 0x77129a94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!UserDeleteW32Process+6b
    96786428 8b0d241b8c96 mov ecx,dword ptr [win32k!gpHandleFlagsMutex (968c1b24)]

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: win32k!UserDeleteW32Process+6b

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 48d1b9ef

    FAILURE_BUCKET_ID: 0xc2_d_win32k!UserDeleteW32Process+6b

    BUCKET_ID: 0xc2_d_win32k!UserDeleteW32Process+6b

    Followup: MachineOwner
    ---------

    Does anny1 know how to fix this?
  2. Route44

    Route44 TechSpot Ambassador Posts: 12,139   +28

    This error is caused by either a faulty driver or buggy software. Unfortunately any drivers that are cited belong to your Windows OS and these are too general to be of much help.

    besides gaming, what other times do you experience the BSODs?
  3. P!M

    P!M Newcomer, in training Topic Starter Posts: 42

    Sometimes if I shutdown the pc, when I click ok I get a BSOD. I also get DRIVER IRQL NOT LESS OR EQUAL and all that ****, but I have got no dumps from those. When I get one in the near future I will post it here.

    Thanks for the answer
  4. Route44

    Route44 TechSpot Ambassador Posts: 12,139   +28

    That is an 0xD1 error and they are almost always caused by faulty drivers. It can also be caused by faulty or mismatched RAM, or a damaged pagefile.
  5. P!M

    P!M Newcomer, in training Topic Starter Posts: 42

    Next BSOD: (while playing game)

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {c0000005, 8208068c, 8a7d7b00, 8a7d77fc}

    Probably caused by : memory_corruption

    Followup: memory_corruption
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8208068c, The address that the exception occurred at
    Arg3: 8a7d7b00, Exception Record Address
    Arg4: 8a7d77fc, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    nt!PnpProcessRelation+22
    8208068c 817b4814030000 cmp dword ptr [ebx+48h],314h

    EXCEPTION_RECORD: 8a7d7b00 -- (.exr 0xffffffff8a7d7b00)
    ExceptionAddress: 8208068c (nt!PnpProcessRelation+0x00000022)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00000357
    Attempt to read from address 00000357

    CONTEXT: 8a7d77fc -- (.cxr 0xffffffff8a7d77fc)
    eax=b05c39f0 ebx=0000030f ecx=00000000 edx=00000000 esi=0000030f edi=b05c39f0
    eip=8208068c esp=8a7d7bc8 ebp=8a7d7be4 iopl=0 nv up ei ng nz ac po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292
    nt!PnpProcessRelation+0x22:
    8208068c 817b4814030000 cmp dword ptr [ebx+48h],314h ds:0023:00000357=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 00000357

    READ_ADDRESS: GetPointerFromAddress: unable to read from 81f42868
    Unable to read MiSystemVaType memory at 81f22420
    00000357

    FOLLOWUP_IP:
    nt!PnpProcessRelation+22
    8208068c 817b4814030000 cmp dword ptr [ebx+48h],314h

    BUGCHECK_STR: 0x7E

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    LAST_CONTROL_TRANSFER: from b05c39f0 to 8208068c

    STACK_TEXT:
    8a7d7be4 b05c39f0 0000030f 852c13c0 8a7d7c10 nt!PnpProcessRelation+0x22
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    8a7d7c14 82089538 b05c39f0 8a7d7c50 8208058d 0xb05c39f0
    8a7d7c20 8208058d 852c13c0 00000003 00000001 nt!IopAllocateRelationList+0x4d
    8a7d7c50 82083cd8 00000003 8a7d7ce8 8a7d7cc8 nt!PnpBuildRemovalRelationList+0x42
    8a7d7d04 81f6fe17 8a7d7d34 00000000 af7e0490 nt!PnpProcessQueryRemoveAndEject+0x2ee
    8a7d7d1c 81f9b3c0 00000000 81f0d13c 845cfd78 nt!PnpProcessTargetDeviceEvent+0x38
    8a7d7d44 81e43445 84b87268 00000000 845cfd78 nt!PnpDeviceEventWorker+0x201
    8a7d7d7c 81fe0b18 84b87268 046553b1 00000000 nt!ExpWorkerThread+0xfd
    8a7d7dc0 81e39a2e 81e43348 00000001 00000000 nt!PspSystemThreadStartup+0x9d
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    82080694 - nt!PnpProcessRelation+2a
    [ 57:d7 ]
    1 error : !nt (82080694)

    MODULE_NAME: memory_corruption

    IMAGE_NAME: memory_corruption

    FOLLOWUP_NAME: memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MEMORY_CORRUPTOR: ONE_BIT

    STACK_COMMAND: .cxr 0xffffffff8a7d77fc ; kb

    FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

    BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

    Followup: memory_corruption
    ---------
    I have this memory

    Kingston KVR667D2N5K2/4G, 4096 MB, DDR2, PC5300, 667 MHz, 2 x
  6. Route44

    Route44 TechSpot Ambassador Posts: 12,139   +28

    * Run memtest on your RAM.

    1. Go to www.memtest.org and download the latest ISO version. It is free and perfectly safe.

    2. Burn to a CD.

    3. Place CD in your drive and reboot with CD in drive. (You might have to place your drive as first bootable in your BIOS) The test will take over.

    4. Let it run for a LONG time. The rule is a minimum of 7 Passes; unless of course you start getting errors sooner and if so go to Step 6. There are 8 individual tests per Pass. Many people will start this test before going to bed and check it the next day.

    5. If you have errors you have corrupted memory and it needs to be replaced.

    6. Also, with errors you need to run this test per stick of RAM. Take out one and run the test. Then take that one out and put the other in and run the test. If you start getting errors before 7 Passes you know that stick is corrupted and you don’t need to run the test any further on that stick.
  7. P!M

    P!M Newcomer, in training Topic Starter Posts: 42

    OK I will try this. Thanks you will hear the results

    Ok I tested 1 memory module I ran it for 8.5 hours and 0 errors so that one is good, I will test the other one soon.
  8. P!M

    P!M Newcomer, in training Topic Starter Posts: 42

    OK I am sure the other module was broken. I played the whole day and no BSOD, and that never happened before. I had this pc build, so it was broken from the beginning.

    Thanks folks.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.