Hi -
Welcome to Seven Forums.
Code:
Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility
Your BSOD's were caused by Norton:
Code:
fffff880`061e44b8 fffff880`068b59f0Unable to load image \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEVENT64x86.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT64x86.SYS
SYMEVENT64x86+0x269f0
Code:
fffff880`061e4458 fffff880`063de2e0Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\BASHDefs\20130301.001\BHDrvx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys
BHDrvx64+0x1372e0
Code:
fffff880`061e4128 fffff880`06afeab8Unable to load image \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for EraserUtilRebootDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for EraserUtilRebootDrv.sys
EraserUtilRebootDrv+0x2ab8
Please remove it using its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase
We recommended Microsoft Security Essentials from a strict BSOD perspective. Is most compatible & provides most stability compared to other antivirus app/Internet Security Software.
Warning
Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.
Run a full scan with both (separately) once downloaded, installed and updated.
Perform a System File Check to check the integrity of all protected Windows 7 :
- Click on the start
- Type CMD on Search
- Left click and Run as Administrator
- Type
Full tutorial here:
Check your hard drive(s) for errors by running chkdsk
Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.
Please upload your msinfo32.txt file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Export -> Save as msinfo32.txt and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .txt file, click send to compressed (zipped) folder -> Upload the .zip file here.
Number down items at start-up. Keep only your anti-virus, this also improves the time for logging into windows.
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 0, fffff80002ef1cd4}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ef1cd4, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003115100
GetUlongFromAddress: unable to read from fffff800031151c0
0000000000000000 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!IopCompleteRequest+c64
fffff800`02ef1cd4 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: csrss.exe
IRP_ADDRESS: ffffffffffffff88
TRAP_FRAME: fffff880061e46a0 -- (.trap 0xfffff880061e46a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880061e3918 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ef1cd4 rsp=fffff880061e4830 rbp=0000000000000000
r8=0000000000004740 r9=0000000000000080 r10=0000000000000002
r11=00000000000001c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc64:
fffff800`02ef1cd4 488b09 mov rcx,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002edc1e9 to fffff80002edcc40
STACK_TEXT:
fffff880`061e4558 fffff800`02edc1e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`061e4560 fffff800`02edae60 : 00000000`00000100 fffff880`061e4958 fffffa80`05cca958 fffffa80`0570bc60 : nt!KiBugCheckDispatch+0x69
fffff880`061e46a0 fffff800`02ef1cd4 : 00000000`00000001 00000000`00000000 fffff880`20206f49 fffff880`061e4b18 : nt!KiPageFault+0x260
fffff880`061e4830 fffff800`02ecf657 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff8a0`00000000 : nt!IopCompleteRequest+0xc64
fffff880`061e4900 fffff800`02e8aee5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`061e4980 fffff800`0313196a : fffffa80`04d4de30 fffffa80`05ccab30 fffff880`061e4b10 fffff880`061e4b08 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`061e49b0 fffff800`031fa85e : fffffa80`00000004 fffffa80`05ccab30 fffff880`061e4b10 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x292ea
fffff880`061e4aa0 fffff800`02edbed3 : 00000000`00000014 fffffa80`05708b50 00000000`002fe5a8 00000000`002fe801 : nt!NtMapViewOfSection+0x2bd
fffff880`061e4b70 00000000`76d6159a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`002fe588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d6159a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`02edae60 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 50e79935
FAILURE_BUCKET_ID: X64_0xA_nt!KiPageFault+260
BUCKET_ID: X64_0xA_nt!KiPageFault+260
Followup: MachineOwner
---------
Quote