Blue Screen of Death - fltmgr.sys

HelpMyPro · 02 Nov 2012

Recent I have got 2 BSOD, they are all related to fltmgr.sys, I don't know how to make it stop happening. Please help!

The required files have been zipped up and uploaded.

==================================================
Dump File : 110112-22152-01.dmp
Crash Time : 1/11/2012 9:41:05 p.m.
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x00000050
Parameter 1 : fffffa80`081c5066
Parameter 2 : 00000000`00000000
Parameter 3 : fffff880`02c5c5ae
Parameter 4 : 00000000`00000000
Caused By Driver : fltmgr.sys
Caused By Address : fltmgr.sys+22b00
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+705c0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\110112-22152-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7600
Dump File Size : 262,144
==================================================

==================================================
Dump File : 110212-22105-01.dmp
Crash Time : 2/11/2012 7:22:43 p.m.
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x00000050
Parameter 1 : fffffa80`183e6052
Parameter 2 : 00000000`00000000
Parameter 3 : fffff880`018f45ae
Parameter 4 : 00000000`00000000
Caused By Driver : fltmgr.sys
Caused By Address : fltmgr.sys+22b00
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+705c0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\110212-22105-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 7600
Dump File Size : 262,144
==================================================

Arc · 02 Nov 2012

Welcome aboard.

It is (both of the crashes you supplied) crashed by ESet NOD32 antivirus system monitor driver.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80081c5066, 0, fffff88002c5c5ae, 0}

*** WARNING: Unable to verify timestamp for eamonm.sys
*** ERROR: Module load completed but symbols could not be loaded for eamonm.sys

Could not read faulting driver name
Probably caused by : eamonm.sys ( eamonm+75ae )

Followup: MachineOwner
---------

Driver Reference Table - eamon.sys

Uninstall Eset, use Microsoft Security Essentials - Microsoft Windows.

Let us know the results.

marsmimar · 02 Nov 2012

Hello HelpMyPro and welcome to Seven Forums.

Fltmgr.sys is a Windows driver and an essential part of the operating system. Your computer is also showing a problem with eamonm.sys. This file most often belongs to ESET Smart Security with the specific description of Amon monitor. Do you now have, or have you ever had, ESET installed on your machine?

I'd try restoring your computer to a date/time prior to the first BSOD using a system restore point.

System Restore

Next, I would remove ESET (if it is installed) using the official ESET uninstall instructions. Even if you previously removed ESET, if you didn't follow their uninstall instructions, you may have remnants left behind that are contributing to the BDODs. Once the computer is stable you can reinstall ESET if you so desire.

How do I manually uninstall my Windows ESET security product? - ESET Knowledgebase

Download Antivirus Solutions for Home | Download | ESET

Now that the computer has been rolled back to a previous restore point and ESET has been removed, I'd check for damaged or corrupt system files by running a system file checker scan from an elevated command prompt (option two.) If any problems are found, run the scan 3 times and reboot your computer after each scan. NOTE: You do not have to be connected to the internet to run the SFC so no anti-malware product is needed at this point.

SFC /SCANNOW Command - System File Checker

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80183e6052, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880018f45ae, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf90e0
 fffffa80183e6052 

FAULTING_IP: 
eamonm+75ae
fffff880`018f45ae 66837c41fe5c    cmp     word ptr [rcx+rax*2-2],5Ch

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88006046560 -- (.trap 0xfffff88006046560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000140 rbx=0000000000000000 rcx=fffffa80183e5dd4
rdx=0000000000000280 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880018f45ae rsp=fffff880060466f0 rbp=fffffa800aa7a1f0
 r8=fffffa80130d7c10  r9=fffff80002c3be80 r10=fffffa8003a10640
r11=fffffa80045b3060 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
eamonm+0x75ae:
fffff880`018f45ae 66837c41fe5c    cmp     word ptr [rcx+rax*2-2],5Ch ds:0104:fffffa80`183e6052=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b41bf4 to fffff80002ac25c0

STACK_TEXT:  
fffff880`060463f8 fffff800`02b41bf4 : 00000000`00000050 fffffa80`183e6052 00000000`00000000 fffff880`06046560 : nt!KeBugCheckEx
fffff880`06046400 fffff800`02ac06ae : 00000000`00000000 00000000`00000104 fffffa80`052dc300 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x41d37
fffff880`06046560 fffff880`018f45ae : fffffa80`039c9800 fffff800`02dd43c3 00000000`00000fec fffff880`018f2f5a : nt!KiPageFault+0x16e
fffff880`060466f0 fffffa80`039c9800 : fffff800`02dd43c3 00000000`00000fec fffff880`018f2f5a fffffa80`00000009 : eamonm+0x75ae
fffff880`060466f8 fffff800`02dd43c3 : 00000000`00000fec fffff880`018f2f5a fffffa80`00000009 fffff880`060467d0 : 0xfffffa80`039c9800
fffff880`06046700 fffffa80`0539f2f8 : fffffa80`045bae10 00000000`00000000 fffffa80`0539f2e0 fffffa80`0539f2f8 : nt!IopCloseFile+0x1f3
fffff880`06046790 fffffa80`045bae10 : 00000000`00000000 fffffa80`0539f2e0 fffffa80`0539f2f8 fffff880`06046a10 : 0xfffffa80`0539f2f8
fffff880`06046798 00000000`00000000 : fffffa80`0539f2e0 fffffa80`0539f2f8 fffff880`06046a10 fffffa80`053a5950 : 0xfffffa80`045bae10


STACK_COMMAND:  kb

FOLLOWUP_IP: 
eamonm+75ae
fffff880`018f45ae 66837c41fe5c    cmp     word ptr [rcx+rax*2-2],5Ch

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  eamonm+75ae

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: eamonm

IMAGE_NAME:  eamonm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4fd9f4c4

FAILURE_BUCKET_ID:  X64_0x50_eamonm+75ae

BUCKET_ID:  X64_0x50_eamonm+75ae

Followup: MachineOwner

EDIT: Looks like Archie (Arc) beat me by a few minutes. :)