BSOD when closing Norton NIS

[Mike99]

A BSOD happened several weeks ago.

On 2-14-2013 - When I woke up the PC there was a Norton information message, not an error message. I don’t recall the details because it usually is about some helpful tip. When I closed it I immediately got a BSOD. This is the first & only time I’ve seen a BSOD on the affected PC which is about 8 months old.

On 4-2-2013 - I just got a message last night that WMC had stopped working. I clicked on the help & restart (or words to that effect) & WMC came up immediately.

I noticed when viewing the logs under Administrative Events there are a lot of "Homegroup Log" errors. Could this be because the other PC in the Homegroup was in sleep mode at the time?

I also had an unexpected shutdown back in December 2012 & could never find the source of the problem. Everything I saw in the logs just said unexpected shutdown. And I had an unexpected black screen with a re-boot message back in July 2012 & ran some HDD diagnostics & the drive was OK. I don’t know if any of the above are related but thought I’d mention them.

(Back on 3-20-2013 I powered off the PC, therefore I know that this unexpected shutdown was my doing. Also I was playing around on another date & killed the power once or twice, but again that was my doing.)

Hopefully I did the attachment correctly.
Any comments, help & suggestions would be greatly appreciated.
Thank you in advance.

 

[Northernsoul55]

Hi,
From your crash dump files:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffffffffffe0, 0, fffff800021e3210, 0}

Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObDereferenceSecurityDescriptor+20 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.

The analysis was somewhat inconclusive as to exact driver issues.

Run SFC to check the integrity of all Windows 7 system files:

Click on the Start > Type in search cmd
Right click cmd at top and Run as Administrator
Type SFC /scannow at the prompt
(Note: there is a space between SFC and /scannow)
:ar: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Also ensure you have all the latest Windows updates installed

I did however notice that you have some Norton Drivers on your system
which may explain why you got the Norton pop-up:

Timestamp: unavailable (00000000)
ENG64 ENG64.SYS Thu Dec 20 09:24:21 2012 (50D2D945)
EX64 EX64.SYS Thu Dec 20 09:22:39 2012

Relates to: Norton Anti-Virus

IDSvia64.sys
IDSvia64 IDSvia64.sys Wed Aug 29 03:48:40 2012

Relates to: Norton Internet Security

BHDrvx64.sys
BHDrvx64 BHDrvx64.sys Fri Jan 11 18:50:17 2013

Relates to: Symantec Heuristics Driver

Use the removal tool to see if it deletes the drivers:
:ar: https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us
If not use Driver Sweeper:
:ar: http://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html

Please update this driver as it is very old:

AVerBDA716x_x64.sys Thu Apr 30 04:16:20 2009
Relates to: TV Tuner from AverMedia

Support: AVerMedia AVerTV Global - TV Tuners, Live IPTV Streaming Encoder, Video Capture Card, Media Player and Multimedia Products - Support -
Downloads: AVerMedia AVerTV Global - TV Tuners, Live IPTV Streaming Encoder, Video Capture Card, Media Player and Multimedia Products - Support -
Try the OEM if it came with the computer

I would also suggest removing Avast and installing MSE:

Microsoft Security Essentials.
Recommended from a strict BSOD perspective, compatibility & stability
compared to other antiviruses/internet security software.

:ar: Microsoft Security Essentials - Microsoft Windows

Post back any results/observations.

cheers

Dave

 

[Mike99]

Thanks for looking at my data.

I ran SFC a couple months ago & there was no problem. I just ran it again & this time it said Windows Resource Protection found corrupt files & successfully repaired them. Details are in the CBS.log. I tried to open it but got ‘Access is denied”. I copied it to my other PC & it opened in Notepad without any problem. It is 16.6 MB & has dates from 2013-03-15 to 2013-04-05.

I re-ran SFC & now get Windows Resource Protection did not find any integrity violations.

I did have Norton NIS when I got the BSOD when I closed the Norton message. But a couple weeks ago I uninstalled it via control panel, then restarted or rebooted the PC, then ran the Norton Removal Tool & rebooted the PC. Does the data indicate that the Norton drivers were on the PC at time of the BSOD? Or that the Norton drivers are still on the PC even though I supposedly removed NIS?

Anyway I ran NRT again & did a cold re-start. I tried to find where the Norton drivers where located before I re-ran NRT but could not find them. Where are they located so I can look to verify they are gone?

When I installed the AVerTVHD Duet MTVHDDUWB tuner cards the driver on the disc was vers 1.3.64.74 dated June 1, 2009. The driver on their website was vers 1.3.0.74 dated 2009/05/18 and still is. The tuner is no longer listed on their website & the company told me it was “in shortage at this moment”. Who knows when/if any driver will be updated.

Is there anything I should look for in that CBS.log that might indicate a problem?

 

[Northernsoul55]

Hi

"Windows Resource Protection did not find any integrity violations" is good, seems like
it successfully repaired the corrupt files.

Norton drivers were remnants still on your PC since install, so I assume they were on during BSOD..

To manaually remove them/or look to see if removed, navigate to:

C:\windows\system32\drivers
You can right click and delete any of the drivers I mentioned if they have not been removed.

Are you still experiencing BSOD'S after removing those drivers?
If you are post up the new crash dumps.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

:ar: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Look forward to your feedback

(if you post your CBS.log I can ask another member to look at it for you? Not my best subject )

cheers

Dave

 

[Mike99]

I only had the BSOD one time & that was on the HTPC which I've been using since June 2012. It may be another 6 months or hopefully never that it occurs again.

I was reading this thread while at my other PC which still has Norton NIS on it. I thought I check out the drivers just to get familiar with things. I looked in:
C:\windows\system32\drivers
I did not see any of the drivers that you had mentioned. I even did a search & came up empty.

I then went to the affected HTPC & looked & searched & also came up empty. This might be expected because NIS was hopefully removed from the HTPC.

However since I could not find the drivers on the PC which has NIS that makes me wonder that I'm not doing something right. FWIW I am set up to show hidden folders & files. Any ideas why I cannot find the drivers on the PC with NIS?

 

[Northernsoul55]

Perhaps they are now removed somehow and NIS therefore can't locate them.
Either way they are no longer on your system I take it?
Can I have an easier question next time please

Cheers

Dave

 

[Mike99]

How would I post the 16.6 MB CBS.log for someone to look at?

 

[Northernsoul55]

If SFC repaired the files successfully then there seems little point in
analysing the logs, as they are repaired.

Cheers

Dave