bad_pool_caller crash: dump file attached

[keith burke]

I tried reading this file to get information but i could not read the symbols that came up when i opened it, asking for some assistance please

 

[cluberti]

Looks like a file information request passed through ESET (eamon), into Acronis, and then blew up:

3: kd> kn
 # ChildEBP RetAddr  
00 9e933668 8b99ff3b nt!FsRtlLookupPerStreamContextInternal+0x9a
01 9e9336ac 8b9993f0 fltmgr!FltpGetStreamListCtrl+0x5b
02 9e9336c8 8b9d16da fltmgr!FltGetStreamContext+0x1a
03 9e9336f8 8b9d1e24 fileinfo!FIStreamGet+0x36
04 9e933738 8b998324 fileinfo!FIPostCreateCallback+0xb8
05 9e9337a0 8b99b512 fltmgr!FltpPerformPostCallbacks+0x24a
06 9e9337b4 8b99bb46 fltmgr!FltpProcessIoCompletion+0x10
07 9e9337c4 8b99c29c fltmgr!FltpPassThroughCompletion+0x98
08 9e9337f4 8b9af8c9 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x33a
09 9e933840 82a894bc fltmgr!FltpCreate+0x2db
0a 9e933858 8c013fce nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
0b 9e9338ec 8b99c20c tdrpm251+0x9fce
0c 9e933910 8b9af8c9 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
0d 9e93395c 82a894bc fltmgr!FltpCreate+0x2db
0e 9e933974 8242b884 nt!IofCallDriver+0x63
0f 9e9339b0 82a894bc eamon+0x5884
10 9e9339c8 82c8d6ad nt!IofCallDriver+0x63
11 9e933aa0 82c6e26b nt!IopParseDevice+0xed7
12 9e933b1c 82c942d9 nt!ObpLookupObjectName+0x4fa
13 9e933b78 82cafcfa nt!ObOpenObjectByName+0x165

// Can't tell what the file or IRP was because this is a minidump:
3: kd> dc 85d7cce0 L1
85d7cce0  ????????                             ????

3: kd> lmvm tdrpm251
start    end        module name
8c00a000 8c0e4b00   tdrpm251 T (no symbols)           
    Loaded symbol image file: tdrpm251.sys
    Image path: \SystemRoot\system32\DRIVERS\tdrpm251.sys
    Image name: tdrpm251.sys
    Timestamp:        Fri Jul 31 10:00:11 2009 (4A72F8EB)
    CheckSum:         000E0563
    ImageSize:        000DAB00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

3: kd> lmvm eamon
start    end        module name
82426000 824f2000   eamon    T (no symbols)           
    Loaded symbol image file: eamon.sys
    Image path: \SystemRoot\system32\DRIVERS\eamon.sys
    Image name: eamon.sys
    Timestamp:        Fri Sep 11 01:12:15 2009 (4AA9DC2F)
    CheckSum:         00029B5C
    ImageSize:        000CC000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

At this point it's an educated guess, but does removing (completely) ESET and/or Acronis resolve the issue? One of them did this, but without the IRP and file, I can't tell which.

 

[keith burke]

ok let me try taking acronis out and see what happens

 

[keith burke]

what info would i need to tell which one did it though? and thanks a lot for the reply

 

[cluberti]

Ar least a kernel dump, so as to see the actual irp and fsobject being worked on.