BSOD - Norton Internet Security - srtsp64.sys + filtmgr.sys

[DaveZ]

Running Windows Pro x64 and have been having random reboots and bsods for a long time. This past weekend I finally decided to dig into the situation and enabled Driver Verifier. Based on the results, it looks like it is either Norton Internet Security 2015, Goodsync, or a conflict between the two of them. I am leaning towards NIS but would like some confirmation. Here is the sequence of configurations I have tried and the associated bsod minidumps:

• March 1 @12:30pm: Enabled Driver Verifier and msconfig selective startup. Only items enabled are NIS service and SpeedFan.
  • Result: no bsods or crashes for next 1h45
• March 1 @2:15pm: Added Goodsync Service to selective startup, NIS service also remains enabled
  • Result: 2 bsods within 15 mins of startup, @2:28pm & 2:47pm, filtmgr.sys + srtsp64.sys on the stack
• March 1 @3:36pm: Tried the opposite, disabled NIS service and kept Goodsync enabled
  • Result: no bsods for next 1h15
• March 1 @3:47pm: Tried uninstall/reinstall of Norton, NIS + Goodsync both enabled in startup
  • Result: took longer for bsods, but got two @10:02pm and today March 2 @8:19am, filtmgr.sys + srtsp64.sys on the stack
• March 2 @8:30am: Uninstalled Norton Internet Security using the Norton Removal tool, enabled Windows Defender, GoodSync still enabled
  • Result: no bsods as of 3h30 later

So based on this history, I really think it is Norton causing my problems. But the first bullet above shows that I ran Norton for close to 2 hours with no issues when GoodSync was disabled. The crashes did not happen unless both were running. GoodSync is setup to monitor file activity and perform automatic copies between multiple computers on my network, so maybe Goodsync stresses NIS in some way. FWIW, I have the same exact version of NIS 2015 running on two other computers on my network without a single problem.

Would appreciate if someone can review my last 4 minidumps and confirm my analysis. If it is NIS, then I have to figure out a different way to protect the computer.

Thanks in advance!

 

[Arc]

A good job nicely done.

One but all the crash dumps are verifier enabled, and verifier caught Norton and Glary Utilities.

BugCheck C4, {f6, 13c, fffffa800f5bf060, fffff8800114b49c}

*** WARNING: Unable to verify timestamp for SRTSP64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP64.SYS
[COLOR=Red]Probably caused by : SRTSP64.SYS[/COLOR] ( SRTSP64+b9f85 )

Followup: MachineOwner
---------

BugCheck C4, {e1, fffff9801571afb8, 0, 0}

*** WARNING: Unable to verify timestamp for GUBootStartup.sys
*** ERROR: Module load completed but symbols could not be loaded for GUBootStartup.sys
[COLOR=Red]Probably caused by : GUBootStartup.sys[/COLOR] ( GUBootStartup+103c )

Followup: MachineOwner
---------

Both are BSOD causers, widely noticed. You should attempt to get rid of those. But those might not be the root cause as per the single non-DV crash dump, which points to IRST in a deeper search.

fffff880`03dd19f8  fffff880`016f2ec0*** WARNING: Unable to verify timestamp for iaStorA.sys
[COLOR=Red]*** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys[/COLOR]
 iaStorA+0x74ec0

Probably you need to concentrate on it, too; if situation demands. I cannot check how rapid storage is configured (AHCI or SCSI) based on the data you have supplied, also understanding that you are well equipped to deal with such an issue. Hope this info might come handy at any point of time.

EDIT: Windows Defender is not an alternative of Norton. WD is just a spyware protector, and it is not any worthy to use. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner. This combo will serve as a replacement of NIS for sure.

EDIT2: NIS causes BSODs. Not everywhere but somewhere. Why it causes it to some and why some are stable with it ... I dont have that explanation, unfortunately.

 

[DaveZ]

A good job nicely done.

One but all the crash dumps are verifier enabled, and verifier caught Norton and Glary Utilities.

Thanks Arc for the speedy response, much appreciated. Indeed, my initial DV tests on Sat 2/28 pointed out a Sonic / Roxio driver pxhlpa64.sys and Glary's gubootstartup.sys. I removed both of those from my system late Sat night and by peeling the onion got to the Norton driver issue on Sun 3/1. Again, I have both NIS and Glary on all of my other systems which show no stability issues, but you can bet that I will be testing them with DV after I get this system sorted out.

Both are BSOD causers, widely noticed. You should attempt to get rid of those. But those might not be the root cause as per the single non-DV crash dump, which points to IRST in a deeper search.

fffff880`03dd19f8  fffff880`016f2ec0*** WARNING: Unable to verify timestamp for iaStorA.sys
[COLOR=Red]*** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys[/COLOR]
 iaStorA+0x74ec0

Probably you need to concentrate on it, too; if situation demands. I cannot check how rapid storage is configured (AHCI or SCSI) based on the data you have supplied, also understanding that you are well equipped to deal with such an issue. Hope this info might come handy at any point of time.

EDIT: Windows Defender is not an alternative of Norton. WD is just a spyware protector, and it is not any worthy to use. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner. This combo will serve as a replacement of NIS for sure.

EDIT2: NIS causes BSODs. Not everywhere but somewhere. Why it causes it to some and why some are stable with it ... I dont have that explanation, unfortunately.

Thanks for the heads up on the Intel Rapid Storage Technology driver. I will look into that if I need to, but right now my system seems exceedingly stable with Norton removed. If I get to the end of day with no bsods, I am going to gradually add back in some of my other drivers. I plan to test also running some of the Adobe CS programs- Photoshop, Lightroom, Premiere, and After Effects really stress the video and disk and I would hardly ever get through an editing session without a crash. Also, thanks a ton for the pointers to an NIS alternative. I have been a Norton/Symantec user for so many decades since the days of Windows 3.1 that I have never looked elsewhere, but it is looking like it may be time!

Again, thanks for the help!

 

[Arc]

Welcome.

pxhlpa64.sys is used by lightroom, too.

As far as the other machines are stable, what they say ... dont fix it when it is not broken. Troubleshoot only when the situation demands for it; as you planned to proceed with IRST only if the situation demands. That's the right way.

 

[DaveZ]

pxhlpa64.sys is used by lightroom, too.

Wow, interesting! When DV implicated the driver, I removed it from the LowerFilters attribute of my DVD drive in the registry according to these instructions: sonic solutions pxhlpa64.sys driver not digitally signed and plextor - Microsoft Community I have a Plextor bluray drive and figured the driver must have been part of the PlexUtilities. Rather than delete the utilities themselves, I tried this approach first which seems to have worked. I hardly use the drive at all for burning and figured that when the time came, I'd sort out if deactivating the driver caused a problem or not. Googling I see that the driver is indeed used by several Adobe CS programs for CD/DVD authoring- again something I rarely if ever do. So for now, I'll leave it disabled and deal with any functional limitations later.

 

[Arc]

Driver Reference Table - PxHlpa64.sys

Click on the Driver Update Site.

Driver Reference Table (DRT) by usasma (John Carrona) is a great ready reference of the drivers. Bookmark it, it will come handy, very off and on.