Experiencing BSOD

I did the Debugger and got this info. I have no clue what it means. Any help would be greatly appreciated.


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini050608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Tue May 6 07:34:22.718 2008 (GMT-4)
System Uptime: 0 days 0:02:32.328
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, cd4, 1, 866075b0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for fltMgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltMgr.sys
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!PVOID ***
*** ***
*************************************************************************
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_TRACKER_BIG_PAGES ***
*** ***
*************************************************************************
Cannot get _POOL_TRACKER_BIG_PAGES type size
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_TRACKER_BIG_PAGES ***
*** ***
*************************************************************************
Cannot get _POOL_TRACKER_BIG_PAGES type size
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+22f13 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 00000001, Memory contents of the pool block
Arg4: 866075b0, Address of the block of pool being deallocated

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_TRACKER_BIG_PAGES ***
*** ***
*************************************************************************
Cannot get _POOL_TRACKER_BIG_PAGES type size
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_TRACKER_BIG_PAGES ***
*** ***
*************************************************************************
Cannot get _POOL_TRACKER_BIG_PAGES type size
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e5484a

POOL_ADDRESS: 866075b0

BUGCHECK_STR: 0xc2_7

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

LAST_CONTROL_TRANSFER: from 8054a583 to 804f9f13

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f7a95a60 8054a583 000000c2 00000007 00000cd4 nt+0x22f13
f7a95ab0 80534ed0 866075b0 00000000 80534e78 nt+0x73583
f7a95acc f7374b88 86308628 863ee634 863085c0 nt+0x5ded0
f7a95ae0 f73858df 863085c0 e108ab30 863085c4 fltMgr+0x6b88
f7a95af8 8056da14 863085c4 00000000 f7a95b80 fltMgr+0x178df
f7a95b40 f72f6f46 e108ab30 e108aa68 e108ab30 nt+0x96a14
f7a95b5c f72dfc30 860c6558 f7a90703 e108aa98 Ntfs+0x3ef46
f7a95b74 f72ba800 860c6558 e108ab30 00000000 Ntfs+0x27c30
f7a95b90 f72be550 860c6558 e108aa68 00000000 Ntfs+0x2800
f7a95be0 f72dfc7c 860c6558 86f22100 e2b78a00 Ntfs+0x6550
f7a95c38 f72ba7b0 860c6558 e2b78ac8 00000000 Ntfs+0x27c7c
f7a95c64 f72dd4b5 860c6558 01b78ac8 00000000 Ntfs+0x27b0
f7a95ce8 f72e23e3 860c6558 e2b78ac8 e2b78a00 Ntfs+0x254b5
f7a95d7c 80537aff 00000000 00000000 86fc3850 Ntfs+0x2a3e3
f7a95dac 805cea08 00000000 00000000 00000000 nt+0x60aff
f7a95ddc 8054546e 80537a10 00000000 00000000 nt+0xf7a08
00000000 00000000 00000000 00000000 00000000 nt+0x6e46e


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+22f13
804f9f13 5d pop ebp

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+22f13

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

 

Can you tell us what is the problem with your comp?
What OS do you run?
I think the probles is with"ntoskrnl.exe".See this:http://www.computerhope.com/issues/ch000646.htm

 

I will check the link out. I have XP. I am getting BSOD screens occasionally when I go to shut the computer down, generally.

One error I got was STOP: 0x00000024

 

I am no expert and the only knowledge I have in debugging is reading Adryn's (Admin that wrote the Sticky) posts on the subject with interest.

That said, from what it looks like you need to replace ntoskrnl.exe

If it were me (and I could not find Adryn) I would try to do Method 3 here:
http://support.microsoft.com/kb/314477

Remember to replace brackets/text with the drive letters i.e <cd-drive>: would = D: or E: normally.

Or you can wait a day for Adryn to stop by and check it out, he's a little busy these days but the best at debugging.

Also did you add new hardware, restore a back-up, what proceeded the BSOD, is there a main error? It might save him some time if you give him more info, looks like XP-SP2 from log.

