Possible issues with File System Filters 'FileInfo' and 'SymEFA' - causing system to shutdown

Hello.  Hopefully someone could help me with this issue?  It's driving me bonkers.

 

Since installing Norton Internet Security, I have had an issue with my computer randomly shutting itself down.  There doesn't seem to be a pattern to this except for the fact that, each time, the same two events show in my event log immediately prior to the shutdown.

 

Here they are:

 

File System Filter 'FileInfo' (6.1, ‎2009‎-‎07‎-‎13T17:34:25.000000000Z) has successfully loaded and registered with Filter Manager.

 

File System Filter 'SymEFA' (6.0, ‎2010‎-‎07‎-‎22T20:19:55.000000000Z) has successfully loaded and registered with Filter Manager.

 

The next ! Error in the system event log is:

The previous system shutdown at 2:09:56 PM on ‎1/‎8/‎2011 was unexpected. 

 

Upon restart, which occurs automatically, I'm given the option to restart in safe mode due to the system not shutting down properly.  I chose to restart in safe mode.  After windows safe mode loads, I check my event viewer (system) and have multiple errors that occur:

 

The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error:
The dependency service or group failed to start.

 

etc.  There are about 10 more similar errors, most of which seem to be related to networking.

 

Upon restarting the computer again, this time in 'normal' mode, the above errors do not reoccur. 

 

The reason I'm posting this here is that upon searching for infomation about 'SymEFA' and 'FileInfo', I found that the source is Norton.  If anyone could give me some assistance on this issue, I would greatly appreciate it.  This is a brand new computer and  I'm running Win7 Pro (64).  I'm not familiar at all with this OS, as I've been a dedicated XP user until now.  Is this an issue I'm having with Norton? Or should I look elsewhere for support??

 

 

 

There is other software installed, but nothing security related (ie antivirus, antimalware, etc), and I did not have any security-related software installed, nor trial versions of anything, before norton.  The computer was not purchased through a vendor.  The hardware came from NewEgg and was the system was built in my home.  All of the hardware was brand new.  I purchased the digital copy of Norton Internet Security about a week and a half after building this system and getting it up and running.

 

Is it possible that these network errors occur due to the computer not being shut down properly?  When the shutdown occurs, I can be in the middle of any random thing then, bam, the computer shuts down.  No warning at all.  Monitor black, tower quiet, 5 seconds later it reboots then prompts for safe mode/normal mode.

 

I don't have the network related errors until after I restart in safe mode.  Prior to the 'SymEFA' and 'FileInfo' events and the subsequent system shut down, everything is fine.  The network services that have issues while in safe mode do not occur before the restart. 

 

Thanks for the prompt response and assistance! :)

 

 

Safe mode does not have networking, so none of the services start.  That is likely normal in this case.  It will be a hardware issue.  Cable or card not plugged in quite right, could be over-heating, thermal paste insufficient, video card issues.  Did you also check compatibility on all of the components to each other?

 

The Norton files are loading successfully, so I don't think that's a part of the problem.  It could be that, depending on either how long the machine has been running, or whether you are performing an action that requires more performance from the graphics card may determine the shut down time frame. 

 

You could download Speedfan to see if it records any temperature fluctuations, and you might want to test the power supply.  You will need to install and run as administrator.  It is a very small but usefull app.  The download link is up in the menu bar.

 

http://www.almico.com/sfdownload.php

Hello.  Hopefully someone could help me with this issue?  It's driving me bonkers.

 

Since installing Norton Internet Security, I have had an issue with my computer randomly shutting itself down.  There doesn't seem to be a pattern to this except for the fact that, each time, the same two events show in my event log immediately prior to the shutdown.

 

Here they are:

 

File System Filter 'FileInfo' (6.1, ‎2009‎-‎07‎-‎13T17:34:25.000000000Z) has successfully loaded and registered with Filter Manager.

 

File System Filter 'SymEFA' (6.0, ‎2010‎-‎07‎-‎22T20:19:55.000000000Z) has successfully loaded and registered with Filter Manager.

 

The next ! Error in the system event log is:

The previous system shutdown at 2:09:56 PM on ‎1/‎8/‎2011 was unexpected. 

 

Upon restart, which occurs automatically, I'm given the option to restart in safe mode due to the system not shutting down properly.  I chose to restart in safe mode.  After windows safe mode loads, I check my event viewer (system) and have multiple errors that occur:

 

The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error:
A device attached to the system is not functioning.

 

The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error:
The dependency service or group failed to start.

 

etc.  There are about 10 more similar errors, most of which seem to be related to networking.

 

Upon restarting the computer again, this time in 'normal' mode, the above errors do not reoccur. 

 

The reason I'm posting this here is that upon searching for infomation about 'SymEFA' and 'FileInfo', I found that the source is Norton.  If anyone could give me some assistance on this issue, I would greatly appreciate it.  This is a brand new computer and  I'm running Win7 Pro (64).  I'm not familiar at all with this OS, as I've been a dedicated XP user until now.  Is this an issue I'm having with Norton? Or should I look elsewhere for support??

