locked
blue screen rigth after login win7 RRS feed

  • Question

  • Here is all the information about the crash and system, please help:)

    https://skydrive.live.com/redir?resid=4DDD30E05F06EB0B!106

    • Moved by Carey FrischMVP Tuesday, July 24, 2012 6:35 PM Moved to more appropriate forum category (From:Windows 7 Miscellaneous)
    Tuesday, July 24, 2012 5:45 PM

Answers

  • Here is all the information about the crash and system, please help:)

    https://skydrive.live.com/redir?resid=4DDD30E05F06EB0B!106

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff8000302f6ca, address which referenced memory
    Debugging Details:
    ------------------
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b5100
    GetUlongFromAddress: unable to read from fffff800032b51c0
     0000000000000000 Nonpaged pool
    CURRENT_IRQL:  2
    FAULTING_IP: 
    nt!ExpRemoveGeneralLookaside+82
    fffff800`0302f6ca 488908          mov     qword ptr [rax],rcx
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    BUGCHECK_STR:  0xA
    PROCESS_NAME:  System
    TRAP_FRAME:  fffff88002fc4590 -- (.trap 0xfffff88002fc4590)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=fffff8800dd78880 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8000302f6ca rsp=fffff88002fc4720 rbp=fffff8800dd78880
     r8=fffff88002fc4780  r9=0000000000000000 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    nt!ExpRemoveGeneralLookaside+0x82:
    fffff800`0302f6ca 488908          mov     qword ptr [rax],rcx ds:00000000`00000000=????????????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from fffff80003085769 to fffff800030861c0
    STACK_TEXT:  
    fffff880`02fc4448 fffff800`03085769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`02fc4450 fffff800`030843e0 : fffff8a0`03607a70 00000000`000007ff 00000000`00000001 fffff800`03223430 : nt!KiBugCheckDispatch+0x69
    fffff880`02fc4590 fffff800`0302f6ca : fffff880`02fc47b0 fffffa80`0c385a00 fffffa80`0c9a0400 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`02fc4720 fffff800`031a94ac : 00000000`c0020036 fffff880`0dd78928 00000000`00000000 fffffa80`0c9afb50 : nt!ExpRemoveGeneralLookaside+0x82
    fffff880`02fc4780 fffff880`0dd73cb6 : 00000000`c0020036 00000000`504e4445 ffff0000`0f2bc959 00000000`00000001 : nt!ExDeleteNPagedLookasideList+0x1c
    fffff880`02fc47b0 00000000`c0020036 : 00000000`504e4445 ffff0000`0f2bc959 00000000`00000001 00000000`00000001 : epfwwfp+0x4cb6
    fffff880`02fc47b8 00000000`504e4445 : ffff0000`0f2bc959 00000000`00000001 00000000`00000001 fffff880`0dd73f8d : 0xc0020036
    fffff880`02fc47c0 ffff0000`0f2bc959 : 00000000`00000001 00000000`00000001 fffff880`0dd73f8d 00000000`00000000 : 0x504e4445
    fffff880`02fc47c8 00000000`00000001 : 00000000`00000001 fffff880`0dd73f8d 00000000`00000000 00000000`00000000 : 0xffff0000`0f2bc959
    fffff880`02fc47d0 00000000`00000001 : fffff880`0dd73f8d 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1
    fffff880`02fc47d8 fffff880`0dd73f8d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : 0x1
    fffff880`02fc47e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000001 fffffa80`00000000 : epfwwfp+0x4f8d
    STACK_COMMAND:  kb
    FOLLOWUP_IP: 
    epfwwfp+4cb6
    fffff880`0dd73cb6 ??              ???
    SYMBOL_STACK_INDEX:  5
    SYMBOL_NAME:  epfwwfp+4cb6
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: epfwwfp
    IMAGE_NAME:  epfwwfp.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4aa9db1f
    FAILURE_BUCKET_ID:  X64_0xA_epfwwfp+4cb6
    BUCKET_ID:  X64_0xA_epfwwfp+4cb6
    Followup: MachineOwner
    ---------------------------------------------------------------------------------------------------------------------------------------------------

    Bug Check 0xAhttp://msdn.microsoft.com/en-us/library/windows/hardware/ff560129(v=vs.85).aspx

    Your blue screen caused by Epfwwfp.sys with description ESET Personal Firewall driver is a driver file from company ESET belonging to product ESET Smart Security, so try to uninstall it it solve your blue screen or try to update it to the latest version.

