Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

system restore not helping


  • Please log in to reply
37 replies to this topic

#1 millipede

millipede

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 20 November 2012 - 08:46 PM

A little background. I am a member of a group on facebook for people to "pay it forward". I offered services helping solve some computer problems. Someone contacted me with a laptop that stopped working over a year ago and they decided they really wanted it fixed because it has pictures of their grandchild on it that they don't have anywhere else, and the child died of cancer since. :( They hadn't had it fixed up til now because it just cost too much to pay someone to repair.
I could not get windows to startup, even to safe mode... but, I was pretty sure the hard drive was functioning and that it was simply a windows issue.
So..... I put the hard drive in my tower and sure enough, I was able to access all the files I want. I backed up all their documents and pictures to my hard drive until I put them on CD for them, then popped their drive back into the laptop to begin system repair.
System repair failed... and again, it wont even make it into safe mode.
So... I guess I'll try system restore... Still, no go. Tried the most recent, last november... then two other restore points from October 11. Fails every time.
I'm going to keep trying to figure it out, googling and such... But figured I'd ask and see if anyone had any thoughts as to what to try next.
I ran an avast scan and a malwarebytes scan on the drive while it was in my computer and they both came up clean. I don't think it's virus related, but I couldn't swear to that.

Among the recovery options is restoring to factory default... There's no discs with this, it's a mini with no cd/dvd drive... The hard drive appeared to be partitioned while I looked at it in my computer so, perhaps there's an option to restore from the default from that partition?
Their main concern was those images, and I can deliver that to them... but it sure wouldn't hurt if I could get this thing actually running.
Back to work........ I appreciate any thoughts at all. :)
Feel free to ask questions if it's needed... It's an acer aspire one, tiny little thing, windows 7 startup edition (32 bit)

BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:39 AM

Posted 20 November 2012 - 09:56 PM

Hi -
From those that should actually know, I found this - See if it helps -

How-To Restore / Format an Acer Aspire One netbook to Factory Default Settings. This will reinstall Windows.

Step 1 The Acer must first be shut down
Step 2 Turn on the PC then start tapping the F2 button until it goes into the BIOS
Step 3 Select the category MAIN. Look for the D2D Recovery option at the bottom of the screen. Set this to Enabled. (The F5 and F6 keys usually allow you to change values with Acer BIOS settings)
Step 4 Exit the BIOS and SAVE changes (The system should restart. If it does not restart your Acer)
Step 5 During the restart, while the Acer logo is displayed press the ALT + F10 keys at the same time to enter the recovery process
Step 6 Follow the on-screen instructions from here on out

#3 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 20 November 2012 - 11:29 PM

Thanks... though I haven't tried it yet, I have the option for restoring factory defaults from the repair menu. I've just been putting off trying that while trying to figure if there's anything else I can do to repair windows.
I'm wondering if any of the dmp files or anything would at all be helpful.

When it does TRY to boot, a blue screen pops up. It disappears quickly but it starts with 0x0000f4
And when you first try to go into the startup repair, or when it does automatically, it doesn't work initially. You can look for more info... and problem signature 07 says 0xf4.
Since I currently can't do anything... so far.. can't get into safe mode... can't do a system repair or restore... even tried the "last known good configuration" option without success...
Is the factory default settings my last option?
I can access all files when the hard drive is plugged in to my own computer as a second drive.
Any other options or thoughts of should I just give the default settings a try?
I typically don't give up easily and put off starting fresh whenever I can... but I do realize that sometimes it's not avoidable.

#4 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:39 AM

Posted 20 November 2012 - 11:36 PM

Please do the following:
(the screenshots are from Windows XP, but things will be essentially the same in Windows 7)

Get a look at the error message presented by the BSOD (blue screen of death) ....
  • Start tapping the F8 key after you press the ON button, and continue tapping until you are presented with the "Advanced Boot Options" menu screen.

    Posted Image
  • Use the UP/DOWN arrow keys to select "Disable automatic restart on system failure" and press the <ENTER> key.
  • Your system will attempt to start normally, but when it crashes, it will not re-start: Instead, you will see a BSOD with error message.

