Windows 10: BAD_POOL_HEADER caused by ntoskrnl.exe and tcpip.sys

Hello,

I have Windows 10 PRO installed. Other important installed applications are Malwarebytes (Antimalware and Antiexploit), Adguard and utorrent.

Last night I have started a big download on utorrent (a 20GB file) and after some minutes I got this BSOD with BAD_POOL_HEADER; the system restarted, and again after some time I got again BSOD. Again and again, for a total of 6 BSODs. After that, I disabled utorrent and both Malwarebytes programs, and since then I have had no crash.

Could you please tell me what is the problem, by looking at the log archive I am uploading, and what should I do to prevent this BSOD (a solution not involving permanently disable of Malwarebytes and utorrent)? If you have any more questions for me, please ask!

Also, I will upload an image taken with BlueScreenView application:
Attachment 32569

Thanks in advance!

EDIT: since problem involves TCP/IP, I think I should mention that I use wireless USB (as I am on a computer), with drivers installed from the same USB, and the site for this USB device is http://www.tenda.cn/uk/product/W326U.html

:)

 

ntoskrnl.exe+231de5 BSOD windows 10

Hello,

I am using Asus vivobook s400c for more than two years. I have upgraded to windows 10 from my windows 8.1 just about a year ago. It was working fine until two weeks ago that I faced multiple repeating BSOD (Bad_POOL_HEADER). finally I could read the mini-dump
file with BlueScreenViewer. Always it shows ntoskrnl.exe+231de5 and some times some others.

I read in the internet that it can happen from malware or virus. I have updated Bitdefender and Anti-MalwareBytes on my system and I made sure of not presenting any Malware or virus.

The last way was changing the Physical memory and at the end I changed the RAM. Everything seemed to be fixed for a week but again I face BSOD with same error!

I'd like to ask you for a solution.

By the way I changed my Hard drive to use SSD one before I upgrade from windows 8.1 to 10.

Below you find minidump files history:

==================================================

Dump File : 041216-5390-01.dmp

Crash Time : 4/12/2016 12:00:00 PM

Bug Check String : BAD_POOL_CALLER

Bug Check Code : 0x000000c2

Parameter 1 : 00000000`00000007

Parameter 2 : 00000000`0000126c

Parameter 3 : 00000000`00000000

Parameter 4 : ffffe000`df3441c8

Caused By Driver : NETIO.SYS

Caused By Address : NETIO.SYS+16f2f

File Description : Network I/O Subsystem

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 10.0.10586.0 (th2_release.151029-1700)

Processor : x64

Crash Address : ntoskrnl.exe+142760

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\WINDOWS\Minidump\041216-5390-01.dmp

Processors Count : 4

Major Version : 15

Minor Version : 10586

Dump File Size : 289,292

Dump File Time : 4/12/2016 12:01:20 PM

==================================================

==================================================

Dump File : 041216-5062-01.dmp

Crash Time : 4/12/2016 7:26:03 AM

Bug Check String : BAD_POOL_HEADER

Bug Check Code : 0x00000019

Parameter 1 : 00000000`00000020

Parameter 2 : ffffe000`81669890

Parameter 3 : ffffe000`816698b0

Parameter 4 : 00000000`04020089

Caused By Driver : tcpip.sys

Caused By Address : tcpip.sys+7bd50

File Description : TCP/IP Driver

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 10.0.10586.0 (th2_release.151029-1700)

Processor : x64

Crash Address : ntoskrnl.exe+142760

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\WINDOWS\Minidump\041216-5062-01.dmp

Processors Count : 4

Major Version : 15

Minor Version : 10586

Dump File Size : 289,188

Dump File Time : 4/12/2016 9:22:43 AM

==================================================

==================================================

Dump File : 041116-4953-01.dmp

Crash Time : 4/11/2016 8:00:07 PM

Bug Check String : BAD_POOL_HEADER

Bug Check Code : 0x00000019

Parameter 1 : 00000000`00000020

Parameter 2 : ffffe000`52c00af0

Parameter 3 : ffffe000`52c00b10

Parameter 4 : 00000000`04020011

Caused By Driver : tcpip.sys

Caused By Address : tcpip.sys+7bd50

File Description : TCP/IP Driver

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 10.0.10586.0 (th2_release.151029-1700)

Processor : x64

Crash Address : ntoskrnl.exe+142760

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\WINDOWS\Minidump\041116-4953-01.dmp

Processors Count : 4

Major Version : 15

Minor Version : 10586

Dump File Size : 289,268

Dump File Time : 4/11/2016 8:01:02 PM

==================================================

==================================================

Dump File : 041116-8515-01.dmp

Crash Time : 4/11/2016 6:09:46 PM

Bug Check String : BAD_POOL_HEADER

Bug Check Code : 0x00000019

Parameter 1 : 00000000`00000020

Parameter 2 : ffffe001`105c1710

Parameter 3 : ffffe001`105c1730

Parameter 4 : 00000000`04020008

Caused By Driver : tcpip.sys

Caused By Address : tcpip.sys+7bd50

File Description : TCP/IP Driver

Product Name : Microsoft® Windows® Operating System

Company : Microsoft Corporation

File Version : 10.0.10586.0 (th2_release.151029-1700)

Processor : x64

Crash Address : ntoskrnl.exe+142760

Stack Address 1 :

Stack Address 2 :

Stack Address 3 :

Computer Name :

Full Path : C:\WINDOWS\Minidump\041116-8515-01.dmp

Processors Count : 4

Major Version : 15

Minor Version : 10586

Dump File Size : 289,116

Dump File Time : 4/11/2016 6:10:44 PM

==================================================

 

