Re: BSOD bad_pool_header SBS 2003

At my wits end here...

there seems to be no rhyme or reason as to when this comes up. Seemed
to be only during restart...then I could consistantly boot if I
disabled firewall and ISA during startup. Event log showed an error
with ISA regarding a web proxy filter not able to load..and ISA also
wouldn't take any changes I made. So I tried to uninstall ISA, and
halfway through the uninstall, I got the BSOD again. Figured maybe
the HD was corrupt whereever ISA resided, so I ran a chkdsk on
restart.

After 5 hours, it booted into Windows, but ISA had the same errors,
and Firewall wouldn't start. I competed the ISA uninstall, and the
last step where it has me run the connect to internet wizard, I got
the BSOD right where I was supposed to accept the certificate. BSOD
again while restarting; I'm about to go into safe mode again and try
to disable certain things.

There were some errors in the chkdsk that it supposedly fixed.




On Jun 21, 2:39 pm, Tim W <t...@xxxxxxxxxxxxxxx> wrote:
Maybe, maybe not.

I did a fresh install of Avast server, and left for the night while it
did the boot scan upon restart.

Got back in here around 1 to see that the server still kept crashing
with the bad_pool_header error; last dump file I grabbed pointed to
ntkrpamp.  It rebooted 4 or 5 times, the 5th time it stayed up.

The one process that keeps coming up is inetinfo

It was up and running for a while, with most things working
correctly...until I rebooted it.

It has now come up with the bad_pool_error BSOD 2 more times; I'm
trying the 3rd time now.  I can't hang around the office today; so no
matter what happens I'm leaving it in a few minutes and plan on
spending all day tomorrow here.

Here is the latest memory.dmp

0: kd> !analyze -v
*******************************************************************************
*
*
*                        Bugcheck
Analysis                                    *
*
*
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause
of
the problem, and then special pool applied to the suspect tags or the
driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e258ca88, The pool entry we were looking for within the page.
Arg3: e258caf0, The next pool entry.
Arg4: 0c0d042a, (reserved)

Debugging Details:
------------------

Page ea36c not present in the dump file. Type ".hh dbgerr004" for
details
Page ea5e0 not present in the dump file. Type ".hh dbgerr004" for
details
PEB is paged out (Peb.Ldr = 7ffde00c).  Type ".hh dbgerr001" for
details
PEB is paged out (Peb.Ldr = 7ffde00c).  Type ".hh dbgerr001" for
details

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  e258ca88 Paged pool

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  inetinfo.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 808927bb to 80827c63

STACK_TEXT:
ba456310 808927bb 00000019 00000020 e258ca88 nt!KeBugCheckEx+0x1b
ba456378 f7b7ac3c e258ca90 00000000 f7b7c2bd nt!ExFreePoolWithTag
+0x477
ba456430 f7b7ac7f 89628450 e42c8b38 e41299a8 Ntfs!NtfsAddDosOnlyName
+0x1d1
ba45646c f7b904af 89628450 00000001 08410400 Ntfs!NtfsAddLink+0xac
ba456668 f7b94a04 89628450 8a038008 8a0381bc Ntfs!NtfsCreateNewFile
+0x847
ba45688c f7b91ef8 89628450 8a038008 ba4568cc Ntfs!NtfsCommonCreate
+0x1226
ba456990 8081df65 8acba020 8a038008 8a038008 Ntfs!NtfsFsdCreate+0x17d
ba4569a4 f725d54d 895e1a80 00000000 8b12fbe0 nt!IofCallDriver+0x45
ba4569d4 8081df65 8b0781c0 8a038008 8a038008 fltmgr!FltpCreate+0x1d9
ba4569e8 f724fb25 00000000 8a038008 8a0381e0 nt!IofCallDriver+0x45
ba456a0c f725d5de ba456a2c 8a545318 00000000 fltmgr!
FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
ba456a48 8081df65 8a545318 8a038008 8a038008 fltmgr!FltpCreate+0x26a
ba456a5c 808f8f71 ba456c04 8b151018 00000000 nt!IofCallDriver+0x45
ba456b44 80937942 8b151030 00000000 897052e8 nt!IopParseDevice+0xa35
ba456bc4 80933a76 00000000 ba456c04 00000040 nt!ObpLookupObjectName
+0x5b0
ba456c18 808eae25 00000000 00000000 4d998001 nt!ObOpenObjectByName
+0xea
ba456c94 808ec0bf 152af2dc 40100080 152af278 nt!IopCreateFile+0x447
ba456cf0 808eeb4e 152af2dc 40100080 152af278 nt!IoCreateFile+0xa3
ba456d30 8088978c 152af2dc 40100080 152af278 nt!NtCreateFile+0x30
ba456d30 7c8285ec 152af2dc 40100080 152af278 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be
wrong.
152af2d4 00000000 00000000 00000000 00000000 0x7c8285ec

STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+477
808927bb ff75fc          push    dword ptr [ebp-4]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePoolWithTag+477

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  45ec0a19

FAILURE_BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag+477

BUCKET_ID:  0x19_20_nt!ExFreePoolWithTag+477

Followup: MachineOwner
---------

On Jun 20, 8:45 pm, Tim W <t...@xxxxxxxxxxxxxxx> wrote:

Looks like it actually was Avast...unistalled Avast and the
distributed network manager, did a normal startup, and no BSOD.

Everything isn't working correctly (Windows is telling me I have to re-
activate within 3 days?), but its working enough where I'm confident
the worst is behind me.

Couldn't re-install Avast for some reason; I'm going to shut it down
and come back to the office tomorrow to figure out the rest.

Any other suggestions are always appreciated, and I'll be sure to keep
this thread updated.

Thanks,

Tim

On Jun 20, 7:34 pm, "SuperGumby [SBS MVP]" <n...@xxxxxxxxxxx> wrote:

I actually only got alerted to this site today, might help.

http://www.aumha.org/a/stop.php
0x00000019: BAD_POOL_HEADER
A pool header issue is a problem with Windows memory allocation. Device
driver issues are probably the msot common, but this can have diverse causes
including bad sectors or other disk write issues, and problems with some
routers. (By theory, RAM problems would be suspect for memory pool issues,
but I haven't been able to confirm this as a cause.)
"STOP: 0x00000019" error message on Windows Server 2003 {KB 892260} Server
2003 (NTFS problem corrected in current Service Pack)
Error message when a Delayed Write Failure event is reported in Windows
Server 2003: "Stop 0x00000019 - BAD_POOL_HEADER" or "Stop 0xCD
PAGE_FAULT_BEYOND_END_OF_ALLOCATION" {KB 925259} Server 2003 (driver issue;
hotfix available)
When backing up to Clarion storage in a SAN environment, Windows Server 2003
may stop responding after restart {KB 884585} Server 2003 (caused by adding
more than 20 mount points during the backup; hotfix available)
When trying to control a Systems Management Server 2003 client from a remote
location, Stop error on SMS 2003 client {KB 905795} SMS 2003 (driver issue)

---comment---
Disk write errors. SO, yes, AV is a possibility, also %free space (DO NOT
tell me 'I have 37GB free', tell me what percentage)

"Tim W" <t...@xxxxxxxxxxxxxxx> wrote in message

news:757f483d-bce7-4403-acff-130227cb6385@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Of course, on a Friday afternoon, the server suddenly went down 5
minutes before I was going to leave (3 hours ago).

Upon restart, sometimes I get to the login, and bet an 0x19
bad_pool_header.  Sometimes, I get it before login.  But I get it
every time.

I can get into safe mode, and if I pick 'Diagnostic Startup', I can
reboot and log in fine.

The first 2 dump files tell me the probable culprit is aswMon2.sys,
which is Avast (I have the Avast SBS suite running on here).

I tried to disable certain processes (shadow copy, and then Avast),
but every dump file still points to aswMon2.sys.  My next step that I
plan on trying after I post this is to uninstall Avast and see what
happens.

I have made no hardware changes in well over a year.  The last debug
of memory.dmp is included below.

If the same thing happens after I uninstall Avast, I will run
memtest.  In the meantime, if anybody has any other suggestions,
please feel free to reply.

