Vista BSOD 0x00000019: BAD_POOL_HEADER on startup

Hey guys, hopefully one of you guys know the answer to this problem.
This problems seems to happen on random, there's no exact pattern and it doesn't happen every time on startup.

Anyway, I get this BSOD 0x00000019: BAD_POOL_HEADER on startup and sometimes shutdown. I'm running on vista, this only happens on startup or shutdown. I have a dell inspiron 1720, intel core 2 duo 2.4 ghz, 2 gigs of ram, and Nvidia 256 mb 8600 GT. I'm running on Vista Home Edition with SP1.

Anyway, I searched all over the internet, but most refers to XP or Windows server. A lot of people have this problem too but none of them have the answer. Most people are just guessing and saying its the ram or aol...etc.

I came across a couple a sites that might give you some ideas, for me, reading it is like another language so I hope someone can give it to me straight what's the problem
http://msdn.microsoft.com/en-us/library/ms793223.aspx

 

Try a RAM test, I've had the error before and I think it's due to RAM not working properly before executing memory hungry applications.

 

Did you receive this machine with Vista or you upgraded from XP? You might have inherited an XP bug.

 

When you restarted the computer, did it direct you to any Microsoft support kb articles that might help with the problem? If so, you can usually find it again in Control Panel > Sys & Maint > Problem Reports & Solutions

Also:

You can run the kernel debugger to debug the kernel dump. This will tell you what part of the system the problem occurred in, i.e. which driver or the kernel itself or what. It usually gives a big hint as to what the problem is, or at least it gives some other info to paste into a google search.

Here are the instructions:

http://forums.majorgeeks.com/showthread.php?t=35246

Install the Microsoft Debugging Tools, then from the Start menu, right-click WinDbg and select Run as Administrator, then follow the instructions on the page I linked to.
After loading the dump file, type "!analyze -v" as it explains on that page. Then post back the results here.

 

I got this machine with Vista

I did check the ram with memtest86 and everything is fine.

Every time this error occurs, I always select check internet for solutions for nothing comes up. But I will do what you suggested swarmer.

 

From what I've read, this is usually a network driver problem. You could try booting, pressing F8, and then selecting "use unsigned drivers", and see if the BSOD persists. If it stops, you could try removing and installing the newest network drivers that are available (NIC and wifi). Have you recently installed any new hardware or new drivers?

If that doesn't help, you could also reseat your memory and wifi card (if possible), to see if a loose card is responsible.

 

Ok, I Finally got around to debugging all the damn minidump files. From the looks of it, the MAIN fault is something called ntkrpamp.exe. starting from 4/23/08 till today, I had over 19 of these cases out of 27 BSOD. That’s right, almost every day I had one. Sometimes I’m unlucky enough to get 4 in one day like 5/29/08 So please help me resolve this issue, I’m really tried of these startups BSOD. Posted below are all the crash log for the past 2 months.

4/23/08
BugCheck A, {0, 1b, 0, 81ec1cba}

Probably caused by : win32k.sys ( win32k!SetWakeBit+da )

4/27/08
BugCheck 19, {20, 9c1c2ad8, 9c1c2b28, a0a0203}

GetPointerFromAddress: unable to read from 81f37868
Unable to read MiSystemVaType memory at 81f17420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

4/28/08
BugCheck 19, {20, 9a6fab60, 9a6fab88, a050205}

GetPointerFromAddress: unable to read from 81f87868
Unable to read MiSystemVaType memory at 81f67420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

5/02/08
BugCheck 19, {20, 9a8f16c0, 9a8f16f0, a060207}

GetPointerFromAddress: unable to read from 81f47868
Unable to read MiSystemVaType memory at 81f27420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

5/06/08
BugCheck 24, {1904aa, 9a0ee900, 9a0ee5fc, 88026ee5}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquirePagingResourceExclusive+20 )

5/13/08
BugCheck 19, {20, 812de9a0, 812de9b8, a03020a}

Probably caused by : fileinfo.sys ( fileinfo!FIStreamLog+6e )

5/13/08
BugCheck 19, {20, 9ad15788, 9ad157a0, a030203}

Probably caused by : fileinfo.sys ( fileinfo!FIStreamLog+6e )

