New
#1
bad_pool_caller crash: dump file attached
I tried reading this file to get information but i could not read the symbols that came up when i opened it, asking for some assistance please
I tried reading this file to get information but i could not read the symbols that came up when i opened it, asking for some assistance please
Looks like a file information request passed through ESET (eamon), into Acronis, and then blew up:
At this point it's an educated guess, but does removing (completely) ESET and/or Acronis resolve the issue? One of them did this, but without the IRP and file, I can't tell which.Code:3: kd> kn # ChildEBP RetAddr 00 9e933668 8b99ff3b nt!FsRtlLookupPerStreamContextInternal+0x9a 01 9e9336ac 8b9993f0 fltmgr!FltpGetStreamListCtrl+0x5b 02 9e9336c8 8b9d16da fltmgr!FltGetStreamContext+0x1a 03 9e9336f8 8b9d1e24 fileinfo!FIStreamGet+0x36 04 9e933738 8b998324 fileinfo!FIPostCreateCallback+0xb8 05 9e9337a0 8b99b512 fltmgr!FltpPerformPostCallbacks+0x24a 06 9e9337b4 8b99bb46 fltmgr!FltpProcessIoCompletion+0x10 07 9e9337c4 8b99c29c fltmgr!FltpPassThroughCompletion+0x98 08 9e9337f4 8b9af8c9 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x33a 09 9e933840 82a894bc fltmgr!FltpCreate+0x2db 0a 9e933858 8c013fce nt!IofCallDriver+0x63 WARNING: Stack unwind information not available. Following frames may be wrong. 0b 9e9338ec 8b99c20c tdrpm251+0x9fce 0c 9e933910 8b9af8c9 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa 0d 9e93395c 82a894bc fltmgr!FltpCreate+0x2db 0e 9e933974 8242b884 nt!IofCallDriver+0x63 0f 9e9339b0 82a894bc eamon+0x5884 10 9e9339c8 82c8d6ad nt!IofCallDriver+0x63 11 9e933aa0 82c6e26b nt!IopParseDevice+0xed7 12 9e933b1c 82c942d9 nt!ObpLookupObjectName+0x4fa 13 9e933b78 82cafcfa nt!ObOpenObjectByName+0x165 // Can't tell what the file or IRP was because this is a minidump: 3: kd> dc 85d7cce0 L1 85d7cce0 ???????? ???? 3: kd> lmvm tdrpm251 start end module name 8c00a000 8c0e4b00 tdrpm251 T (no symbols) Loaded symbol image file: tdrpm251.sys Image path: \SystemRoot\system32\DRIVERS\tdrpm251.sys Image name: tdrpm251.sys Timestamp: Fri Jul 31 10:00:11 2009 (4A72F8EB) CheckSum: 000E0563 ImageSize: 000DAB00 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 3: kd> lmvm eamon start end module name 82426000 824f2000 eamon T (no symbols) Loaded symbol image file: eamon.sys Image path: \SystemRoot\system32\DRIVERS\eamon.sys Image name: eamon.sys Timestamp: Fri Sep 11 01:12:15 2009 (4AA9DC2F) CheckSum: 00029B5C ImageSize: 000CC000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
ok let me try taking acronis out and see what happens
what info would i need to tell which one did it though? and thanks a lot for the reply