bad_spool_header BSOD almost daily

[carlitoswayec]

Hello,

I am having almost daily BSOD's on Windows 10. I finally decided to look for help, so installed the Debugging Tools for Windows 10. It seems the error is caused by the mbamservice.exe driver affecting the Windows NETIOS.sys module? Please help me figure it out, thank you!

Here is what my (huge 800Mb) memory dump file says:


Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 10240 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10240.16590.amd64fre.th1_st1.151104-1714
Machine Name:
Kernel base = 0xfffff803`f168b000 PsLoadedModuleList = 0xfffff803`f19b0070
Debug session time: Fri Dec 18 12:39:23.774 2015 (UTC - 5:00)
System Uptime: 0 days 3:31:58.476
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7fab8018). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 1254, 0, ffffe000dc7c07d8}

*** ERROR: Module load completed but symbols could not be loaded for mwac.sys
Probably caused by : NETIO.SYS ( NETIO!NetioFreeMdl+2707f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 0000000000001254, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: ffffe000dc7c07d8, Address of the block of pool being deallocated

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 10240.16590.amd64fre.th1_st1.151104-1714

SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.

SYSTEM_PRODUCT_NAME: GA-990FXA-UD5

BIOS_VENDOR: Award Software International, Inc.

BIOS_VERSION: F11

BIOS_DATE: 10/26/2012

BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.

