Repeating BSOD, Error DRIVER_CORRUPTED_EXPOOL

[trostc]

Working with a Dell E6540 on Windows 8.1. I've been chasing this BSOD for most of the week, and some days I think I have it licked, but then the next it comes right back... and is repeatable. The Stop Errors sometimes indicate a specific driver, but not always the same. The machine has latest Symantec Endpoint Protection and Cisco AnyConnect VPN client. Interestingly enough, the machine does not crash unless connected to the VPN, but we've uninstalled/reinstalled and done as much troubleshooting as possible, and still not sure what set this off. The errors started almost an entire week after the AnyConnect Client was updated, and before the latest SEP build was installed. (All Windows updates applied Any help is appreciated. If I've left something out, let me know. View attachment 67148

 

[axe0]

Hi trostc,

Welcome to the 8forums.

Symantec tried to empty a block of memory with a specific tag which didn't exists, the reaction on this was delaying the action where after the tagged memory was being moved to the virtual memory (page file) which went wrong because of the problem with the non-existing memory reference.
That is what caused the crashes.

Please reinstall Symantec
Uninstall: https://support.symantec.com/en_US/article.TECH184988.html

4: kd> k
Child-SP          RetAddr           Call Site
ffffd000`38315128 fffff803`3d770de9 nt!KeBugCheckEx
ffffd000`38315130 fffff803`3d76f63a nt!KiBugCheckDispatch+0x69
ffffd000`38315270 fffff803`3d8b5972 nt!KiPageFault+0x23a
ffffd000`38315400 fffff803`3d8b484e nt!ExDeferredFreePool+0x102
ffffd000`38315480 fffff801`ada27c44 nt![COLOR=#ff0000]ExFreePoolWithTag[/COLOR]+0x84e
ffffd000`38315570 ffffd000`38316110 [COLOR=#ff0000]SYMNETS[/COLOR]+0x27c44
ffffd000`38315578 00000000`00000000 0xffffd000`38316110

1: kd> k
Child-SP          RetAddr           Call Site
ffffd000`e37e6948 fffff803`af9723e9 nt!KeBugCheckEx
ffffd000`e37e6950 fffff803`af970c3a nt!KiBugCheckDispatch+0x69
ffffd000`e37e6a90 fffff803`afab7972 nt!KiPageFault+0x23a
ffffd000`e37e6c20 fffff803`afab684e nt!ExDeferredFreePool+0x102
ffffd000`e37e6ca0 fffff801`9e939d49 nt![COLOR=#ff0000]ExFreePoolWithTag[/COLOR]+0x84e
ffffd000`e37e6d90 00000000`00000000 [COLOR=#ff0000]IDSvia64[/COLOR]+0x60d49

Please reinstall or update Cisco
Driver Reference Table - acsock64.sys

*** WARNING: Unable to verify timestamp for acsock64.sys
*** ERROR: Module load completed but symbols could not be loaded for acsock64.sys
7: kd> lmvm acsock64start             end                 module name
fffff800`d6f9a000 fffff800`d6fd0000   acsock64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\acsock64.sys
    Image name: acsock64.sys
    Timestamp:        [COLOR=#ff0000]Thu Oct 08 17:12:56 2015[/COLOR] (561687F8)
    CheckSum:         0003DD8B
    ImageSize:        00036000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update/reinstall/remove following drivers/software.

[COLOR=red][B]GEARAspiWDM.sys Thu May 3 21:56:17 2012 (4FA2E2E1)[/B][/COLOR] 
[COLOR=red][B]stdcfltn.sys Sat Jul 14 01:30:14 2012 (5000AF86)[/B][/COLOR] 
[COLOR=red][B]DellRbtn.sys Fri Aug 3 23:32:54 2012 (501C4386)[/B][/COLOR] 
[COLOR=red][B]ST_Accel.sys Thu Mar 28 00:00:21 2013 (51537A05)[/B][/COLOR] 
[COLOR=red][B]iBtFltCoex.sys Thu Apr 18 16:17:24 2013 (51700074)[/B][/COLOR] 
[COLOR=red][B]Apfiltr.sys Tue May 21 08:04:29 2013 (519B0E6D)[/B][/COLOR] 
[COLOR=red][B]TeeDriverx64.sys Mon Aug 19 19:23:31 2013 (52125493)[/B][/COLOR] 
[COLOR=red][B]intelppm.sys Thu Aug 22 10:46:35 2013 (5215CFEB)[/B][/COLOR] 
[COLOR=red][B]RTDVHD64.sys Tue Aug 27 07:28:08 2013 (521C38E8)[/B][/COLOR]

http://www.carrona.org/drivers/driver.php?id=GEARAspiWDM.sys
http://www.carrona.org/drivers/driver.php?id=stdcfltn.sys
http://www.carrona.org/drivers/driver.php?id=DellRbtn.sys
http://www.carrona.org/drivers/driver.php?id=ST_Accel.sys
http://www.carrona.org/drivers/driver.php?id=iBtFltCoex.sys
http://www.carrona.org/drivers/driver.php?id=Apfiltr.sys
http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=RTDVHD64.sys

 

[trostc]

Aside from the GEARaspiWDM.sys driver that should have come from iTunes, I have updated all of the available drivers from Dell's website, and then also ran all available driver updates from the Intel Driver update tool as well. I can't really uninstall these drivers, is there something specific that they are causing or just appearing out of date?

