Endpoint Protection Small Business Edition

  • Private Community
 View Only
Back to discussions
Expand all | Collapse all

SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

Migration User

Migration UserAug 04, 2010 01:32 AM

Try by upgrading to RU6a

  • 1.  SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Jul 28, 2010 02:30 PM
    Here is my crash dump.  I am running SEP 11.0.5002.333.  Our IT department pushes out updates so I do not have the ability to manually modify settings of SEP.  Is this fixed in an updated version of SEP or am I stuck crashing one (maybe two) time(s) a week?

    Loading Dump File [C:\Windows\Minidump\072710-24304-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16385.x86fre.win7_rtm.090713-1255
    Machine Name:
    Kernel base = 0x82a12000 PsLoadedModuleList = 0x82b5a810
    Debug session time: Tue Jul 27 09:07:09.310 2010 (UTC - 5:00)
    System Uptime: 0 days 23:26:55.776
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................................
    Loading User Symbols
    Loading unloaded module list
    .................
    Unable to load image \SystemRoot\system32\DRIVERS\teefer2.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for teefer2.sys
    *** ERROR: Module load completed but symbols could not be loaded for teefer2.sys
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {c0000005, 97f93ac5, 9017fc54, 9017f830}

    Probably caused by : teefer2.sys ( teefer2+4ac5 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 97f93ac5, The address that the exception occurred at
    Arg3: 9017fc54, Exception Record Address
    Arg4: 9017f830, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    teefer2+4ac5
    97f93ac5 8b770c          mov     esi,dword ptr [edi+0Ch]

    EXCEPTION_RECORD:  9017fc54 -- (.exr 0xffffffff9017fc54)
    ExceptionAddress: 97f93ac5 (teefer2+0x00004ac5)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000000
       Parameter[1]: 7269572c
    Attempt to read from address 7269572c

    CONTEXT:  9017f830 -- (.cxr 0xffffffff9017f830)
    eax=00000000 ebx=00000001 ecx=00000357 edx=97f9a842 esi=88df2008 edi=72695720
    eip=97f93ac5 esp=9017fd1c ebp=82e25700 iopl=0         nv up ei pl nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
    teefer2+0x4ac5:
    97f93ac5 8b770c          mov     esi,dword ptr [edi+0Ch] ds:0023:7269572c=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  STRING_DEREFERENCE

    PROCESS_NAME:  System

    CURRENT_IRQL:  1

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  00000000

    EXCEPTION_PARAMETER2:  7269572c

    READ_ADDRESS: GetPointerFromAddress: unable to read from 82b7a718
    Unable to read MiSystemVaType memory at 82b5a160
     7269572c

    FOLLOWUP_IP:
    teefer2+4ac5
    97f93ac5 8b770c          mov     esi,dword ptr [edi+0Ch]

    BUGCHECK_STR:  0x7E

    LAST_CONTROL_TRANSFER:  from 97f93c18 to 97f93ac5

    STACK_TEXT:  
    WARNING: Stack unwind information not available. Following frames may be wrong.
    9017fd24 97f93c18 00000000 8c332c13 873bf000 teefer2+0x4ac5
    00000000 00000000 00000000 00000000 00000000 teefer2+0x4c18


    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  teefer2+4ac5

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: teefer2

    IMAGE_NAME:  teefer2.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a0b1eba

    STACK_COMMAND:  .cxr 0xffffffff9017f830 ; kb

    FAILURE_BUCKET_ID:  0x7E_teefer2+4ac5

    BUCKET_ID:  0x7E_teefer2+4ac5

    Followup: MachineOwner
    ---------


  • 2.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Jul 28, 2010 02:36 PM
    install verion 11.0.6000 should fix the issue.


  • 3.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Jul 28, 2010 02:36 PM

    Are you running any other security or encryption software on this system?


  • 4.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Jul 28, 2010 02:50 PM

    We utilitze LANDesk to have updates pushed out but other than that, there is no other security or encryption software on the system that I know of.


  • 5.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Jul 28, 2010 02:51 PM

    I will ask our IT department if this is possible.

    Thanks for the suggestion


  • 6.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Aug 03, 2010 10:37 PM
    I got a similar BSOD pointing at teefer2.sys on Win 7 & Dell E6400. Does 11.0.6 fix this problem?
     Here is the crashdump analysis:

    1: kd> !analyze -v

    *******************************************************************************

    * *

    * Bugcheck Analysis *

    * *

    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)

    Invalid system memory was referenced. This cannot be protected by try-except,

    it must be protected by a Probe. Typically the address is just plain bad or it

    is pointing at freed memory.

    Arguments:

    Arg1: ee61546e, memory referenced.

    Arg2: 00000000, value 0 = read operation, 1 = write operation.

    Arg3: 94bdfac5, If non-zero, the instruction address which referenced the bad memory

    address.

    Arg4: 00000002, (reserved)

    Debugging Details:

    ------------------

    *** WARNING: Unable to verify timestamp for teefer2.sys

    *** ERROR: Module load completed but symbols could not be loaded for teefer2.sys

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!_KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!_KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!_KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!_KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!_KPRCB ***

    *** ***

    *************************************************************************

    *************************************************************************

    *** ***

    *** ***

    *** Your debugger is not using the correct symbols ***

    *** ***

    *** In order for this command to work properly, your symbol path ***

    *** must point to .pdb files that have full type information. ***

    *** ***

    *** Certain .pdb files (such as the public OS symbols) do not ***

    *** contain the required information. Contact the group that ***

    *** provided you with these symbols if you need this command to ***

    *** work. ***

    *** ***

    *** Type referenced: nt!_KPRCB ***

    *** ***

    *************************************************************************

    ADDITIONAL_DEBUG_TEXT:

    Use '!findthebuild' command to search for the target build information.