5/14/08
BugCheck 19, {20, 9476e538, 9476e588, a0a0203}

Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+de42 )

5/14/08
BugCheck 19, {20, 9df01188, 9df011d8, a0a0203}

GetPointerFromAddress: unable to read from 82143868
Unable to read MiSystemVaType memory at 82123420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

5/20/08
BugCheck A, {0, 1b, 0, 820c1cba}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+14 )

5/21/08
BugCheck 19, {20, 9aa77840, 9aa77870, a060207}

GetPointerFromAddress: unable to read from 82137868
Unable to read MiSystemVaType memory at 82117420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

5/27/08
BugCheck A, {0, 1b, 0, 822f4cba}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+14 )

5/29/08
BugCheck 19, {20, 9a99f9f0, 9a99fa40, a0a0203}

GetPointerFromAddress: unable to read from 82372868
Unable to read MiSystemVaType memory at 82352420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

5/29/08
BugCheck 19, {20, 9b586c10, 9b586c28, a03020a}

GetPointerFromAddress: unable to read from 82338868
Unable to read MiSystemVaType memory at 82318420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

5/29/08
BugCheck 1000008E, {c0000005, 8241b787, 97cc4a6c, 0}

Probably caused by : dxgkrnl.sys ( dxgkrnl!VIDMM_PROCESS_HEAP::FreeBlock+31 )

5/29/08
BugCheck 19, {20, 81547970, 81547988, a03020a}

GetPointerFromAddress: unable to read from 82383868
Unable to read MiSystemVaType memory at 82363420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/3/08
BugCheck 19, {20, 9c04bb20, 9c04bb50, a060207}

GetPointerFromAddress: unable to read from 82381868
Unable to read MiSystemVaType memory at 82361420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/6/08
BugCheck 19, {20, 9afd86b8, 9afd8720, a0d020f}

GetPointerFromAddress: unable to read from 82383868
Unable to read MiSystemVaType memory at 82363420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/7/08
BugCheck A, {0, 1b, 0, 822f4cba}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+14 )

6/9/08
BugCheck D1, {4, 2, 1, 8bcb3faf}

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+2ac )

6/9/08
BugCheck 19, {20, 9ba9c7e0, 9ba9c7f8, a03020a}

GetPointerFromAddress: unable to read from 82373868
Unable to read MiSystemVaType memory at 82353420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/10/08
BugCheck 19, {20, 9a19c9e0, 9a19ca30, a0a0203}

GetPointerFromAddress: unable to read from 8234b868
Unable to read MiSystemVaType memory at 8232b420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/11/08
BugCheck 19, {20, 99dfb210, 99dfb278, a0d020f}

GetPointerFromAddress: unable to read from 82544868
Unable to read MiSystemVaType memory at 82524420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/11/08
BugCheck 19, {20, 9df4cbe8, 9df4cc10, a050208}

GetPointerFromAddress: unable to read from 82579868
Unable to read MiSystemVaType memory at 82559420
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+17f )

6/12/08
BugCheck 1000008E, {c0000005, 82507886, 8915b37c, 0}

*** WARNING: Unable to verify timestamp for TICalc.SYS
*** ERROR: Module load completed but symbols could not be loaded for TICalc.SYS
Probably caused by : TICalc.SYS ( TICalc+fb4 )

Followup: MachineOwner
6/12/08
BugCheck 1000007E, {c0000005, 805f6082, 8916f8a8, 8916f5a4}

Probably caused by : sfsync04.sys ( sfsync04+9082 )

6/13/08
BugCheck 1000008E, {c0000005, 82602998, 94461ad4, 0}

Probably caused by : ntkrpamp.exe ( nt!AlpcpCancelMessagesByRequestor+2d )

Counts:
ntkrpamp.exe – 19
win32k.sys – 1
sfsync04.sys – 1
TICalc.SYS – 1
dxgkrnl.sys – 1
Ntfs.sys – 1
fileinfo.sys – 2
klif.sys – 1

 

In the debugger, enter the command:
!analyze -v

You can just click on it like in a web browser... it should be in blue and underlined in the debugger output.

It usually adds way more detail.

Try that for a few of them and post back.

