Joey J Miguel
New Member
- Joined
- Mar 13, 2011
- Messages
- 18
Unable to load image \SystemRoot\system32\DRIVERS\eamon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsNonCachedIo+8e )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88003192da8
Arg3: fffff88003192610
Arg4: fffff8800125ceae
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88003192da8 -- (.exr 0xfffff88003192da8)
ExceptionAddress: fffff8800125ceae (Ntfs!NtfsNonCachedIo+0x000000000000008e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88003192610 -- (.cxr 0xfffff88003192610)
rax=0000000000000002 rbx=0000000000000280 rcx=fffff8a00c2e85e0
rdx=fffffa80047cfbd0 rsi=0000000000000000 rdi=fffff8a00c2e8710
rip=fffff8800125ceae rsp=fffff88003192fe0 rbp=fffff88003193030
r8=0000000000000002 r9=0000000000000004 r10=ffbffa8004776180
r11=fffff88003193110 r12=fffff88003193350 r13=fffff88003193350
r14=fffff8a00c2e85e0 r15=fffffa80047cfbd0
iopl=0 nv up ei pl nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
Ntfs!NtfsNonCachedIo+0x8e:
fffff880`0125ceae 49039aa8020000 add rbx,qword ptr [r10+2A8h] ds:002b:ffbffa80`04776428=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b090e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsNonCachedIo+8e
fffff880`0125ceae 49039aa8020000 add rbx,qword ptr [r10+2A8h]
FAULTING_IP:
Ntfs!NtfsNonCachedIo+8e
fffff880`0125ceae 49039aa8020000 add rbx,qword ptr [r10+2A8h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff88001263a12 to fffff8800125ceae
STACK_TEXT:
fffff880`03192fe0 fffff880`01263a12 : fffff880`03193350 fffffa80`047cfbd0 00000003`f260315a 00000000`00000a00 : Ntfs!NtfsNonCachedIo+0x8e
fffff880`03193160 fffff880`01268413 : fffff880`03193350 fffffa80`047cfbd0 fffff880`03193501 fffff880`03193501 : Ntfs!NtfsCommonWrite+0x872
fffff880`03193320 fffff880`010b823f : fffffa80`047cff70 fffffa80`047cfbd0 fffffa80`047dec30 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`031935a0 fffff880`010b66df : fffffa80`05e20760 fffffa80`069ab5a0 fffffa80`05e20700 fffffa80`047cfbd0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`03193630 fffff880`026eeb07 : fffffa80`047cfbd0 fffff880`02f63180 fffff8a0`0c2f4018 fffff880`03193840 : fltmgr!FltpDispatch+0xcf
fffff880`03193690 fffffa80`047cfbd0 : fffff880`02f63180 fffff8a0`0c2f4018 fffff880`03193840 fffffa80`036fb1a0 : eamon+0x5b07
fffff880`03193698 fffff880`02f63180 : fffff8a0`0c2f4018 fffff880`03193840 fffffa80`036fb1a0 00000000`00000001 : 0xfffffa80`047cfbd0
fffff880`031936a0 fffff8a0`0c2f4018 : fffff880`03193840 fffffa80`036fb1a0 00000000`00000001 fffffa80`069ab5a0 : 0xfffff880`02f63180
fffff880`031936a8 fffff880`03193840 : fffffa80`036fb1a0 00000000`00000001 fffffa80`069ab5a0 fffff800`028c02ff : 0xfffff8a0`0c2f4018
fffff880`031936b0 fffffa80`036fb1a0 : 00000000`00000001 fffffa80`069ab5a0 fffff800`028c02ff fffffa80`047cfbd0 : 0xfffff880`03193840
fffff880`031936b8 00000000`00000001 : fffffa80`069ab5a0 fffff800`028c02ff fffffa80`047cfbd0 fffff800`028bf987 : 0xfffffa80`036fb1a0
fffff880`031936c0 fffffa80`069ab5a0 : fffff800`028c02ff fffffa80`047cfbd0 fffff800`028bf987 fffffa80`0480dae0 : 0x1
fffff880`031936c8 fffff800`028c02ff : fffffa80`047cfbd0 fffff800`028bf987 fffffa80`0480dae0 fffffa80`0480d990 : 0xfffffa80`069ab5a0
fffff880`031936d0 fffff800`028bf987 : 00000000`00000000 fffff880`03193c58 fffffa80`01e15540 00000000`00000000 : nt!IoSynchronousPageWrite+0x24f
fffff880`03193750 fffff800`028bd804 : fffff8a0`0c2f4010 fffff8a0`0c2f4018 fffffa80`043fad90 fffffa80`043fad90 : nt!MiFlushSectionInternal+0xa58
fffff880`03193990 fffff800`028bd259 : 00000000`00003d89 00000000`00000000 00000000`00001000 00000000`00000000 : nt!MmFlushSection+0xa4
fffff880`03193a50 fffff800`028c494b : fffffa80`047f0d68 fffff800`00000001 00000000`00000001 fffffa80`00001000 : nt!CcFlushCache+0x5e9
fffff880`03193b50 fffff800`028c5520 : fffff800`02ad8100 fffff880`03193c58 00000000`00000000 fffff800`00000000 : nt!CcWriteBehind+0x1eb
fffff880`03193c00 fffff800`028de961 : fffffa80`036ead60 fffff880`012d5230 fffff800`02ad8140 fffff800`00000002 : nt!CcWorkerThread+0x1c8
fffff880`03193cb0 fffff800`02b747c6 : 0000050e`00000000 fffffa80`036fb1a0 00000000`00000080 fffffa80`036d1040 : nt!ExpWorkerThread+0x111
fffff880`03193d40 fffff800`028afc26 : fffff880`02f63180 fffffa80`036fb1a0 fffff880`02f6dfc0 0000050e`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03193d80 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`03192ce0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsNonCachedIo+8e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88003192610 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsNonCachedIo+8e
BUCKET_ID: X64_0x24_Ntfs!NtfsNonCachedIo+8e
Followup: MachineOwner
.................Captain Jack said:You could install Microsoft Security Essentials instead.