Plagued by Bad_pool_caller BSOD

ChrisLPlumb · Apr 24, 2015

Every time I boot up normally, I get this BSOD almost as soon as I log in. I can boot in safe mode with no problems though.

I made a panicked thread already but no one responded. Sorry I'm being so demanding, but you've got to understand that this is happening to a super expensive laptop I bought from PC Specialist. I was saving for over a year to be able to afford it.

The minidumps should give you a better idea of what's wrong (I hope), but this started happening after a botched installation of Daemon Tools Lite. Bullguard flagged an exe in the installation called Soft Disc Bus Service, which I believe is a driver that DT uses. I blocked it as per Bullguard's advice, and the installation hung, so I ended the task and tried to uninstall / reinstall, both of which also hung. I tried a manual uninstall suggested by Soft Disc themselves, and found I couldn't delete the program folder because of soft disc bus service.exe, which weirdly was being used by soft disc bus service.exe. So then, I decided to use Revo to clean uninstall, opting to not use Daemon Tools' uninstaller and letting Revo handle it. I had "make a system restore point" turned off because it was making Revo hang, but I kept back-up registry ticked. I didn't check and delete any of the registry stuff that Revo gave me the option of deleting, but I deleted the stuff on the next prompt which seemed to be mostly "Local App" stuff, I think. Then, the system had to restart. Revo told me that some files would be removed upon restarting, and among these files was Soft Disc Bus Service.exe. The aforementioned BSOD started happening after this restart.

So I tried booting in safe mode, and found I was BSOD-free. I was actually able to delete the rest of the contents of the DT program file (Soft Disc Bus Service.exe included), and they're in my recycle bin now, but that didn't rectify the issue, and I'm still getting the BSOD. I system restored to a time earlier this evening before I'd installed Daemon Tools, but that also hasn't helped.

I'm terrified I've deleted something vital and that my computer is f**ked. Please, please help me out here.

Here are some minidumps: https://www.dropbox.com/sh/gebarvf1w7xt5ma/AAC_Tgb-3FKCG1N7OHRSgxPUa?dl=0

Paul NZ · Apr 25, 2015

I would uninstall bitdefender then use their removal tool. To remove the rest of it. Any 3rd party security program will crash windows. I'll rather have nothing and be crash free.

ChrisLPlumb · Apr 25, 2015

I'm having trouble actually finding the locations of bdagent.sys and mwlPSDFilter.sys. Would you have any idea?

EDIT: Oh wait, is that what the microsoft support link describes? I guess bdagent.sys and mwlPSDFilter.sys are "kernel mode filter drivers" right? Sorry, I'm really kind of learning as I go along.

Paul NZ · Apr 25, 2015

Have no idea I dont use any 3rd party security programs

Probably in system32 folder

And if Bitdefender and Bullguard are installed, bad idea. If theyre running at the same time, they'll conflict with each other. bdagent.sys isnt a windows file it belongs to Bullguard

And mwlPSDFilter.sys belongs to Privatesafe or something.

ChrisLPlumb · Apr 25, 2015

Paul NZ :

That's just it though, I don't have BitDefender installed on this computer. There just seems to be a filter driver for it knocking about. Would their removal tool get rid of that driver do you think?

Paul NZ · Apr 25, 2015

The removal tool should remove everything it installed. Go here if it's a trial. Select what it is then get it / run it

johnbl · Apr 25, 2015

if it were me, I would uninstall Bullguard and the drivers for Fingerprint Scanner
and the truefos.sys driver. the only "safe" driver would be the microsoft driver

note: you might run this tool and see if it helps figure out your devices with problems.
http://www.osronline.com/article.cfm?name=devicetree_v230.zip&id=97
look for the tool devicetree.exe in the i386 directory (if you can get access to the tool)
I already had an account. If you can not run it don't worry about it.

ChrisLPlumb :

So in other words, luafv.sys was the "first" driver installed, and therefore the oldest "link", while nskernel.sys was the latest and newest one installed? You believe bdagent.sys is like "bad driver 3" in your example, corrupting good drivers 4 and 5 (the first and oldest drivers in the chain, i.e. mwlPSDFilter.sys and luafv.sys)?

