eamonm.sys BSOD - Stop code: SYSTEM_THREAD_EXCEPTION NOT HANDLED

[Marcos 4,601]

19 minutes ago, Mwh65 said:

To confirm are you referring to the KB5004945 patch released by Microsoft?

Correct.

[mmsoar 1]

Just a piece of additional information:  I'm running version 14.1.20.0 of "Eset Internet Security"

 

I'll add to the reports.  After updating windows with KB5004945 my system will run from 30 seconds to 3-4 minutes.  Trying to get anything done will result in a bug check "System Thread exception not handled"  .  This includes trying "System Restore" from within windows.  It's necessary to do it from the bluescreen troubleshooting window.

The address is listed as eamonm.sys +6200 as previously reported

Deleting the update via system restore removes the problem.  Re-installing the update caused the BSOD to repeat with the same eamonm.sys+6200 address.  Removing the update again restores normal behavior. 

I would submit to others that rebuilding the PC is not required unless there are no system restore points available.

I've paused updates until this issue is resolved.

[itman 1,508]

21 hours ago, mmsoar said:

Just a piece of additional information:  I'm running version 14.1.20.0 of "Eset Internet Security"

I would upgrade to the latest EIS ver. which is 14.2.19 and see if that resolves the issue. As previously posted, I am running this version and have no Eset related  issues after applying KB5004945 on my Win 10 x(64) 21H1 device.

Edited July 10, 2021 by itman

[Bigctm 0]

1 hour ago, itman said:

I would upgrade to the latest EIS ver. which is 14.2.19 and see if that resolves the issue. As previously posted, I am running this version and have no Eset related  issues after applying KB5004945 on my Win 10 x(64) 21H1 device.

I am on version 14.2.19 and had the issue and had to uninstall KB5004945.  Are you using BIOS or UEFI?  Might be secure boot related...who knows at this point...I turned off windows updates in the meantime.  Hopefully there will be a solution soon.  

[itman 1,508]

30 minutes ago, Bigctm said:

Are you using BIOS or UEFI?

My Gigabyte motherboard falls into the "vintage" category so its BIOS based. This by itself would rule out any Secure Boot use. I do have all HV options enabled; core isolation and memory integrity.

I don't think the issue is UEFI based but perhaps something to do with TPM interface modification perhaps?

Edited July 10, 2021 by itman

[Marcos 4,601]

Are all machines where BSOD occurs relatively new with USB3.x support? Do you use a USB-C cable to connect USB devices?

So far it looks like a USB3 component writing to a memory area that was already freed by the component and is already allocated by ESET.

[itman 1,508]

4 hours ago, Marcos said:

Are all machines where BSOD occurs relatively new with USB3.x support?

My motherboard dates to 2010. So, USB 3.0 capability is not relatively new feature. I am also having no issues but do not have any USB 3.0 devices connected presently.

Also, I am assuming that a USB 3.0 device would have to be connected via a USB 3.0 cable at system startup time to be applicable.

Edited July 12, 2021 by itman

[Cousin Vinny 6]

This is the hardware environment of the machine I was having trouble with (no USB 3.x devices):