    Posted Image
  • Record the error message details (contained in the areas outlined in red, in the above example image), and post in your reply.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#5 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 20 November 2012 - 11:50 PM

A process or thread crucial to system operation has unexpectedly exited or been terminated.

Technical information:

*** Stop: 0x000000F4 (0x00000003, 0x91D6AD40, 0x91D6AEAC, 0x81E04AC0)



Thanks

#6 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:39 AM

Posted 20 November 2012 - 11:56 PM

Thank you.

STOP 0x000000F4: CRITICAL_OBJECT_TERMINATION

Please check to see if there are any recent minidumps available, and if so, zip them up and attach the zip file to a reply.
Note: If there are many minidumps, please limit the number zipped up to the most recent 10.

Please zip up the minidumps and attach the resultant zip file to your next reply so I can have a closer look. There's a chance I might get some more useful info from them.
  • Navigate to C:\Windows\Minidump <<< folder
  • Click on the first minidump file to select it.
  • Hold down the <Shift> key, and click on the last minidump file to select all of the files.
  • Release the <Shift> key.
  • Now, right-click on any one of the selected files > Send to ... > Compressed (zipped) Folder.
    The zip file will be located in the same place (the Minidump folder).
  • Attach the zip file to your next reply.
    When you click on Add Reply, you will see the facility to attach a file just below the box where you type your message.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#7 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 21 November 2012 - 09:37 AM

Thanks. I went to bed before I got to this, wish I hadn't because I have a question about that.
I put that hard drive back in my tower this morning and went to find that folder. The drive is E: because it's not MY hard drive... But, I went into the windows folder and found no such folder. So I just searched the E: drive for "dmp" and found there's a folder in windows\system32\com but it looks empty...
And there's three dmp files in \appdata\local\crashdumps, two of them related to yahoo but all of them old.
There was one single 162MB dmp file right in the windows folder... Memory.dmp. It was created last night. Since that is the most recent and only one that looks worth looking at, I'll attach that one.
Or... maybe I wont.
"file not found or no read permissions"


Edit: after looking around on google, I ended up copying the file to my own documents folder. From there I was able to zip it. Only problem now is the size. When I go to attach a file here, it says the limit is 512kb or something. This file, after being zipped, is 45,170kb. JUST a bit bigger than the limit.

Edited by millipede, 21 November 2012 - 10:51 AM.


#8 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 21 November 2012 - 12:00 PM

I downloaded windbg just for kicks. I, of course, don't know my way around that so much. Had to run it as an admin to get the crash dump memory.dmp that I mentioned. It could not get as much info as it could for the other, less relevant dumps. Don't know if it's helpful or not, but here's what it said...

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe - 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16841.x86fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0x81c4d000 PsLoadedModuleList = 0x81d8c590
Debug session time: Tue Nov 20 22:00:17.502 2012 (UTC - 6:00)
System Uptime: 0 days 0:01:07.236
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe - 
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdc00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 92ed7d40, 92ed7eac, 81e3eac0}

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for SYMEVENT.SYS - 
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

------------------------------------------------
|                                              |
|         NT symbols are not available         |
|         reduced functionality                |
|                                              |
------------------------------------------------
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : wininit.exe

Followup: MachineOwner
---------


I did a LITTLE searching, starting with the ntkrnlmp that is mentioned early on in that... and got lots of results having to do with drivers. That said, this crashed just over a year ago so I don't know they can be certain of anything but... one of the last things they can remember doing was trying to get an external cd burner installed. So, driver issues could indeed be something.
I'm also, not sure why, thinking about testing the memory...
And, at the moment I decided to look at files created around the time it was last used. It looks like it was last used 11/13/11 but it looks like someone tried fixing it a week and a half later...
There are several files, multiple really, from around the time it looks like it was last successfully running. Among them, something about updates... like, windows update was running around that time as well. Several options out there I guess. Going to keep poking around...