    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: teefer2

    FAULTING_MODULE: 82a44000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a0b1eba

    READ_ADDRESS: ee61546e

    FAULTING_IP:

    teefer2+4ac5

    94bdfac5 8b770c mov esi,dword ptr [edi+0Ch]

    MM_INTERNAL_CODE: 2

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x50

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from 82a8a638 to 82ac9903

    STACK_TEXT:

    WARNING: Stack unwind information not available. Following frames may be wrong.

    8aab2c90 82a8a638 00000000 ee61546e 00000000 nt+0x85903

    8aab2d24 94bdfc18 00000000 88936c13 86a6a000 nt+0x46638

    8aab2d3c 94bdfcea 00000000 867b3d48 8aab2d90 teefer2+0x4c18

    8aab2d40 00000000 867b3d48 8aab2d90 00000000 teefer2+0x4cea

    　

    STACK_COMMAND: .bugcheck ; kb

    FOLLOWUP_IP:

    teefer2+4ac5

    94bdfac5 8b770c mov esi,dword ptr [edi+0Ch]

    SYMBOL_NAME: teefer2+4ac5

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: teefer2.sys

    BUCKET_ID: WRONG_SYMBOLS

    Followup: MachineOwner

    ---------



  • 7.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Aug 04, 2010 01:32 AM
    Try by upgrading to RU6a


  • 8.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 01, 2010 01:17 PM

    My IT department doesn't have ru6 yet ready to give to users so I haven't been able to try it and am still experiencing issues.  If you are able to try and use it ru6, let me know if it works for you.

    Else, can you download RU6 somewhere?


  • 9.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 01, 2010 01:25 PM

    RU6 MP1 (11.0.6100.645) is the newest build available. Log in to fileconnect to get the latest version.

    https://fileconnect.symantec.com/licenselogin.jsp?localeStr=en_US


  • 10.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 01, 2010 01:51 PM

    Where can I find the serial #?

    Symantec is supplied on our images I believe so I don't have a physical copy.


  • 11.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 01, 2010 01:54 PM

    Symantec licensing team might have sent you have an email
    it should have the serial number



  • 12.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 01, 2010 04:15 PM

    I assume our IT department has the serial number but is there a way for me to figure it out without having to call IT?


  • 13.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 01, 2010 05:41 PM

    I used this
    http://seer.entsupport.symantec.com/docs/notes/files/sep/sep_11.0.5/11.0ru5to11.0ru6client-onlypatch32bit.html
    to upgrade to RU6.  It now shows 11.0.6000.550

    Hopefully no more BSOD's


  • 14.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Sep 02, 2010 01:01 AM
    It would  be great if you do not face any bsod's now. However, 11.0.6000.550 is not the latest. Until you get the  latest  version, if you still face the issue, then you could try  to remove the  Network threat  protection component.

    Go to Add/Remove  programs, and  select  Symantec Endpoint  protection, and  change. Uncheck Network threat  protection, and finish the  wizard.


  • 15.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Feb 24, 2011 09:29 AM

    We have had similar BSODs on Dell E6400 XFRs with 11.0.6100.645 and 11.0.6200.754 relating to SYMEVENT.SYS when the systems are moved from one dock to another dock. The BSODs occur after a short delay after the unit is docked.

    Heres a sample dump:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [F:\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
    Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.x86fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0x82c08000 PsLoadedModuleList = 0x82d50810
    Debug session time: Tue Feb 22 10:01:59.628 2011 (UTC - 5:00)
    System Uptime: 0 days 0:09:35.209
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    ...............
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 7ffdf00c).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    .............
    0: kd> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 925d72a3, The address that the exception occurred at
    Arg3: c1b3f41c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for SYMEVENT.SYS -
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for SYMTDI.SYS -
    *** ERROR: Module load completed but symbols could not be loaded for nmdrv.sys

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    SYMEVENT!SYMEvent_AllocVMData+c713
    925d72a3 3971a0          cmp     dword ptr [ecx-60h],esi

    TRAP_FRAME:  c1b3f41c -- (.trap 0xffffffffc1b3f41c)
    .trap 0xffffffffc1b3f41c
    ErrCode = 00000000
    eax=865082b0 ebx=925e4b1c ecx=00000065 edx=925e4d2c esi=00001f60 edi=925e4b18
    eip=925d72a3 esp=c1b3f490 ebp=c1b3f494 iopl=0         nv up ei pl nz ac pe cy
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
    SYMEVENT!SYMEvent_AllocVMData+0xc713:
    925d72a3 3971a0          cmp     dword ptr [ecx-60h],esi ds:0023:00000005=????????
    .trap
    Resetting default scope

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  SmartMCT.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from 82cc5382 to 82ce4d10