 

[axe0]

They are just old, old drivers are usually from software that hasn't been updated in a while or not proper updated.

 

[trostc]

So they should be updated as best practice, but not necessarily causing the issue/conflict?

 

[axe0]

They necessarily don't have to be updated, but it frequently occurs that if one doesn't update a driver that has been suggested to update that some then cause problems.
Best practice is to update them yes.

 

[Leinahtan]

I decided to create an account here because I appear to be having the exact problem trostc is. Maybe if we find any similarities between the two of us we can pinpoint the problem.

The computer I have is a desktop that I assembled together which consists of the following parts:
i7 5820k CPU (6 Core Haswell-E)
Asus x99 Sabertooth Motherboard
Dominator Corsair 3000 MHZ memory DDR4 (32GB), previously had Mushkin Redline (16GB)
Various Hard Drives, loading bay
EVGA 560 GTX ti (used)

The difference in memory was a test to determine if the problem was caused by the Mushkin.

The BSOD occurs in both Windows 10 and 7, across multiple installations (got the BSOD, reinstalled Windows, got it again, repeated several times, on both Windows 7 and 10). This system has a dual boot configuration. However, the first setup only had Windows 10. The conditions are the same, the same BSOD occurs only when connected after a random period of time (30 minutes to hours, its not set). The BSOD does seem to occur sooner on Windows 10 than Windows 7. I tried turning the virtual memory off to prevent the problem as someone above mentioned it may be a problem with the memory being dumped to the paging file, but the BSOD still happens. I also updated to the newest version of Cisco VPN anyconnect and it still BSOD's.

If you are still around trost, let me know.

 

[axe0]

Hi Leinathan,

Welcome to the 8forums

Please follow http://www.eightforums.com/bsod-cra...e-screen-death-bsod-posting-instructions.html and create a new thread for your problem, your problem might be the same (can't say for sure) but to get better help we prefer to help each individual in a separate thread so nobody gets confused

 

[trostc]

Leinathan - We think the issue is under control now, either that or users aren't reporting that the issue is still ongoing... What has seemed to fix most was making sure all Windows Updates were installed, uninstalling/reinstalling all the network adapters, and then complete removal (including manually removing folders left behind) for Cisco AnyConnect and reinstalling that from scratch.

 

[Leinahtan]

Leinathan - We think the issue is under control now, either that or users aren't reporting that the issue is still ongoing... What has seemed to fix most was making sure all Windows Updates were installed, uninstalling/reinstalling all the network adapters, and then complete removal (including manually removing folders left behind) for Cisco AnyConnect and reinstalling that from scratch.

Odd. I reinstalled Windows 7 and 10 several times and still ran into the problem. However, I think I found the problem, which may be due to Cisco VPN 4.2.xxx, which appears to constantly crash after a period of use. Rolling back to 3.xx Any connect resolved the issue it seems. However, we are still testing it to make sure it works.

 

[trostc]

Odd. I reinstalled Windows 7 and 10 several times and still ran into the problem. However, I think I found the problem, which may be due to Cisco VPN 4.2.xxx, which appears to constantly crash after a period of use. Rolling back to 3.xx Any connect resolved the issue it seems. However, we are still testing it to make sure it works.

Interesting find. The majority of our users haven't experienced any BSOD's, only about 25%. Though, the latest build does seem to be more susceptible to disconnects due to packet loss. I suspect that repeated connections and disconnects (auto-reconnect enabled) might cause the instability... but those that we have clean uninstalled and reinstalled manually, (after the client was auto-updated from the server) without any pre-configured settings-they seem fine then, too.

 

[Spagnum]

Leinathan - We think the issue is under control now, either that or users aren't reporting that the issue is still ongoing... What has seemed to fix most was making sure all Windows Updates were installed, uninstalling/reinstalling all the network adapters, and then complete removal (including manually removing folders left behind) for Cisco AnyConnect and reinstalling that from scratch.

fits with what I found out.


Odd. I reinstalled Windows 7 and 10 several times and still ran into the problem. However, I think I found the problem, which may be due to Cisco VPN 4.2.xxx, which appears to constantly crash after a period of use. Rolling back to 3.xx Any connect resolved the issue it seems. However, we are still testing it to make sure it works.

Fits with what I found out
https://quickview.cloudapps.cisco.com/quickview/bug/CSCuy01698