SYMEFA.SYS causes computer crashes (BSOD) when DVD inserted into drive

Aalandjana · May 1, 2011, 2:26pm

Hello,

I have newly purchased Norton Internet Security 2011 and installed it on my Windows XP computer (which prior to that worked just fine) and now every time I insert DVD disc into my DVD drive it goes to blue screen of death. The dump file points to symefa.sys which is NIS driver so that too confirms that it is an issue with Norton. I've seen topics on this forum where the crashes were random when computer idle, however mine is only when DVD inserted into DVD drive. Can anybody please look into this and offer some solution?

Thank you.

Allan

This is my dump file from the most recent crash.

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

Loading Dump File [C:\WINDOWS\Minidump\Mini050111-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 2600.xpsp_sp2_gdr.100216-1441

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553420

Debug session time: Sun May 1 12:13:48.718 2011 (UTC + 1:00)

System Uptime: 0 days 1:29:10.291

Loading Kernel Symbols

...............................................................

................................................................

.............................................

Loading User Symbols

Loading unloaded module list

..................................................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 806d0753, 9abeec84, 0}

*** WARNING: Unable to verify timestamp for SYMEFA.SYS

*** ERROR: Module load completed but symbols could not be loaded for SYMEFA.SYS

Probably caused by : SYMEFA.SYS ( SYMEFA+80371 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 806d0753, The address that the exception occurred at

Arg3: 9abeec84, Trap Frame

Arg4: 00000000

Debugging Details:

------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:

hal!ExAcquireFastMutex+f

806d0753 ff09 dec dword ptr [ecx]

TRAP_FRAME: 9abeec84 -- (.trap 0xffffffff9abeec84)

ErrCode = 00000002

eax=00000000 ebx=9abeedbc ecx=00000001 edx=8aa03b20 esi=871d0c30 edi=8796fb28

eip=806d0753 esp=9abeecf8 ebp=9abeed08 iopl=0 nv up ei pl nz ac po cy

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213

hal!ExAcquireFastMutex+0xf:

806d0753 ff09 dec dword ptr [ecx] ds:0023:00000001=????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 804ec6c4 to 806d0753

STACK_TEXT:

9abeecf4 804ec6c4 8796fb28 00000000 9abeedbc hal!ExAcquireFastMutex+0xf

9abeed08 b9da7bf8 871d0c30 875a2c20 00000000 nt!FsRtlLookupPerStreamContextInternal+0x14

9abeed6c b9db89bd 875a2c20 8796fb28 00000000 fltmgr!FltpGetStreamListCtrl+0x5a

9abeed88 b9da4b19 875a2c20 8796fb28 87260eb0 fltmgr!FltpCleanupStreamListCtrlForFileObjectClose+0x17

9abeeda4 b9da5059 9abeedbc 8796fb28 8aa03b20 fltmgr!FltpPassThrough+0x93

9abeedd4 804ee003 87260eb0 87b10a50 87b10a50 fltmgr!FltpDispatch+0x10d

9abeede4 80577fce 8796fb10 00000000 00000000 nt!IopfCallDriver+0x31

9abeee1c 805af89f 0096fb28 8796fb10 00000000 nt!IopDeleteFile+0x132

9abeee38 80522045 8796fb28 00000000 000009ac nt!ObpRemoveObjectRoutine+0xdf

9abeee5c 805b089f 87c03da0 e1000c08 87be1360 nt!ObfDereferenceObject+0x5f

9abeee74 805b0935 e1000c08 8796fb28 000009ac nt!ObpCloseHandleTableEntry+0x155

9abeeebc 805b0a6d 000009ac 00000000 00000000 nt!ObpCloseHandle+0x87

9abeeed0 8053ca48 800009ac 9abeef5c 804fd665 nt!NtClose+0x1d

9abeeed0 804fd665 800009ac 9abeef5c 804fd665 nt!KiFastCallEntry+0xf8

9abeef4c b9dba1b5 800009ac 00000080 9abef01c nt!ZwClose+0x11

9abeef5c b9d14371 800009ac 9abeefb4 9abeeff4 fltmgr!FltQueryVolumeInformation+0x39

WARNING: Stack unwind information not available. Following frames may be wrong.

9abef01c b9d13baa 00000003 00000000 9abef03c SYMEFA+0x80371

9abef040 b9db259b 9abef05c 00000005 00000003 SYMEFA+0x7fbaa

9abef074 b9db2b22 884eac20 00000005 80544300 fltmgr!FltpDoInstanceSetupNotification+0x4b

9abef0d4 b9db2ead 8a93b5c8 875a2c20 00000005 fltmgr!FltpInitInstance+0x272

9abef144 b9db2fb8 8a93b5c8 875a2c20 00000005 fltmgr!FltpCreateInstanceFromName+0x295

9abef1ac b9db9fde 8a93b5c8 875a2c20 00000005 fltmgr!FltpEnumerateRegistryInstances+0xf4

9abef1fc b9db08ec 875a2c20 9abef298 87624718 fltmgr!FltpDoFilterNotificationForNewVolume+0xe4

9abef240 b9da40e8 876244b0 9abef4b0 87260eb0 fltmgr!FltpFastIoQueryOpen+0x66

9abef260 b9db0927 000000f2 00000000 9abef298 fltmgr!FltpPerformFastIoCall+0x300

9abef2b8 805775fe 876244b0 9abef4b0 8772caf8 fltmgr!FltpFastIoQueryOpen+0xa1

9abef3a4 805b399a 8922fb50 00000000 87247198 nt!IopParseDevice+0x916

9abef42c 805afe7b 00000000 9abef46c 00000040 nt!ObpLookupObjectName+0x56a

9abef480 8056b3bd 00000000 00000000 9abef501 nt!ObOpenObjectByName+0xeb

9abef604 8053ca48 0385f860 0385f838 0385f88c nt!NtQueryAttributesFile+0xf1

9abef604 7c90e514 0385f860 0385f838 0385f88c nt!KiFastCallEntry+0xf8

0385f88c 00000000 00000000 00000000 00000000 0x7c90e514

STACK_COMMAND: kb

FOLLOWUP_IP:

SYMEFA+80371

b9d14371 ?? ???

SYMBOL_STACK_INDEX: 10

SYMBOL_NAME: SYMEFA+80371

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEFA

IMAGE_NAME: SYMEFA.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce1ac63

FAILURE_BUCKET_ID: 0x8E_SYMEFA+80371

BUCKET_ID: 0x8E_SYMEFA+80371