Solved BAD_POOL_CALLER and ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

FacYa

New Member
Messages
13
Hi,

iam getting randomly bluescreens,
first is used Windows 7 Pro and i recived Bsods with Pen_list_corrupt etc...
i thought my system may just be broken, so i updatet it to Windows 8.1 Pro...

Now iam reciving BAD_POOL_CALLER caused by NETIO.SYS so i gues its something with my W-LAN Usb Stick or something? Read somewhere that it have something to do with the network connection... iam using an Cisco WUSB600N V.2 W-Lan Stick
and
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY which was caused by Kaspersky Installation, first time i recived this bluescreen, after that i tried to install it again and it worked without problems.

And i recived a blank Bsod, the log just says "address in stack" -> "ntoskrnl.exe"...

SF Log is attached, would be great if you could help me... this BSODS are hunting me.
Most of the BSODs i recive if i close things... things with memory cache i think... VLC - Spotify - Firefox...

I did a memcheck for 4 hours... 0 errors... seems like my RAM is fine... :-/

Thx for your time.
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

There are five crash dumps in total and three of them shows Bugcheck C2 BAD_POOL_CALLER.

Code:
BugCheck C2, {7, 1205, 0, ffffe000059dd0b8}

*** WARNING: Unable to verify timestamp for[COLOR=#ff0000] [B]netr28ux.sys[/B][/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for netr28ux.sys
fffff8017c937340: Unable to get special pool info
fffff8017c937340: Unable to get special pool info
GetUlongFromAddress: unable to read from fffff8017c9d2208
Probably caused by : [B]NETIO.SYS[/B] ( NETIO! ?? ::FNODOBFM::`string'+797c )

Please follow the below steps.

1. Update Ralink RT2870 series USB802.11n Wireless Adapter driver.

One of the dump directly blames this driver. Please remove the older version and download the latest one from the below link.

MediaTek - Downloads Windows

2. Update Intel Chipset and graphic driver.

Run the online update checker and install any driver it offers.

Intel® Driver Update Utility

3. Uninstall Locktime Netlimitter.

One of the crash dump blames nldrv.sys, a kernel mode driver used by "Netlimitter" software.

Code:
BugCheck 139, {3, ffffd000285f1f10, ffffd000285f1e68, 0}

*** WARNING: Unable to verify timestamp for[COLOR=#ff0000] [B]nldrv.sys[/B][/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for nldrv.sys
Probably caused by : nldrv.sys ( nldrv+eaac )

Please uninstall this software completely from the system.

4. Uninstall Kaspersky as a test.

Kaspersky is also seems to be contributing to the crashes.

Code:
BugCheck C2, {7, 1205, 0, ffffe000061df6d8}

*** WARNING: Unable to verify timestamp for[B] [COLOR=#ff0000]klwfp.sys[/COLOR][/B]
*** ERROR: Module load completed but symbols could not be loaded for klwfp.sys
*** WARNING: Unable to verify timestamp for [B][COLOR=#ff0000]kneps.sys[/COLOR][/B]
*** ERROR: Module load completed but symbols could not be loaded for kneps.sys
*** WARNING: Unable to verify timestamp for[B][COLOR=#ff0000] klflt.sys[/COLOR][/B]
*** ERROR: Module load completed but symbols could not be loaded for klflt.sys
fffff8021b530340: Unable to get special pool info
fffff8021b530340: Unable to get special pool info
GetUlongFromAddress: unable to read from fffff8021b5cb208
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string'+797c )

Please uninstall Kaspersky at least as a test. Once the issue is resolved, you can download and install the latest version from the official site and use your legal key to activate.

Free Kaspersky Internet Security 2014 Trial | Kaspersky Lab US

5. Scan for malware.

The last crash dump shows a rogue driver 70862289.sys is present in your system.

Code:
BugCheck FC, {fffff800086f3008, 8000000422fdd863, ffffd000383385c0, 2}

*** WARNING: Unable to verify timestamp for 70862289.sys
*** ERROR: Module load completed but symbols could not be loaded for 70862289.sys
Probably caused by : [COLOR=#ff0000][B]70862289.sys[/B][/COLOR] ( 70862289+4c008 )

It might be a malware infection. Please scan your system using the following tools.

