SYMEFA.SYS causing BSOD on Windows 7 x64

Norton Security | Norton Internet Security
1

Hi,

I am using Windows 7 x64 with NIS 11(18.5)

 

From last 2-3 weeks I've been getting BSODs very frequently and after debugging dump files with Windows Debugger and couple of other tools,

I've come to a conclusion that SYMEFA.SYS is the culprit.

 

I am able to boot normally into windows after BSODs  but these blue screens, crashing my computer when I am working heavily, really frustrate me.

 

Following are the reports:

 

 On Wed 2/16/2011 1:42:03 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\021611-27908-01.dmp
This was probably caused by the following module: symds64.sys (SYMDS64+0x2A47)
Bugcheck code: 0x19 (0x3, 0xFFFFF8A00E385D60, 0xFFFFF8A01233A700, 0xFFFFF8A00E385D60)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\drivers\NISx64\1205000.07D\SYMDS64.SYS
product: SymDS
company: Symantec Corporation
description: Symantec Data Store
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: symds64.sys (Symantec Data Store, Symantec Corporation).
Google query: symds64.sys Symantec Corporation BAD_POOL_HEADER




On Wed 2/16/2011 1:42:03 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: symefa64.sys (SYMEFA64+0x3DAE)
Bugcheck code: 0x19 (0x3, 0xFFFFF8A00E385D60, 0xFFFFF8A01233A700, 0xFFFFF8A00E385D60)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\drivers\NISx64\1205000.07D\SYMEFA64.SYS
product: EFA
company: Symantec Corporation
description: Symantec Extended File Attributes
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: symefa64.sys (Symantec Extended File Attributes, Symantec Corporation).
Google query: symefa64.sys Symantec Corporation BAD_POOL_HEADER

 

Windows Debugger Report:

 

Please read attached file.

 

 

2

Another BSOD today noon, this time caused by SRTSP64.SYS.

it seems that NIS 11 is having some serious issue with Win7.

 

Please tell me how to get rid of this.

3

From the description you've provided, the source of the crash could be anything. Some Windows driver is corrupting memory and you've now seen crashes in three different drivers due to this memory corruption. Because the corruption is all over the place, my first suspect would be a hardware device driver corrupting memory while handling an interrupt. Do you have any unusual hardware devices or beta drivers installed?

 

I'm also going to ask for a copy of your dumps (although the mini-dump probably isn't very useful.) Somebody should be providing you with instructions about transferring the dumps soon. Unfortunately, with memory corruption issues, it can be very difficult, if not impossible, to determine who corrupted the memory when the corruption is detected much latter.

 

P.S. These errors might also be caused by over-clocked systems and/or failing memory but that probably isn't the case...

4

Hi reese:

 

Thank you for your reply.

I've uploaded the Complete Memory Dumps as instructed by Tim with the filename as my username Shridhar.

Please have a look at it.

I do not have any unusual driver instaled neither a beta one except that I have IE9 RC installed.

 

Thanks.

5

Thanks for the dump Shridhar!

 

This dump is from a 'crash' in SRTSP64. It matches your previous comments -- our driver is asking the operating system for some memory when the operating system detects that the memory allocation information has been damaged. If it is a hardware device that is causing the problem during an interrupt, as I suspect, it is long gone and it may be difficult to isolate from the dump. This still 'feels' like a hardware driver problem and it seems very unlikely to be related to having IE9 RC installed. I'm going to ask somebody more knowledgeable than myself to take a look at the dump as well to see if they can glean any more information from it.

6

Hi Shridhar,

 

We'd like to research this further if possible.  I've sent you a PM with the details.

 

Dennis

7

Hi dennis:

 

Thank you so much for your help.I have collected the crash dumps by following your insrtuctions.

Please let me know where to upload these dumps and how.

Do I upload them to the previously mentioned location ? 

 

Thanking you,

Shridhar

8

Hi:

 

Surprisingly no replies yet.(Weekend...may be).

I have collected the dumps....do I upload those to the previously mentioned location ? 

 

 

 

9

Yes, that would be great!  Thanks again Shridhar!

10

Hi dennis:

 

Dumps uploaded  with the name " Shridhar_MEMORY_New "

Please have a look.

 

Thank you for your help,

Shridhar.

11

Shridhar,

 

From the latest dump, it appears that you may have bad RAM.

 

Windows 7 has a built-in tool you can use to diagnose this:

 

http://windows.microsoft.com/en-US/windows7/Diagnosing-memory-problems-on-your-computer

 

You can also get to this tool by typing "memory" in the Start menu search bar, click "Windows Memory Diagnostic" in the search results, then clicking "Restart Now and check for problems (recommended)".

 

When your computer restarts, Windows will begin running a series of tests on your RAM to attempt to find problems with it.  There are actually many tests available, and some failures will not begin to appear until some time later.  You can change the "Test Mix" option from Standard to Extended, and Pass Count to 0 (then wait 6 hours or so) if the problems do not immediately manifest.

 

Dennis

12

Hi dennis:

 

Thank you so much for your help.I ran the test with the extended option for almost 9 hrs.

But it came up with " no problems have been found yet ".

I do not doubt you but is it seriously related to my RAM or anything else ?

 

Thank you,

Shridhar.

13

In the most recent crashdump, there was a single-bit error in video driver memory.

 

Generally, software errors do not manifest as random single-bit corruption - but hardware does.  Unfortunately, it sounds like the Windows system memory check did not coax it out.

 

When your machine crashes like this, does it occur while playing a game or movie?

14

Hi dennis:

 

No, my system crashed at random time whenever it did.

Sometimes it crashed even when computer was idle,sometimes while MS-WORD was open, etc.

 

But since there was an error in video memory, I think my Graphics Card / its drivers may be the cause of this whole issue.

I'll try to reinstall the drivers or card itself and then check the result and then notify you.

 

Thank you for your help,

Shridhar