...Or did you try that already?

 

Thanks for the tip, i did that with some of the ones with the ntkrpamp error
Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!AlpcpCancelMessagesByRequestor+2d
82602998 8b463c mov eax,dword ptr [esi+3Ch]

TRAP_FRAME: 94461ad4 -- (.trap 0xffffffff94461ad4)
ErrCode = 00000000
eax=001f0003 ebx=81326b60 ecx=81326b5c edx=00000001 esi=00000000 edi=ffff0000
eip=82602998 esp=94461b48 ebp=94461b58 iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
nt!AlpcpCancelMessagesByRequestor+0x2d:
82602998 8b463c mov eax,dword ptr [esi+3Ch] ds:0023:0000003c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: LogonUI.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8260304a to 82602998

STACK_TEXT:
94461b58 8260304a 8f9c7268 80c257a0 80c25808 nt!AlpcpCancelMessagesByRequestor+0x2d
94461b90 8260342f 8f9c7268 00000000 80dd0020 nt!AlpcpDisconnectPort+0x1e4
94461ba8 826035ef 84489da0 94461c04 8262d550 nt!AlpcpDoPortCleanup+0x10
94461bb4 8262d550 80dd0020 8f9c7268 001f0001 nt!AlpcpClosePort+0x23
94461c04 8262d3e0 80dd0020 00489da0 001f0001 nt!ObpDecrementHandleCount+0x146
94461c50 825f37ff 969e4388 812dc298 80dd0020 nt!ObpCloseHandleTableEntry+0x234
94461c80 825f3783 969e4388 94461c94 80dd0020 nt!ExSweepHandleTable+0x5f
94461ca0 8261eee7 65423298 80dd0ba8 80dd0948 nt!ObKillProcess+0x54
94461d04 8261f2ff 00000000 00000000 80dd0948 nt!PspExitThread+0x5b6
94461d24 825f3064 80dd0948 00000000 00000001 nt!PspTerminateThreadByPointer+0x5b
94461d54 82467a7a ffffffff 00000000 001ffe34 nt!NtTerminateProcess+0x1e0
94461d54 77549a94 ffffffff 00000000 001ffe34 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
001ffe34 00000000 00000000 00000000 00000000 0x77549a94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!AlpcpCancelMessagesByRequestor+2d
82602998 8b463c mov eax,dword ptr [esi+3Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!AlpcpCancelMessagesByRequestor+2d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 47918b12

FAILURE_BUCKET_ID: 0x8E_nt!AlpcpCancelMessagesByRequestor+2d

BUCKET_ID: 0x8E_nt!AlpcpCancelMessagesByRequestor+2d

Followup: MachineOwner
---------


BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 9df4cbe8, The pool entry we were looking for within the page.
Arg3: 9df4cc10, The next pool entry.
Arg4: 0a050208, (reserved)

Debugging Details:
------------------

GetPointerFromAddress: unable to read from 82579868
Unable to read MiSystemVaType memory at 82559420

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from 82579868
Unable to read MiSystemVaType memory at 82559420
9df4cbe8

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8253000c to 8250f163

STACK_TEXT:
89163544 8253000c 00000019 00000020 9df4cbe8 nt!KeBugCheckEx+0x1e
891635b8 82699ca5 9df4cbf0 00000000 6bcaf19e nt!ExFreePoolWithTag+0x17f
89163638 82645695 0000001d 89163664 88e614a0 nt!CmpCallCallBacks+0x5c1
89163680 82656b25 0000001d 00000000 8916371c nt!CmPostCallbackNotification+0x55
891637e8 826882ff 88e13d90 84490040 9a5814b0 nt!CmpParseKey+0xc7f
89163878 8265ffea 00000000 891638d0 00000240 nt!ObpLookupObjectName+0x5a8
891638d8 82656fa8 89163a58 84490040 9df4a100 nt!ObOpenObjectByName+0x13c
891639a4 82657067 89163ac0 000f003f 89163a58 nt!CmOpenKey+0x1b1
891639c0 82499a7a 89163ac0 000f003f 89163a58 nt!NtOpenKey+0x16
891639c0 82497f4d 89163ac0 000f003f 89163a58 nt!KiFastCallEntry+0x12a
89163a44 82614857 89163ac0 000f003f 89163a58 nt!ZwOpenKey+0x11
89163a70 8258eedc 82758ea0 000f003f 00000000 nt!LdrpOpenKey+0x36
89163b1c 825b1687 00000000 00000000 945ccd00 nt!PnpDriverLoadingFailed+0x119
89163cfc 825b1d0b 00000001 00000000 89163d24 nt!IopLoadDriver+0xb14
89163d44 8247a41d 945ccd00 00000000 84488d78 nt!IopLoadUnloadDriver+0x70
89163d7c 82617a1c 945ccd00 6bcafa66 00000000 nt!ExpWorkerThread+0xfd
89163dc0 82470a3e 8247a320 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+17f
8253000c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePoolWithTag+17f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 47918b12

FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+17f

BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+17f

Followup: MachineOwner
---------

 

I did a search on google for other people who have the ntkrpamp.exe error, some of them says its the ram some says its antivirus

my ram 2 GB DDR2. 667 MHz 2 Dimm, i just ran the memtest-86, 2 passes, no errors

my antivirus was kaspersky antivirus 7 but I already unistalled that, but still got a BSOD this morning.

Some others have said its because of firefox, but this never happened to me because i always happens before I login. Its only the startups and shutdown that this might occur, other times, it never does.

 

It's probably a driver, but...
What security software do you have installed? Firewall/antivirus/antispyware?

EDIT: ok, any firewall or antispyware software?

At first I was thinking memory... but the fact that you only get them on startup/shutdown makes me think it's not memory. That and your memory test.

 

Though luck. It might be some driver that is not working well.
If possible, mayby you could try disabling non-essential drivers that aren't needed for the OS itself? That includes the hidden "Non-plug and play drivers" group shown from "Device Manager->View->Show hidden devices". For example, the sfsync04.sys is a copy protection driver called StarForce.

Also, you might want to run chkdsk and mayby try to fix the Windows setup with the installation disk. I mean if you regulary experience BSOD while there is HD activity, chances are that some data files are more or less corrupted. Many of those files you listed are related to the file system handling with one way or another.

By the way, how long did you run that memtest86?

 

I let the memtest run all night, it went though like 5 or 6 passes, no errors

no firewall, no antispyware software (unless you count ccleaner)

I was also thinking it was the driver, like a video driver since that would make sense, the second it starts it screws up- but I changed several different drivers. So its really hard to pinpoint this thing because it occurs on random. I restarted/shut down my computer 10 times today and no BSOD.

 

Some people also said it might be heat issues, Although it is a laptop, Inspiron 1720, I don't think thats it because its on startup, the computer has been cooled down over night, plus its a fairly cool day.


btw thanks guys for sticking by me through this problem. I know its frustrating on both ends trying to figure out this puzzle.

 

I have a customer's laptop that is doing the same thing... I've kind of narrowed it down to AOL though... particularly the connection service it runs. If I disable that service then everything runs fine until I try to connect to AOL... the service is the only one with AOL in the name (AOL Connectivity Service). Unfortunately, downloading and reinstalling did nothing to fix the issue. Any other ideas? It's got 9.0VR on it, and I'm not sure why the last person to look into this didnt go with 9.1 but I have it downloading right now to try it. I don't have a very positive feeling about it working though.

 

Yea the problem is, I don't think its AOL because my AOL/AIM doesn't even start and it crashes. AIM doesn't run on startup on my laptop.

I always get these crashes before I login to vista or I shut down. After a few days of no crashes, i thought the problem was fixed. But yesterday night, as I was shutting down, I got another BSOD.
6/17/08

 

lol i guess this problem is fairly common since its on the dell's front page of support
"Blue screen of error on startup for Windows Vista"
http://support.dell.com/support/top...d=33428502887DCFF7E040A68F5B2835B9&l=en&s=dhs

Hopefully it helps some of you guys, I just wanted to make sure it wouldn't happen soon so I followed the instructions and not only upgraded my BIOS but also formatted

 

Probably one of those things will fix it... lol.

 

I got the blue screen error with the bad_pool_header. I was just wondering if maybe you guys think Ghost might have had something to do with it? Since it was running that...