Audio inputs and outputs    Remote Audio    Microsoft    10.0.19041.1    12/6/2019
Audio inputs and outputs    Speakers/Headphones (Realtek Audio)    Microsoft    10.0.19041.1    12/6/2019
Batteries    HID UPS Battery    Microsoft    10.0.19041.1    6/21/2006
Computer    ACPI x64-based PC    (Standard computers)    10.0.19041.1    6/21/2006
Disk drives    KXG60ZNV256G NVMe TOSHIBA 256GB    (Standard disk drives)    10.0.19041.789    6/21/2006
Display adapters    Intel UHD Graphics 630    Intel Corporation    27.20.100.8935    10/28/2020
DVD/CD-ROM drives    HL-DT-ST DVD+-RW GU90N    (Standard CD-ROM drives)    10.0.19041.1023    6/21/2006
Firmware    System Firmware    Microsoft    10.0.19041.1    6/21/2006
Human Interface Devices    American Power Conversion USB UPS    American Power Conversion    10.0.19041.868    6/21/2006
Human Interface Devices    HID-compliant consumer control device    Microsoft    10.0.19041.1    6/21/2006
Human Interface Devices    HID-compliant system controller    (Standard system devices)    10.0.19041.868    6/21/2006
Human Interface Devices    USB Input Device    (Standard system devices)    10.0.19041.868    6/21/2006
Human Interface Devices    USB Input Device    (Standard system devices)    10.0.19041.868    6/21/2006
Human Interface Devices    USB Input Device    (Standard system devices)    10.0.19041.868    6/21/2006
Imaging devices    Brother DCP-7065DN    Brother    1.1.19.19    4/4/2013
Imaging devices    ScanSnap S1300i    FUJITSU    2.0.3.1    1/31/2014
Keyboards    HID Keyboard Device    (Standard keyboards)    10.0.19041.1    6/21/2006
Mice and other pointing devices    HID-compliant mouse    Microsoft    10.0.19041.1    6/21/2006
Monitors    Generic PnP Monitor    (Standard monitor types)    10.0.19041.488    6/21/2006
Monitors    Generic PnP Monitor    (Standard monitor types)    10.0.19041.488    6/21/2006
Network adapters    Intel Ethernet Connection (7) I219-LM    Intel    12.18.8.9    1/24/2019
Network adapters    WAN Miniport (IKEv2)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (IP)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (IPv6)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (L2TP)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (Network Monitor)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (PPPOE)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (PPTP)    Microsoft    10.0.19041.1    6/21/2006
Network adapters    WAN Miniport (SSTP)    Microsoft    10.0.19041.1    6/21/2006
Ports (COM & LPT)    Communications Port (COM1)    (Standard port types)    10.0.19041.1    6/21/2006
Ports (COM & LPT)    Intel Active Management Technology - SOL (COM3)    Intel    2042.0.13.0    10/14/2020
Print queues    ABS PDF Driver v400    AMYUNI Technologies    10.0.19041.1    6/21/2006
Print queues    Adobe PDF    Adobe    10.0.19041.1    6/21/2006
Print queues    Brother DCP-7065DN Printer    Brother    10.0.19041.1    6/21/2006
Print queues    Fax    Microsoft    10.0.19041.1    6/21/2006
Print queues    Microsoft Print to PDF    Microsoft    10.0.19041.1    6/21/2006
Print queues    Microsoft XPS Document Writer    Microsoft    10.0.19041.1    6/21/2006
Print queues    OneNote    Microsoft    10.0.19041.1    6/21/2006
Print queues    OneNote    Microsoft    10.0.19041.1    6/21/2006
Print queues    Root Print Queue    Microsoft    10.0.19041.1    6/21/2006
Print queues    Send To OneNote 2016    Microsoft    10.0.19041.1    6/21/2006
Printers    Brother DCP-7065DN Printer    Brother    1.10.0.0    4/5/2013
Processors    Intel Core i5-8600 CPU @ 3.10GHz            
Processors    Intel Core i5-8600 CPU @ 3.10GHz            
Processors    Intel Core i5-8600 CPU @ 3.10GHz            
Processors    Intel Core i5-8600 CPU @ 3.10GHz            
Processors    Intel Core i5-8600 CPU @ 3.10GHz            
Processors    Intel Core i5-8600 CPU @ 3.10GHz            
Security devices    Trusted Platform Module 2.0    (Standard)    10.0.19041.746    6/21/2006
Software components    Intel Graphics Command Center    Intel Corporation    27.20.100.8935    10/28/2020
Software components    Intel Graphics Control Panel    Intel Corporation    27.20.100.8935    10/28/2020
Software components    Intel Optane Memory and Storage Management Component    Intel Corporation    18.0.0.1    3/2/2020
Software components    Intel Optane Pinning Shell Extensions    Intel Corporation    18.0.1.1138    8/3/2020
Software components    Intel Optane Pinning Shell Extensions    Intel Corporation    18.0.1.1138    8/3/2020
Software components    Realtek Asio Component    Realtek    1.0.0.4    6/19/2017
Software components    Realtek Audio Effects Component    Realtek    11.0.6000.686    5/21/2019
Software components    Realtek Audio Universal Service    Realtek    1.0.0.172    5/20/2019
Software components    Waves Audio Effects Component    Waves    3.2.0.81    11/29/2018
Software devices    Microsoft Device Association Root Enumerator    Microsoft    10.0.19041.1    6/21/2006
Software devices    Microsoft GS Wavetable Synth    Microsoft    10.0.19041.1    6/21/2006
Software devices    Microsoft RRAS Root Enumerator    Microsoft    10.0.19041.1    6/21/2006
Sound, video and game controllers    Intel Display Audio    Intel Corporation    10.27.0.9    2/25/2020
