BSOD Windows 2008 R2
I had a system blue screen with the following information. Can someone please help with resolving this issue.
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80001bee000, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExDeferredFreePool+174
fffff800`01bee000 4c395008 cmp qword ptr [rax+8],r10
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
PROCESS_NAME: System
TRAP_FRAME: fffff8800225b310 -- (.trap 0xfffff8800225b310)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff880008001c0
rdx=fffffa80636ef110 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001bee000 rsp=fffff8800225b4a0 rbp=0000000000000000
r8=fffffa806890e990 r9=fffffa80636ef0a0 r10=fffffa80636ef0b0
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!ExDeferredFreePool+0x174:
fffff800`01bee000 4c395008 cmp qword ptr [rax+8],r10 ds:00000000`00000008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001ab9b69 to fffff80001aba600
STACK_TEXT:
fffff880`0225b1c8 fffff800`01ab9b69 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0225b1d0 fffff800`01ab87e0 : 00000000`00000001 00000000`00000000 00000000`00000e9b 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0225b310 fffff800`01bee000 : fffffa80`680d6000 fffffa80`dd8b27f0 fffffa80`680e1f80 fffff880`0611df5c : nt!KiPageFault+0x260
fffff880`0225b4a0 fffff800`01bef4c1 : fffff880`00000001 fffffa80`690dc5f0 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x174
fffff880`0225b530 fffff880`00e77c44 : fffffa80`680e2320 fffffa80`00000000 fffffa80`626c6670 00000000`00000000 : nt!ExFreePoolWithTag+0x411
fffff880`0225b5e0 fffff880`0611e91e : fffffa80`680d6990 00000000`00000000 00000000`00000000 fffff880`0225b840 : NDIS!NdisFreeNetBufferListContext+0x54
fffff880`0225b610 fffffa80`680d6990 : 00000000`00000000 00000000`00000000 fffff880`0225b840 fffffa80`680d6000 : basp+0x1291e
fffff880`0225b618 00000000`00000000 : 00000000`00000000 fffff880`0225b840 fffffa80`680d6000 fffff880`01a71260 : 0xfffffa80`680d6990
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+174
fffff800`01bee000 4c395008 cmp qword ptr [rax+8],r10
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ExDeferredFreePool+174
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0xC5_2_nt!ExDeferredFreePool+174
BUCKET_ID: X64_0xC5_2_nt!ExDeferredFreePool+174
Followup: Pool_corruption
---------
September 8th, 2010 7:12am
Hi,
Is this the only blue screen that you have received?
Have you recently installed any new drivers, updated BIOS/Firmware, or
installed an application that works with a driver such as an antivirus?
-- Mike Burr
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2010 9:08am
Hi,
I would like to confirm the following questions first:
1.
When did the issue start to occur?
2.
Is there any change made on this system?
3.
What were you doing or which program was running when BSOD occurred?
4.
Is it reproducible?
Based on the following information, the BSOD issue can be caused by the network card. NDIS means this issue may relate to network components and Basp
can be the network card driver from Broadcom.
------------------------------------------------------------------------
fffff880`0225b5e0 fffff880`0611e91e : fffffa80`680d6990 00000000`00000000 00000000`00000000 fffff880`0225b840 :
NDIS!NdisFreeNetBufferListContext+0x54
fffff880`0225b610 fffffa80`680d6990 : 00000000`00000000 00000000`00000000 fffff880`0225b840 fffffa80`680d6000 :
basp+0x1291e
------------------------------------------------------------------------
If you do have Broadcom network adapter installed, please try to update the network card driver to test the issue.
If the issue persists, would you please send me more minidump files for analyzing. For your convenience, I have created a workspace for you. You can
upload the information files to the following link. (Please choose "Send Files to Microsoft")
Workspace URL:
https://sftasia.one.microsoft.com/choosetransfer.aspx?key=ca806d59-13cf-44d6-b09b-f46a0626232b
Password: epjVICi3jn!No4
Note: Due to differences in text formatting with various email clients, the workspace link above may appear to be broken. Please be sure to include
all text between '(' and ')' when typing or copying the workspace link into your browser. Meanwhile, please note that files uploaded for more than 72 hours will be deleted automatically. Please ensure to notify me timely after you have uploaded the files.
Thank you for your understanding.
Collect Minidump Files
=================
1. Click "Start", input "SYSDM.CPL" (without quotation marks) in the “Search” bar and press “Enter”.
2. Switch to the "Advanced" tab and click the "Settings" button under "Startup and Recovery".
3. Under "Write debugging information" section, make sure the "Small memory dump (128KB)" option is selected.
4. Make sure "%SystemRoot%\Minidump" is in the "Small dump directory" open box and click “OK”.
If the Blue Screen appears again, please refer to the following steps to collect memory dump files:
1. Click “Start”, type “%SystemRoot%\Minidump" (without quotation marks) in “Search” bar and press “Enter”.
2. Go to your Desktop, right-click on it and create a new folder named "Dump".
3. Copy all the memory dump files (looks like [Mini092008-01.dmp]) in Minidump to this folder.
4. Right-click on the Dump folder, click "Send To", and click "Compressed (zipped) Folder".
5. Please send the ZIP file to us.
For more information, please read the Microsoft KB Article:
How to read the small memory dump files that Windows creates for debugging.
If no more clues can be found, you may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can
assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call.
To obtain the phone numbers for specific technology request please take a look at the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Regards,
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
September 8th, 2010 12:30pm
I upload the minidump, the issue happened once, and I wasn't in front of the system when this happened. There was a firmware installation prior to this, but I am trying to detemine this.
Thanks,
Stephen Robinson
Free Windows Admin Tool Kit Click here and download it now
September 8th, 2010 7:09pm
Hi,
I would like to confirm that have you fixed the issue? If not, what is the current situation? If there is anything that I can do for you, please do not
hesitate to let me know, and I will be happy to help.
Regards,
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
September 14th, 2010 9:44pm