Solved BSOD on start up, locale 2057, after virus removal.

I unfortunately managed to contract the Ukash virus/trojan. I dealt with this following a few guides on line that led me to restore to yesterday, use malware anitbytes and what appears to have succesfully removed the virus. Now if i try to start the system in normal start mode i get to the log on screen before BSOD'ing. The following is from the windows report when i start back up in Safemode with networking. The windows report wont complete:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 2057

Additional information about the problem:
BCCode: 50
BCP1: FFFFF80003421080
BCP2: 0000000000000000
BCP3: FFFFF880098CFD83
BCP4: 0000000000000002
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\040313-4602-01.dmp
C:\Users\SMceachern\AppData\Local\Temp\WER-13182-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\windows\system32\en-US\erofflps.txt


I have also followed the instruction on uploading the log files using the handy tool on the forum. Please can someone help me?

Symantec Endpoint Driver itself is your problem, as it is seen very often.
Description here: Driver Reference Table - SRTSPL64.SYS

And, all the three crash dumps show the same result here.

Uninstall Norton and all Symentec products using Norton Removal tool. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.

Arc, thank you for the quick reply. This appears to have solved the issue. MSE installed though may have an issue with that but thats not for this thread. MBAM scanning now but at least I can get into normal mode and after a scan hopefully catch up on a few hours of lost work time. Rep given, though i know my rep power is tiny but virtual pint your way.

You are welcome mate
For any further issues, let us know.

Hi,

Replacing Antivirus can not be a solution.

There is a fix note related to SRTSPL64.SYS in SEP 11.x platform

SRTSPL64.SYS crashes on Windows 2008 Server
Fix ID: 1949035
Symptom: BugCheck 50, PAGE_FAULT_IN_NONPAGED_AREA, in SRTSPL64.SYS
Solution: Fixed resource cleanup issues

Reference: http://www.symantec.com/docs/TECH103087

SEP latest version should not cause any issue. Latest version details can be found here: https://www-secure.symantec.com/connect/articles/what-are-symantec-endpoint-protection-sep-versions-released-officially

To handle virus related issue always follow the best practice:
Best Practices for Troubleshooting Viruses on a Network
http://www.symantec.com/docs/TECH122466

You can always involve Symantec support team if threat could not detect. Be aware that third-party antivirus products are often designed with a different purpose in mind, and therefore employ a different scope of detection. Symantec security products such as SAV and Symantec Endpoint Protection (SEP) are intended to balance detection of legitimate threats with a level of false positive detection acceptable to enterprise-class computing environments with thousands or even hundreds of thousands of seats.

However to get it assured submit the suspicious files to Symantec security response team for further analysis.
Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files in SEP 12.1 and Submit the same to Symantec Security Response Team.
https://www-secure.symantec.com/connect/articles/u...
Symantec Help (SymHelp)
http://www.symantec.com/docs/TECH170752
You can scan the machine using Symantec power eraser tool also.
Use Power Eraser to detect threat and remove them
http://www.symantec.com/theme.jsp?themeid=spe-user...

Regards,
Chetan Savade

Hi,

You can log a case with Support as well.

How to create a new case in MySupport
http://www.symantec.com/docs/TECH58873
How to Create and Validate a SymAccount for using Symantec's MySupport
http://www.symantec.com/docs/HOWTO31127
How to update a support case and upload diagnostic files with MySupport
http://www.symantec.com/docs/TECH71023

Regards,
Chetan Savade

Chetan, here we are independent debuggers. Our responsibility is to the issue only, not to anything else. If anybody comes to us seeking help, and we know that his problem is caused by the antivirus that is a wide problem, we definitely will suggest to remove that costly but crash prone antivirus and to install the free but more efficient one.

And, replacing the antivirus is the solution, that is already proved in post #3.

http://www.sevenforums.com/bsod-hel...ale-2057-after-virus-removal.html#post2349819

Well said Arc!! Excellent!!

How many hundreds of instances have we seen Symantec cause these BSOD's? Way too many!!

Golden said:

Well said Arc!!

How many hundreds of instances have we seen Symantec cause these BSOD's? Way too many!!

Click to expand...

Hundreds is not the appropriate unit to measure the mess .... as we dont measure time in nanoseconds

Giga is better, maybe Peta?

I can only agree with Arc, i was glad to get that rubbish off my machine and would have uninstalled before if it was part of my companies IT policy. However they agreed after the advice given here to get it to feck!