How to use verifier?

Gary Roach

I'm debugging a machine running XP Pro SP2. It gives a blue screen
occasionally with a c5 stop error. It seems I'm supposed to run the driver
verifier utility to deal with this. I don't know which drivers to monitor
and monitoring them all slows the system down so much that it's unusable.
I've analyzed the minidump from the crash (output included afterwards) and
it tells me the problem is in Internet Explorer. Which drivers should I
monitor? Thanks for any help.

--
Gary Roach
ADB Services


--------------------------------------- Minidump
Output --------------------------------------


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [p:\Mini062308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
srv*c:\symbols*
Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Jun 23 10:41:24.343 2008 (GMT-4)
System Uptime: 2 days 7:32:40.075
Loading Kernel Symbols
.................................................. .................................................. ............................
Loading User Symbols
Loading unloaded module list
.....................
ERROR: FindPlugIns 8007007b
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {0, 2, 1, 8054a10d}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at
an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8054a10d, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+107
8054a10d 893b mov dword ptr [ebx],edi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 8054a75f to 8054a10d

STACK_TEXT:
b953f994 8054a75f 00000001 863aada8 00000000 nt!ExDeferredFreePool+0x107
b953f9d4 805bf507 862cdd00 00000000 b953fd64 nt!ExFreePoolWithTag+0x47f
b953fd48 805409ac 00000005 0221fedc 00000001
nt!NtWaitForMultipleObjects+0x2f5
b953fd48 7c90eb94 00000005 0221fedc 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0221ff50 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
8054a10d 893b mov dword ptr [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+107

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

nass

"Gary Roach" wrote:

> I'm debugging a machine running XP Pro SP2. It gives a blue screen
> occasionally with a c5 stop error. It seems I'm supposed to run the driver
> verifier utility to deal with this. I don't know which drivers to monitor
> and monitoring them all slows the system down so much that it's unusable.
> I've analyzed the minidump from the crash (output included afterwards) and
> it tells me the problem is in Internet Explorer. Which drivers should I
> monitor? Thanks for any help.
>
> --
> Gary Roach
> ADB Services
>
>
> --------------------------------------- Minidump
> Output --------------------------------------
>
>
> Microsoft (R) Windows Debugger Version 6.6.0007.5
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [p:\Mini062308-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is:
> srv*c:\symbols*
> Executable search path is: c:\windows\i386
> Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
> compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_qfe.070227-2300
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
> Debug session time: Mon Jun 23 10:41:24.343 2008 (GMT-4)
> System Uptime: 2 days 7:32:40.075
> Loading Kernel Symbols
> .................................................. .................................................. ............................
> Loading User Symbols
> Loading unloaded module list
> .....................
> ERROR: FindPlugIns 8007007b
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 100000C5, {0, 2, 1, 8054a10d}
>
> Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )
>
> Followup: Pool_corruption
> ---------
>
> 1: kd> !analyze -v
> ERROR: FindPlugIns 8007007b
> ************************************************** *****************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ************************************************** *****************************
>
> DRIVER_CORRUPTED_EXPOOL (c5)
> An attempt was made to access a pageable (or completely invalid) address at
> an
> interrupt request level (IRQL) that is too high. This is
> caused by drivers that have corrupted the system pool. Run the driver
> verifier against any new (or suspect) drivers, and if that doesn't turn up
> the culprit, then use gflags to enable special pool.
> Arguments:
> Arg1: 00000000, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: 8054a10d, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
> BUGCHECK_STR: 0xC5_2
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!ExDeferredFreePool+107
> 8054a10d 893b mov dword ptr [ebx],edi
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> PROCESS_NAME: iexplore.exe
>
> LAST_CONTROL_TRANSFER: from 8054a75f to 8054a10d
>
> STACK_TEXT:
> b953f994 8054a75f 00000001 863aada8 00000000 nt!ExDeferredFreePool+0x107
> b953f9d4 805bf507 862cdd00 00000000 b953fd64 nt!ExFreePoolWithTag+0x47f
> b953fd48 805409ac 00000005 0221fedc 00000001
> nt!NtWaitForMultipleObjects+0x2f5
> b953fd48 7c90eb94 00000005 0221fedc 00000001 nt!KiFastCallEntry+0xfc
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 0221ff50 00000000 00000000 00000000 00000000 0x7c90eb94
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!ExDeferredFreePool+107
> 8054a10d 893b mov dword ptr [ebx],edi
>
> SYMBOL_STACK_INDEX: 0
>
> FOLLOWUP_NAME: Pool_corruption
>
> IMAGE_NAME: Pool_Corruption
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> SYMBOL_NAME: nt!ExDeferredFreePool+107
>
> MODULE_NAME: Pool_Corruption
>
> FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+107
>
> BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+107
>
> Followup: Pool_corruption
> ---------

As the eroor mentioning that a plug-ins not loading and you need to know
which plug in?
What your motherboard make and model?

Dopes the machine get overheated?
Try to test the memory by using this tool:

You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it on
Reboot.

You may need to reposition/reset the RAM sticks in their slots.

Try to use the Verifier.exe command to see which Drivers not Verified on
your system:
How to Use Driver Verifier to Troubleshoot Windows Drivers



Stop error message in Windows XP that you may receive: "0x0000009C
(0x00000004, 0x00000000, 0xb2000000, 0x00020151)"



Unexplained computer behaviour may be caused by deceptive software


Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:


2.... And also for malware from here:




Run a scan from here on-line:


Download Avast Cleaner from here:

Lots of tools to download and disinfect your machine:



=How to perform a clean boot procedure to prevent background programs from
interfering with a game or a program that you currently use



Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP


Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

HTH.
nass
-------