    STACK_TEXT: 
    c1b3ef84 82cc5382 0000008e c0000005 925d72a3 nt!KeBugCheckEx+0x1e
    c1b3f3ac 82c4c036 c1b3f3c8 00000000 c1b3f41c nt!KiDispatchException+0x1ac
    c1b3f414 82c4bfea c1b3f494 925d72a3 badb0d00 nt!CommonDispatchException+0x4a
    c1b3f494 925d7a8f 00001f60 00000001 867a9448 nt!Kei386EoiHelper+0x192
    WARNING: Stack unwind information not available. Following frames may be wrong.
    c1b3f4b4 94a651f4 00000002 00001f60 867a9448 SYMEVENT!SYMEvent_AllocVMData+0xceff
    c1b3f4d4 94a51311 85e02da0 c1b3f500 94a51e60 SYMTDI!ConfigEnumOpen+0xac04
    c1b3f4e0 94a51e60 85e02da0 94a51d60 867a9448 SYMTDI!GetGUIDevice+0x1421
    c1b3f500 94a51cd1 00000000 00000000 00000000 SYMTDI!isManualStart+0x480
    c1b3f51c 82c70b33 88d33300 864824c8 867a9448 SYMTDI!isManualStart+0x2f1
    c1b3f564 83a160cd 889c5c88 8666d810 8a7200b0 nt!IopfCompleteRequest+0x128
    c1b3f588 82c444bc 8d410df0 864824c8 86482580 tdx!TdxTdiDispatchCreate+0x213
    c1b3f5a0 94a51d53 864824c8 867a9448 00000000 nt!IofCallDriver+0x63
    c1b3f5b4 94a5247e 867a9448 86482578 88d33300 SYMTDI!isManualStart+0x373
    c1b3f5d8 94a524ba 88d33300 94a50c70 c1b3f600 SYMTDI!isManualStart+0xa9e
    c1b3f5e8 82c444bc 88d33300 864824c8 8648259c SYMTDI!isManualStart+0xada
    c1b3f600 94ab2735 94aea9a2 8a51bef0 00000000 nt!IofCallDriver+0x63
    c1b3f624 94ab2a4f 88d33300 864824c8 86797f80 nmdrv+0x1c735
    c1b3f670 94ab35bd 88d4f4e0 864824c8 c1b3f698 nmdrv+0x1ca4f
    c1b3f680 82c444bc 88d4f4e0 864824c8 86797fdc nmdrv+0x1d5bd
    c1b3f698 82e486ad ef73904d c1b3f840 00000000 nt!IofCallDriver+0x63
    c1b3f770 82e2926b 889c5c88 a5ce4518 86596568 nt!IopParseDevice+0xed7
    c1b3f7ec 82e4f2d9 00000000 c1b3f840 00000240 nt!ObpLookupObjectName+0x4fa
    c1b3f848 82e4762b c1b3fa9c 85ce4518 c1b3f800 nt!ObOpenObjectByName+0x165
    c1b3f8c4 82e7ee29 c1b3fadc 02000000 c1b3fa9c nt!IopCreateFile+0x673
    c1b3f920 94b74031 c1b3fadc 02000000 c1b3fa9c nt!IoCreateFileEx+0x9e
    c1b3fb64 94b70fb0 86800458 8a70f558 00000016 afd!AfdTdiCreateAO+0x573
    c1b3fbec 94b7d504 884b5038 88d4b030 c1b3fc14 afd!AfdBind+0x37a
    c1b3fbfc 82c444bc 88d4b030 885e0df8 885e0df8 afd!AfdDispatchDeviceControl+0x3b
    c1b3fc14 82e45f6e 884b5038 885e0df8 885e0ed4 nt!IofCallDriver+0x63
    c1b3fc34 82e62d5f 88d4b030 884b5038 00000000 nt!IopSynchronousServiceTail+0x1f8
    c1b3fcd0 82e6553a 88d4b030 885e0df8 00000000 nt!IopXxxControlFile+0x6aa
    c1b3fd04 82c4b44a 000006d0 0000061c 00000000 nt!NtDeviceIoControlFile+0x2a
    c1b3fd04 76f864f4 000006d0 0000061c 00000000 nt!KiFastCallEntry+0x12a
    0012fc58 00000000 00000000 00000000 00000000 0x76f864f4


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    SYMEVENT!SYMEvent_AllocVMData+c713
    925d72a3 3971a0          cmp     dword ptr [ecx-60h],esi

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  SYMEVENT!SYMEvent_AllocVMData+c713

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: SYMEVENT

    IMAGE_NAME:  SYMEVENT.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP:  4bc7bdeb

