0x000003B problem

kennymoody · 14 Dec 2015

Hi Golden

we have the same problem with 0x000003B , Lenovo M73 ( not E ) , Win7 64Bit SP1 and NOD32 anti-virus

I have downloaded sat2 minidump and have a look by using bluescreenview
and I found out that I have that same error with him

I am wondering what tools you are using to check the result to find out that "ehdrv.sys" cause the problem ?
so that I can also have a look to my minidump to confirm it ?

This 0x000003B problem should be come after the latest windows update ....
two computer is still testing the problem in our office , one with NOD32 version 9 , and one without NOD32

Thanks so much

Regards,
Kenny

kennymoody · 15 Dec 2015

I have the same 0x000003B BSOD as this post this few days

seems that the problem is due to the NOD32 anti-virus ,
I have tried NOD32 Version 7 , 8 , 9 , it remains the same

attached please find the minidump of 2 of our PC that have the same 3B BSOD problem

Attachment 377915

Attachment 377916

Thanks so much !

Golden · 15 Dec 2015

For each Pc, do this:

1. Download the DM Log Collector application to your desktop by clicking the link below

DM Log Collector.exe

2. Run it by double-clicking the icon on your desktop, and follow the prompts.
3. Locate the .ZIP file that is created on your desktop, and upload it here in your next reply.

kennymoody · 15 Dec 2015

Hi Golden,

here you are , 2 of our PC

I have around 7 PC ( more and more coming .....

) at different location got the same BSOD , I am trying to remove the NOD32 and install MSE to solve the problem

Attachment 377918

Attachment 377919

Thanks Golden !

Golden · 15 Dec 2015

Both suffer from the same issue....ESET Nod32

Code:

fffff880`03f65ee8  fffff880`05320158Unable to load image \SystemRoot\system32\DRIVERS\ehdrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ehdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys
 ehdrv+0x1e158
fffff880`03f65ef0  fffffa80`00002134
fffff880`03f65ef8  fffff880`03f661f0
fffff880`03f65f00  fffff880`03f67be0
fffff880`03f65f08  fffff800`04651000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`03f65f10  fffff800`0481939c nt!TraceLoggingMetadataEnd+0x9322
fffff880`03f65f18  fffff880`03f66470
fffff880`03f65f20  00000000`00000000
fffff880`03f65f28  fffff800`048d8990 nt!BBTBuffer <PERF> (nt+0x287990)
fffff880`03f65f30  fffff880`03f68000
fffff880`03f65f38  fffff880`03f5f000
fffff880`03f65f40  00000000`00000000
fffff880`03f65f48  fffffa80`036fc660
fffff880`03f65f50  fffff800`046c3ed3 nt!KiSystemServiceCopyEnd+0x13
fffff880`03f65f58  fffff800`04651000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`03f65f60  fffff800`048d8990 nt!BBTBuffer <PERF> (nt+0x287990)
fffff880`03f65f68  fffff880`03f67be0
fffff880`03f65f70  00000014`00000000
fffff880`03f65f78  fffff880`03f65fa0
fffff880`03f65f80  fffff800`046c3ac0 nt!KiSystemServiceHandler
fffff880`03f65f88  fffff800`0481939c nt!TraceLoggingMetadataEnd+0x9322
fffff880`03f65f90  fffff880`03f66470
fffff880`03f65f98  fffffa80`00000000
fffff880`03f65fa0  00000000`00000034
fffff880`03f65fa8  fffffa80`07101091Unable to load image C:\Program Files\ESET\ESET NOD32 Antivirus\em018_64.dat, Win32 error 0n2
*** WARNING: Unable to verify timestamp for em018_64.dat
*** ERROR: Module load completed but symbols could not be loaded for em018_64.dat
 em018_64+0xe091

Check that the network drivers are up-to-date. If they are, and the BSOD persist, replace ESET with MSE and monitor for further BSOD's.

kennymoody · 15 Dec 2015

Thanks Golden

I confirmed that the problem is due to NOD32 , I made contact with ESET to find the solution .

also with the tutorials in "https://www.tenforums.com/tutorials/5558-windbg-basics-debugging-crash-dumps-windows-10-a.html"

I know how to show the same result as you also , thanks so much !!! Very nice tutorial !