Bad_pool_caller (c2)

[catherinesc]

My XP machine has been rebooting itself after recovering from a serious error. I am never using the machine when this happens. Because several of us use the machine I don't really have a time of reference for when it started, but suspect it started with my new monitor. I believe I had to install new drivers.
Can someone help me read this to see if I am even close?
Thanks!

Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Oct 4 13:02:33.855 2008 (GMT-7)
System Uptime: 4 days 9:59:49.142
Loading Kernel Symbols
....................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, cd4, 4100602, e32db3b8}

Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+2a3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 04100602, Memory contents of the pool block
Arg4: e32db3b8, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS: e32db3b8

FREED_POOL_TAG: IoNm

BUGCHECK_STR: 0xc2_7_IoNm

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from 8054a583 to 804f9deb

STACK_TEXT:
ab1832c8 8054a583 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
ab183318 80582037 e32db3b8 00000000 8a9c18e8 nt!ExFreePoolWithTag+0x2a3
ab183400 805bddc0 8a9c1900 00000000 89dfda28 nt!IopParseDevice+0xadb
ab183478 805ba448 00000000 ab1834b8 00000040 nt!ObpLookupObjectName+0x53c
ab1834cc 80574ec1 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
ab183548 80575838 00fde984 00100020 00fde93c nt!IopCreateFile+0x407
ab1835a4 80578ff7 00fde984 00100020 00fde93c nt!IoCreateFile+0x8e
ab1835e4 8054086c 00fde984 00100020 00fde93c nt!NtOpenFile+0x27
ab1835e4 7c90eb94 00fde984 00100020 00fde93c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fdebd0 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+2a3
8054a583 8b45f8 mov eax,dword ptr [ebp-8]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePoolWithTag+2a3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0xc2_7_IoNm_nt!ExFreePoolWithTag+2a3

BUCKET_ID: 0xc2_7_IoNm_nt!ExFreePoolWithTag+2a3

Followup: MachineOwner
---------

0: kd> !amalyze -v
No export amalyze found

 

[Achilles_ny]

You're on the right track. It's likely a driver issue; hit F8 just after the BIOS loads to enter Safe Mode, inside Device Manager, you should be able to uninstall the errant driver.

 

[Route44]

0C2 errors are caused either by a faulty driver or buggy software. In what you posted it cited the driver ntkrpamp.exe which is a core Windows driver which you definitely don't want to delete.

So...

1. Run chkdsk in your Run option in your start-up menu.

2. Run vieus/malware scan; could be with that you might have picked something up because several of you use it.

* Let us know of the results.