    FAILURE_BUCKET_ID:  0x8E_SYMEVENT!SYMEvent_AllocVMData+c713

    BUCKET_ID:  0x8E_SYMEVENT!SYMEvent_AllocVMData+c713

    Followup: MachineOwner
    ---------

    eax=82d3f17c ebx=c1b3f300 ecx=0000002c edx=00000000 esi=82d31d20 edi=00000000
    eip=82ce4d10 esp=c1b3ef68 ebp=c1b3ef84 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000206
    nt!KeBugCheckEx+0x1e:
    82ce4d10 cc              int     3
    ChildEBP RetAddr  Args to Child             
    c1b3ef84 82cc5382 0000008e c0000005 925d72a3 nt!KeBugCheckEx+0x1e
    c1b3f3ac 82c4c036 c1b3f3c8 00000000 c1b3f41c nt!KiDispatchException+0x1ac
    c1b3f414 82c4bfea c1b3f494 925d72a3 badb0d00 nt!CommonDispatchException+0x4a (FPO: [0,20,0])
    c1b3f494 925d7a8f 00001f60 00000001 867a9448 nt!Kei386EoiHelper+0x192
    WARNING: Stack unwind information not available. Following frames may be wrong.
    c1b3f4b4 94a651f4 00000002 00001f60 867a9448 SYMEVENT!SYMEvent_AllocVMData+0xceff
    c1b3f4d4 94a51311 85e02da0 c1b3f500 94a51e60 SYMTDI!ConfigEnumOpen+0xac04
    c1b3f4e0 94a51e60 85e02da0 94a51d60 867a9448 SYMTDI!GetGUIDevice+0x1421
    c1b3f500 94a51cd1 00000000 00000000 00000000 SYMTDI!isManualStart+0x480
    c1b3f51c 82c70b33 88d33300 864824c8 867a9448 SYMTDI!isManualStart+0x2f1
    c1b3f564 83a160cd 889c5c88 8666d810 8a7200b0 nt!IopfCompleteRequest+0x128
    c1b3f588 82c444bc 8d410df0 864824c8 86482580 tdx!TdxTdiDispatchCreate+0x213 (FPO: [Non-Fpo])
    c1b3f5a0 94a51d53 864824c8 867a9448 00000000 nt!IofCallDriver+0x63
    c1b3f5b4 94a5247e 867a9448 86482578 88d33300 SYMTDI!isManualStart+0x373
    c1b3f5d8 94a524ba 88d33300 94a50c70 c1b3f600 SYMTDI!isManualStart+0xa9e
    c1b3f5e8 82c444bc 88d33300 864824c8 8648259c SYMTDI!isManualStart+0xada
    c1b3f600 94ab2735 94aea9a2 8a51bef0 00000000 nt!IofCallDriver+0x63
    c1b3f624 94ab2a4f 88d33300 864824c8 86797f80 nmdrv+0x1c735
    c1b3f670 94ab35bd 88d4f4e0 864824c8 c1b3f698 nmdrv+0x1ca4f
    c1b3f680 82c444bc 88d4f4e0 864824c8 86797fdc nmdrv+0x1d5bd
    c1b3f698 82e486ad ef73904d c1b3f840 00000000 nt!IofCallDriver+0x63
    c1b3f770 82e2926b 889c5c88 a5ce4518 86596568 nt!IopParseDevice+0xed7
    c1b3f7ec 82e4f2d9 00000000 c1b3f840 00000240 nt!ObpLookupObjectName+0x4fa
    c1b3f848 82e4762b c1b3fa9c 85ce4518 c1b3f800 nt!ObOpenObjectByName+0x165
    c1b3f8c4 82e7ee29 c1b3fadc 02000000 c1b3fa9c nt!IopCreateFile+0x673
    c1b3f920 94b74031 c1b3fadc 02000000 c1b3fa9c nt!IoCreateFileEx+0x9e
    c1b3fb64 94b70fb0 86800458 8a70f558 00000016 afd!AfdTdiCreateAO+0x573 (FPO: [Non-Fpo])
    c1b3fbec 94b7d504 884b5038 88d4b030 c1b3fc14 afd!AfdBind+0x37a (FPO: [Non-Fpo])
    c1b3fbfc 82c444bc 88d4b030 885e0df8 885e0df8 afd!AfdDispatchDeviceControl+0x3b (FPO: [Non-Fpo])
    c1b3fc14 82e45f6e 884b5038 885e0df8 885e0ed4 nt!IofCallDriver+0x63
    c1b3fc34 82e62d5f 88d4b030 884b5038 00000000 nt!IopSynchronousServiceTail+0x1f8
    c1b3fcd0 82e6553a 88d4b030 885e0df8 00000000 nt!IopXxxControlFile+0x6aa
    c1b3fd04 82c4b44a 000006d0 0000061c 00000000 nt!NtDeviceIoControlFile+0x2a
    c1b3fd04 76f864f4 000006d0 0000061c 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ c1b3fd34)
    0012fc58 00000000 00000000 00000000 00000000 0x76f864f4
    start    end        module name
    80ba7000 80baf000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
    81e00000 81e0b000   mouhid   mouhid.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
    81e0b000 81e17000   cvusbdrv cvusbdrv.sys Thu Oct 29 14:37:32 2009 (4AE9E0EC)
    81e17000 81e23c80   ftdibus  ftdibus.sys  Thu Oct 22 11:11:08 2009 (4AE0760C)
    81e2a000 81e96000   stwrt    stwrt.sys    Wed Mar 10 01:03:06 2010 (4B97361A)
    81e96000 81ec5000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
    81ec5000 81ede000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
    81ede000 81f1b000   HSXHWAZL HSXHWAZL.sys Fri Feb 13 15:58:15 2009 (4995DEE7)
    81f1b000 81f2c000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
    81f2c000 81f39000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
    81f39000 81f4a000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
    81f4a000 81f5d000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
    81f5d000 81f63480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
    81f64000 81f65700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
    81f66000 81f7d000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
    81f7d000 81f89000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
    81f89000 81facb80   usbvideo usbvideo.sys Wed Mar 03 23:04:40 2010 (4B8F3158)
    81fad000 81fd04c0   CtClsFlt CtClsFlt.sys Wed Sep 16 04:07:41 2009 (4AB09CCD)
    81ff6000 82000000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
    82000000 8200b000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
    8200b000 8210d000   HSX_DPV  HSX_DPV.sys  Fri Feb 13 16:00:17 2009 (4995DF61)