 

I haven't installed anything new. I had problems with my laptop last November and had GeekSquad out to check things out and the fellah told me I needed a new hard drive, which I had him install.

The on/off button on the computer is doing the same thing it did when the hard drive went bad. I barely have to touch it when I have that BSOD to turn it off. Normally, if I physically turn the machine off rather than shutting it down, I have to hold the button down for a bit.

I have Trend Micro Virus and SpySweeper. I've tried very hard to surf safely and I am so frustrated to be having problems again.

This is one BSOD message I got BAD_POOL_HEADER. Another was about a physical memory dump.

The last BSOD error message I got was:

A problem has been detected.

Disble or uninstall any anti-virus, disk defrag or backup utillities. Check your hard drive config and check for any updated drivers. Run chkdsk/F to check for hard drives corruption and then restart.

STOP: 0x001902FE, 0xF7A9D86C, 0xF7A9D568, 0x804E25ED)

I tried to do a windows update last night and my computer won't get through it.

I appreciate any and all help.

I created recovery CDs myself. I didn't get any physical software when I ordered my computer, so I don't have an XP disk, per se, I guess.

 

My computer is trying to download Windows XP Service Pack 3, but can't get through it. It doesn't give me an error, it just simply stops showing me any progress.

 

Ntoskrnl.exe is a boot process and most likely your problem and corrupt, due to malware or another cause is in question. Either way think we have to try to fix it in software before we can send you to malware, if malware. Have you had any malware type problems? (this is important)

I would stop trying to install SP3, when your system is unstable adding more factors usually is not good, makes it harder to troubleshoot. The only way SP3 would help you is if the update included a fresh copy of the corrupt file, overwrote it and you had no other issues. Also, there are a few reports of the same file having errors with SP3, so another question - did you get this error before trying to update to SP3? (this is important)

When you made a recovery CD the file should be included on it since it's a required file but did you make the CD before you started having problems? (this is important)

Think now you see that adding factors to a BSOD can just cause a cascade of questions and makes it harder to troubleshoot. Best to stop and deal with it before going on or it causes other issues, also I would back up documents, mail etc. but not to a "clean external drive" CD would be best just in case it's malware.

Your "physical software" was a recovery partition on your HD that now is in question since your HD was replaced and it's unknown if GeekSquad created this partition again. You can install Everest and that will tell you what is on your Physical Drives (will show partitions) but I would wait to resolve your BSODs first.

If it were me I would just replace the file from a clean back up and see if it helps. I have 15 copies of the file on my PC and most likely a few more on back-ups, last one is dated 2/28/07 and in KB31784 (XP-SP2 update) files are all the same size 2130KB last version is 5.1.2600.3093 but I'm in over my head now and would wait for a MajorGeek to tell you that's OK to do, I don't want to make things worse. Sorry, I can't be of more help, I'm self taught and not a MajorGeek but I will try to do what I can. Please review above and supply answers to the questions.

p.s. Adyrn most likely has his nose in books now, finals time - didn't remember till today when a friend mentioned.

Help please MGs.

 

I started over on the Malware forum and did the "Read Me First" items. Got a clean bill of health in that regard from the folks over there.

Hoo boy, you're not going to be happy with me. SP3 got installed yesterday morning. I was having problems before I tried installing it, though, so I don't think it's the problem.

Yes, I made my recovery CDs before I started having problems.

I've had no more BSOD since SP3 installed yesterday. I am, however, getting an error about scan.msi, which I think is related to my printer/scanner/copier.

I will sit tight until someone tells me for sure what to do.

I appreciate your input.

 

Just put your printer/scanner/copier CD in and the error might go away.
You don't need to uninstall or reinstall; it's looking for something and once it finds it, it will stop bugging you.

 

Sorry my bad, should have read your prior posts

*smiles* I'm happy - it worked, all that counts.

Plodr posted a fix, if it doesn't work...can happen, post your HP Model and error number, looks like a pesty error but not a biggy.

Thank you, but you fixed the BSOD. Remember to make a new Restore Point if stable, and when you get rid of final error make new Recovery CDs.