BSOD when closing Norton NIS


  1. Posts : 258
    Windows 7 Ultimate x64
       #1

    BSOD when closing Norton NIS


    A BSOD happened several weeks ago.

    On 2-14-2013 - When I woke up the PC there was a Norton information message, not an error message. I don’t recall the details because it usually is about some helpful tip. When I closed it I immediately got a BSOD. This is the first & only time I’ve seen a BSOD on the affected PC which is about 8 months old.

    On 4-2-2013 - I just got a message last night that WMC had stopped working. I clicked on the help & restart (or words to that effect) & WMC came up immediately.

    I noticed when viewing the logs under Administrative Events there are a lot of "Homegroup Log" errors. Could this be because the other PC in the Homegroup was in sleep mode at the time?

    I also had an unexpected shutdown back in December 2012 & could never find the source of the problem. Everything I saw in the logs just said unexpected shutdown. And I had an unexpected black screen with a re-boot message back in July 2012 & ran some HDD diagnostics & the drive was OK. I don’t know if any of the above are related but thought I’d mention them.

    (Back on 3-20-2013 I powered off the PC, therefore I know that this unexpected shutdown was my doing. Also I was playing around on another date & killed the power once or twice, but again that was my doing.)

    Hopefully I did the attachment correctly.
    Any comments, help & suggestions would be greatly appreciated.
    Thank you in advance.
      My Computer


  2. Posts : 2,014
    Windows 7 Professional 64bit
       #2

    Hi,
    From your crash dump files:
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 50, {ffffffffffffffe0, 0, fffff800021e3210, 0}

    Could not read faulting driver name
    Probably caused by : ntkrnlmp.exe ( nt!ObDereferenceSecurityDescriptor+20 )
    Followup: MachineOwner
    ---------
    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    The analysis was somewhat inconclusive as to exact driver issues.

    Run SFC to check the integrity of all Windows 7 system files:

    Click on the Start > Type in search cmd
    Right click cmd at top and Run as Administrator
    Type SFC /scannow at the prompt
    (Note: there is a space between SFC and /scannow)
    https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

    Also ensure you have all the latest Windows updates installed

    I did however notice that you have some Norton Drivers on your system
    which may explain why you got the Norton pop-up:

    Timestamp: unavailable (00000000)
    ENG64 ENG64.SYS Thu Dec 20 09:24:21 2012 (50D2D945)
    EX64 EX64.SYS Thu Dec 20 09:22:39 2012
    Relates to: Norton Anti-Virus

    IDSvia64.sys
    IDSvia64 IDSvia64.sys Wed Aug 29 03:48:40 2012
    Relates to: Norton Internet Security

    BHDrvx64.sys
    BHDrvx64 BHDrvx64.sys Fri Jan 11 18:50:17 2013
    Relates to: Symantec Heuristics Driver

    Use the removal tool to see if it deletes the drivers:
    https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us
    If not use Driver Sweeper:
    https://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html

    Please update this driver as it is very old:

    AVerBDA716x_x64.sys Thu Apr 30 04:16:20 2009
    Relates to: TV Tuner from AverMedia

    Support: AVerMedia AVerTV Global - TV Tuners, Live IPTV Streaming Encoder, Video Capture Card, Media Player and Multimedia Products - Support -
    Downloads: AVerMedia AVerTV Global - TV Tuners, Live IPTV Streaming Encoder, Video Capture Card, Media Player and Multimedia Products - Support -
    Try the OEM if it came with the computer

    I would also suggest removing Avast and installing MSE:

    Microsoft Security Essentials.
    Recommended from a strict BSOD perspective, compatibility & stability
    compared to other antiviruses/internet security software.

    Microsoft Security Essentials - Microsoft Windows

    Post back any results/observations.

    cheers

    Dave
      My Computer


  3. Posts : 258
    Windows 7 Ultimate x64
    Thread Starter
       #3

    Thanks for looking at my data.

    I ran SFC a couple months ago & there was no problem. I just ran it again & this time it said Windows Resource Protection found corrupt files & successfully repaired them. Details are in the CBS.log. I tried to open it but got ‘Access is denied”. I copied it to my other PC & it opened in Notepad without any problem. It is 16.6 MB & has dates from 2013-03-15 to 2013-04-05.

    I re-ran SFC & now get Windows Resource Protection did not find any integrity violations.

    I did have Norton NIS when I got the BSOD when I closed the Norton message. But a couple weeks ago I uninstalled it via control panel, then restarted or rebooted the PC, then ran the Norton Removal Tool & rebooted the PC. Does the data indicate that the Norton drivers were on the PC at time of the BSOD? Or that the Norton drivers are still on the PC even though I supposedly removed NIS?

    Anyway I ran NRT again & did a cold re-start. I tried to find where the Norton drivers where located before I re-ran NRT but could not find them. Where are they located so I can look to verify they are gone?

    When I installed the AVerTVHD Duet MTVHDDUWB tuner cards the driver on the disc was vers 1.3.64.74 dated June 1, 2009. The driver on their website was vers 1.3.0.74 dated 2009/05/18 and still is. The tuner is no longer listed on their website & the company told me it was “in shortage at this moment”. Who knows when/if any driver will be updated.

    Is there anything I should look for in that CBS.log that might indicate a problem?
      My Computer


  4. Posts : 2,014
    Windows 7 Professional 64bit
       #4

    Hi

    "Windows Resource Protection did not find any integrity violations" is good, seems like
    it successfully repaired the corrupt files. :)

    Norton drivers were remnants still on your PC since install, so I assume they were on during BSOD..

    To manaually remove them/or look to see if removed, navigate to:

    C:\windows\system32\drivers
    You can right click and delete any of the drivers I mentioned if they have not been removed.

    Are you still experiencing BSOD'S after removing those drivers?
    If you are post up the new crash dumps.

    Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

    Driver Verifier - Enable and Disable

    Look forward to your feedback

    (if you post your CBS.log I can ask another member to look at it for you? Not my best subject )

    cheers

    Dave
      My Computer


  5. Posts : 258
    Windows 7 Ultimate x64
    Thread Starter
       #5

    I only had the BSOD one time & that was on the HTPC which I've been using since June 2012. It may be another 6 months or hopefully never that it occurs again.

    I was reading this thread while at my other PC which still has Norton NIS on it. I thought I check out the drivers just to get familiar with things. I looked in:
    C:\windows\system32\drivers
    I did not see any of the drivers that you had mentioned. I even did a search & came up empty.

    I then went to the affected HTPC & looked & searched & also came up empty. This might be expected because NIS was hopefully removed from the HTPC.

    However since I could not find the drivers on the PC which has NIS that makes me wonder that I'm not doing something right. FWIW I am set up to show hidden folders & files. Any ideas why I cannot find the drivers on the PC with NIS?
      My Computer


  6. Posts : 2,014
    Windows 7 Professional 64bit
       #6

    Perhaps they are now removed somehow and NIS therefore can't locate them.
    Either way they are no longer on your system I take it?
    Can I have an easier question next time please :)

    Cheers

    Dave
      My Computer


  7. Posts : 258
    Windows 7 Ultimate x64
    Thread Starter
       #7

    How would I post the 16.6 MB CBS.log for someone to look at?
      My Computer


  8. Posts : 2,014
    Windows 7 Professional 64bit
       #8

    If SFC repaired the files successfully then there seems little point in
    analysing the logs, as they are repaired.

    Cheers

    Dave
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 22:33.
Find Us