    8210d000 821c2000   HSX_CNXT HSX_CNXT.sys Fri Feb 13 15:57:25 2009 (4995DEB5)
    821c2000 821cf000   modem    modem.sys    Mon Jul 13 19:55:24 2009 (4A5BC96C)
    821cf000 821f3000   IntcHdmi IntcHdmi.sys Mon Dec 14 10:12:32 2009 (4B2655E0)
    821f3000 821fd000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
    821fd000 821fe080   dump_ephdvdmp dump_ephdvdmp.sys Tue Aug 26 11:51:06 2008 (48B4266A)
    82c08000 83018000   nt       ntkrpamp.exe Fri Jun 18 23:55:24 2010 (4C1C3FAC)
    83018000 8304f000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
    83200000 83221000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
    8322e000 832a6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
    832a6000 832b7000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
    832b7000 832bf000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
    832bf000 83301000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
    83301000 833ac000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
    833ac000 833e0000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
    83800000 83823000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
    8382f000 838a0000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
    838a0000 838ae000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
    838ae000 838f6000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
    838f6000 838ff000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
    838ff000 83900700   ephdlink ephdlink.sys Tue Aug 26 11:51:07 2008 (48B4266B)
    83901000 83909000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
    83909000 83933000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
    83933000 8393e000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
    8393e000 8394f000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
    8394f000 83957000   compbatt compbatt.sys Mon Jul 13 19:19:18 2009 (4A5BC0F6)
    83957000 83962000   BATTC    BATTC.SYS    Mon Jul 13 19:19:15 2009 (4A5BC0F3)
    83962000 83972000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
    83972000 839bd000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
    839bd000 839c4000   pciide   pciide.sys   Mon Jul 13 19:11:19 2009 (4A5BBF17)
    839c4000 839d2000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
    839d2000 839e8000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
    839e8000 839fb000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
    83a00000 83a09300   PxHelp20 PxHelp20.sys Tue Jun 23 19:16:17 2009 (4A416241)
    83a0a000 83a21000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
    83a22000 83bd7000   iaStor   iaStor.sys   Wed Mar 03 21:30:51 2010 (4B8F1B5B)
    83bd7000 83be0000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
    83be0000 83be9000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
    83be9000 83bfa000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
    83bfa000 83bfd480   eafsprot eafsprot.sys Tue Aug 26 11:51:06 2008 (48B4266A)
    8c600000 8c60e000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
    8c60e000 8c617000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
    8c617000 8c625000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
    8c634000 8c763000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
    8c763000 8c78e000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
    8c78e000 8c7a1000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
    8c7a1000 8c7fe000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
    8c800000 8c80b000   Msfs     Msfs.SYS     Mon Jul 13 19:11:26 2009 (4A5BBF1E)
    8c80b000 8c816000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
    8c818000 8c8cf000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
    8c8cf000 8c90d000   NETIO    NETIO.SYS    Thu Apr 08 22:32:21 2010 (4BBE91B5)
    8c90d000 8c932000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
    8c932000 8c95f000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
    8c95f000 8c991000   fvevol   fvevol.sys   Mon Jul 13 19:13:01 2009 (4A5BBF7D)
    8c991000 8c9a6300   EPHDXLAT EPHDXLAT.sys Tue Aug 26 11:51:07 2008 (48B4266B)
    8c9a7000 8c9b8000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
    8c9b8000 8c9dd000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
    8c9ea000 8c9f2000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
    8c9f2000 8c9fa000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
    8ca00000 8ca10000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
    8ca10000 8ca18000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
    8ca18000 8ca20000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
    8ca24000 8cb6d000   tcpip    tcpip.sys    Sun Jun 13 23:36:59 2010 (4C15A3DB)
    8cb6d000 8cb9e000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
    8cb9e000 8cba6380   vmstorfl vmstorfl.sys Mon Jul 13 19:28:44 2009 (4A5BC32C)
