BSOD after win7 updates, ntoskrnl.exe+253d0

[roachi]

hello, i'm new here so i hope i get this right.
yesterday i get the october win7 updates, i turn off my pc and updates install, turn pc back on all good using it all last night, turn it on this aft and i get a i think a bsod, ( i wasnt in room during boot ) think it was on windows repair screen or restore when i came into room with pc, anyway i hit ok and it did a restore, think it restored to yesterday just befor the windows updates.
so i been reading alsorts on the net but i still have no idea what has happened, well a bit i do, i think the updates corrupt the ntoskrnl.exe this is a guess.
i have come here for help and i think im in the right place, i hope so
i have attached this dump file i have had a look at it with bluescreenview but have no idea

 

[koolkat77]

Please upload your msinfo32.nfo file. To get this:

• Click on the Start rb:
• Type msinfo32 into the Search programs and files box
• When it opens, go to File, Save
• Save as msinfo32.nfo and save in a place you will remember
• Let it finish the process of gathering and saving the system info
• Right click the .nfo file, click send to compressed (zipped) folder
• Upload the .zip file here.

[FONT="Verdana"][B]STOP 0x0000000A[/B]: IRQL_NOT_LESS_OR_EQUAL
[B]Usual causes[/B]:  Kernel mode driver, System Service, BIOS, Windows, [U]Virus scanner[/U], Backup tool, compatibility
BugCheck A, {0, 2, 0, fffff80002eadf74}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
[/FONT]

Looks like Norton is causing some problems for you. (I'm not surprised)

[FONT="Verdana"]fffff880`037563b8  fffff880`040929f0Unable to load image \??\C:\Windows\system32\Drivers\[COLOR="Red"]SYMEVENT64x86.SYS[/COLOR], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [B][URL="http://www.carrona.org/drivers/search.php?id=SYMEVENT64x86.SYS"]SYMEVENT64x86.SYS[/URL][/B]
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT64x86.SYS
 SYMEVENT64x86+0x269f0[/FONT]

[FONT="Verdana"]fffff880`03756358  fffff880`0459e2e0Unable to load image \??\C:\ProgramData\[B]Norton[/B]\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120928.001\BHDrvx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys
 BHDrvx64+0x1372e0[/FONT]

Suggestions:

Norton is a known cause to BSoDs. Please uninstall it and all its components using the Norton Removal Tool. If the removal tool does not help: try uninstalling with Revo Uninstallers Advanced Mode (registry leftover). Download and install Microsoft Security Essentials, make a full scan once updated.
→ Norton Removal Tool

Run the System File Checker that scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible
→ http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html​

Report back

 

[roachi]

hello Koolkat77, i have uninstalled norton but i have to say this is the first time i've had a problem with norton, used it since 2005. i have installed ms security essentials (i hope it's good i never had a virus/malware/spyware with norton) and run a scan came back good.
i have done a sfc /scannow came back "windows resource protection did not find any integrity violations",, all good ?
you didn't say if i had to reinstall the windows updates, oh well i installed them after i installed ms security then ran the sfc /scannow.
msinfo added.

what are all them other .sys i see in bluescreenview, are they something to do with the bsod too
thanks roachi

ahh just looking in blueview again and the SYMEVENT64x86.SYS isn't highlighted, the highlighted one i thought was the crasher, so could it be any of these .sys that caused the bsod

 

[koolkat77]

Bluescreen view is merely an entry level program. It can view the dumps, hardly provides accurate information, cannot analyze in details.

 

[roachi]

is it 100% norton ? i like norton and would like to carry on using it but if it defo is then i'l stop.
reason i ask is i seen other post where someone says it xxx.sys but turned out to be something else

 

[koolkat77]

You need to observe whether you get BSoDs after uninstalling Norton.
If you like it so much, you can keep it but expect BSoDs. My intention is to help, not to stop you from using the software you like.

 

[roachi]

ok, i will report back next weekend, friday maybe

 

[koolkat77]

Okay

 

[roachi]

hello Koolkat, so it's been almost a week since this BSOD problem and i have not had another, does this mean it was 100% norton that caused the BSOD ?
btw, i made this post at norton forums, might aswell if it a norton problem
norton and bsod - Norton Community

another thing, when/if i reinstall norton am i going to run into problems removing ms essentials ? i don't see a removel tool and reading about it on the net some people have trouble removing it.

