Hi,
All of the attached DMP files are of the
BAD_POOL_CALLER (c2) bugcheck.
Code:
0: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffff880`064170d8 fffff802`32078a6e : 00000000`000000c2 00000000`00000007 00000000`000011c1 00000000`00420640 : nt!KeBugCheckEx
fffff880`064170e0 fffff880`02242b23 : fffffa80`03d322b0 00000000`00000000 fffffa80`03d32030 00000000`00000000 : nt!ExFreePool+0x984
fffff880`064171c0 fffff880`0285eb6c : 00000000`000000b0 00000000`00000000 00000000`00000000 fffff880`0296c340 : NETIO! ?? ::FNODOBFM::`string'+0x7c9
fffff880`06417210 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip+0x161b6c
tcpip and NETIO in the call stack, possible adapter / 3rd party firewall antivirus conflicts...
Running a !poolval on the address of the block of pool being deallocated to check for pool corruption (4th parameter) shows:
Code:
0: kd> !poolval fffffa8003d322b0
Pool page fffffa8003d322b0 region is Unknown
Validating Pool headers for pool page: fffffa8003d322b0
Pool page [ fffffa8003d32000 ] is VALID.
Definitely looking like device drivers at this point, let's move on:
1. Remove and replace Norton with Windows 8's built-in Windows Defender for temporary troubleshooting purposes -
https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=45C4AC0D9BB760C424090B42D016AEDD.4?pvid=f-home
2. I see
TuneUpUtilitiesDriver64.sys in the loaded drivers list. What are you using this software for, what purpose? Are you registry cleaning with it?
Regards,
Patrick