    Regards,

     


    MCT / MCITP / MCTS / MCSA / C|EH

    • Marked as answer by Leo Huang Tuesday, July 31, 2012 1:28 AM
    Tuesday, July 24, 2012 8:36 PM

All replies

  • Tuesday, July 24, 2012 7:03 PM
  • The Stop 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above. The value of the third parameter indicates that the driver was performing a write operation.
    According to the dump file, the fautling module reported was epfwwfp.sys (the ESET Personal Firewall driver), a driver file from company ESET belonging to the product ESET Smart Security.
    Try disabling this firewall and report the problem to the program's developer.

    Bye.


    Luigi Bruno

    Tuesday, July 24, 2012 7:28 PM
  • Here is all the information about the crash and system, please help:)

    https://skydrive.live.com/redir?resid=4DDD30E05F06EB0B!106

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff8000302f6ca, address which referenced memory
    Debugging Details:
    ------------------
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b5100
    GetUlongFromAddress: unable to read from fffff800032b51c0
     0000000000000000 Nonpaged pool
    CURRENT_IRQL:  2
    FAULTING_IP: 
    nt!ExpRemoveGeneralLookaside+82
    fffff800`0302f6ca 488908          mov     qword ptr [rax],rcx
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    BUGCHECK_STR:  0xA
    PROCESS_NAME:  System
    TRAP_FRAME:  fffff88002fc4590 -- (.trap 0xfffff88002fc4590)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=fffff8800dd78880 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8000302f6ca rsp=fffff88002fc4720 rbp=fffff8800dd78880
     r8=fffff88002fc4780  r9=0000000000000000 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    nt!ExpRemoveGeneralLookaside+0x82:
    fffff800`0302f6ca 488908          mov     qword ptr [rax],rcx ds:00000000`00000000=????????????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from fffff80003085769 to fffff800030861c0
    STACK_TEXT:  
    fffff880`02fc4448 fffff800`03085769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`02fc4450 fffff800`030843e0 : fffff8a0`03607a70 00000000`000007ff 00000000`00000001 fffff800`03223430 : nt!KiBugCheckDispatch+0x69
    fffff880`02fc4590 fffff800`0302f6ca : fffff880`02fc47b0 fffffa80`0c385a00 fffffa80`0c9a0400 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`02fc4720 fffff800`031a94ac : 00000000`c0020036 fffff880`0dd78928 00000000`00000000 fffffa80`0c9afb50 : nt!ExpRemoveGeneralLookaside+0x82
    fffff880`02fc4780 fffff880`0dd73cb6 : 00000000`c0020036 00000000`504e4445 ffff0000`0f2bc959 00000000`00000001 : nt!ExDeleteNPagedLookasideList+0x1c
    fffff880`02fc47b0 00000000`c0020036 : 00000000`504e4445 ffff0000`0f2bc959 00000000`00000001 00000000`00000001 : epfwwfp+0x4cb6
    fffff880`02fc47b8 00000000`504e4445 : ffff0000`0f2bc959 00000000`00000001 00000000`00000001 fffff880`0dd73f8d : 0xc0020036
    fffff880`02fc47c0 ffff0000`0f2bc959 : 00000000`00000001 00000000`00000001 fffff880`0dd73f8d 00000000`00000000 : 0x504e4445
    fffff880`02fc47c8 00000000`00000001 : 00000000`00000001 fffff880`0dd73f8d 00000000`00000000 00000000`00000000 : 0xffff0000`0f2bc959
    fffff880`02fc47d0 00000000`00000001 : fffff880`0dd73f8d 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1
    fffff880`02fc47d8 fffff880`0dd73f8d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : 0x1
    fffff880`02fc47e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000001 fffffa80`00000000 : epfwwfp+0x4f8d
    STACK_COMMAND:  kb
    FOLLOWUP_IP: 
    epfwwfp+4cb6
    fffff880`0dd73cb6 ??              ???
    SYMBOL_STACK_INDEX:  5
    SYMBOL_NAME:  epfwwfp+4cb6
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: epfwwfp
    IMAGE_NAME:  epfwwfp.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4aa9db1f
    FAILURE_BUCKET_ID:  X64_0xA_epfwwfp+4cb6
    BUCKET_ID:  X64_0xA_epfwwfp+4cb6
    Followup: MachineOwner
    ---------------------------------------------------------------------------------------------------------------------------------------------------

    Bug Check 0xAhttp://msdn.microsoft.com/en-us/library/windows/hardware/ff560129(v=vs.85).aspx

    Your blue screen caused by Epfwwfp.sys with description ESET Personal Firewall driver is a driver file from company ESET belonging to product ESET Smart Security, so try to uninstall it it solve your blue screen or try to update it to the latest version.

    Regards,

     


    MCT / MCITP / MCTS / MCSA / C|EH

    • Marked as answer by Leo Huang Tuesday, July 31, 2012 1:28 AM
    Tuesday, July 24, 2012 8:36 PM