BAD_POOL_HEADER ntoskrnl.exe, attempting to find cause

StaleMeat · 22 Feb 2017

Hello, for roughly the past week I have begun encountering a semi-persistent and annoying BSOD with the error code BAD_POOL_HEADER upon attempting to log in to windows after restart/shutdown. After spending some time reading into what it meant and how to potentially fix it. So far I have tried the following:

Updated drivers and made sure up to date drivers were not corrupted.
Used CCleaner to attempt to clean out any old registries.
System Restored to the 8th (which did not fix the problem).
Checked for damaged hardware with chkdsk and Windows Memory Diagnostic tools (No damage to either were detected by either test).
Uninstalled unused drivers from the device manager.
Turned off Fast Startup.

Given the seemingly wide range of potential things that can cause this error, I have spent several days attempting to find the problem and fix it. Unfortunately, because it only seems to trip occasionally on login, it has made attempting to do so incredibly frustrating to say the least. Checking the dump with the program Whocrashed shows the potential culprit being ntoskrnl.exe, although it being part of the operating system leads me to believe another driver may be conflicting with it in some way. Any help or insight into the problem would be greatly appreciated!

Note: Some of the Blue Screens from that log are from me attempting to boot up the system while the Driver Verifier Manager was running.

BSODHunter · 22 Feb 2017

Code:

0x00000019:    BAD_POOL_HEADER (20.02.2017 20:52:17) [Windows 10] 
 
CAUSED BY:     amifldrv64.sys [13.09.2011] * MSI DPC Latency Tuner * => https://www.msi.com/index.php 
 
PROCESS:       SCEWIN_64.exe 
 
Usual causes:  Device driver

Code:

0x000000C9:    DRIVER_VERIFIER_IOMANAGER_VIOLATION (21.02.2017 22:03:10) [Windows 10] 
 
CAUSED BY:     ntoskrnl    
               ramdriv.sys [27.12.2012] * RAMDriv Enterprise driver from QSoft [ Qualitative Software ] belonging to product RAMDriv made for Ardence  
 
PROCESS:       System 
 
Usual causes:  Driver verifier

eventlog error:

Code:

The driver \Driver\iaLPSS2_UART2 failed to load for the device PCI\VEN_8086&DEV_A127&SUBSYS_79981462&REV_31\3&11583659&0&F0.

There is something really strange with your storage/disk configuration. Can u pls provide us with more information how u installed windows?

Software like ramdisk (installing Windows on RAM) and MSI Tweak tools can cause BSODs.
U also have the MSI Command Center installed, thats for overclocking and tweaking CPU and is know causing Bluescreens too.

Code:

Service File Name:  C:\Program Files (x86)\MSI\Command Center\ClockGen\NTIOLib_X64.sys 
Service File Name:  C:\Program Files (x86)\MSI\Command Center\ClockGen\CPU_Frequency\NTIOLib_X64.sys
Service File Name:  "C:\Program Files (x86)\MSI\RAMDisk\MSI_RAMDisk_Service.exe"

I recommend a clean windows 10 installation on an SSD for u, without all the tweaking and overvlocking software

StaleMeat · 22 Feb 2017

Thank you so much for the reply! I had a sinking suspicion that one of the MSI services were causing the problem. Could simply uninstalling the problem programs be enough to fix the problem?

BSODHunter · 23 Feb 2017

Yes, I would try to uninstall all those tools. But its worth to repair filesystem after that:
Repair Windows Filesystem:

1. Open an elevated command prompt.
2. In the elevated command prompt, type these commands below, and press Enter:

dism /Online /NoRestart /Cleanup-Image /CheckHealth
dism /Online /NoRestart /Cleanup-Image /ScanHealth
dism /Online /NoRestart /Cleanup-Image /RestoreHealth

sfc /scannow

chkdsk %systemdrive% /F /R /X
fsutil dirty set %systemdrive%

SFC:
The SFC command scans the integrity of all protected system files and replaces incorrect versions with correct Microsoft versions.
DISM:
If a Windows image becomes unserviceable, you can use the Deployment Imaging and Servicing Management (DISM) tool to update the files and correct the problem.
For example, you would use DISM to fix Windows component store corruption when a sfc /scannow command is unable to repair corrupted or modified system files because the component store (source) is corrupted. SFC should be able to repair the files afterwards.
CHKDSK:
Checking your drives for errors every once in a while can help fix some performance issues. Drive errors can usually be caused by bad sectors, improper shutdowns, bad software, corruption, physical damage, etc...

StaleMeat · 24 Feb 2017

So all the MSI tools have been completely uninstalled. Afterwards I proceeded to check for any problems with the filesystems and fix them if found using the commands recommended. DISM and SFC both showed no issues with windows, and aside from clearing up some unused indexes and security descriptors Checkdisk also showed no further issues. I am currently 99% positive that uninstalling the programs has fixed the issue, but I will give it a few days before marking it as solved just to be sure.

StaleMeat · 27 Feb 2017

After waiting a few days, I have still not had any issues, so I think I can safely say the issue is solved! Thank you so very much BSODHunter for helping me fix this issue!

BSODHunter · 28 Feb 2017