ESET Smart Security 3.0667与WindowsXP Sp3冲突

今天升级了nod32 2.7到新的所谓的3.0安全套装,的确功能强大,资源占用也少,特别是垃圾邮件扫描,实在强悍的很!

可惜今天关机时出现蓝屏,用Windbg分析如下,发现果然是nod32导致的问题。

看来nod32 与Windows XP SP3的确有轻微的不兼容情况出现,以前用的MACfee,1年多从未出现过类似情况,可是用了nod32,它的功能实在好的很,有这个毛病,但好在几天了又没出现过了,估计是开发程序debug有关。现在忍了,如果再出现,就回到2.7时代吧。

分析日志记录下来,以备日后查阅。

《ESET Smart Security 3.0667与WindowsXP Sp3冲突》

 

 

 

Microsoft (R) Windows Debugger Version 6.7.0005.0

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini021209-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720

Debug session time: Thu Feb 12 16:58:49.921 2009 (GMT+8)

System Uptime: 0 days 9:02:58.661

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

………………………………………………………………………………………………………………………………………….

Loading User Symbols

Loading unloaded module list

……………………..

Unable to load image eamon.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for eamon.sys

*** ERROR: Module load completed but symbols could not be loaded for eamon.sys

Unable to load image FILEM.SYS, Win32 error 0n2

*** WARNING: Unable to verify timestamp for FILEM.SYS

*** ERROR: Module load completed but symbols could not be loaded for FILEM.SYS

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, a9248f94, b3272a94, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Probably caused by : eamon.sys ( eamon+4f94 )

Followup: MachineOwner

———

Microsoft (R) Windows Debugger Version 6.7.0005.0

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini021209-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720

Debug session time: Thu Feb 12 16:58:49.921 2009 (GMT+8)

System Uptime: 0 days 9:02:58.661

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

………………………………………………………………………………………………………………………………………….

Loading User Symbols

Loading unloaded module list

……………………..

Unable to load image eamon.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for eamon.sys

*** ERROR: Module load completed but symbols could not be loaded for eamon.sys

Unable to load image FILEM.SYS, Win32 error 0n2

*** WARNING: Unable to verify timestamp for FILEM.SYS

*** ERROR: Module load completed but symbols could not be loaded for FILEM.SYS

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, a9248f94, b3272a94, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Probably caused by : eamon.sys ( eamon+4f94 )

Followup: MachineOwner

———

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but …

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: a9248f94, The address that the exception occurred at

Arg3: b3272a94, Trap Frame

Arg4: 00000000

Debugging Details:

——————

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

MODULE_NAME: eamon

FAULTING_MODULE: 804d8000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 484eaeee

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 – “0x%08lx”

FAULTING_IP:

eamon+4f94

a9248f94 8b4808 mov ecx,dword ptr [eax+8]

TRAP_FRAME: b3272a94 — (.trap 0xffffffffb3272a94)

ErrCode = 00000000

eax=00000004 ebx=a927c6cc ecx=00000000 edx=8658ec08 esi=00000000 edi=a927c6b8

eip=a9248f94 esp=b3272b08 ebp=b3272b18 iopl=0 nv up ei ng nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286

eamon+0x4f94:

a9248f94 8b4808 mov ecx,dword ptr [eax+8] ds:0023:0000000c=????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from a86a4ef2 to a9248f94

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

b3272b18 a86a4ef2 8658ec08 88fdf808 8658ec08 eamon+0x4f94

b3272b88 804f6098 8658ec08 88fdf808 a927c6cc FILEM+0x6ef2

b3272bd4 804f2968 88dff308 00000000 88fdf800 nt+0x1e098

b3272bec a9248f7e 88fdf800 a9248f06 86c2c030 nt+0x1a968

b3272c08 804f6098 88fdf808 86c2c030 88eb35f8 eamon+0x4f7e

b3272c54 804f6212 88f82390 00000000 78590000 nt+0x1e098

b3272c6c 80584b84 86c2c030 00000000 00000000 nt+0x1e212

b3272cb0 805bc472 00eb35f8 00000000 88eb35e0 nt+0xacb84

b3272ccc 805276da 88eb35f8 00000000 000005f4 nt+0xe4472

b3272cfc 805bd3dd e26d3e98 88eb35f8 000005f4 nt+0x4f6da

b3272d44 805bd515 000005f4 00000001 00000000 nt+0xe53dd

b3272d58 8054262c 000005f4 00cbfe60 7c92e4f4 nt+0xe5515

b3272d64 7c92e4f4 badb0d00 00cbfdcc 00000000 nt+0x6a62c

b3272d68 badb0d00 00cbfdcc 00000000 00000000 0x7c92e4f4

b3272d6c 00cbfdcc 00000000 00000000 00000000 0xbadb0d00

b3272d70 00000000 00000000 00000000 00000000 0xcbfdcc

STACK_COMMAND: kb

FOLLOWUP_IP:

eamon+4f94

a9248f94 8b4808 mov ecx,dword ptr [eax+8]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: eamon.sys

SYMBOL_NAME: eamon+4f94

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

———

本文转自斯克迪亚博客园博客,原文链接:http://www.cnblogs.com/sgsoft/archive/2009/02/12/1389419.html,如需转载请自行联系原作者

点赞