Sound, video and game controllers    Realtek Audio    Microsoft    6.0.8710.1    5/22/2019
Storage controllers    Intel Chipset SATA/PCIe RST Premium Controller    Intel Corporation    18.30.1.1138    8/3/2020
Storage controllers    Microsoft Storage Spaces Controller    Microsoft    10.0.19041.1081    6/21/2006
System devices    ACPI Fan    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Fan    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Fan    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Fan    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Fan    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Fixed Feature Button    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Power Button    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    ACPI Processor Aggregator    (Standard system devices)    10.0.19041.1    6/21/2006
System devices    ACPI Thermal Zone    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    Charge Arbitration Driver    (Standard system devices)    10.0.19041.1    6/21/2006
System devices    Composite Bus Enumerator    Microsoft    10.0.19041.1    6/21/2006
System devices    High Definition Audio Controller    Microsoft    10.0.19041.1081    6/8/2021
System devices    High precision event timer    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    Intel 300 Series Chipset Family LPC Controller (Q370) - A306    INTEL    10.1.16.3    7/18/1968
System devices    Intel Gaussian Mixture Model - 1911    INTEL    10.1.7.2    7/18/1968
System devices    Intel Host Bridge/DRAM Registers - 3EC2    INTEL    10.1.14.3    7/18/1968
System devices    Intel Management Engine Interface    Intel    2102.100.0.1044    1/3/2021
System devices    Intel PCI Express Root Port #4 - A33B    INTEL    10.1.16.3    7/18/1968
System devices    Intel PCI Express Root Port #9 - A330    INTEL    10.1.16.3    7/18/1968
System devices    Intel Power Engine Plug-in    Intel Corporation    10.0.19041.662    6/21/2006
System devices    Intel Serial IO GPIO Host Controller - INT3450    Intel Corporation    30.100.1816.3    4/17/2018
System devices    Intel Serial IO I2C Host Controller - A368    Intel Corporation    30.100.1929.1    7/15/2019
System devices    Intel SMBus - A323    INTEL    10.1.16.3    7/18/1968
System devices    Intel SPI (flash) Controller - A324    INTEL    10.1.16.3    7/18/1968
System devices    Intel Thermal Subsystem - A379    INTEL    10.1.16.3    7/18/1968
System devices    Microsoft ACPI-Compliant System    Microsoft    10.0.19041.964    6/21/2006
System devices    Microsoft Hyper-V Virtualization Infrastructure Driver    Microsoft    10.0.19041.1052    6/21/2006
System devices    Microsoft System Management BIOS Driver    (Standard system devices)    10.0.19041.1    6/21/2006
System devices    Microsoft UEFI-Compliant System    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Virtual Drive Enumerator    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    Microsoft Windows Management Interface for ACPI    Microsoft    10.0.19041.1    6/21/2006
System devices    NDIS Virtual Network Adapter Enumerator    Microsoft    10.0.19041.1    6/21/2006
System devices    Numeric data processor    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    PCI Express Root Complex    (Standard system devices)    10.0.19041.964    6/21/2006
System devices    PCI standard RAM Controller    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    PCI-to-PCI Bridge    (Standard system devices)    10.0.19041.964    6/21/2006
System devices    Plug and Play Software Device Enumerator    (Standard system devices)    10.0.19041.1    12/6/2019
System devices    Programmable interrupt controller    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    Remote Desktop Camera Bus    Microsoft    10.0.19041.1    6/21/2006
System devices    Remote Desktop Device Redirector Bus    Microsoft    10.0.19041.1    6/21/2006
System devices    Remote Desktop USB Hub    (Standard system devices)    10.0.19041.1023    6/21/2006
System devices    System CMOS/real time clock    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    System timer    (Standard system devices)    10.0.19041.1081    6/21/2006
System devices    UMBus Enumerator    Microsoft    10.0.19041.1    6/21/2006
System devices    UMBus Enumerator    Microsoft    10.0.19041.1    6/21/2006
System devices    UMBus Enumerator    Microsoft    10.0.19041.1    6/21/2006
System devices    UMBus Root Bus Enumerator    Microsoft    10.0.19041.1    6/21/2006
UCMCLIENT    Cypress UCM Client Peripheral Driver    Cypress Semiconductor Corporation    1.2.1.20    11/28/2017
Universal Serial Bus controllers    Intel USB 3.1 eXtensible Host Controller - 1.10 (Microsoft)    Generic USB xHCI Host Controller    10.0.19041.1081    6/7/2021
Universal Serial Bus controllers    USB Composite Device    (Standard USB Host Controller)    10.0.19041.488    6/21/2006
Universal Serial Bus controllers    USB Composite Device    (Standard USB Host Controller)    10.0.19041.488    6/21/2006
Universal Serial Bus controllers    USB Printing Support    Microsoft    10.0.19041.1081    6/21/2006
Universal Serial Bus controllers    USB Root Hub (USB 3.0)    (Standard USB HUBs)    10.0.19041.964    4/22/2021

