EM008K_64.DLL BSOD 0x1D , Windows 10

[Robert Becskei 0]

Hello everybody ,

 

Since today , I am having Problems with ESET . I keep receiving a BSOD randomly . And always 0x1D and failing module EM008K_64.DLL .

 

==================================================
Dump File         : 120719-29328-01.dmp
Crash Time        : 07.12.2019 23:37:59
Bug Check String  : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code    : 0x000000d1
Parameter 1       : 00000000`00000002
Parameter 2       : 00000000`00000002
Parameter 3       : 00000000`00000000
Parameter 4       : fffff803`2feae5f5
Caused By Driver  : em008k_64.dll
Caused By Address : em008k_64.dll+e5f5
File Description  :
Product Name      :
Company           :
File Version      :
Processor         : x64
Crash Address     : ntoskrnl.exe+1c14e0
Stack Address 1   :
Stack Address 2   :
Stack Address 3   :
Computer Name     :
Full Path         : C:\WINDOWS\Minidump\120719-29328-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 18362
Dump File Size    : 567.180
Dump File Time    : 07.12.2019 23:40:18
==================================================

 

 

I have no idea what is this and why is this happening , can anyone please help me. For now I disabled the firewall , but I am not even sure if this DLL has something to do with the ESET Firewall.

 

Thank you

[Marcos 5,070]

Please configure Windows to generate complete or active memory dumps, reproduce BSOD and provide a dump in a compressed form for perusal.

[Robert Becskei 0]

So I uploaded a memory dump I have , unfortunately Windows 10 was configured to Automatic Memory Dump.

I am not sure if this helps you. The link to the file : https://gofile.io/?c=y064nZ

I have configured windows to do Active Memory Dumps, if the problem comes back , I will upload the new memory dump.

 

Thank you.

[Peter Randziak 1,130]

Hello @Robert Becskei,

thank you for the dump file, I opened a ticket for our devs to check it.

I will keep you posted.

Peter

tracking note: P_ESSW-9800 

[Marcos 5,070]

It's caused by an old bug which was revealed thanks to your dump. We should be able to address it via an automatic module update soon.

[Robert Becskei 0]

much appreciated! thank you!

[denixx 7]

Marcos,

Having GSODs now...

Already have a fulldump, it's weight is 24,3 GiB in 7zip-archive.

Please take a look at the attached WinDbg analyze attempt. Will it have interest for you?

 

Also, I've been here: 

And came from here:

 

2019-12-21_20-41_analyze.txt 2019-12-21_22-22_lmvm_em008k_64.txt

Edited December 21, 2019 by denixx

[StudioMaX 1]

Has this bug been fixed? Sometimes I get a BSOD for a few times a day, sometimes none for weeks.

Minidumps: https://gofile.io/?c=yQ1pOz

Edited December 26, 2019 by StudioMaX

[Marcos 5,070]

It will be fixed in the firewall module 1398+.

[StudioMaX 1]

Do you know when this update will be released publicly? Or how can I avoid this error? At the moment, I get a BSOD several times a day, as well as data loss in some programs due to incorrect file saving. The minidump shows the same driver with the same parameters. As an option, I see only the complete removal of ESET Internet Security, since it is not known when the update will be released.

[Topboss 0]

Still the bug exist.
The report, using nirsoft utility,  from computer with win 10 pro 64 bits. Before some versions of ESET inter. sec or ESET smart sec prem didn't have any problem.
==============

 problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: em008k_64.dll

DRIVER_IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x000000d1 (0x0000000000000002, 0x0000000000000002, 0x0000000000000000,
0xfffff80763d5e5f5)

*** em008k_64.dll - Address 0xfffff80763d5e5f5 base at 0xfffff80763d50000 DateStamp
0x5da789b6

==================

And the history of dump files.

011920-12187-01.dmp    19-Jan-20 2:54:13 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000002    00000000`00000002    00000000`00000000    fffff801`6891e5f5    em008k_64.dll    em008k_64.dll+e5f5                    x64    ntoskrnl.exe+1c14e0                    C:\WINDOWS\Minidump\011920-12187-01.dmp    4    15    18362    1,626,869    19-Jan-20 2:54:48 PM    

120319-7515-01.dmp    03-Dec-19 10:10:04 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000002    00000000`00000002    00000000`00000000    fffff805`244ce5f5    em008k_64.dll    em008k_64.dll+e5f5                    x64    ntoskrnl.exe+1c14e0                    C:\WINDOWS\Minidump\120319-7515-01.dmp    4    15    18362    770,175    03-Dec-19 10:10:34 PM    

112919-6531-01.dmp    29-Nov-19 12:26:01 AM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000002    00000000`00000002    00000000`00000000    fffff804`5789e5f5    em008k_64.dll    em008k_64.dll+e5f5                    x64    ntoskrnl.exe+1c14e0                    C:\WINDOWS\Minidump\112919-6531-01.dmp    4    15    18362    1,331,379    29-Nov-19 12:26:32 AM    

112819-5921-01.dmp    28-Nov-19 6:15:15 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000002    00000000`00000002    00000000`00000000    fffff803`4e6be5f5    em008k_64.dll    em008k_64.dll+e5f5                    x64    ntoskrnl.exe+1c14e0                    C:\WINDOWS\Minidump\112819-5921-01.dmp    4    15    18362    1,396,531    28-Nov-19 6:15:45 PM    

111319-5734-01.dmp    13-Nov-19 4:32:43 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000002    00000000`00000002    00000000`00000000    fffff807`63d5e5f5    em008k_64.dll    em008k_64.dll+e5f5                    x64    ntoskrnl.exe+1c14e0                    C:\WINDOWS\Minidump\111319-5734-01.dmp    4    15    18362    1,271,949    13-Nov-19 4:33:12 PM    

 

 

[Marcos 5,070]

Please configure Windows to generate complete memory dumps as per https://support.eset.com/en/how-do-i-generate-a-memory-dump-manually. When BSOD occurs, a complete memory dump will be generated. We'll need it to determine the cause of the crash.

In the mean time, you can provide us with the minidump for perusal.

If you are able to reproduce the crash, does updating from the pre-release update channel fix it?

[Orion13622 0]

When will this bug be resolved.  I would presume that since it's initial report in December of last year that this would be a priority to resolve sooner rather than later.

This is becoming a serious annoyance considering everything else in my system is working normally.  If this persists, and is not resolved soon, I will be removing Eset and find a different solution for Anti-virus.

On Wed 1/22/2020 8:59:29 AM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: em008k_64.dll (0xFFFFF8071F4CE5F5)
Bugcheck code: 0xD1 (0x2, 0x2, 0x0, 0xFFFFF8071F4CE5F5)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Program Files\ESET\ESET Security\Modules\em008k_64\1544\em008k_64.dll
product: ESET Security
company: ESET
description: Epfw module
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: em008k_64.dll (Epfw module, ESET).
Google query: em008k_64.dll ESET DRIVER_IRQL_NOT_LESS_OR_EQUAL