Tech Support Forum banner
Status
Not open for further replies.

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0x000000C1.... What is this?!

15K views 20 replies 4 participants last post by  ghostlyshark  
#1 ·
I could have sworn I already posted this, but apparently that got lost. Any help would be very much appreciated! Anyway, the other night, I noticed mozilla firefox was acting funny, it crashed and then I decided it was time to restart the computer. So I did, and then I got the bsod. I was hoping it was a fluke, but it kept coming back. The error came up as stated in the title. I tried running verifier, which singled out "sp_rsdrv2.sys" as an unsigned driver. I eventually tried quarantining this to no avail. After running verifier, the computer would bsod, then try to restart, bsod again, then prompt me to start in safe mode or the last known settings that work. These bsod stated kernel_data_inpage_error and page_fault_in_nonpaged_area.

I tried safe mode (no networking), which was fine, and I was able to use antivir, avast, mbam, and spyware terminator. Nothing showed up from any scan. I ran chkdsk and it detected and deleted a corruption, but then I still got the bsod when not in safe mode.

So then I tried getting back on windows normally and I noticed some strange things after starting up. I get a menu from the mobo connections and it offers a test for the speakers. So for fun, I try the test and the right speaker sounds nice and loud, the left is barely audible- no idea if that has anything to do with the bsod, but maybe it's a driver... I also notice that spyware terminator is blocking "wsimd.sys"- no idea what that is either. I try using ff again, and that has the worst problems. It will crash over and over, but IE seems fine. The one glaring problem there came on facebook, trying to IM someone and seeing that the message is trying to load, then failing, but the other person sees it- does not happen in IE. And on one occasion I saw that my d-link wireless (something... didn't really catch what it said) failed. So, could that be some kind of networking problem? I have no idea- there is so much to sort through.

I am also very suspicious of the RAM. Btw- this is an AMD phenom quad core, that I originally installed 2 sticks of crucial 1gb ddr2 800 and then later added 1 stick of 2gb transcend ddr2 800. I HOPE it is the RAM, but if not, I am at a loss so far. I have the .dmp files, but have not been able to view them yet. I'll post them as soon as I can. Until then, any suggestions? Thanks!
 
#3 · (Edited)
Hi ghostlyshark! :smile:

I can almost guarantee you are correct in your assumption that it is the RAM. The BSoD always indicates either driver or hardware failure. Some viruses do produce a fake BSoD, but if all of those programs that you ran came up clean, then it seems pretty legit.

You can do as rbalaji recommended and run Memtest86. You can find a guide locally on the forum here.

For reference:
Spyware-Net identifies sp_rsdrv2.sys as a file belonging to Spyware Terminator.

Hope this helps and feel free to come back for any additional help!
 
#6 ·
Well, I took out the memory stick that I suspected would be problematic and everything is running smoothly now (knock on wood). Yes, I know this is lazy, but it was happening so much that this seems to prove it was that stick of RAM. Thanks for everyone's help- hopefully I won't have to add anything more to this thread. Now, how to get a refund for this stupid stick?
 
#8 ·
ugh... it ran fine all night and even rendered a video overnight. But this morning I tried to put that video on my flash drive and it wouldn't go- said there is no room on my flash drive. However, it recognized if I tried to put a video on that was too large, and also allowed me to put mp3's on. So, for haha's I restarted the computer and that's when things got ugly- bsod, 0x0000007e. Powered down, turned back on and it seemed fine again, but still can't get my video on the flash drive. So... no more lazy way out- I'll test the RAM, but could it be the video card (ATI Radeon 512mb)? What the heck would I do about that?
 
#10 ·
Tested all 3 sticks of RAM, no errors. But the bsod comes up wayyyy less if I only run one or two sticks at a time. Could it be a certain slot that is the problem and not the stick? I did run each test on the same slot. This is driving me crazy. I love my computer :-(
 
#14 ·
OK- It is almost 4:30 AM and I can look at this computer monitor anymore. I am pasting the minidump info from the original crash if anyone is so kind or daring to take a peek please:


C:\Program Files\Debugging Tools for Windows (x86)>kd -y srv*c:\symbols*http://m
sdl.microsoft.com/download/symbols -i c:\windows\system32\spool\xpsep\i386 -z c:
\windows\minidump\mini030209-03.dmp

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\mini030209-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: c:\windows\system32\spool\xpsep\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Mon Mar 2 16:31:04.250 2009 (GMT-5)
System Uptime: 0 days 0:02:11.203
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {8b40ef68, 8b40eeb1, c50094, 23}

Probably caused by : memory_corruption ( nt!MmFreeSpecialPool+2a1 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: 8b40ef68, address trying to free
Arg2: 8b40eeb1, address where bits are corrupted
Arg3: 00c50094, (reserved)
Arg4: 00000023, caller is freeing an address where nearby bytes within the same
page have been corrupted

