Bluescreen Windows 8 erzeugt durch fwpkclnt.sys

Lajiola · 1. November 2013

Guten Morgen,

Ich hab seit den letzen 3 Tagen häufiger Bluescreens mit der Meldung BAD_POOL_HEADER

Nach etwas suche wurde häufig empfohlen die Registry zu säubern mit Hilfe von CC Cleaner, brachte leider nicht den gewünschten erfolg.

Also hab ich mal die ganzen Minidumps mit WinDBG durchlaufen lassen und bekomme immer wieder die fwpkclnt.sys ausgespuckt.

Da ich keine Ahnung habe was ich nun machen soll stell ich die Frage hier mal in die Runde :-)

Intel Core i7 4770K
Asus Z87-Pro
nVidia GeForce GTX 770
Creative Sound Blaster Recon3D

Achja, weiterhin ist mir aufgefallen das nach dem BSOD Persöhnliche Daten aus Anwendungen Fehlen.
Also Anmelde Daten von Spotify, Outlook Passwörter usw.

Meine nächsten Schritte:
Alle Treiber Aktualisieren
Update auf Windows 8.1

Code:

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa8012b53230, The pool entry we were looking for within the page.
Arg3: fffffa8012b53250, The next pool entry.
Arg4: 0000000004020005, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff803d0969168
GetUlongFromAddress: unable to read from fffff803d09691f8
 fffffa8012b53230 Nonpaged pool

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff803d0883ba9 to fffff803d066b440

STACK_TEXT:  
fffff880`0a6144c8 fffff803`d0883ba9 : 00000000`00000019 00000000`00000020 fffffa80`12b53230 fffffa80`12b53250 : nt!KeBugCheckEx
fffff880`0a6144d0 fffff880`01dcd3b2 : fffffa80`12b53240 00000000`00000012 fffff880`0a6146b0 00000000`676e7049 : nt!ExFreePool+0xadb
fffff880`0a6145b0 fffff880`01f232ac : fffff880`009f0180 00000000`00000500 00000000`00000000 00000000`00000000 : tcpip!IppInspectBuildHeaders+0x5f2
fffff880`0a6148a0 fffff880`0a04482f : fffff880`0a614aa0 fffff880`00000014 fffff880`0a614af0 fffff880`0a6149c0 : fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+0x1dc
fffff880`0a614950 fffff880`0a614aa0 : fffff880`00000014 fffff880`0a614af0 fffff880`0a6149c0 fffff880`0a614a50 : nldrv+0xf82f
fffff880`0a614958 fffff880`00000014 : fffff880`0a614af0 fffff880`0a6149c0 fffff880`0a614a50 fffff880`00000006 : 0xfffff880`0a614aa0
fffff880`0a614960 fffff880`0a614af0 : fffff880`0a6149c0 fffff880`0a614a50 fffff880`00000006 00000000`00000000 : 0xfffff880`00000014
fffff880`0a614968 fffff880`0a6149c0 : fffff880`0a614a50 fffff880`00000006 00000000`00000000 00000000`00000000 : 0xfffff880`0a614af0
fffff880`0a614970 fffff880`0a614a50 : fffff880`00000006 00000000`00000000 00000000`00000000 fffffa80`00000000 : 0xfffff880`0a6149c0
fffff880`0a614978 fffff880`00000006 : 00000000`00000000 00000000`00000000 fffffa80`00000000 00000000`00000000 : 0xfffff880`0a614a50
fffff880`0a614980 00000000`00000000 : 00000000`00000000 fffffa80`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`00000006


STACK_COMMAND:  kb

FOLLOWUP_IP: 
fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1dc
fffff880`01f232ac 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1dc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fwpkclnt

IMAGE_NAME:  fwpkclnt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  513034da

BUCKET_ID_FUNC_OFFSET:  1dc

FAILURE_BUCKET_ID:  0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0

BUCKET_ID:  0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0

Followup: MachineOwner
---------

1: kd> lmvm fwpkclnt
start             end                 module name
fffff880`01f0d000 fffff880`01f75000   fwpkclnt   (private pdb symbols)  c:\symbols\fwpkclnt.pdb\69E5349BA22044E6B568EFE6CCBC4C692\fwpkclnt.pdb
    Loaded symbol image file: fwpkclnt.sys
    Mapped memory image file: c:\symbols\fwpkclnt.sys\513034DA68000\fwpkclnt.sys
    Image path: \SystemRoot\System32\drivers\fwpkclnt.sys
    Image name: fwpkclnt.sys
    Timestamp:        Fri Mar 01 05:55:54 2013 (513034DA)
    CheckSum:         0006BE49
    ImageSize:        00068000
    File version:     6.2.9200.16547
    Product version:  6.2.9200.16547
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     fwpkclnt.sys
    OriginalFilename: fwpkclnt.sys
    ProductVersion:   6.2.9200.16547
    FileVersion:      6.2.9200.16547 (win8_gdr.130228-1507)
    FileDescription:  FWP/IPsec Kernel-Mode API
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa8012c16700, The pool entry we were looking for within the page.
Arg3: fffffa8012c16720, The next pool entry.
Arg4: 0000000004020012, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80181b5d168
GetUlongFromAddress: unable to read from fffff80181b5d1f8
 fffffa8012c16700 Nonpaged pool

