Windows XP SP3 crashing with ESET Smart Security

Discussion in 'ESET Smart Security' started by sumako, Mar 2, 2009.

Thread Status:
Not open for further replies.
  1. sumako

    sumako Registered Member

    Joined:
    Jan 21, 2009
    Posts:
    1
    OS: Windows XP Pro SP3
    ESET Smart Security 3.0.684

    My system crashed randomly during BT.


    Use !analyze -v to get detailed debugging information.

    BugCheck 100000D1, {0, 2, 1, 890408ea}

    Unable to load image epfw.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for epfw.sys
    *** ERROR: Module load completed but symbols could not be loaded for epfw.sys
    Probably caused by : epfw.sys ( epfw+8014 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 890408ea, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: 00000000

    CURRENT_IRQL: 2

    FAULTING_IP:
    +ffffffff890408ea
    890408ea f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    PROCESS_NAME: utorrent.exe

    LAST_CONTROL_TRANSFER: from 890219f3 to 890408ea

    SYMBOL_ON_RAW_STACK: 1

    STACK_ADDR_RAW_STACK_SYMBOL: ffffffffa6203618

    STACK_COMMAND: dds A6203618-0x20 ; kb

    STACK_TEXT:
    a62035f8 8a98d644
    a62035fc a6203600
    a6203600 8abbda4a
    a6203604 894f3628
    a6203608 894f47a8
    a620360c 00000000
    a6203610 a6203630
    a6203614 a68d9014 epfw+0x8014
    a6203618 00002711
    a620361c 8abbda4e
    a6203620 0000000c
    a6203624 8abbda5a
    a6203628 00000008
    a620362c a6203674
    a6203630 a6203690
    a6203634 a68d2220 epfw+0x1220
    a6203638 894f3630
    a620363c a68dc04f epfw+0xb04f
    a6203640 894f3628
    a6203644 a6203690
    a6203648 8901f705
    a620364c 8a98d63c
    a6203650 a62038cc
    a6203654 a62038c0
    a6203658 a62038c0
    a620365c a620371c
    a6203660 894f47a8
    a6203664 a6203688
    a6203668 00000000
    a620366c 8ad20008
    a6203670 894f3628
    a6203674 a62036b8


    FOLLOWUP_IP:
    epfw+8014
    a68d9014 ?? o_O

    SYMBOL_NAME: epfw+8014

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: epfw

    IMAGE_NAME: epfw.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 490213de

    FAILURE_BUCKET_ID: 0xD1_W_epfw+8014

    BUCKET_ID: 0xD1_W_epfw+8014

    Followup: MachineOwner
    ---------

    1: kd> lmvm epfw
    start end module name
    a68d1000 a68e5000 epfw T (no symbols)
    Loaded symbol image file: epfw.sys
    Image path: epfw.sys
    Image name: epfw.sys
    Timestamp: Sat Oct 25 02:28:46 2008 (490213DE)
    CheckSum: 0002031E
    ImageSize: 00014000
    Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
     
    Last edited: Mar 2, 2009
  2. nonoise

    nonoise Registered Member

    Joined:
    Jun 6, 2008
    Posts:
    322
    try v4 :D
     
Thread Status:
Not open for further replies.