Norton Internet Security / Norton AntiVirus

[Shridhar]

Hi,

I am using Windows 7 x64 with NIS 11(18.5)

From last 2-3 weeks I've been getting BSODs very frequently and after debugging dump files with Windows Debugger and couple of other tools,

I've come to a conclusion that SYMEFA.SYS is the culprit.

I am able to boot normally into windows after BSODs  but these blue screens, crashing my computer when I am working heavily, really frustrate me.

Following are the reports:

 On Wed 2/16/2011 1:42:03 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\021611-27908-01.dmp
This was probably caused by the following module: symds64.sys (SYMDS64+0x2A47)
Bugcheck code: 0x19 (0x3, 0xFFFFF8A00E385D60, 0xFFFFF8A01233A700, 0xFFFFF8A00E385D60)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS
product: SymDS
company: Symantec Corporation
description: Symantec Data Store
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: symds64.sys (Symantec Data Store, Symantec Corporation).
Google query: symds64.sys Symantec Corporation BAD_POOL_HEADER




On Wed 2/16/2011 1:42:03 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: symefa64.sys (SYMEFA64+0x3DAE)
Bugcheck code: 0x19 (0x3, 0xFFFFF8A00E385D60, 0xFFFFF8A01233A700, 0xFFFFF8A00E385D60)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS
product: EFA
company: Symantec Corporation
description: Symantec Extended File Attributes
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: symefa64.sys (Symantec Extended File Attributes, Symantec Corporation).
Google query: symefa64.sys Symantec Corporation BAD_POOL_HEADER

Windows Debugger Report:

Please read attached file.

[Shridhar]

Another BSOD today noon, this time caused by SRTSP64.SYS.

it seems that NIS 11 is having some serious issue with Win7.

Please tell me how to get rid of this.

[reese_anschultz]

From the description you've provided, the source of the crash could be anything. Some Windows driver is corrupting memory and you've now seen crashes in three different drivers due to this memory corruption. Because the corruption is all over the place, my first suspect would be a hardware device driver corrupting memory while handling an interrupt. Do you have any unusual hardware devices or beta drivers installed?

I'm also going to ask for a copy of your dumps (although the mini-dump probably isn't very useful.) Somebody should be providing you with instructions about transferring the dumps soon. Unfortunately, with memory corruption issues, it can be very difficult, if not impossible, to determine who corrupted the memory when the corruption is detected much latter.

P.S. These errors might also be caused by over-clocked systems and/or failing memory but that probably isn't the case...

[Shridhar]

Hi reese:

Thank you for your reply.

I've uploaded the Complete Memory Dumps as instructed by Tim with the filename as my username Shridhar.

Please have a look at it.

I do not have any unusual driver instaled neither a beta one except that I have IE9 RC installed.

Thanks.

[reese_anschultz]

Thanks for the dump Shridhar!

This dump is from a 'crash' in SRTSP64. It matches your previous comments -- our driver is asking the operating system for some memory when the operating system detects that the memory allocation information has been damaged. If it is a hardware device that is causing the problem during an interrupt, as I suspect, it is long gone and it may be difficult to isolate from the dump. This still 'feels' like a hardware driver problem and it seems very unlikely to be related to having IE9 RC installed. I'm going to ask somebody more knowledgeable than myself to take a look at the dump as well to see if they can glean any more information from it.

[dennis_lawler]

Hi Shridhar,

We'd like to research this further if possible.  I've sent you a PM with the details.

Dennis

[Shridhar]

Hi dennis:

Thank you so much for your help.I have collected the crash dumps by following your insrtuctions.

Please let me know where to upload these dumps and how.

Do I upload them to the previously mentioned location ? 

Thanking you,

Shridhar

[Shridhar]

Hi:

Surprisingly no replies yet.(Weekend...may be).

I have collected the dumps....do I upload those to the previously mentioned location ? 

[dennis_lawler]

Yes, that would be great!  Thanks again Shridhar!

[Shridhar]

Hi dennis:

Dumps uploaded  with the name " Shridhar_MEMORY_New "

Please have a look.

Thank you for your help,

Shridhar.