 

 

 

Hm...Funny you mention speedfan ^^  Just last week a friend walked me through Speedfan, Prime95 and FurMark.  My temps did run a bit hot during the torture test from Prime95, but I didn't have any problems during the test.

 

With FurMark, however, my system froze so I had to manually restart the system.  It occassionally freezes when I play WoW, so he was concerned with my graphics card.  Since adjusting my gpu fan from 50% to 75%, I haven't had the freezing problem. 

 

Test the power supply?  I had assumed 850 would be more than enough, but I can look into that as well.

 

This random shutdown issue has never occurred when I was running WoW or any other performance-demanding programs.  Today it occurred with only Ventrilo, Live msgr and Firefox open.  I wasn't doing anything in particular, just checking my facebook page. 

 

So if these networking events/errors occurred in safe mode w/o networking, then perhaps that's what caused those errors?  (duh on my part, I knew that lol).  I can try restarting in safe mode w/ networking when/if this issue occurs again, and see if those same network errors occur in my event log.  Assuming that safe mode causes the networking issues in the log, then that problem is solved.  But I'm back to the initial problem - the shut down.

 

As far as I know, compatibility is fine.  There is nothing to indicate there's a problem. Device manager looks fine, I dont get any notifications of issues.  The only device that I occassionally have malfunctions with is my headset, which is made by microsoft.  It's the microsoft lifechat headset w/ microphone.  Hm...I occassionally have issues with Ventrilo freezing on me as well, though closing the program and restarting it fixes the freeze.  I'll try updating the software and things for my headset and see if, by some odd chance, that's causing the issue.

 

I've considered reinstalling my OS for the last few weeks, but I dread it.  During the first week of using this computer, I was running system updates and, upon restart, two of the security updates failed and caused windows to not be able to load.  I had to do a sys restore in order to get things back to normal.  I narrowed the problem updates down to 2 by installing one at a time.  I still have not installed them.  It was suggested on the microsoft forums that I may have been "hacked" and I should reinstall my OS and start from scratch.  I suppose I may have to if these issues persist.

 

Aside from overheating or power issues, any other thoughts? 

 

 

 

 

I recommend that you view advanced system settings and go to the Startup and Recovery Settings. On the Startup and Recovery screen make sure that, for System failure, the option to write an event to the system log is enabled and the option to write debugging information is set to either Kernel or Complete memory dump. If the problem occurs again, you should see a blue screen indicating the likely culprit and a dump file might get saved. Once you have a dump file let me know and instructions will be provided to get it to me for examination.

 

SymEFA does exercise a lot of your system's memory so if the memory is having problems (possibly due to heating,) it is likely to expose the issue. After looking at the dump we might be able to point to a definitive issue or see some evidence that it is due to a memory problem.

Alright, so I haven't had another occurance of this issue until about 15 minutes ago.  The restart happened twice within 5 mins of each other.  System restarted, I chose to restart windows normally.  5 seconds after my desktop came up the system shut down again.  Upon reviewing my event log, once again, there are 2 events related to Norton Internet Security immediately prior to both of the shutdowns.

 

Directly before the first shutdown:

 

File System Filter 'BHDrvx64' (6.1, ‎2010‎-‎11‎-‎15T17:11:35.000000000Z) has successfully loaded and registered with Filter Manager.

 

File System Filter 'eeCtrl' (6.0, ‎2010‎-‎05‎-‎21T15:44:45.000000000Z) has successfully loaded and registered with Filter Manager.

 

After restart, and before second shutdown:

 

File System Filter 'SymEFA' (6.0, ‎2010‎-‎11‎-‎15T15:56:23.000000000Z) has successfully loaded and registered with Filter Manager.

 

File System Filter 'FileInfo' (6.1, ‎2009‎-‎07‎-‎13T17:34:25.000000000Z) has successfully loaded and registered with Filter Manager.

 

Can this really be coincidence???  Didn't have these issues before Norton. ><

 

As for the dump file, I checked my settings, and they are as you suggested already; I didn't have to change them.  I don't have the "Complete memory dump" option, only the "Kernel" or "small memory dump" options.  Even with these settings, I see no bsod when the system restarts.  I do have the option of selecting or deselecting the "restart automatically" upon System Failure.  Should I disable that?  My monitor simply goes black and my cpu is silent.

 

I have no knowledge of how to access a dump or I would post it right now.

 

 


Jishin wrote:

 

...

 

I do have the option of selecting or deselecting the "restart automatically" upon System Failure.  Should I disable that?  My monitor simply goes black and my cpu is silent.

 

...

 


Sorry, I forgot to tell you to make sure that automatic restart was disabled. This should help to point to the source of the problem as well.

 

P.S. In those same settings you'll find the location of the dump file. Look on your system for a file at that location and if it is there, save it away and let us know.

K, I changed the restart automatically setting.  We'll see what the BSOD says.  As for the dump file, the path just says:

 

%SystemRoot%\MEMORY.DMP

 

I can't seem to find that anywhere.  I search my main drive and nothing.  Not finding anything helpful to point me in the right direction online, either.  I suppose this is a registry thing, hm?

 

 

Run "%SystemRoot%" and an explorer window should open up to that path and show you the file. You may have to change some of the view settings to actually see the file though. Usually this path is something like c:\windows\system .