    8cba7000 8cbe6000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
    8cbe6000 8cbee000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
    8cbee000 8cbf9000   PBADRV   PBADRV.sys   Mon Jan 07 13:52:14 2008 (478274DE)
    90e00000 90e1f000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
    90e1f000 90e2c000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
    90e2c000 90fe1000   dump_iaStor dump_iaStor.sys Wed Mar 03 21:30:51 2010 (4B8F1B5B)
    92400000 92413580   NAVENG   NAVENG.SYS   Mon Dec 13 20:42:27 2010 (4D06CB83)
    92414000 9241d080   SRTSPX   SRTSPX.SYS   Tue Jul 27 02:23:41 2010 (4C4E7B6D)
    9241e000 92425000   Null     Null.SYS     Mon Jul 13 19:11:12 2009 (4A5BBF10)
    92425000 9242c000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
    92433000 9247e000   SRTSP    SRTSP.SYS    Tue Jul 27 02:23:23 2010 (4C4E7B5B)
    9247e000 925c8900   NAVEX15  NAVEX15.SYS  Mon Dec 13 20:51:18 2010 (4D06CD96)
    925c9000 925ee000   SYMEVENT SYMEVENT.SYS Thu Apr 15 21:31:23 2010 (4BC7BDEB)
    925ee000 925fa000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
    92820000 9285f000   WavxDMgr WavxDMgr.sys Tue Jan 19 10:46:43 2010 (4B55D3E3)
    9285f000 92879000   WudfPf   WudfPf.sys   Fri Jan 15 02:04:13 2010 (4B50136D)
    92879000 92881c00   WinUSB   WinUSB.sys   Thu Sep 10 23:00:12 2009 (4AA9BD3C)
    92882000 928a2500   WUDFRd   WUDFRd.sys   Fri Jan 15 02:04:39 2010 (4B501387)
    928a3000 928af000   scfilter scfilter.sys Mon Jul 13 19:33:50 2009 (4A5BC45E)
    928af000 928bf000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
    928bf000 92905000   nwifi    nwifi.sys    Mon Jul 13 19:51:59 2009 (4A5BC89F)
    92905000 92915000   ndisuio  ndisuio.sys  Mon Jul 13 19:53:51 2009 (4A5BC90F)
    92915000 92928000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
    92928000 929ad000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
    929ad000 929c6000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
    929c6000 929d8000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
    929d8000 929fb000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:32:02 2010 (4B88CA72)
    94a00000 94a1f000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
    94a1f000 94a30000   vwififlt vwififlt.sys Mon Jul 13 19:52:03 2009 (4A5BC8A3)
    94a30000 94a3e000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
    94a3e000 94a6a480   SYMTDI   SYMTDI.SYS   Wed Jun 17 17:11:02 2009 (4A395BE6)
    94a6b000 94a74000   nmutilnt nmutilnt.sys Fri Apr 09 06:28:03 2010 (4BBF0133)
    94a74000 94a7e000   nmroam   nmroam.sys   Fri Apr 09 06:28:47 2010 (4BBF015F)
    94a7e000 94a95de0   fsclm    fsclm.sys    Wed Jul 17 07:21:41 2002 (3D355345)
    94a96000 94b5c000   nmdrv    nmdrv.sys    Fri Apr 09 06:30:52 2010 (4BBF01DC)
    94b5c000 94bb6000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
    94bb6000 94be8000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
    94be8000 94bef000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
    94bef000 94bff000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
    96220000 9628a000   SPBBCDrv SPBBCDrv.sys Mon Dec 14 23:39:00 2009 (4B2712E4)
    9628a000 962cb000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
    962cb000 962d5000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
    962d5000 962df000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
    962df000 9633d000   eeCtrl   eeCtrl.sys   Fri May 21 17:44:53 2010 (4BF6FED5)
    9633d000 9635a000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Fri May 21 17:44:53 2010 (4BF6FED5)
    9635a000 96366000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
    96366000 963ca000   csc      csc.sys      Mon Jul 13 19:15:08 2009 (4A5BBFFC)
    963ca000 963e2000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
    963e2000 963f0000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
    99600000 99616000   ftser2k  ftser2k.sys  Thu Oct 22 11:09:28 2009 (4AE075A8)
    99616000 99631000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
    9965c000 996a7000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
    996a7000 996bf000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
    996bf000 996e1000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
    996e1000 996f9000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
    996f9000 99710000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
    99710000 99721000   nmvnic   nmvnic.sys   Fri Apr 09 06:34:11 2010 (4BBF02A3)
    99721000 9972b000   rdpbus   rdpbus.sys   Mon Jul 13 20:02:40 2009 (4A5BCB20)
    9972b000 9975f000   ks       ks.sys       Wed Mar 03 22:57:52 2010 (4B8F2FC0)
    9975f000 9976d000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
    9976d000 997b1000   usbhub   usbhub.sys   Fri Dec 04 01:51:51 2009 (4B18B187)
    997b1000 997d4000   xtouch   xtouch.sys   Mon Jul 06 06:28:03 2009 (4A51D1B3)