Ideally then I'd reinstall mwlPSDFilter.sys and luafv.sys, putting them at the top of the chain and leaving bdagent.sys with nothing older than it to corrupt (i.e. like the way bad driver 3 can no longer corrupt good drivers 4 and 5). But, you're saying you don't know how to re-run the setup for luafv.sys which has been corrupted, and so instead, it would be better if I pushed bdagent.sys and mwlPSDFilter.sys to the top of the chain by reinstalling them, leaving luafv.sys at the bottom of the chain, like bad driver 3 in your example? That, or simply uninstall mwlPSDFilter.sys, and reinstall / update bdagent.sys so that there's only 5 drivers in the chain (rather than 6 including mwlPSDFilter), with luafv.sys at the bottom not causing any corruption? Sorry about this by the way, I just want to make sure I understand what you're saying.

Also, is the implication that the activity of fltmgr.sys lead to the crash because it was dealing with the problematic filter drivers in the chain that were older than (installed before) NSKernel.sys? In other words, is NSkernel.sys kind of like a "good driver" in your example? And so are you saying that the culprit must be among those first 5 drivers (starting with the oldest, luafv.sys, and ending with the latest, which is bdspy.sys)? But you also seem to think that BdAgent.sys had the corrupting influence on the drivers before it, so would that not make IT the culprit?

Could I not instead just uninstall Bullguard and the drivers for Fingerprint Scanner / MyWinLocker permanently? Bullguard is a trial that came free with the machine, and I was planning to replace it with Avast or AVG anyway. Would this work do you think? Your advice here presumes that I want to keep both Bullguard and Fingerprint Scanner / MyWinLocker drivers, but I'm not really that fussed about them. I didn't know the laptop had a fingerprint scanner when I bought it - the fingerprint scanner had no role to play in my decision to buy it, nor did MyWinLocker, whatever that is. What do you think? Would just uninstalling them both be unwise?

Also, by "truefos.sys" do you mean "trufos.sys" which is apparently a driver associated with BitDefender? Is the extra "e" a typo? Because I couldn't find information on "truefos.sys." Incidentally, if the culprit driver is one of the first 5 in the list, I have to say that trufos.sys is pretty suspicious to me, because I don't have and never have had BitDefender on this machine, so where would a BitDefender driver have come from?

Anyway, thanks for everything so far. Hopefully we're closing in on the problem. I'll give your advice a try.

ChrisLPlumb · Apr 25, 2015

Stuck on something. When I go into administrative tools and then services, there are about 9 different Bullguard Services, and it seems I can only disable one at a time. If I try to disable one, and then another, the first one switches back to "automatic" at startup.

That said, I found bdagent.sys and mwlPSDFilter.sys in regedit. I haven't touched them yet, but they're there. I just need to know what services to disable. Does disabling services through task manager work? I can disable the three Bullguard ones that show up there.

Should I just try all 9 one by one? They are as follows: (BG = Bullguard) BG backup service, BG Behavioural Detection, BG cache service, BG e-mail monitoring service, BG firewall service, BG Main Service, BG on-access service, BG scanning service, BG update service.

Paul NZ · Apr 25, 2015

Uninstall the program, so its gone

And no disabling services in task manager wont work. Next time you reboot they'll run again

johnbl · Apr 25, 2015

I would uninstall the programs thru control panel if I could, sometimes the vendor will have their own uninstall program on the their website. (I just don't know in this case)

ChrisLPlumb :

johnbl · Apr 25, 2015

here are some of the suspect drivers (not including the 3 fingerprint drivers)

\SystemRoot\system32\DRIVERS\BdAgent.sys Tue May 13 08:05:29 2014
\SystemRoot\system32\drivers\BdSpy.sys Tue Oct 08 08:08:05 2013 (different date from the other two files??)
\SystemRoot\system32\DRIVERS\BdNet.sys Thu Mar 06 08:30:53 2014

\SystemRoot\system32\DRIVERS\NSKernel.sys Wed Mar 18 01:13:08 2015
\SystemRoot\system32\DRIVERS\NSNetmon.sys Wed Mar 18 01:13:07 2015

\SystemRoot\system32\DRIVERS\Trufos.sys Sat Oct 11 02:01:08 2014

ChrisLPlumb · Apr 25, 2015

Okay, so you think the best thing to do would be to just uninstall Bullguard (which I'll just replace with Avast or AVG) and the drivers for the Fingerprint Scanner (which I'll never use), as well as that BitDefender driver? (if I can find it?) Bullguard doesn't provide a removal tool. On their website they just provide a basic step-by-step uninstallation.