Malwarebytes antimalware free : Malwarebytes Anti-Malware Download (Full scan)

ESET online scanner : Using ESET's Online Scanner - MajorGeeks Support Forums

Kaspersky TDSS Killer : TDSSKiller Download
 

My Computer

System One

  • OS
    Windows 7
Thx alot, but... Ralink? I got a cisco w-lan stick... i dont really get that...
and netlimiter, is pretty important for me... do i have to remove the whole programm?
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

Your Cisco WLAN stick is using the Ralink chip inside it. In fact all the WiFi adapters uses either Ralink, Realtek or Atheroz chips because they are the major WiFi chip makers. First check with the Cisco site for updated drivers. If not available, download the generic driver from "Ralink" site.

You should remove the "Netlimitter" program at least as a test. Otherwise we won't know whether it is the actual root cause. Once the issue is solved, you can either install an updated version or find an alternative one.
 

My Computer

System One

  • OS
    Windows 7

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

The official support page of "Linksys" only lists Win XP, Vista and 7 driver. Windows 8 is not supported.

WUSB600N Support | Dual-Band Wireless-N USB Network Adapter

But the Mediatek site lists a recent driver update ( 9/23/2013) which supports XP, Vista, 7 and 8. Here is the download link for that driver : MediaTek - Downloads Windows

Just enter your E-Mail address at the bottom and the download will begin. Remember to uninstall the old driver completely before updating.
 

My Computer

System One

  • OS
    Windows 7
i startet the intel driver update utility in the internet explorer now... but it shows on EVERY hardware
"This device is unknown or unsupported. Please contact the manufacturer for possible updates."
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Yes i installed the Wifi driver you gave me... but it still says "linksys" under hardware...

btw, last 3 bluescreens were BAD_POOL_CALLER, the rest didnt pop up

oh and the last link you gave me for the intel drivers, after i startet it, it told me that my driver currently installed are NEWER then the one i was about to install? o_O
How is that even possible, i thought those are the newest driver?
CURRENT: 9.4.0.1027
The Driver from the Link: 9.4.0.1026
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

Intel site only listed 9.4.0.1026​ . Since your's is already up to dated, ignore that part. How the system works now ?. Did you experienced more blue screens ?. My primary suspects in your case are the outdated WiFi drivers and the netlimitter program.
 

My Computer

System One

  • OS
    Windows 7
Iam still getting Bluescreens...
and well i updatet the Wifi Driver but it still doesnt list it as Ralink Wifi...

Bluescreens are saying:
fwpkclnt.sys fwpkclnt.sys+38400 fffff800`01ca5000 fffff800`01d11000 0x0006c000 0x5215f7c6 22.08.2013 12:36:38 Microsoft® Windows® Operating System FWP/IPsec Kernel-Mode API 6.3.9600.16384 (winblue_rtm.130821-1623) Microsoft Corporation C:\WINDOWS\system32\drivers\fwpkclnt.sys
NETIO.SYS NETIO.SYS+d769 fffff800`01600000 fffff800`01679000 0x00079000 0x5215f7e4 22.08.2013 12:37:08 Microsoft® Windows® Operating System Network I/O Subsystem 6.3.9600.16384 (winblue_rtm.130821-1623) Microsoft Corporation C:\WINDOWS\system32\drivers\NETIO.SYS
ntoskrnl.exe ntoskrnl.exe+292338 fffff802`31c0f000 fffff802`32390000 0x00781000 0x52341cf4 14.09.2013 09:23:16 Microsoft® Windows® Operating System NT Kernel & System 6.3.9600.16404 (winblue_gdr.130913-2141) Microsoft Corporation C:\WINDOWS\system32\ntoskrnl.exe
tcpip.sys tcpip.sys+6ef91 fffff800`01a26000 fffff800`01ca5000 0x0027f000 0x523d51f5 21.09.2013 08:59:49 Betriebssystem Microsoft® Windows® TCP/IP-Treiber 6.3.9600.16384 (winblue_rtm.130821-1623) Microsoft Corporation C:\WINDOWS\system32\drivers\tcpip.sys

Which clearly mentions the tcpip driver...
The Event overview tells me (google translatet it):
The browser driver has received too many did not allow datagrams from the remote computer "EASYBOX" to the name "FACYA PC" on transport "NetBT_Tcpip_ {6641E529-86DE-4a5a-8A9F-6E21B1BC0908}". The datagram is available in the data. There are no events generated as long as the reset frequency has not expired.

that comes right before the Bluescreen appears
and:
Error loading driver \ Driver \ WudfRd for the device SWD \ WPDBUSENUM \ {ceb7b680-11E3-4106-824d-bc5ff43578f4} # 0,000,000,000,100,000th
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
There you go
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

I am at work so don't have the tools to analyze the dumps. Anyway i did a quick look at the dumps using Windbg and it seems you didn't followed the instructions i gave.

