Windows 10 Fails Regular Boot, Safe Mode boot OK

[adish 0]

Hi,

  I have a desktop Windows 10 x64 machine that's been working fine for months/years. It was automatically updated from Win7 last year. 

A couple days ago I replaced the 2x4GB DDR3 memory with 2x8GB DDR3. This seemed to work though for some reason it works at 800MHz instead of the 1600MHz that the memory supports. The BIOS shows mem freq 1600 as expected. But this is the smaller issue. The PC worked booted fine.

When everything seemed to working as expected, I was still bothered by the slow startup and login times. Now with 16GB I had expected these times to improve.
I installed Windows SDK performance recording tool and set it to record the boot sequence and restarted the PC. 

Windows failed to boot twice (UNEXPECTED KERNEL MODE TRAP) and went into the auto diagnostic repair mode. Restore just spins until I lose patience. I did manage to boot in safe mode and disable the recording. It did not help.

Running sfc/scannow "did not find any integrity violations". 

I also managed to uninstall the Windows SDK/Perf Rec (by restarting the MSI service) - to no avail.

I ran the Windows memory test, but when it's done it reboots, the reboot fails, and I never did see the results.

I replaced the new RAM with the original ones, but this did not make any difference (BIOS setting are as they were originally).

After further investigation, it turned out the ESET driver eamonm.sys might be a factor.

Code:

BugCheck 1000007F, {8, ffff84001fc88b30, ffff840020108000, fffff8019ea3b196}

*** WARNING: Unable to verify timestamp for *** ERROR: Module load completed but symbols could not be loaded for eamonm.sys

I think I also remember a software update done by ESET at about the same time as the above.
I uninstalled ESET in Safe Mode (barely and partially) and the computer booted properly.

I then went on to freshly reinstall ESET NOD32.

When I restarted the computer, I got the same dreaded "UNEXPECTED KERNEL MODE TRAP" BSOD again.

Please advise!

 

 

Edited May 20, 2017 by adish

[cyberhash 188]

Does your bios have a option to use XMP for the memory ??? Use that if it does and f10(save and exit) and see if it solves your problem.

[adish 0]

Thanks for the prompt reply!

I changed XMP in the BIOS from Disabled to Profile1 (the only other option).
The same problem remains. No effect I could see.

[cyberhash 188]

22 minutes ago, adish said:

Thanks for the prompt reply!

I changed XMP in the BIOS from Disabled to Profile1 (the only other option).
The same problem remains. No effect I could see.

Did you install the new sticks of ram into the same slots on the motherboard that you removed the old ones from ? There should be a manual for your motherboard from the manufacturer showing you the order that ram should be installed.

[adish 0]

Yes. Same slots.

In any case I now have the originals, so there is effectively no change there.

[Marcos 5,070]

Please configure Windows to generate complete memory dumps, then restart the system and reproduce the crash. When done, compress the memory dump, upload it to a safe location and pm me a download link. Also enclose logs collected by ESET Log Collector (it generates a zip archive).

Before generating a memory dump, I'd recommend replacing RAM modules with the former 2x4 GB ones in order to get a smaller dump.

[adish 0]

Hi Marcos,

  I have already replaced to original RAM modules. Anyway, I currently uninstalled ESET so I can get some urgent work done.

Before I can do what you ask, which would require me to reinstall it (again) and figure out the mem-dump process, please take a look here, where I originally posted and where I was pointed to ESET as the/a cause. There's a zip file there with the dumps I did a couple of days ago. Please LMK if they're sufficiently informative.

[Marcos 5,070]

The crash is caused by stack exhaustion, however, ESET's eamonm takes only very little of the stack. The stack seems to have started to grow after enabling ETW logging (25 ffffdb01`77b14200 fffff800`4d81b3ae nt!EtwpTraceHandle+0x150) so the solution would be to stop logging.

[adish 0]

How do I stop the logging? (What exactly is ETW logging?)

Would this be related to the Windows Performance Recorder?

[Marcos 5,070]

42 minutes ago, adish said:

Would this be related to the Windows Performance Recorder?

Most likely, The issues started after enabling WPR.

[adish 0]

I did manage to get a successful WPR session now and it seems like the auto loggin was disabled due to the successful run.

I'll try reinstalling ESET.