    99a00000 99a1f000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
    99a1f000 9a0a5000   igdkmd32 igdkmd32.sys Mon Jan 25 20:42:39 2010 (4B5E488F)
    9a0a5000 9a15c000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 20:48:33 2009 (4AC54DE1)
    9a15c000 9a195000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:25:25 2009 (4A5BC265)
    9a195000 9a1cf000   e1y6232  e1y6232.sys  Fri Jun 12 21:16:04 2009 (4A32FDD4)
    9a1cf000 9a1da000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
    9a1da000 9a1e9000   usbehci  usbehci.sys  Fri Dec 04 01:51:10 2009 (4B18B15E)
    9a1e9000 9a200000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
    9ac00000 9ac0b000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
    9ac0b000 9ac0c380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
    9ac14000 9aead000   bcmwl6   bcmwl6.sys   Thu Jan 21 22:30:34 2010 (4B591BDA)
    9aead000 9aeb7000   vwifibus vwifibus.sys Mon Jul 13 19:52:02 2009 (4A5BC8A2)
    9aeb7000 9aee5000   pcmcia   pcmcia.sys   Mon Jul 13 19:19:29 2009 (4A5BC101)
    9aee5000 9af11000   1394ohci 1394ohci.sys Wed Oct 14 23:02:08 2009 (4AD690B0)
    9af11000 9af2a000   sdbus    sdbus.sys    Wed Dec 16 22:47:05 2009 (4B29A9B9)
    9af2a000 9af3b000   rimmptsk rimmptsk.sys Thu Jun 25 03:58:09 2009 (4A432E11)
    9af3b000 9af53000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
    9af53000 9af95000   Apfiltr  Apfiltr.sys  Wed Mar 10 04:20:05 2010 (4B976445)
    9af95000 9afa2000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
    9afa2000 9afaf000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
    9afb9000 9afbc700   CmBatt   CmBatt.sys   Mon Jul 13 19:19:18 2009 (4A5BC0F6)
    9afbd000 9afc6000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:19:16 2009 (4A5BC0F4)
    9afc6000 9afd8000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
    9afd8000 9afe5000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
    9afe5000 9aff7000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
    9d4a0000 9d6eb000   win32k   win32k.sys   Tue Oct 19 23:00:01 2010 (4CBE5B31)
    9d700000 9d709000   TSDDD    TSDDD.dll    Mon Jul 13 20:01:40 2009 (4A5BCAE4)
    9d730000 9d74e000   cdd      cdd.dll      Mon Jul 13 21:04:18 2009 (4A5BD992)
    b6000000 b6008000   BCM42RLY BCM42RLY.sys Thu Jan 21 22:31:27 2010 (4B591C0F)
    b600f000 b605e000   srv2     srv2.sys     Thu Aug 26 23:30:45 2010 (4C773165)
    b605e000 b60af000   srv      srv.sys      Thu Aug 26 23:31:26 2010 (4C77318E)
    b60af000 b60d3000   rfcomm   rfcomm.sys   Mon Jul 13 19:51:41 2009 (4A5BC88D)
    b60d3000 b60e0000   BthEnum  BthEnum.sys  Mon Jul 13 19:51:35 2009 (4A5BC887)
    b60e0000 b60fb000   bthpan   bthpan.sys   Mon Jul 13 19:51:43 2009 (4A5BC88F)
    b60fb000 b616e000   btwavdt  btwavdt.sys  Thu Jun 25 01:49:48 2009 (4A430FFC)
    b616e000 b61ef000   btwaudio btwaudio.sys Wed Jul 01 09:54:29 2009 (4A4B6A95)
    b61ef000 b61fa000   btwl2cap btwl2cap.sys Fri Apr 03 20:28:35 2009 (49D6A9B3)
    b61fa000 b61fcd80   btwrchid btwrchid.sys Thu Jun 25 01:51:31 2009 (4A431063)
    b7c00000 b7c25000   rdpdr    rdpdr.sys    Mon Jul 13 20:02:56 2009 (4A5BCB30)
    b7c25000 b7c2f000   tdtcp    tdtcp.sys    Mon Jul 13 20:01:37 2009 (4A5BCAE1)
    b7c3b000 b7c76000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
    b7c76000 b7c91000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
    b7c91000 b7c9e000   tssecsrv tssecsrv.sys Mon Jul 13 20:01:50 2009 (4A5BCAEE)
    b7ca9000 b7cac180   mdmxsdk  mdmxsdk.sys  Mon Jun 19 17:26:59 2006 (449716A3)
    b7cad000 b7d44000   peauth   peauth.sys   Mon Jul 13 20:35:44 2009 (4A5BD2E0)
    b7d44000 b7d4e000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
    b7d4e000 b7d6f000   srvnet   srvnet.sys   Thu Aug 26 23:30:39 2010 (4C77315F)
    b7d6f000 b7d81000   BTHUSB   BTHUSB.sys   Mon Jul 13 19:51:36 2009 (4A5BC888)
    b7d81000 b7de5000   bthport  bthport.sys  Mon Jul 13 19:51:30 2009 (4A5BC882)
    b7de5000 b7df2000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
    b7df2000 b7dfa000   XAudio32 XAudio32.sys Wed Apr 29 14:20:55 2009 (49F89A87)
    b9025000 b9056000   RDPWD    RDPWD.SYS    Mon Jul 13 20:01:50 2009 (4A5BCAEE)
    b9056000 b9057480   qcfilterdl2k qcfilterdl2k.sys Tue Jul 07 20:47:23 2009 (4A53EC9B)
    b9058000 b908e000   qcusbnetdl2k qcusbnetdl2k.sys Mon Sep 14 17:17:35 2009 (4AAEB2EF)
    b908e000 b90a7f80   qcusbserdl2k qcusbserdl2k.sys Mon Sep 14 17:15:45 2009 (4AAEB281)
    b90a8000 b90d2000   fastfat  fastfat.SYS  Mon Jul 13 19:14:01 2009 (4A5BBFB9)
    b90d2000 b90d5a00   prepdrv  prepdrv.sys  Fri Sep 18 03:57:51 2009 (4AB33D7F)
    b90d6000 b90dad00   SYMREDRV SYMREDRV.SYS Wed Jun 17 17:11:33 2009 (4A395C05)
    b9145000 b914e000   asyncmac asyncmac.sys Mon Jul 13 19:54:46 2009 (4A5BC946)
    b914e000 b9159000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)