I advised you to remove "Netlimitter" at least as a test but it is still present in your system.

Code:
ffffd000`2177c658  fffff800`04c488e0Unable to load image \??\C:\Program Files\Locktime Software\NetLimiter 4\nldrv.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for nldrv.sys
*** ERROR: Module load completed but symbols could not be loaded for nldrv.sys
 nldrv+0xc8e0

Kaspersky is also still present in the system.

Code:
ffffd000`2177c9c8  fffff800`024d0e64Unable to load image \SystemRoot\system32\DRIVERS\klwfp.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for klwfp.sys
*** ERROR: Module load completed but symbols could not be loaded for klwfp.sys
 klwfp+0x4e64


While we are troubleshooting a BSOD issue, we can't say for sure a particular program is the root cause of blue screen. A crash dump only give us limited information and we need to do detective work to find the real culprit. I am not saying to permanently abandon "Netlimiter" or "Kaspersky" but simply trying to eliminate possible culprits one by one to find the villain. Please uninstall them at least as a test.

I will look in to other possible issues once i get back home.
 

My Computer

System One

  • OS
    Windows 7
i will remove both, i just hoped that the driver updates would fix it allready :-/
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

In my experience, a BSOD which blames NETIO.SYS can be caused by either of the below reasons.


  • Outdated network interface card driver.
  • A network filter driver.
  • Driver used by download managing programs.
  • Third party firewall programs.

Your last dump shows the WiFi driver has been updated to the latest version successfully.

Code:
netr28ux.sys                [B]Fri Sep  6 18:17:06 2013 [/B](5229CECA)
Ralink RT2870 series USB802.11n Wireless Adapter Driver (you may have a different manufacturer)

Now there is mainly two possibilities remains. Either the Kaspersky Internet Security firewall driver or the Netlimitter program's filter driver. Both of them can be seen in the raw call stack of the thread which crashed. Once you removed both of them, we will see know whether one of them is the real culprit.
 

My Computer

System One

  • OS
    Windows 7
no bluescreens yet with kasp + netlimiter deinstalled...
But the Problem is, sometimes the Bluescreens apeard once a month... sometime 5 times a day... so its pretty hard to say "its fixed now"...

Do you think i can reinstall Kaspersky?
No Virus Scanner at all feels strange ^^
 

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Hi

Please wait at least a week before installing Kaspersky. In the meantime, you can enable "Windows defender" which will give you basic protection.

How to turn on Windows Defender in Windows 8 (and XP, Vista and 7) - PC Advisor

When you re-install Kaspersky, don't use the version came with the retail CD. Please download the latest version of "Kaspersky AV" (Not "Internet Security" ) from the official site.

Kaspersky Anti-Virus | Trials | 30-Day Free Download

You can use your legal key to activate the AV. If the key is for "Internet Security" , Kaspersky will ask your permission to switch to that version. I suggest clicking "No" and sticking with the antivirus only version. "Internet security" came with firewall which may cause BSOD issues like the one you are experiencing.
 

My Computer

System One

  • OS
    Windows 7
Just a quick feedback, not a single bluescreen yet.
Iam going to reinstall kaspersky antivirus now.

EDIT:

Seems like KIS Keys arent able to be downgraded to KAV.
I installed KIS now, lets see if Netlimiter deinstallation alone fixed it.
Maybe they troubled each other.
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1 Pro
    Computer type
    PC/Desktop
    CPU
    i7 - 2600k
    Motherboard
    Asus Z77 Pro3
    Memory
    Ripjaw 2x 8GB Ram
    Graphics Card(s)
    Powercolor Radeon 6950
    Antivirus
    Kaspersky Internet Security 2014
Back
Top