Edit: amongst folders and files created around the time that it appears it last worked... Norton, Nero(I'm guessing for that external drive), and Internet Explorer(I'm guessing the windows updates I saw).
I'd LOVE to uninstall/remove Norton and even Nero from there but can you accurately remove those things with it being a secondary drive?

Edited by millipede, 21 November 2012 - 01:25 PM.


#9 kingnick42

kingnick42

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:09:39 AM

Posted 21 November 2012 - 02:46 PM

If you just want to reinstall windows, most netbooks have a recovery partition which you can use to reinstall windows.

#10 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 21 November 2012 - 02:53 PM

I don't know if you read the entire thread.... but, I plan on troubleshooting a bit more before I try that.

#11 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:39 AM

Posted 21 November 2012 - 04:15 PM

There was one single 162MB dmp file right in the windows folder... Memory.dmp. It was created last night. Since that is the most recent and only one that looks worth looking at, I'll attach that one.
... I was able to zip it. Only problem now is the size. When I go to attach a file here, it says the limit is 512kb or something. This file, after being zipped, is 45,170kb. JUST a bit bigger than the limit.

There is no guarantee that debugging this dump (and, yes, this dump is relevant!) will provide an answer to the cause of the crash, but I think it is well worth the effort to get a proper look at it.

Seems we have two options:
  • You upload the zipped 45 MB to a file-sharing website and I download it from there and debug it myself.
    or ...
  • I teach you how to set up WinDbg properly (we need to set the symbol path correctly, which is quite simple), and you debug the dump using my instructions and we get a look at the results that way.

Let me know which way you wish to try, and ask any questions.

Edited by AustrAlien, 21 November 2012 - 04:16 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 21 November 2012 - 04:19 PM

I'm on my way out to run a few errands but will be back in a couple hours most likely.
My first thought it, whatever works for you. I've never used a file sharing site but it wont hurt to try it. Wouldn't hurt much to learn a little about windbg either. I'd say whichever method is less troublesome for you.
I'll get back to you as soon as I get back from town.

Thanks.

#13 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:39 AM

Posted 21 November 2012 - 04:24 PM

Let's go with the file-sharing website idea.

Register and create an account (free) with Posted Image and upload the zipped 45 MB file there, and then provide me with a link to access/download it.

Edited by AustrAlien, 21 November 2012 - 04:27 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#14 millipede

millipede
  • Topic Starter

  • Members
  • 661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:outer space
  • Local time:03:39 PM

Posted 21 November 2012 - 07:25 PM

Thanks...
https://www.box.com/s/um1u351j941czxkxk3lk

#15 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:39 AM

Posted 21 November 2012 - 07:50 PM

Excellent! Thank you.

STACK_TEXT:
8ef32c18 81f1ff13 000000f4 00000003 92ed7d40 nt!KeBugCheckEx+0x1e
8ef32c3c 81e735c2 81e3eac0 92ed7eac 92ed7dd8 nt!PspCatchCriticalBreak+0x71
8ef32c6c 81e6602b 92ed7d40 92e9b268 000036b1 nt!PspTerminateAllThreads+0x2d
8ef32ca0 8a7ce529 00000000 000036b1 855fcf28 nt!NtTerminateProcess+0x1a2
WARNING: Stack unwind information not available. Following frames may be wrong.
8ef32d24 81c8277a 00000000 000036b1 0016f7f8 SYMEVENT!SYMEvent_IrpHandlerInstall+0x1499
8ef32d24 77ba8380 00000000 000036b1 0016f7f8 nt!KiFastCallEntry+0x12a
0000003b 00000000 00000000 00000000 00000000 0x77ba8380

At this early stage it would appear that Norton/Symantec is causing the problem: See SYMEVENT in the crash stack, likely to be the problem driver. The date is very old too (2009) !!!

SYMEVENT.SYS Fri Aug 14 08:22:41 2009

WinDbg output:
Spoiler

Edited by AustrAlien, 21 November 2012 - 07:52 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users