Maybe I can use the BitDefender removal tool suggested by Paul for trufos.sys.

ChrisLPlumb · Apr 25, 2015

johnbl :

But uninstalling Bullguard should get rid of those drivers (excluding trufos) too, right? Including the NovaShield ones, which are associated with it.

Paul NZ · Apr 25, 2015

If bitdefender has been installed go to device manager view / show hidden devices. Those file entries maybe under system devices. If they are select them then delete them

Altho use the removal tool for bitdefender first

ChrisLPlumb · Apr 25, 2015

Okay Bullguard is gone, and I uninstalled the EgisTec drivers for the fingerprint scanner via device manager. However, "Egistec Fingerprint Driver" is still listed in programs and features, and I can't uninstall it because it seems to open an INstaller to do so, and installers can't be used in Safe Mode. Also, mwlPSDFilter, mwlPSDNServ, and mwlPSDVDisk can still be found in the registry editor.

Should I have disabled the relevant filter drivers before I uninstalled those drivers in device manager? I can get them back by adding legacy hardware. I opted not to delete the driver installers just in case. The only thing is that there isn't, so far as I can tell, an associated service for the fingerprint drivers that I could disable before modifying the registry to disable the relevant filter drivers. Should there be? There's EgisTec Service, which has no description, and EgisTec Ticket Service, which also has no description.

Paul NZ · Apr 25, 2015

You should have uninstalled the fingerprint drivers first, it would have gone back to the default drivers in device manager

ChrisLPlumb · Apr 25, 2015

Paul NZ :

Could you elaborate? There are separate things to install for some reason. In programs and features there are two EgisTec programs listed - BioExcess and EgisTec Fingerprint Driver. I can't uninstall the latter because it seems to open an installer to do, rather than an uninstaller. You can't use installers in safe mode.

Then, listed in device manager under "Secure Biometric Devices" are "EgisTec ES603", and "Fingerprint Reader." I can uninstall both, but the former seems to come back after reboot. Also, I'm not sure what removal tool to get for trufos.sys (the mysterious BitDefender driver), as there are quite a few: http://www.bitdefender.com/site/view/uninstall_consumer_trial.html

I haven't actually tried a normal boot yet to see if the bluescreening is still happening since I got rid of Bullguard, I'm sort of afraid to. It might be worth getting a dump if it does happen though, now that Bullguard and all its drivers are out of the picture.

Paul NZ · Apr 25, 2015

You download the tool for the version of bitdefender that was installed

ChrisLPlumb · Apr 25, 2015

Very excellent news. I booted normally having uninstalled Bullguard and did not experience any bluescreening! I'm logged in and nothing has happened so far. I'll be back if something does happen, but it's looking good so far. My only concern now is that installing anti-virus at all might cause problems again. The thing is, Bullguard was working fine before and no bluescreens were occuring at normal startup. It was only after that whole Daemon Tools cock-up I described in the first post that things went haywire. If I were to install free versions of Avast or AVG, do you guys reckon it might create issues again, or do you think the problem lies solely with Bullguard? I suppose now that I'm in I can properly uninstall the fingerprint stuff - maybe that stuff causes problems with anti-virus drivers? Or maybe it's that trufos driver, but I can't locate that anywhere. It's not in the hidden drivers folder, it doesn't show up in hidden devices in device manager, and it's nowhere in regedit so far as I can tell. And why would it be? I never installed BitDefender, and it didn't come packaged with the machine, so I'm at a loss as to why it was coming up in the dump files.

Anyway, thanks so much for your patience and detailed advice John, and thanks Paul for chiming in and offering help too. Again, I'll be back if something comes up, but I've been logged in now for a good while and nothing bad has happened, so I think we're golden. Cheers!

Paul NZ · Apr 25, 2015

Dont install anything. Most will crash the system sooner or later. And MSE even tho it's Microsoft can make a system lag. I've never installed any 3rd party programs

And never had any probs. If you dont do dodgy things / don't go to dodgy sites I wouldnt bother with a separate AV program

Plagued by Bad_pool_caller BSOD

Honorable

Polypheme

Honorable

Polypheme

Honorable

Polypheme

Polypheme

Honorable

Polypheme

Polypheme

Polypheme

Honorable

Honorable

Polypheme

Honorable

Polypheme

Honorable

Polypheme

Honorable

Polypheme

Share this page