    Unloaded modules:
    b90db000 b9145000   spsys.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0006A000
    81fd1000 81fdc000   monitor.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000B000
    81fdc000 81ff6000   qcusbserdl2k.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    b7c91000 b7ca9000   parport.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00018000
    81e17000 81e20000   WinUSB.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00009000
    997d4000 997f5000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00021000
    8c9dd000 8c9ea000   crashdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000D000
    90e32000 90fe7000   dump_iaStor.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  001B5000
    90fe7000 90ff8000   dump_dumpfve.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00011000
    90ff8000 90ffa000   dump_ephdvdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00002000
    9afaf000 9afb9000   serenum.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000A000
    833e0000 833fa000   serial.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001A000
    9963b000 9965c000   tunnel.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00021000
     



  • 16.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Feb 25, 2011 06:00 AM

    Bonjour à tous,

    Même erreur sur un DELL Vostro 1720 avec Windows 7 (32 bits) et SEP 12 fraichement installé. BSOD (teefer2.sys) au bout de quelques minutes après avoir démarré l'ordinateur.

    ??



  • 17.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Feb 25, 2011 01:07 PM

    Hi Gary2360 and thttht,

     

    You both should open cases with support for the BSOD issues that you are experiencing. Be prepared to provide a full dump to help our engineers find root cause of the issue.

     

    Phone - http://www.symantec.com/business/support/contact_techsupp_static.jsp

    Online - https://mysupport.symantec.com/

     



  • 18.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Trusted Advisor
    Posted Mar 15, 2011 01:47 PM

    Hi Gary2360,

    This is for you.

     

    Again, if you are using SEP version 11.0.5002, I would say migrate to the Latest version.

     

    Since you are carrying  Older version 11.0.5002

    We recommend you to upgrade the Symantec Endpoint Protection Manager and all clients to Latest version.

    Since you are carrying old version, there would be 2 upgrades you will have to go through. Please check the steps below:

    1) From Symantec Endpoint Protection 11.0.5002  to Symantec Endpoint Protection 11.0.6005 (RU6a)

    http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/6f5427dfdd4a0cc18825770400611b5a?OpenDocument

    2) From Symantec Endpoint Protection 11.0.6005 (RU6a) to Symantec Endpoint Protection 11.0.6200 (RU6 MP2)

    http://www.symantec.com/business/support/index?page=content&id=TECH145428&actp=search&viewlocale=en_US&searchid=1293479302456

     

    Reason:---> check the Release Notes below:

    Release notes for Symantec Endpoint Protection 11.0.x and Symantec Network Access Control 11.0.x

     
     
     
     

    Hi thttht,

    This is for you.

    What version of SEP are you using?

    Are you using SEP SBE version 12?

    Migrate to Latest version SEP SBE 12 RU1

    Migrating to Symantec Endpoint Protection Small Business Edition 12.0 RU1

    http://www.symantec.com/business/support/index?page=content&id=TECH97511&actp=search&viewlocale=en_US&searchid=1300210377439



  • 19.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Mar 25, 2011 12:55 PM
      |   view attached

    SEP 12.0.1001.95 + Win7 Professional 64 Bit BSOD

    Sorry to say that we have found the same issue with Win 7 Professional 64 Bit SP1 and SEP 12.0.1001.95.

    Teefer2.sys will BSOD the machine.

    Machine Hardware Specs:

    Type:Laptop

    Manufacturer and Model:  Samsung RF-711

    • Intel® Core™ i7-2630QM Quad Core
    • 6 GB Ram DDR3-1333
    • 1 TB HDD
    • NVIDIA® GeForce™ GT 540M 1GB

     OS:Windows 7 Professional (Enterprise), 64 Bit, SP1

     Other Software present:

    Symantec Endpoint Protection 12.0.1 Client, 64 Bit 12.0.1001.95

    MS Office 2010 Professional Plus 64 Bit

    I can provide the dmp file if Support needs it, but seeng this discussion it seems they might not.



  • 20.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Mar 25, 2011 01:08 PM

    @ Jorge, Windows 7 SP1 is not yet a supported OS patch version for SEP 12 SBE. You can still open a case, and we can get the developers looking at your dump file to find root cause.

     

    Best,

    Thomas



  • 21.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Mar 28, 2011 04:31 AM

    @ Thomas (Cycletech):

    Thanks for the info on Win 7 SP1. Guess its the price we pay for being the front runners :)

    Sadly cant roll back from SP1 to non SP, since the base install is a clean Win 7 Pro 64 Bit w/ SP1 ( we are not applying SP1 from MS Update, but the clean SP1 release itself to the machine ).

    Already opened a support case through Symantec Portugal. I assume the dev dep at Symantec will get the full info and files straight from there.



  • 22.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Apr 04, 2011 11:11 AM

    I am an internal customer of SEP product. SEP v11.0.6100.645 has been installed in my laptop (DELL - Latitude - E6400 model with Windows-XP installed). Since Mar 31, 2011, I am experiencing the same issue as others reported in this forum (i.e. a "blue-screen" appears and then machine gets restarted immediately). I observed that the machine gets restarted almost for every 60 to 65 minutes (this may not hold true for others). In my preliminary attempt to find some workaround, I stopped and started the "Symantec Endpoint Protection" windows-service for every 45 minutes which seems helpful (machine is not restarting for more than 3 hours!) for the time-being until getting a permanent resolution. I will probably try to have a batch file to stop and start "Symantec Endpoint Protection" windows-service for every 45 minutes (using Windows "Scheduled tasks" feature).



  • 23.  RE: SEP teefer2.sys BSOD - Windows 7 32-bit - Dell Latitude E6400

    Posted Apr 05, 2011 11:04 AM

    Created a batch file with the following commands in it. Scheduled this to run for every 45 minutes using "Windows Scheduled Tasks" feature in the "Control Panel". It helps for now and my laptop does NOT get restarted. At least, I can use my laptop without fearing of losing my work.

    REM ===== Commands to stop and start SEP service =====

    NET STOP "Symantec AntiVirus"
    NET START "Symantec AntiVirus"