 

[koolkat77]

Feel free to install Norton but first uninstall MSE from control panel, it does not need a separate uninstaller.

Good luck.

 

[roachi]

hay koolkat can you attach a full debug of my dump or is that it all in your post (#2) ?, i'd like to look at it even tho i don't know what to look for

i will be getting norton suite 2013, i will mark this thread as solved if i get a BSOD when i install norton 2013

 

[koolkat77]

Based on your bug checks usual causes, we analyze the output you upload for us in the zip file. Your dump came with bug check A. "STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL". It's usual causes are: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility -//- Source: Carrona.org

I do not use Norton, never will, but I know that Norton comes with a third party firewall and a back up tool.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BugCheck A, {0, 2, 0, fffff80002eadf74}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

Not all dumps give the accurate information on the first go, sometimes we need to do a little digging with them and "ntkrnlmp.exe" is not the true cause of your crash. So I ran some commands on your dump and it gave me these. (See the font in blue)

[COLOR="Blue"]fffff880`03756028  fffff880`02e7cab8Unable to load image \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\[URL="http://www.carrona.org/drivers/search.php?id=EraserUtilRebootDrv.sys"]EraserUtilRebootDrv.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for EraserUtilRebootDrv.sys
*** ERROR: Module load completed but symbols could not be loaded for EraserUtilRebootDrv.sys
 EraserUtilRebootDrv+0x2ab8[/COLOR]
fffff880`03756030  00000000`00000000
fffff880`03756038  00000000`00000000
fffff880`03756040  00000000`00000000
fffff880`03756048  00000000`00000000
fffff880`03756050  00000000`00000000
fffff880`03756058  00000000`00000000
fffff880`03756060  00000000`00000000
fffff880`03756068  00000000`00000000
fffff880`03756070  00000000`00000000
fffff880`03756078  00000000`00000000
fffff880`03756080  00000000`00000000
fffff880`03756088  00000000`00000000
fffff880`03756090  00000000`00000000
fffff880`03756098  00000000`00000000
fffff880`037560a0  00000000`00000000
fffff880`037560a8  00000000`00000000
fffff880`037560b0  00000000`00000000
fffff880`037560b8  00000000`00000000
fffff880`037560c0  00000000`00000000
fffff880`037560c8  00000000`00000000
fffff880`037560d0  00000000`00000000
fffff880`037560d8  00000000`00000000
fffff880`037560e0  00000000`00000000
fffff880`037560e8  00000000`00000000
fffff880`037560f0  00000000`00000000
fffff880`037560f8  00000000`00000000
fffff880`03756100  00000000`00000000
fffff880`03756108  00000000`00000000
fffff880`03756110  00000000`00000000
fffff880`03756118  00000000`00000000
fffff880`03756120  00000000`00000000
fffff880`03756128  00000000`00000000
fffff880`03756130  00000000`00000000
fffff880`03756138  00000000`00000000
fffff880`03756140  00000000`00000000
fffff880`03756148  00000000`00000000
fffff880`03756150  00000000`00000000
fffff880`03756158  00000000`00000000
fffff880`03756160  00000000`00000000
fffff880`03756168  00000000`00000000
fffff880`03756170  00000000`00000000
fffff880`03756178  00000000`00000000
fffff880`03756180  00000000`00000000
fffff880`03756188  00000000`00000000
fffff880`03756190  00000000`00000000
fffff880`03756198  00000000`00000000
fffff880`037561a0  00000000`00000000
fffff880`037561a8  00000000`00000000
fffff880`037561b0  00000000`00000000
fffff880`037561b8  00000000`00000000
fffff880`037561c0  00000000`00000000
fffff880`037561c8  00000000`00000000
fffff880`037561d0  00000000`00000000
fffff880`037561d8  00000000`00000000
