0x0000007E problem

Horseshoe said:

System is home-built with dualbooting WinXP Pro 32 bit and Win 7 Pro 64 bit. Used Easy BCD.

2nd last time restarting from XP to Win 7 the computer would not start Win 7. Never did find a solution under previous post as there was no BSOD to see (cycled too fast). It just started working like it should after about 1 week and 30 restarts (and lots of useless tinkering).

This time: yesterday restarted into Win 7 after a big delay. Shortly thereafter got a Norton Internet Security 2010 corrupted please reinstall (separate install for each OS). Fine, I’ll fix this in the am. Now for today: This time I got a true BSOD – message was:
***STOP: 0x0000007E (0xFFFFFFFFC0000005,0xFFFFF80002F0B4DC,0xFFFFF88003385838, 0xFFFFF88003385090)

Restarted the PC as suggested and it got into Win 7 after a small hesitation. Ran the forum suggested programs to collate data and submit. I’ve also attached a document listing what is in the PC.

Any suggestions?


edit: Got Norton working and even though the new Perf Report shows no virus protection, the Security Centre says Norton is working OK

Most of these were caused by your Symantec. Please remove and replace with Microsoft Security Essentials


http://www.microsoft.com/security_essentials/

Download and run the Norton Removal Tool to uninstall your Norton product | Norton Support

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\052011-18236-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`030a7650
Debug session time: Fri May 20 10:08:51.206 2011 (GMT-4)
System Uptime: 0 days 0:00:08.736
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002f0b4dc, fffff88003385838, fffff88003385090}

Unable to load image \SystemRoot\system32\drivers\NISx64\1108000.005\SYMEFA64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEFA64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS
Probably caused by : SYMEFA64.SYS ( SYMEFA64+28ba0 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002f0b4dc, The address that the exception occurred at
Arg3: fffff88003385838, Exception Record Address
Arg4: fffff88003385090, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlSplay+a
fffff800`02f0b4dc 488b10          mov     rdx,qword ptr [rax]

EXCEPTION_RECORD:  fffff88003385838 -- (.exr 0xfffff88003385838)
ExceptionAddress: fffff80002f0b4dc (nt!RtlSplay+0x000000000000000a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

CONTEXT:  fffff88003385090 -- (.cxr 0xfffff88003385090)
rax=0000000000000000 rbx=fffff8a000d4cda0 rcx=fffffa8000000001
rdx=0000000000000000 rsi=00000000c0000024 rdi=fffff8a000d4cd88
rip=fffff80002f0b4dc rsp=fffff88003385a78 rbp=fffff88001388060
 r8=fffff8a00030634c  r9=ffffffffff5b9562 r10=fffff8a000d4cdf8
r11=fffff8a000d4cda0 r12=fffff88001388060 r13=0000000000000001
r14=ffffffffffffffff r15=0000000000000001
iopl=0         nv up ei pl nz ac po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010217
nt!RtlSplay+0xa:
fffff800`02f0b4dc 488b10          mov     rdx,qword ptr [rax] ds:002b:00000000`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003111100
 0000000000000000 

FOLLOWUP_IP: 
SYMEFA64+28ba0
fffff880`013a2ba0 ??              ???

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002eb8fc9 to fffff80002f0b4dc

STACK_TEXT:  
fffff880`03385a78 fffff800`02eb8fc9 : 00000000`00000013 fffff880`03385b08 00000000`00000001 fffff880`01388060 : nt!RtlSplay+0xa
fffff880`03385a80 fffff880`013a2ba0 : fffff8a0`00d4cd70 fffff880`01388060 00000000`00000000 fffff8a0`00306320 : nt!RtlDelete+0x5d
fffff880`03385ab0 fffff8a0`00d4cd70 : fffff880`01388060 00000000`00000000 fffff8a0`00306320 00000000`00000000 : SYMEFA64+0x28ba0
fffff880`03385ab8 fffff880`01388060 : 00000000`00000000 fffff8a0`00306320 00000000`00000000 fffff880`01392c4f : 0xfffff8a0`00d4cd70
fffff880`03385ac0 00000000`00000000 : fffff8a0`00306320 00000000`00000000 fffff880`01392c4f fffff8a0`00d4cd70 : SYMEFA64+0xe060


SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  SYMEFA64+28ba0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SYMEFA64

IMAGE_NAME:  SYMEFA64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4bcf727b

STACK_COMMAND:  .cxr 0xfffff88003385090 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_SYMEFA64+28ba0

BUCKET_ID:  X64_0x7E_SYMEFA64+28ba0

Followup: MachineOwner
---------

Love to run it (Removal Tool), even tried it, does not work. It keeps aborting at the "We have detected Norton Utilities 14 on your system - please remove manually at "Control Panel / Programs and Features" before running this utility.

I did that and even restarted the PC before running the Tool again. Still stops at the above step even though NU is no longer in the programs list. Contacted Symantec. They said (after logging on remotely and seeing for themselves) to don't worry, that NU is not on my system. Does not help me run the Removal Tool I said. They suggested another removal tool still in beta downloadable from www.norton.com/rr . Guess what - it does not work either, hangs at the same error message.

Ultimately I got Norton Internet Security 2011 to replace 2010 and installed it. Still get the same cryptic message from the "perfmon /report" (See the second reort attachment) regarding lack of security even though the Security Center states Symantec is installed and working. Can I trust the MS package?

Can I ever trust booting into WinXP ever again without having this happen a 3rd time?

Horseshoe said:

Love to run it (Removal Tool), even tried it, does not work. It keeps aborting at the "We have detected Norton Utilities 14 on your system - please remove manually at "Control Panel / Programs and Features" before running this utility.

I did that and even restarted the PC before running the Tool again. Still stops at the above step even though NU is no longer in the programs list. Contacted Symantec. They said (after logging on remotely and seeing for themselves) to don't worry, that NU is not on my system. Does not help me run the Removal Tool I said. They suggested another removal tool still in beta downloadable from www.norton.com/rr . Guess what - it does not work either, hangs at the same error message.

Ultimately I got Norton Internet Security 2011 to replace 2010 and installed it. Still get the same cryptic message from the "perfmon /report" (See the second reort attachment) regarding lack of security even though the Security Center states Symantec is installed and working. Can I trust the MS package?

Can I ever trust booting into WinXP ever again without having this happen a 3rd time?

Norton is difficult to remove. Dont know if this will help.

Norton 360 How to uninstall

I'll check it out but somnething tells me I'll have to track down the install disc and see what it has for an uninstaller as 360 is more complex than just Norton Utilities