Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\122410-80465-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x8280b000 PsLoadedModuleList = 0x8294a570
Debug session time: Fri Dec 24 03:02:46.490 2010 (UTC - 5:00)
System Uptime: 0 days 7:35:33.957
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {33007e18, 2, 0, 9002f031}
Unable to load image \SystemRoot\system32\DRIVERS\eamonm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamonm.sys
*** ERROR: Module load completed but symbols could not be loaded for eamonm.sys
Probably caused by : eamonm.sys ( eamonm+7031 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 33007e18, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 9002f031, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 8296a700
Unable to read MiSystemVaType memory at 8294a0c0
33007e18
CURRENT_IRQL: 2
FAULTING_IP:
eamonm+7031
9002f031 83791800 cmp dword ptr [ecx+18h],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: TrustedInstall
TRAP_FRAME: af7cb73c -- (.trap 0xffffffffaf7cb73c)
ErrCode = 00000000
eax=00000000 ebx=85bfcbb0 ecx=33007e00 edx=0000003e esi=90086f54 edi=000010dc
eip=9002f031 esp=af7cb7b0 ebp=af7cb824 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
eamonm+0x7031:
9002f031 83791800 cmp dword ptr [ecx+18h],0 ds:0023:33007e18=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 9002f031 to 82843b7b
STACK_TEXT:
af7cb73c 9002f031 badb0d00 0000003e af7cb758 nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
af7cb824 888dbaeb d5d0bbd8 af7cb844 af7cb870 eamonm+0x7031
af7cb890 888de9f0 af7cb8d4 d5a3e008 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
af7cb8a8 888f21fe af7cb8d4 888f5f3c 00000000 fltmgr!FltpPassThroughInternal+0x40
af7cb8bc 888f28b7 af7cb8d4 d5a3e008 85db6520 fltmgr!FltpCreateInternal+0x24
af7cb900 82839f44 855d3020 855d9ae0 85db657c fltmgr!FltpCreate+0x2c9
af7cb918 82a0d7ad 8d6a9bc0 af7cbac0 00000000 nt!IofCallDriver+0x63
af7cb9f0 82a10988 85545bb0 856c83c0 8562cd20 nt!IopParseDevice+0xed7
af7cba6c 82a4f354 00000000 af7cbac0 00000240 nt!ObpLookupObjectName+0x4fa
af7cbacc 82a0ad4e af7cbc30 846c83c0 af7cbb00 nt!ObOpenObjectByName+0x165
af7cbb48 82a52060 af7cbbf8 00100002 af7cbc30 nt!IopCreateFile+0x673
af7cbba4 82a7c250 af7cbbf8 00100002 af7cbc30 nt!IoCreateFileEx+0x9e
af7cbc70 82a42b53 af7cbce4 d5995b08 d5be1678 nt!IopOpenLinkOrRenameTarget+0x12f
af7cbd18 8284079a 00006398 01c6f328 08039170 nt!NtSetInformationFile+0x967
af7cbd18 77c164f4 00006398 01c6f328 08039170 nt!KiFastCallEntry+0x12a
01c6f2d8 00000000 00000000 00000000 00000000 0x77c164f4
STACK_COMMAND: kb
FOLLOWUP_IP:
eamonm+7031
9002f031 83791800 cmp dword ptr [ecx+18h],0
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: eamonm+7031
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: eamonm
IMAGE_NAME: eamonm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c18e21e
FAILURE_BUCKET_ID: 0xD1_eamonm+7031
BUCKET_ID: 0xD1_eamonm+7031
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\122410-50435-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x8281d000 PsLoadedModuleList = 0x8295c570
Debug session time: Fri Dec 24 03:38:18.740 2010 (UTC - 5:00)
System Uptime: 0 days 0:34:35.833
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {1018, 2, 0, 8f014031}
Unable to load image \SystemRoot\system32\DRIVERS\eamonm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamonm.sys
*** ERROR: Module load completed but symbols could not be loaded for eamonm.sys
Probably caused by : eamonm.sys ( eamonm+7031 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00001018, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8f014031, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 8297c700
Unable to read MiSystemVaType memory at 8295c0c0
00001018
CURRENT_IRQL: 2
FAULTING_IP:
eamonm+7031
8f014031 83791800 cmp dword ptr [ecx+18h],0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: TrustedInstall
TRAP_FRAME: b0e6073c -- (.trap 0xffffffffb0e6073c)
ErrCode = 00000000
eax=00000000 ebx=8520c478 ecx=00001000 edx=0000001e esi=8f06bf54 edi=000015a4
eip=8f014031 esp=b0e607b0 ebp=b0e60824 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
eamonm+0x7031:
8f014031 83791800 cmp dword ptr [ecx+18h],0 ds:0023:00001018=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 8f014031 to 82855b7b
STACK_TEXT:
b0e6073c 8f014031 badb0d00 0000001e b0e60758 nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
b0e60824 888e1aeb b3761a18 b0e60844 b0e60870 eamonm+0x7031
b0e60890 888e49f0 b0e608d4 8554aa58 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
b0e608a8 888f81fe b0e608d4 888fbf3c 00000000 fltmgr!FltpPassThroughInternal+0x40
b0e608bc 888f88b7 b0e608d4 8554aa58 84de46e8 fltmgr!FltpCreateInternal+0x24
b0e60900 8284bf44 8560a350 85613630 84de4744 fltmgr!FltpCreate+0x2c9
b0e60918 82a1f7ad 9540f66b b0e60ac0 00000000 nt!IofCallDriver+0x63
b0e609f0 82a22988 85571e20 856d73c0 84a2f5a8 nt!IopParseDevice+0xed7
b0e60a6c 82a61354 00000000 b0e60ac0 00000240 nt!ObpLookupObjectName+0x4fa
b0e60acc 82a1cd4e b0e60c30 846d73c0 b0e60b00 nt!ObOpenObjectByName+0x165
b0e60b48 82a64060 b0e60bf8 00100002 b0e60c30 nt!IopCreateFile+0x673
b0e60ba4 82a8e250 b0e60bf8 00100002 b0e60c30 nt!IoCreateFileEx+0x9e
b0e60c70 82a54b53 b0e60ce4 d24a6730 86dcd158 nt!IopOpenLinkOrRenameTarget+0x12f
b0e60d18 8285279a 00006388 00eff444 07e46680 nt!NtSetInformationFile+0x967
b0e60d18 778e64f4 00006388 00eff444 07e46680 nt!KiFastCallEntry+0x12a
00eff3f4 00000000 00000000 00000000 00000000 0x778e64f4
STACK_COMMAND: kb
FOLLOWUP_IP:
eamonm+7031
8f014031 83791800 cmp dword ptr [ecx+18h],0
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: eamonm+7031
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: eamonm
IMAGE_NAME: eamonm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c18e21e
FAILURE_BUCKET_ID: 0xD1_eamonm+7031
BUCKET_ID: 0xD1_eamonm+7031
Followup: MachineOwner
---------