fffff880`037561e0  00000000`00000000
fffff880`037561e8  00000000`00000000
fffff880`037561f0  00000000`00000000
fffff880`037561f8  00000000`00000000
fffff880`03756200  00000000`00000000
fffff880`03756208  00000000`00000000
fffff880`03756210  00000000`00000000
fffff880`03756218  00000000`00000000
fffff880`03756220  00000000`00000000
fffff880`03756228  00000000`00000000
fffff880`03756230  00000000`00000000
fffff880`03756238  00000000`00000000
fffff880`03756240  00000000`00000000
fffff880`03756248  00000000`00000000
fffff880`03756250  00000000`00000000
fffff880`03756258  00000000`00000000
fffff880`03756260  00000000`00000000
fffff880`03756268  00000000`00000000
fffff880`03756270  00000000`00000000
fffff880`03756278  00000000`00000000
fffff880`03756280  00000000`00000000
fffff880`03756288  00000000`00000000
fffff880`03756290  00000000`00000000
fffff880`03756298  00000000`00000000
fffff880`037562a0  00000000`00000000
fffff880`037562a8  00000000`00000000
fffff880`037562b0  00000000`00000000
fffff880`037562b8  00000000`00000000
fffff880`037562c0  00000000`00000000
fffff880`037562c8  00000000`00000000
fffff880`037562d0  00000000`00000000
fffff880`037562d8  00000000`00000000
fffff880`037562e0  00000000`00000000
fffff880`037562e8  00000000`00000000
fffff880`037562f0  00000000`00000000
fffff880`037562f8  00000000`00000000
fffff880`03756300  00000000`00000000
fffff880`03756308  00000000`00000000
fffff880`03756310  00000000`00000000
fffff880`03756318  00000000`00000000
fffff880`03756320  00000000`00000000
fffff880`03756328  00000000`00000000
fffff880`03756330  00000000`00000000
fffff880`03756338  00000000`00000000
fffff880`03756340  00000000`00000000
fffff880`03756348  00000000`00000000
fffff880`03756350  00000000`00000000
[COLOR="blue"]fffff880`03756358  fffff880`0459e2e0Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120928.001\[URL="http://www.carrona.org/drivers/search.php?id=BHDrvx64.sys"]BHDrvx64.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys
 BHDrvx64+0x1372e0[/COLOR]
fffff880`03756360  fffff880`037563b8
fffff880`03756368  fffffa80`08edac00
fffff880`03756370  fffff880`03756430
fffff880`03756378  fffff880`03756380
fffff880`03756380  00000000`00000000
fffff880`03756388  fffff880`04493e99 BHDrvx64+0x2ce99
fffff880`03756390  fffff8a0`0257b960
fffff880`03756398  00000000`00000000
fffff880`037563a0  00000000`000001c8
fffff880`037563a8  fffff800`02e9fd8f nt!KeWaitForSingleObject+0x19f
fffff880`037563b0  00000000`00000003
[COLOR="Blue"]fffff880`037563b8  fffff880`040929f0Unable to load image \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/search.php?id=SYMEVENT64x86.SYS"]SYMEVENT64x86.SYS[/URL]
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT64x86.SYS
 SYMEVENT64x86+0x269f0[/COLOR]
fffff880`037563c0  fffff8a0`00548130
fffff880`037563c8  fffffa80`08ecf828
fffff880`037563d0  fffff880`03756538
fffff880`037563d8  fffff880`009ec180
fffff880`037563e0  fffffa80`08edab50
fffff880`037563e8  00000000`00000000
fffff880`037563f0  fffff880`03755810
fffff880`037563f8  00000000`00000000
fffff880`03756400  00000000`00000000
fffff880`03756408  fffff880`03756620

1. SYMEVENT64x86.SYS = Driver Reference Table / Norton Internet Security
2. BHDrvx64.sys = Driver Reference Table / Symantec Heuristics Driver
3. EraserUtilRebootDrv.sys = Driver Reference Table / Symantec /Norton

Hope your system stays BSoD free with the latest version of Norton.

Good Luck

 

[roachi]

hi Koolkat. i'm thinking the problem might be in the 2012 version of norton, will see soon, i will update here when i get 2013 noton suite.
i would like to thank you Koolkat for the help you have given me, thank you

 

[koolkat77]

You're welcome