Bad_Pool_Caller

[jit]

Hi,

One of the PCs in the office started doing random reboots yesterday. I disabled auto restart and found that it was due to a Bad_Pool_Caller. I'm suspecting a driver but as they have been no upgrades to hardware recently it's difficult to determine what device is causing it. I was hoping one of you could narrow it down for me using the attached minidump files.

Thanks!

 

[Route44]

All 4 error codes are the same 0x000000C2: BAD_POOL_CALLER
A kernel-mode process or driver incorrectly attempted to perform memory operations. Typically, a faulty driver or buggy software causes this.

The probable cause was simply cited as a Windows OS driver and thing with OS drivers is usually they are too general to be of much diagnostic use. They more so point out that there is an issue rather then directing us to the issue or that they are the issue.

However, in the mix the following were cited:

Twice noted: The driver COH32.sys which is part of Symantec Shared-Various Symantec applications use the shared virus definition folder \VirusDefs (usually located at C: \Program Files\Common Files\Symantec Shared\VirusDefs). These applications create temporary folders and files under this shared folder.

The driver SmcGui.exe which is part of your Symantec firewall.

And lastly SpybotSD.exe.

 

[jit]

Thanks Route44.

I just changed the memory sticks. If it crashes again i'm going to use the System File checker to verify all OS drivers. Then i'll try reinstalling the Symantec client for that machine.

I am also unable to do a system restore, even in safe mode. Any idea on what could be causing that? The only other time i could not restore was due to a rootkit but MBAM, Superantispyware and Symantec Endpoint have come up clean.

Thanks,
Jit.

 

[jit]

I ended up having to reimage the machine. Updating drivers, verifying the OS files & changing memory sticks did not work. I was in the process of reinstalling Symantec Endpoint Protection when it did not boot up after the uninstall. The boot up error was due to a corrupted registry hive. the system is stable after the reimage.

Thanks again for all your help.