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80181a77ba9 to fffff8018185f440

STACK_TEXT:  
fffff880`0a2304c8 fffff801`81a77ba9 : 00000000`00000019 00000000`00000020 fffffa80`12c16700 fffffa80`12c16720 : nt!KeBugCheckEx
fffff880`0a2304d0 fffff880`01d2d3b2 : fffffa80`12c16710 00000000`00000012 fffff880`0a2306b0 00000000`676e7049 : nt!ExFreePool+0xadb
fffff880`0a2305b0 fffff880`01e832ac : fffffa80`13512540 fffff801`81a754d4 00000000`00000000 00000000`00000000 : tcpip!IppInspectBuildHeaders+0x5f2
fffff880`0a2308a0 fffff880`0aaa782f : fffff880`0a230aa0 fffff880`00000014 fffff880`0a230af0 fffff880`0a2309c0 : fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+0x1dc
fffff880`0a230950 fffff880`0a230aa0 : fffff880`00000014 fffff880`0a230af0 fffff880`0a2309c0 fffff880`0a230a50 : nldrv+0xf82f
fffff880`0a230958 fffff880`00000014 : fffff880`0a230af0 fffff880`0a2309c0 fffff880`0a230a50 fffff880`00000006 : 0xfffff880`0a230aa0
fffff880`0a230960 fffff880`0a230af0 : fffff880`0a2309c0 fffff880`0a230a50 fffff880`00000006 00000000`00000000 : 0xfffff880`00000014
fffff880`0a230968 fffff880`0a2309c0 : fffff880`0a230a50 fffff880`00000006 00000000`00000000 00000000`00000000 : 0xfffff880`0a230af0
fffff880`0a230970 fffff880`0a230a50 : fffff880`00000006 00000000`00000000 00000000`00000000 fffffa80`00000000 : 0xfffff880`0a2309c0
fffff880`0a230978 fffff880`00000006 : 00000000`00000000 00000000`00000000 fffffa80`00000000 00000000`00000000 : 0xfffff880`0a230a50
fffff880`0a230980 00000000`00000000 : 00000000`00000000 fffffa80`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`00000006


STACK_COMMAND:  kb

FOLLOWUP_IP: 
fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1dc
fffff880`01e832ac 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  fwpkclnt!FwpsConstructIpHeaderForTransportPacket0+1dc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fwpkclnt

IMAGE_NAME:  fwpkclnt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  513034da

BUCKET_ID_FUNC_OFFSET:  1dc

FAILURE_BUCKET_ID:  0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0

BUCKET_ID:  0x19_20_fwpkclnt!FwpsConstructIpHeaderForTransportPacket0

Followup: MachineOwner
---------

4: kd> lmvm fwpkclnt
start             end                 module name
fffff880`01e6d000 fffff880`01ed5000   fwpkclnt   (private pdb symbols)  c:\symbols\fwpkclnt.pdb\69E5349BA22044E6B568EFE6CCBC4C692\fwpkclnt.pdb
    Loaded symbol image file: fwpkclnt.sys
    Mapped memory image file: c:\symbols\fwpkclnt.sys\513034DA68000\fwpkclnt.sys
    Image path: \SystemRoot\System32\drivers\fwpkclnt.sys
    Image name: fwpkclnt.sys
    Timestamp:        Fri Mar 01 05:55:54 2013 (513034DA)
    CheckSum:         0006BE49
    ImageSize:        00068000
    File version:     6.2.9200.16547
    Product version:  6.2.9200.16547
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     fwpkclnt.sys
    OriginalFilename: fwpkclnt.sys
    ProductVersion:   6.2.9200.16547
    FileVersion:      6.2.9200.16547 (win8_gdr.130228-1507)
    FileDescription:  FWP/IPsec Kernel-Mode API
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

MagicAndre1981 · 1. November 2013

was ist der Treiber nldrv.sys?

Lajiola · 1. November 2013

Mahlzeit,

nldrv.sys gehört zu Netlimiter http://www.netlimiter.com/, die neuste Test Version war wohl der Auslöser, die vorigere Version lief ohne Probleme.

Das Problem mit den Passwörtern lag wohl daran das CC Cleaner den Reg Eintrag "Protected storage system" entfernt hat, nachdem ich diesen Wiederherstellen konnte läuft auch das wieder.

Problem kann also als gelöst angesehen werden.

Suche

Bluescreen Windows 8 erzeugt durch fwpkclnt.sys

Lajiola

Lt. Junior Grade

MagicAndre1981

Admiral

Lajiola

Lt. Junior Grade

Ähnliche Themen

Passend zum Thema

Wer erinnert sich? Heute vor 25 Jahren erschien Windows 2000 alias „NT 5.0“

Noch nicht ausgestorben Heute vor 10 Jahren erhielt Windows XP das letzte Update

Windows Update Neues Projekt bringt Windows 95 bis XP auf den neusten Stand