Thanks

DEBUG INFO:
-------------------------------------------------------
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause
of
the problem, and then special pool applied to the suspect tags or the
driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e1647d48, The pool entry we were looking for within the page.
Arg3: e1647db0, The next pool entry.
Arg4: 0c0d0410, (reserved)

Debugging Details:
------------------

Page ea58c not present in the dump file. Type ".hh dbgerr004" for
details
Page ea860 not present in the dump file. Type ".hh dbgerr004" for
details
PEB is paged out (Peb.Ldr = 7ffd800c).  Type ".hh dbgerr001" for
details
PEB is paged out (Peb.Ldr = 7ffd800c).  Type ".hh dbgerr001" for
details

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  e1647d48 Paged pool

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  inetinfo.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 808927bb to 80827c63

STACK_TEXT:
b9b85344 808927bb 00000019 00000020 e1647d48 nt!KeBugCheckEx+0x1b
b9b853ac f7b7ac3c e1647d50 00000000 f7b7c2bd nt!ExFreePoolWithTag
+0x477
b9b85464 f7b7ac7f 89c3c008 e3f9e0d0 e13583b8 Ntfs!NtfsAddDosOnlyName
+0x1d1
b9b854a0 f7b904af 89c3c008 00000001 10a00400 Ntfs!NtfsAddLink+0xac
b9b8569c f7b94a04 89c3c008 8a5ec210 8a5ec3c4 Ntfs!NtfsCreateNewFile
+0x847
b9b858c0 f7b91ef8 89c3c008 8a5ec210 b9b85900 Ntfs!NtfsCommonCreate
+0x1226
b9b859c4 8081df65 8aa37020 8a5ec210 8b190030 Ntfs!NtfsFsdCreate+0x17d
b9b859d8 f725d458 8a5ec3e8 8b190030 8ad303f0 nt!IofCallDriver+0x45
b9b85a04 8081df65 8aa36260 8a5ec210 00000000 fltmgr!FltpCreate+0xe4
b9b85a18 ba25c95e 8a1eef60 8a173d58 89c92f00 nt!IofCallDriver+0x45
WARNING: Stack unwind information not available. Following frames may
be wrong.
b9b85a3c ba25683c 8a16c760 005ec210 8081df65 aswMon2+0x695e
b9b85a5c 808f8f71 b9b85c04 8b13ec70 00000000 aswMon2+0x83c
b9b85b44 80937942 8b13ec88 00000000 8991d680 nt!IopParseDevice+0xa35
b9b85bc4 80933a76 00000000 b9b85c04 00000040 nt!ObpLookupObjectName
+0x5b0
b9b85c18 808eae25 00000000 00000000 00000001 nt!ObOpenObjectByName
+0xea
b9b85c94 808ec0bf 072ef2dc 40100080 072ef278

...

read more »

.

Relevant Pages

  • Re: bad VPN client addresses from ISA
    ... It seems to be that your VPN client cannot find or conenct to the DHCP Server. ... You can also set a static address pool in the VPN configuration of ISA! ...
    (microsoft.public.isa.configuration)
  • Re: Routing und RAS DHCP abstellen
    ... Wie kann ich dauerhaft festlegen das nur der StatischeAdress Pool ... das liegt daran, dass der ISA, die RRAS Konfig ueberschreibt. ... MMC einen statischen Adresspool ein, dann sollte es klappen oder kommt das ...
    (microsoft.public.de.german.isaserver)
  • RE: KB913648 Volume Shadow Copy Service update
    ... A driver installed on the system is using an excessive amount of non-paged ... Poolmon will list which pool ... VOLSNAP.SYS driver used to take and manage volume snapshots requires paged ... re-size the shadow storage size. ...
    (microsoft.public.windows.file_system)
  • Re: errors that keep on coming up
    ... Param3= Memory contents of the pool block ... Read below or type Verifier in Start Run and choose the max in the wizard. ... How to Use Driver Verifier to Troubleshoot Windows Drivers ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: errors that keep on coming up
    ... Param3= Memory contents of the pool block ... Read below or type Verifier in Start Run and choose the max in the wizard. ... How to Use Driver Verifier to Troubleshoot Windows Drivers ...
    (microsoft.public.windowsxp.help_and_support)