BASEBOARD_PRODUCT: GA-990FXA-UD5

DUMP_TYPE: 1

BUGCHECK_P1: 7

BUGCHECK_P2: 1254

BUGCHECK_P3: 0

BUGCHECK_P4: ffffe000dc7c07d8

POOL_ADDRESS: ffffe000dc7c07d8 Nonpaged pool

FREED_POOL_TAG: Mdl

BUGCHECK_STR: 0xc2_7_Mdl

CPU_COUNT: 8

CPU_MHZ: dc4

CPU_VENDOR: AuthenticAMD

CPU_FAMILY: 15

CPU_MODEL: 2

CPU_STEPPING: 0

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: mbamservice.ex

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: MATEO

ANALYSIS_SESSION_TIME: 12-18-2015 12:59:38.0034

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

LAST_CONTROL_TRANSFER: from fffff803f18fef05 to fffff803f17da4d0

STACK_TEXT:
ffffd000`21accde8 fffff803`f18fef05 : 00000000`000000c2 00000000`00000007 00000000`00001254 00000000`00000000 : nt!KeBugCheckEx
ffffd000`21accdf0 fffff801`b0d791bf : ffffe000`dd7b98a0 ffffe000`dc7c0500 00000000`00000000 fffff801`b1090100 : nt!ExFreePool+0x23d
ffffd000`21acced0 fffff801`b0ef1cbe : ffffe000`e0e34de0 ffffe000`def8acb0 ffffe000`dd7b97a0 fffff801`b51290ee : NETIO!NetioFreeMdl+0x2707f
ffffd000`21accf20 fffff801`b0d51713 : ffffe000`dc7c05b0 00000000`00000001 00000000`00000000 00000000`00000000 : tcpip!FlpReturnNetBufferListChain+0x8e18e
ffffd000`21accf70 fffff801`b0d51456 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe000`e0e34de0 : NETIO!NetioDereferenceNetBufferList+0x163
ffffd000`21accfb0 fffff801`b0e10fac : ffffe000`dc7c05b0 00000000`00000000 00000000`00000000 ffffe000`df1a36c0 : NETIO!NetioDereferenceNetBufferListChain+0x2e6
ffffd000`21acd060 fffff801`b0e121b8 : fffff801`b0fb9310 ffffe000`db311010 00000000`00000001 00000000`00000001 : tcpip!IppReceiveHeaderBatch+0x34c
ffffd000`21acd160 fffff801`b0f5ab88 : ffffe000`dbd92ba0 ffffe000`e0e34de0 00000000`00000001 ffffe000`e288d400 : tcpip!IppFlcReceivePacketsCore+0x338
ffffd000`21acd280 fffff801`b1074de6 : fffff801`b4687802 ffffe000`d974f080 ffffd000`21acd460 fffff801`b0d518db : tcpip!IppInspectInjectReceive+0xf8
ffffd000`21acd2c0 fffff803`f1708925 : ffffd000`21acd460 ffffd000`21acd460 ffffe000`dd7b97a0 ffffe000`daa875c0 : fwpkclnt!FwppInjectionStackCallout+0x116
ffffd000`21acd350 fffff801`b10766c6 : ffffe000`da1ffd00 ffffe000`e288d400 ffffe000`da085800 00000000`00000002 : nt!KeExpandKernelStackAndCalloutInternal+0x85
ffffd000`21acd3a0 fffff801`b107631d : 00000000`00000000 ffffd000`21acd4d9 ffffe000`e288d430 ffffe000`e0e34de0 : fwpkclnt!NetioExpandKernelStackAndCallout+0x52
ffffd000`21acd3e0 fffff801`b51261b8 : ffffe000`def8acb0 00000000`00000000 ffffe000`dd7b9700 00000000`00000008 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x2ad
ffffd000`21acd520 fffff801`b51266bc : ffffe000`e0e34de0 00000000`00000003 ffffd000`21acd5f0 00000000`00000000 : mwac+0x61b8
ffffd000`21acd5b0 fffff801`b51265c8 : ffffe000`de9d4250 fffff801`00000002 ffffe000`de9d4201 ffffd000`21acd6b0 : mwac+0x66bc
ffffd000`21acd630 fffff801`b5126f51 : ffffe000`de9d4250 00000000`00000002 fffff801`b512e7c0 fffff801`b512e420 : mwac+0x65c8
ffffd000`21acd680 fffff801`b512451f : fffff801`b512ec80 fffff801`b512ec80 00000000`00000002 fffff801`b512e7c0 : mwac+0x6f51
ffffd000`21acd6b0 fffff801`b5123233 : 00000000`00000000 00000000`00000000 fffff801`b512eca0 fffff801`b5123315 : mwac+0x451f
ffffd000`21acd6e0 fffff801`b5122e9e : 00000000`00000000 00000000`00000002 fffff801`b512eca0 fffff803`f16d8781 : mwac+0x3233
ffffd000`21acd750 fffff801`b5124377 : fffff801`b512e7c0 00000000`00000000 ffffe000`e2bb3880 ffffd000`21acdb80 : mwac+0x2e9e
ffffd000`21acd780 fffff801`b51298e8 : ffffe000`e2bb3860 00000000`00000000 00000000`00000001 00000000`00000000 : mwac+0x4377
ffffd000`21acd7b0 fffff803`f1ac8c4d : 00000000`00000000 ffffd000`21acdb80 ffffd000`21acdb80 ffffc000`00000001 : mwac+0x98e8
ffffd000`21acd800 fffff803`f1ac8526 : 00000000`000012c0 00000000`51633560 00000000`00000001 00000000`2958ddf8 : nt!IopXxxControlFile+0x71d
ffffd000`21acda20 fffff803`f17e4b63 : ffffd000`746c6644 ffffd000`21acdb08 00000000`00000000 fffff803`f1aa7448 : nt!NtDeviceIoControlFile+0x56
ffffd000`21acda90 00000000`51631e52 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0db1ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x51631e52


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 1c662895ee107e6473854d5d443c0240a5b5331d

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a78bc9740dbfb686c5c0ba2b397608b31acfe066

THREAD_SHA1_HASH_MOD: 91dd9b0232768cfb302fbb9ae4e6737989437fe3

FOLLOWUP_IP:
NETIO!NetioFreeMdl+2707f
fffff801`b0d791bf 90 nop

FAULT_INSTR_CODE: 9020e990

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: NETIO!NetioFreeMdl+2707f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 563ad315

BUCKET_ID_FUNC_OFFSET: 2707f

FAILURE_BUCKET_ID: 0xc2_7_Mdl__NETIO!NetioFreeMdl

BUCKET_ID: 0xc2_7_Mdl__NETIO!NetioFreeMdl

PRIMARY_PROBLEM_CLASS: 0xc2_7_Mdl__NETIO!NetioFreeMdl

TARGET_TIME: 2015-12-18T17:39:23.000Z

OSBUILD: 10240

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2015-11-04 23:15:48

BUILDDATESTAMP_STR: 151104-1714

BUILDLAB_STR: th1_st1

BUILDOSVER_STR: 10.0.10240.16590.amd64fre.th1_st1.151104-1714

ANALYSIS_SESSION_ELAPSED_TIME: 24e3

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc2_7_mdl__netio!netiofreemdl

FAILURE_ID_HASH: {f2c46e80-d936-89a0-13f9-f9b302dc640b}

Followup: MachineOwner
---------

 

[carlitoswayec]

Hello,

I asked for help on the MalwareBytes forum, and they seem to think the problem is actually caused by my external sound card.

I hope someone here can help out.


Thank you,