[itman 1,508]

Current USB 3 standards:

Quote

USB 3.0 / USB 3.1 (Gen 1)

 

In 2008 the USB 3.0 standard was introduced, with which the speed of data transmission could be increased to 5 Gbit / s.

USB 3.1 (Gen 2)

The USB 3.1 upgrade was launched in 2013, which made higher data transfer speeds possible. Up to 10 Gbit / s were now possible.

USB 3.2

USB 3.2 was introduced in 2017 and the speed could be doubled to up to 20 Gbit / s. USB type C plugs are required, which then transmit 10 Gbit / s in each direction in the multi-lane method over two pairs of wires.

https://www.reichelt.com/magazin/en/usb-3-0-3-1-3-2-and-4-0/

 

Edited July 12, 2021 by itman

[itman 1,508]

Here's the deal on the USB 3 angle.

See below screen shot. Windows did update my driver for it in early June.  It appears to have arrived as part of June cumulative update which patched the initial PrintNightmare vulnerabilities.

Now my printer is USB 2.0 connected.  So USB 3.0 issue in this regard is N/A for me. I also would have never been vulnerable to the remote printer connection vulnerabilities. 

The Win 10 KB5004945 patch did not update USB 3.0 drivers it appears. Therefore, I can't see how USB 3.0 is causing these Eset sourced blue screens.

[itman 1,508]

Ah ..........., this might be USB 3 related after all. I had to jog my memory a bit. It's a bit complicated.

To begin, my "vintage" Gigabyte motherboard does not natively support USB 3. They added a NEC chip to do so. Also whatever USB 3 controller Gigabyte supplied, it was not the Renensas one shown in my screen shot. Win 10 on installation replaced the original controller with the Renensas one. As such, Microsoft is now the provider for driver updates to it.

It is possible that Microsoft in their haste to push out the KB5004945 and related patches did not do extensive compatibility tests on USB 3 controller drivers other than their own supported ones in relation to AV interfacing with the controller?

There is also an easy way to test this USB 3 source theory. Any Eset installed device BSOD because of KB5004945 can temporarily disable their USB 3 controller via Device Manager. Reinstall the KB5004945 or related patch. If BSOD stops, this proves that the USB 3 controller driver is the source.

Edited July 12, 2021 by itman

[Marcos 4,601]

If you can reproduce the BSOD please let us know and we will provide you with a batch file that will enable a special pool that will help us locate the troubling driver overwriting or corrupting memory allocated by ESET which results in BSOD.

[itman 1,508]

Just a FYI here.

The July cumulative updates are rolling out and a number of Win drivers were updated. The one that caught my eye was usbprint.sys which is the USB printer driver. So it is possible this Eset BSOD issue might be resolved after applying this update.

[Aryeh Goretsky 353]

Hello,

NEC Electronics spun off Renesas Electronics in 2002.  As a result, drivers dated after that time for NEC hardware such as USB controllers may show up as having device drivers written by Renesas.

Regards,

Aryeh Goretsky

 

[Marcos 4,601]

Should anybody still having issues with BSOD, please make sure to install the Windows update KB5004237 released on July 13 and let us know if it resolves the issue.

[mmsoar 1]

Updated last night to KB5004237.

So far the system appears stable.  At least the MTBF is > 12 hours.

So, whatever the changes are they appear to have largely resolved the rapid bug check issues.

If the problems re-occurs I'll re-post, but for now, thankfully, I'll retire into the background.