IRQL_UNEXPECTED_VALIUE BSOD

H recently updated to windows 10 and I keep getting a blue screen and a restart I tried troubleshooting and automatic restore it did not work please help me It seems to happen while I am watching a youtube video or downloading a game Thanks it seems to be
coming from tcpip.sys 63f86 I posted the bluescreenview below

101015-23234-01.dmp 10/10/2015 1:59:11 AM IRQL_UNEXPECTED_VALUE 0x000000c8 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 tcpip.sys tcpip.sys+63f86 x64 ntoskrnl.exe+14e240 C:\WINDOWS\Minidump\101015-23234-01.dmp 4 15 10240 282,976 10/10/2015
2:00:08 AM

101015-24281-01.dmp 10/10/2015 1:44:14 AM IRQL_UNEXPECTED_VALUE 0x000000c8 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 tcpip.sys tcpip.sys+63f86 x64 ntoskrnl.exe+14e240 C:\WINDOWS\Minidump\101015-24281-01.dmp 4 15 10240 282,976 10/10/2015
1:45:11 AM

100915-18562-01.dmp 10/9/2015 6:14:35 AM IRQL_UNEXPECTED_VALUE 0x000000c8 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 tcpip.sys tcpip.sys+63f86 x64 ntoskrnl.exe+14e240 C:\WINDOWS\Minidump\100915-18562-01.dmp 4 15 10240 282,976 10/9/2015
6:15:26 AM

100715-21109-01.dmp 10/7/2015 7:54:57 AM IRQL_UNEXPECTED_VALUE 0x000000c8 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 tcpip.sys tcpip.sys+63f86 x64 ntoskrnl.exe+14e240 C:\WINDOWS\Minidump\100715-21109-01.dmp 4 15 10240 282,976 10/7/2015
7:55:52 AM

100515-40468-01.dmp 10/5/2015 12:38:34 AM IRQL_UNEXPECTED_VALUE 0x000000c8 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 tcpip.sys tcpip.sys+63cf6 x64 ntoskrnl.exe+14e240 C:\WINDOWS\Minidump\100515-40468-01.dmp 4 15 10240 282,976 10/5/2015
12:39:53 AM

 

Are you running MalwareBytes realtime? There are plenty of instances of it showing in your logs.
Code: BugCheck 19, {20, ffffe001569e5340, ffffe001569e5360, 4020034} *** WARNING: Unable to verify timestamp for mwac.sys *** ERROR: Module load completed but symbols could not be loaded for mwac.sys Probably caused by : fwpkclnt.sys ( fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1dd )[/quote] Code: ffffd000`233c7768 fffff800`5c2c1ed8 mwac+0x1ed8 ffffd000`233c7770 00000000`00000002 ffffd000`233c7778 fffff800`5c2c6f51 mwac+0x6f51 ffffd000`233c7780 ffffe001`4e74abd0 ffffd000`233c7788 00000000`00000002 ffffd000`233c7790 fffff800`5c2ce7c0 mwac+0xe7c0 ffffd000`233c7798 fffff800`5c2ce420 mwac+0xe420 ffffd000`233c77a0 00000000`00000002 ffffd000`233c77a8 fffff800`5c2c451f mwac+0x451f ffffd000`233c77b0 fffff800`5c2cec80 mwac+0xec80 ffffd000`233c77b8 fffff800`5c2cec80 mwac+0xec80 ffffd000`233c77c0 00000000`00000002 ffffd000`233c77c8 fffff800`5c2ce7c0 mwac+0xe7c0 ffffd000`233c77d0 ffffe001`4e4419a0 ffffd000`233c77d8 fffff800`5c2c3233 mwac+0x3233 ffffd000`233c77e0 00000000`00000000 ffffd000`233c77e8 00000000`00000000 ffffd000`233c77f0 fffff800`5c2ceca0 mwac+0xeca0 ffffd000`233c77f8 fffff800`5c2c3315 mwac+0x3315 ffffd000`233c7800 fffff800`5c2ceca8 mwac+0xeca8 ffffd000`233c7808 fffff803`51a2cd8b nt!ObReferenceObjectByHandleWithTag+0xbb[/quote]
If so, just run MBAM on demand to see if the problem stops.

 

Yes, when I had those BSODs, I was running Malwarebytes realtime. Now, I have disabled it, as a temporary solution, and no crash occured since then (it appears utorrent was not a problem).

 

Ok, I ran a demand scan, and everything was ok. I even reactivated Malwarebytes Antimalware (but uninstalled AntiExploit), and so far I had no problem.
I suspect the problem appears only when I am downloading a huge file with utorrent (and Malwarebytes is realtime) and the download speed goes high (probably around 4-6 MB/s). I will try tonight to check if this is true.

 

A week ago one more guy had the same Error. You are right Malware bytes may be the Culprit. The Drivers conflicts on boot causing the issue. I learned it Here Fix "Bad_Pool_Header" Error in Windows 7/8/8.1 & 10 | Fix Errors

If the Issue persists again and again even after disabling Malwarebyte or any other Anti virus other then Windows Defender then you might want to make use of Restore point. Obviously if you had already created it. Hope this helps.

-W10U

 

Today I started again to download a big file, and everything seemed ok. But, after I entered on the site Scared S#!tless: 52 Movies That Will Make Every Man Scream Like A Little Girl and scrolled for some seconds, the BAD_POOL_HEADER BSOD appeared again. After the restart, I disabled malwarebytes, restarted the download on utorrent, and everything was ok. I again entered this site, and forced some scrolling (very fast scrolling up-down from the head to the bottom of the page) and nothing happened.

So, it appears malwarebytes has an issue with high speed downloads and/or scrolling on sites with much graphic content. I will disable it for now and only run on-demand scans.