1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: BAD_POOL_CALLER Stop: 0X000000C2

Discussion in 'Windows XP' started by Trouper, Jul 31, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    I have had about 5 or 6 BSOD's today, all of them were the BAD_POOL_CALLER with the Stop: 0X000000C2 . The parameters listed after that are similar but different every time. I have the minidump files ready for somebody to view, if I can figure how to zip and load them here. I think it all started after loading Trend Micro 2008. Now I can't surf the net for more than about 15-30 minutes before I get the BSOD. I have temporarily uninstalled Trend Micro, to see if that helps. Any help in this matter is greatly appreciated.

    Thanks,
    Trouper
     

    Attached Files:

  2. kniht

    kniht

    Joined:
    May 7, 2006
    Messages:
    1,763
  3. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    Is this program part of the Trend Software? I don't recognize that program at all. Did you get this information from the dump files? I will apply the fix, once I get Trend re-installed and updated again. I got really fed up this afternoon, and uninstalled it again. I was able to surf the net for about 45 minutes uninterupted after doing that, then I shut it down myself. I will try to work on it tomorrow and see what happens. Thanks!

    Trouper
     
  4. kniht

    kniht

    Joined:
    May 7, 2006
    Messages:
    1,763
    Here's the debug info:

    Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Owner\Desktop\New Folder (2)\Mini073108-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: c:\windows\symbols;c:\windows\symbols\w2ksp4;c:\windows\symbols\symbols;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp.080413-2111
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
    Debug session time: Thu Jul 31 09:59:24.334 2008 (GMT-4)
    System Uptime: 0 days 0:21:36.931
    Loading Kernel Symbols
    ................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {7, cd4, 1, 866fef60}

    Unable to load image TM_CFW.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for TM_CFW.sys
    *** ERROR: Module load completed but symbols could not be loaded for TM_CFW.sys
    Probably caused by : TM_CFW.sys ( TM_CFW+9c0e )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_CALLER (c2)
    The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arguments:
    Arg1: 00000007, Attempt to free pool which was already freed
    Arg2: 00000cd4, (reserved)
    Arg3: 00000001, Memory contents of the pool block
    Arg4: 866fef60, Address of the block of pool being deallocated

    Debugging Details:
    ------------------


    POOL_ADDRESS: 866fef60

    FREED_POOL_TAG: FMsl

    BUGCHECK_STR: 0xc2_7_FMsl

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: Idle

    LAST_CONTROL_TRANSFER: from 80544a86 to 804f8cb5

    STACK_TEXT:
    8054998c 80544a86 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
    805499dc f6773c0e 866fef60 00434657 85b6c928 nt!ExFreePoolWithTag+0x2a0
    WARNING: Stack unwind information not available. Following frames may be wrong.
    805499f4 f6795279 866fef60 00000001 85ba6358 TM_CFW+0x9c0e
    80549a08 f67955d3 85ba6358 80527662 85bbf630 TM_CFW+0x2b279
    80549a20 f6788be0 00000002 806d10b8 85bbf630 TM_CFW+0x2b5d3
    80549ab4 f6788d64 80527662 85bbf630 00000000 TM_CFW+0x1ebe0
    80549ad4 f6770168 85bbf630 80549b0c 80549c00 TM_CFW+0x1ed64
    80549ae4 804ffd88 870a0360 870a0338 a3855a70 TM_CFW+0x6168
    80549c00 804ffe9f 805529a0 80552740 ffdff000 nt!KiTimerListExpire+0x122
    80549c2c 80541b8d 80552da0 00000000 0001f9e2 nt!KiTimerExpiration+0xaf
    80549c50 80541b06 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46
    80549c54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    TM_CFW+9c0e
    f6773c0e ?? ???

    SYMBOL_STACK_INDEX: 2

    SYMBOL_NAME: TM_CFW+9c0e

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: TM_CFW

    IMAGE_NAME: TM_CFW.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 477075b5

    FAILURE_BUCKET_ID: 0xc2_7_FMsl_TM_CFW+9c0e

    BUCKET_ID: 0xc2_7_FMsl_TM_CFW+9c0e

    Followup: MachineOwner
    ---------

    kd> lmvm TM_CFW
    start end module name
    f676a000 f6921000 TM_CFW T (no symbols)
    Loaded symbol image file: TM_CFW.sys
    Image path: TM_CFW.sys
    Image name: TM_CFW.sys
    Timestamp: Mon Dec 24 22:15:01 2007 (477075B5)
    CheckSum: 0005DB6C
    ImageSize: 001B7000
    Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0


    Check this out:

    http://www.file.net/process/tm_cfw.sys.html
     
  5. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    WOW. That is a lot of information (all Greek to me) but I am glad you understand it! I just reinstalled Trend, and immediately had a problem. As soon as I tried to access the internet, it shut down with DRIVER_IRQL_NOT_LESS_OR_EQUAL with a Stop: 0x000000D1 (which also happened once before.) I will try to get it back up and load the fix, but if I can't get on the net, I will have to download the stuff onto my desktop and transfer it over. I also had another BAD_POOL_CALLER error too. This is a headache.

    EDIT:
    Well, I tried to download the hot fix, but it says that my computer doesn't have OfficeScan installed. So it wont let me install the updated drivers and such. I looked, and the TM_CFW.sys is listed in my systems32 drivers folder. I tried an experiment, and tried to surf with Trend on. It BSOD again, almost immediately hitting Yahoo. I restarted, and turned off the Trend Firewall, and surfed the net fine for 30 minutes. I have attached the new dump files that happend today. Now what do I do?
    Trouper
     
  6. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    Sorry, here are the new dump files.

    HELP!!!!!