Debugging Details:
------------------


BUGCHECK_STR: 0xC1_23

SPECIAL_POOL_CORRUPTION_TYPE: 23

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: avguard.exe

LAST_CONTROL_TRANSFER: from 8068bbb1 to 8053767a

STACK_TEXT:
a6bf5c10 8068bbb1 000000c1 8b40ef68 8b40eeb1 nt!KeBugCheckEx+0x1b
a6bf5c50 80551e2e 8b40ef68 a6bf5cd3 8ae46ac8 nt!MmFreeSpecialPool+0x2a1
a6bf5c90 8067b4d9 8b40ef68 00000000 8067b680 nt!ExFreePoolWithTag+0x4a
a6bf5c9c 8067b680 00000000 8b40ef68 00000000 nt!VfIrpFree+0xc
a6bf5cb8 80674088 026ebe68 00000000 a6bf5d48 nt!VerifierIoFreeIrp+0x129
a6bf5cc8 8056f66a 8b40ef68 a6bf5d64 0583ff10 nt!IovFreeIrpPrivate+0x41
a6bf5d48 804dd99f 00000134 0583ff54 0583ff38 nt!NtRemoveIoCompletion+0x14a
a6bf5d48 7c90e4f4 00000134 0583ff54 0583ff38 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0583ff20 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmFreeSpecialPool+2a1
8068bbb1 8b4108 mov eax,dword ptr [ecx+8]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmFreeSpecialPool+2a1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48a4044a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xC1_23_nt!MmFreeSpecialPool+2a1

BUCKET_ID: 0xC1_23_nt!MmFreeSpecialPool+2a1

Followup: MachineOwner
---------

1: kd>
 
#16 ·
If anyone is taking a look at this thread, please tell me if this makes sense to you:

When I took out 2 of 3 RAM sticks out to do a memory test, I also saw that there was a lot of dust on the fans. So, of course, while i was at it, I cleaned out a lot of dust. The computer was much better. No weird errors at startup and no bsod for a day (not a matter of minutes like before). I immediately thought that I took out bad RAM, but after testing, I am 99.9% sure that it is not the RAM. So when I got the bsod pointing to kmixer.sys- I thought it has something to do with the audio driver. But then I thought about the dust. Why else would the computer run so much smoother just by cracking the case open and closing again? Cleaning out the dust was the only thing I did other than pull out RAM and the RAM is now back how I had it originally. So I cracked it open again and found more dust, cleaned it out. The theory being that the dust was clogging something, perhaps a fan, and when I was getting into more task intensive things like high-def video editing, it would make the computer crash. So, I put it back together, and used sony vegas pro, previewed in wmp, no problem. I'm going to go get some compressed air and really give this thing a cleaning, and I hope that is the problem, but if it isn't- could it be a virus?
 
#18 ·
cleaned the heck out of it- voltage and temp is fine. i was wrong- ram is at 1.8. cpu temp is only 30 deg. c. everything was running fine UNTIL i went to the bios. I changed nothing, exited without saving, and the bsod came up (x7e), went in bios again, and same thing happened after exiting, but then also happened once more when restarting. and now the mobo audio menu is popping up again when i start the computer again... it's as if it's trying to say "hey- did you just plug this stuff in or what?" i don't get it- hardware issue with the integrated audio?
 
#19 ·
found this minidump from the 7th....


C:\Program Files\Debugging Tools for Windows (x86)>kd -y srv*c:\symbols*http://m
sdl.microsoft.com/download/symbols -i c:\windows\system32\spool\xpsep\i386 -z c:
\windows\minidump\mini030709-01.dmp

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\mini030709-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: c:\windows\system32\spool\xpsep\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Fri Mar 6 01:55:46.203 2009 (GMT-4)
System Uptime: 0 days 1:36:33.786
Loading Kernel Symbols
...............................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
.........................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {1, 1c, 0, 804e1acd}

Probably caused by : ntkrnlmp.exe ( nt!KeWaitForMultipleObjects+cf )

Followup: MachineOwner
---------

2: kd>
 
#21 ·
through the power of deduction, i am now very inclined to believe firefox is causing this. Or it may at least be assisting. The one thing I can think of that I have done before these crashes is the ctrl-scroll zoom on firefox. I know that sounds weird, but I am pretty sure this only happens after I do that. And it makes sense because I only recently started doing this because i have different arrangement in my room, which means i'm far away from the monitor sometimes, and zoom in to read emails. I can't say for sure if this is it, but I just wanted to share this in case anyone else may have the same problem.
 
Status
Not open for further replies.
You have insufficient privileges to reply here.