    Trouper
     

    Attached Files:

  7. kniht

    kniht

    Joined:
    May 7, 2006
    Messages:
    1,763
    I'm checking the new dump files now. Will get back to you. Hang in there :)
     
  8. kniht

    kniht

    Joined:
    May 7, 2006
    Messages:
    1,763
    Trouper

    Have called in the cavalry to help on this one. Hopefully they will chime in soon.

    Seem to now be having a problem with ntkrnlpa.exe.
     
  9. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    Thanks. I downloaded Microsoft Debugger, figured out how to work it, and ran all of my minidumps. As you know, they all break down like this:

    07/23/08 caused by ntoskrnl.exe
    07/29/08 caused by ntoskrnl.exe
    07/31/08 #6 caused by Npfs.sys
    07/31/08 #5 caused by TM_CFW.sys
    07/31/08 #4 caused by TM_CFW.sys
    07/31/08 #3 caused by TM_CFW.sys
    07/31/08 #2 caused by TM_CFW.sys
    07/31/08 #1 caused by TM_CFW.sys
    08/01/08 #1 caused by ntoskrnl.exe
    08/01/08 #2 caused by ntoskrnl.exe

    Now, does this mean that I have multiple problems, and need multiple fixes? Or can it all be related to the Trend Micro problem? I am so confused. I do know that I disabled the Trend Firewall, and so far, 2 hours on the net and no BSOD! I can't wait till the cavalry gets here, so I can get some more answers. Thanks again kniht for the help so far!

    Trouper
     
  10. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    ntkrnlpa.exe is a core system "memory management" module.

    Since you still had Trend installed and running with these and one of the BSODs was still a "Bad Pool Caller" (the same memory is beeing freed twice here) error -- I would contiue to find Trend suspect and want to see what happens with it completely uninstalled.
     
  11. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    Rollin' Rog, Thanks for the response! Is ntkrnlpa.exe the same type "memory management" problem as the ntoskrnl.exe that the debugger said caused it to BSOD 4 times? Also, since I don't have the Trend's OfficeScan installed, do you have any idea why it gave me the TM_CFW.sys error so much?

    Another noob question: According to Debugger, I guess I need to load and set the "symbol path" for the debugger. How do I do that?

    I guess I will completely uninstall Trend again and see what happens over the next week. I will keep checking back here everyday to see if anyone has come up with any more ideas, and I will let you know my progress.

    Thanks again!
    Trouper
     
  12. kniht

    kniht

    Joined:
    May 7, 2006
    Messages:
    1,763
    Your symbol path will point to where you have your symbols on your system.

    Symbol paths on my debugger:

    c:\windows\symbols;c:\windows\symbols\w2ksp4;c:\windows\symbols\symbols;SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    I have several symbols on my system for different OS's. The debugger will first look in c:\windows\symbols if it can't find what it needs there it will then look in c:\windows\symbols\w2ksp4, if it can't find what it needs there it will look in c:\windows\symbols\symbols -- and so on. The last symbol path is the Internet symbol server. I'm sure your symbol paths will differ from mine but that's basically how you set up the paths.

    Separate each symbol path with ;

    This may help:

    http://www.microsoft.com/whdc/DevTools/Debugging/debugstart.mspx
     
  13. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Ah, yes, I don't know how I got that version -- different ones are used depending on the amount of installed memory. I think I was verifying that at the time I posted and got them mixed up.

    Anyway Wikipedia has a good article on the various models >> http://en.wikipedia.org/wiki/Ntoskrnl.exe

    I don't know why the particular sys file was faulting but programs tend to load drivers that are not always used -- and they still are assigned memory which can conflict with other processes on occasion. It's a part of the firewall one way or another.

    Here's something from Trend on it -- I don't know if it applies if you are not using Office Scan

    http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1036319&id=EN-1036319
     
  14. kniht

    kniht

    Joined:
    May 7, 2006
    Messages:
    1,763
    You may want to download autoruns (freeware):

    http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

    No need to install just run the exe. I think it will work on your OS.

    Go to 'Options' and check 'Hide Microsoft entries'.

    Click on the 'Drivers' tab and see if that particular driver is being loaded.
     
  15. Trouper

    Trouper Thread Starter

    Joined:
    Jul 31, 2008
    Messages:
    9
    Well, I didn't get time to uninstall Trend yesterday (had to work, eat, sleep), but I came up with another small problem. I think it is probably related to all this, so at this point I am not too worried. When I got home from work (job #1), I fired up my laptop, and tried to download the symbol package from Microsoft. Everytime I tried to download it, it would hang, and stop downloading. It started at about 150kbs and dropped to 1-5kbs. I tried numerous times, and a couple of different SP3 packages, but all of them seized up and stopped downloading shortly after initiating. I use wireless (Linksys B) so I decided I would plug in the LAN to see if it made a difference. It gave me hell trying to connect to the network, and finally connected with "limited connectivity." It eventually stopped responding, and I never could get the internet. I switched back to the wireless, and it still was veeery slow. My sons laptop (also wireless), and our 2 desktops (LAN off of the Linksys router) were all fine. I eventually downloaded the package on my desktop (22 min) and will transfer it over today. I feel like this was Trend firewall related, even though I had it turned off at the time. Does this sound related? I am definitely going to uninstall Trend for good this afternoon after work, then restart the router and modem. I am going to let everything reconnect, re-aquire network addresses, and see what happens.

    By the way, I contacted Trend about this problem, and got a response stating to uninstall and re-install and update and blah, blah, blah... no mention of any real fix. I even gave them the specific TM_CFW.sys, and I guess the ignored or skipped over that info. Thanks again, and glad you guys are here!

    Trouper
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/735786

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice