locked
Windows Kernel event ID 41 error in Windows 7 RRS feed

  • Question

  • I have a brand new Dell Vestro notebook with Windows 7 64 Bit and it periodically gets a blue screen and reboots for no apparent reason.  I have looked at a couple forums on this site and have not found any ideas of what may be causing this issue and wanted to see if anyone had any ideas.  Aside from the errors below, the only other error I can find in the logs pertain to group policy.

    Critical

    - System

       
    - Provider
          [ Name] Microsoft-Windows-Kernel-Power
          [ Guid] {331C3B3A-2005-44C2-AC5E-77220C37D6B4}
       
      EventID 41
       
      Version 2
       
      Level 1
       
      Task 63
       
      Opcode 0
       
      Keywords 0x8000000000000002
       
    - TimeCreated
          [ SystemTime] 2010-07-25T22:55:01.622819500Z
       
      EventRecordID 13587
       
      Correlation
       
    - Execution
          [ ProcessID] 4
          [ ThreadID] 8
       
      Channel System
       
      Computer CCRS-MOBILE1.ccrs.local
       
    - Security
          [ UserID] S-1-5-18

    - EventData

        BugcheckCode 126
        BugcheckParameter1 0xffffffffc0000005
        BugcheckParameter2 0xfffff8800421f530
        BugcheckParameter3 0xfffff88003da9a78
        BugcheckParameter4 0xfffff88003da92e0
        SleepInProgress false
        PowerButtonTimestamp 0

    BugCheck

    - System

       
    - Provider
          [ Name] Microsoft-Windows-WER-SystemErrorReporting
          [ Guid] {ABCE23E7-DE45-4366-8631-84FA6C525952}
          [ EventSourceName] BugCheck
       
    - EventID 1001
          [ Qualifiers] 16384
       
      Version 0
       
      Level 2
       
      Task 0
       
      Opcode 0
       
      Keywords 0x80000000000000
       
    - TimeCreated
          [ SystemTime] 2010-07-25T22:55:19.000000000Z
       
      EventRecordID 13611
       
      Correlation
       
    - Execution
          [ ProcessID] 0
          [ ThreadID] 0
       
      Channel System
       
      Computer CCRS-MOBILE1.ccrs.local
       
      Security

    - EventData

        param1 0x0000007e (0xffffffffc0000005, 0xfffff8800421f530, 0xfffff88003da9a78, 0xfffff88003da92e0)
        param2 C:\Windows\MEMORY.DMP
        param3 072510-23150-01
    Error:
    - System
       
    - Provider
          [ Name] EventLog
       
    - EventID 6008
          [ Qualifiers] 32768
       
      Level 2
       
      Task 0
       
      Keywords 0x80000000000000
       
    - TimeCreated
          [ SystemTime] 2010-07-25T22:55:13.000000000Z
       
      EventRecordID 13607
       
      Channel System
       
      Computer CCRS-MOBILE1.ccrs.local
       
      Security
    - EventData
        3:53:10 PM
        ‎7/‎25/‎2010
         
         
        428
         
         
        DA070700000019000F0035000A009601DA07070000001900160035000A009601080700003C000000010000000807000000000000580200000100000000000000

    Binary data:

    In Words

    0000: 000707DA 00190000 0035000F 0196000A
    0008: 000707DA 00190000 00350016 0196000A
    0010: 00000708 0000003C 00000001 00000708
    0018: 00000000 00000258 00000001 00000000

    In Bytes

    0000: DA 07 07 00 00 00 19 00 Ú.......
    0008: 0F 00 35 00 0A 00 96 01 ..5...–.
    0010: DA 07 07 00 00 00 19 00 Ú.......
    0018: 16 00 35 00 0A 00 96 01 ..5...–.
    0020: 08 07 00 00 3C 00 00 00 ....<...
    0028: 01 00 00 00 08 07 00 00 ........
    0030: 00 00 00 00 58 02 00 00 ....X...
    0038: 01 00 00 00 00 00 00 00 ........

     

    Monday, July 26, 2010 6:08 PM

Answers

  • I looked at a couple of these and it seems that the teefer2.sys driver
    is causing the problem. Most of the google results indicate that this is
    a problem with the security software provided by Symantec.
     
     # as an HRESULT: Severity: SUCCESS (0), Facility: 0x1000, Code 0x7e
    # for hex 0x7e / decimal 126 :
      SYSTEM_THREAD_EXCEPTION_NOT_HANDLED               bugcodes.h
     
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 1000007E, {ffffffffc0000005, fffff88003eab530,
    fffff88003dc5a78, fffff88003dc52e0}
     
    Probably caused by : teefer2.sys ( teefer2+5530 )
     
    Followup: MachineOwner
    ---------
     
    3: kd> !analyze -v
    ERROR: FindPlugIns 80070005
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88003eab530, The address that the exception occurred at
    Arg3: fffff88003dc5a78, Exception Record Address
    Arg4: fffff88003dc52e0, Context Record Address
     
    Debugging Details:
    ------------------
     EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
    referenced memory at 0x%08lx. The memory could not be %s.
     
    FAULTING_IP:
    teefer2+5530
    fffff880`03eab530 488b7b18        mov     rdi,qword ptr [rbx+18h]
     
    EXCEPTION_RECORD:  fffff88003dc5a78 -- (.exr 0xfffff88003dc5a78)
    ExceptionAddress: fffff88003eab530 (teefer2+0x0000000000005530)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000138
    Attempt to read from address 0000000000000138
     
    CONTEXT:  fffff88003dc52e0 -- (.cxr 0xfffff88003dc52e0)
    rax=0000000000000000 rbx=0000000000000120 rcx=0000000000000015
    rdx=fffff88003eb5a41 rsi=fffff88003ec84e0 rdi=fffffa8007b62010
    rip=fffff88003eab530 rsp=fffff88003dc5cb0 rbp=0000000000000080
     r8=000000000000005c  r9=fffff88003ec749d r10=00000000000003cb
    r11=0000000000000042 r12=fffffa80056b1000 r13=fffff88003eab740
    r14=0000000000000000 r15=fffff88002fd7f40
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b
    efl=00010202
    teefer2+0x5530:
    fffff880`03eab530 488b7b18        mov     rdi,qword ptr [rbx+18h]
    ds:002b:00000000`00000138=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    PROCESS_NAME:  System
     
    CURRENT_IRQL:  1
     
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
    referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_PARAMETER1:  0000000000000000
     
    EXCEPTION_PARAMETER2:  0000000000000138
     
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330b0e0
     0000000000000138
     
    FOLLOWUP_IP:
    teefer2+5530
    fffff880`03eab530 488b7b18        mov     rdi,qword ptr [rbx+18h]
     
    BUGCHECK_STR:  0x7E
     
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
     
    LAST_CONTROL_TRANSFER:  from fffff88003eb59c8 to fffff88003eab530
     
    STACK_TEXT:
    fffff880`03dc5cb0 fffff880`03eb59c8 : fffffa80`09992780
    00000000`00000080 fffff880`03ec84e0 fffff880`03ec82e0 : teefer2+0x5530
    fffff880`03dc5cb8 fffffa80`09992780 : 00000000`00000080
    fffff880`03ec84e0 fffff880`03ec82e0 fffff880`03eab680 : teefer2+0xf9c8
    fffff880`03dc5cc0 00000000`00000080 : fffff880`03ec84e0
    fffff880`03ec82e0 fffff880`03eab680 fffff880`00000000 : 0xfffffa80`09992780
    fffff880`03dc5cc8 fffff880`03ec84e0 : fffff880`03ec82e0
    fffff880`03eab680 fffff880`00000000 fffffa80`05e01010 : 0x80
    fffff880`03dc5cd0 fffff880`03ec82e0 : fffff880`03eab680
    fffff880`00000000 fffffa80`05e01010 00000000`00000001 : teefer2+0x224e0
    fffff880`03dc5cd8 fffff880`03eab680 : fffff880`00000000
    fffffa80`05e01010 00000000`00000001 00000000`0001bf23 : teefer2+0x222e0
    fffff880`03dc5ce0 fffff880`00000000 : fffffa80`05e01010
    00000000`00000001 00000000`0001bf23 00000000`00000001 : teefer2+0x5680
    fffff880`03dc5ce8 fffffa80`05e01010 : 00000000`00000001
    00000000`0001bf23 00000000`00000001 fffff880`03eab78c : 0xfffff880`00000000
    fffff880`03dc5cf0 00000000`00000001 : 00000000`0001bf23
    00000000`00000001 fffff880`03eab78c 00000000`0001bf23 : 0xfffffa80`05e01010
    fffff880`03dc5cf8 00000000`0001bf23 : 00000000`00000001
    fffff880`03eab78c 00000000`0001bf23 fffffa80`056b1000 : 0x1
    fffff880`03dc5d00 00000000`00000001 : fffff880`03eab78c
    00000000`0001bf23 fffffa80`056b1000 ffffffff`ff85ee00 : 0x1bf23
    fffff880`03dc5d08 fffff880`03eab78c : 00000000`0001bf23
    fffffa80`056b1000 ffffffff`ff85ee00 00000000`00000080 : 0x1
    fffff880`03dc5d10 00000000`0001bf23 : fffffa80`056b1000
    ffffffff`ff85ee00 00000000`00000080 fffffa80`03b4e040 : teefer2+0x578c
    fffff880`03dc5d18 fffffa80`056b1000 : ffffffff`ff85ee00
    00000000`00000080 fffffa80`03b4e040 fffff800`03378a86 : 0x1bf23
    fffff880`03dc5d20 ffffffff`ff85ee00 : 00000000`00000080
    fffffa80`03b4e040 fffff800`03378a86 00000000`00000001 : 0xfffffa80`056b1000
    fffff880`03dc5d28 00000000`00000080 : fffffa80`03b4e040
    fffff800`03378a86 00000000`00000001 fffffa80`0574ab60 : 0xffffffff`ff85ee00
    fffff880`03dc5d30 fffffa80`03b4e040 : fffff800`03378a86
    00000000`00000001 fffffa80`0574ab60 00000000`00000080 : 0x80
    fffff880`03dc5d38 fffff800`03378a86 : 00000000`00000001
    fffffa80`0574ab60 00000000`00000080 fffffa80`0574ab60 : 0xfffffa80`03b4e040
    fffff880`03dc5d40 fffff800`030b1b06 : fffff880`02fd3180
    fffffa80`0574ab60 fffff880`02fddfc0 fffff880`01230a90 :
    nt!PspSystemThreadStartup+0x5a
    fffff880`03dc5d80 00000000`00000000 : fffff880`03dc6000
    fffff880`03dc0000 fffff880`03dc4850 00000000`00000000 :
    nt!KxStartSystemThread+0x16
     SYMBOL_STACK_INDEX:  0
     
    SYMBOL_NAME:  teefer2+5530
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: teefer2
     
    IMAGE_NAME:  teefer2.sys
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a0b1ec0
     
    STACK_COMMAND:  .cxr 0xfffff88003dc52e0 ; kb
     
    FAILURE_BUCKET_ID:  X64_0x7E_teefer2+5530
     
    BUCKET_ID:  X64_0x7E_teefer2+5530
     
    Followup: MachineOwner
    ---------
     

    -- Mike Burr
    Tuesday, July 27, 2010 9:34 PM
  • are you using the latest Symantec version? The driver which caused the BSOD ( \SystemRoot\system32\DRIVERS\teefer2.sys ) is a bit old (Wed May 13 21:25:52 2009).

    remove Symantec and use other free tools like MSE or AntiVir.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, July 27, 2010 11:06 PM
  • Yes, the teefer2.sys appears to be the problem.

    If you uninstall Symantec Enpoint Protection and still have blue screens can you provide the resulting minidump files.

    In the following thread "Mike Groenewald" had to take some extra steps to solve the problem:

    http://social.answers.microsoft.com/Forums/en-US/w7repair/thread/e671b55e-8cfc-41cf-a686-67524c2fe485

    Hopefully that will not be necessary in your case.  

    Tuesday, July 27, 2010 11:26 PM

All replies

  • Hi,
     
    This error appears to be,
     
    # for decimal 126 / hex 0x7e :
      SYSTEM_THREAD_EXCEPTION_NOT_HANDLED                    bugcodes.h
     
    and is documented here
     
     
    Depending on the size, is it feasible to upload the file at
    c:\windows\memory.dmp and any files in c:\windows\Minidump to skydrive,
    http://windowslive.com/online/skydrive , and post links so that we might
    be able to help you determine the exact cause of the error (the event
    log information does not specify the exact faulting module). You may
    also be able to look at the memory dumps using the Debugging tools for
    Windows,
     
     

    -- Mike Burr
    Monday, July 26, 2010 9:35 PM
  • Also, it may help to look at the minidump files from the crashes with a debugger, so can you zip up the minidump files in the C:\Windows\Minidump folder and make available (provide link) via Windows Live SkyDrive or similar site?

    The following link has information on using Windows Live SkyDrive:

    http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65

    If you have problems zipping the minidump files copy the minidump files to another location such as a folder on the Desktop

    Monday, July 26, 2010 11:33 PM
  • Thank you for the response.  I have uploaded the mini dump files to the following link:

    http://cid-52921094bfca9c21.skydrive.live.com/redir.aspx?resid=52921094BFCA9C21!122&Bpub=SDX.Docs&Bsrc=GetSharingLink

    I was not able to compress the memory.dmp file enough to upload...it almost doubles the 50 MB limit.  Is there a way to extract the data from this file?

     

    Thanks.

    Tuesday, July 27, 2010 4:47 PM
  • I looked at a couple of these and it seems that the teefer2.sys driver
    is causing the problem. Most of the google results indicate that this is
    a problem with the security software provided by Symantec.
     
     # as an HRESULT: Severity: SUCCESS (0), Facility: 0x1000, Code 0x7e
    # for hex 0x7e / decimal 126 :
      SYSTEM_THREAD_EXCEPTION_NOT_HANDLED               bugcodes.h
     
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 1000007E, {ffffffffc0000005, fffff88003eab530,
    fffff88003dc5a78, fffff88003dc52e0}
     
    Probably caused by : teefer2.sys ( teefer2+5530 )
     
    Followup: MachineOwner
    ---------
     
    3: kd> !analyze -v
    ERROR: FindPlugIns 80070005
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88003eab530, The address that the exception occurred at
    Arg3: fffff88003dc5a78, Exception Record Address
    Arg4: fffff88003dc52e0, Context Record Address
     
    Debugging Details:
    ------------------
     EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
    referenced memory at 0x%08lx. The memory could not be %s.
     
    FAULTING_IP:
    teefer2+5530
    fffff880`03eab530 488b7b18        mov     rdi,qword ptr [rbx+18h]
     
    EXCEPTION_RECORD:  fffff88003dc5a78 -- (.exr 0xfffff88003dc5a78)
    ExceptionAddress: fffff88003eab530 (teefer2+0x0000000000005530)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000138
    Attempt to read from address 0000000000000138
     
    CONTEXT:  fffff88003dc52e0 -- (.cxr 0xfffff88003dc52e0)
    rax=0000000000000000 rbx=0000000000000120 rcx=0000000000000015
    rdx=fffff88003eb5a41 rsi=fffff88003ec84e0 rdi=fffffa8007b62010
    rip=fffff88003eab530 rsp=fffff88003dc5cb0 rbp=0000000000000080
     r8=000000000000005c  r9=fffff88003ec749d r10=00000000000003cb
    r11=0000000000000042 r12=fffffa80056b1000 r13=fffff88003eab740
    r14=0000000000000000 r15=fffff88002fd7f40
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b
    efl=00010202
    teefer2+0x5530:
    fffff880`03eab530 488b7b18        mov     rdi,qword ptr [rbx+18h]
    ds:002b:00000000`00000138=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    PROCESS_NAME:  System
     
    CURRENT_IRQL:  1
     
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
    referenced memory at 0x%08lx. The memory could not be %s.
     
    EXCEPTION_PARAMETER1:  0000000000000000
     
    EXCEPTION_PARAMETER2:  0000000000000138
     
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330b0e0
     0000000000000138
     
    FOLLOWUP_IP:
    teefer2+5530
    fffff880`03eab530 488b7b18        mov     rdi,qword ptr [rbx+18h]
     
    BUGCHECK_STR:  0x7E
     
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
     
    LAST_CONTROL_TRANSFER:  from fffff88003eb59c8 to fffff88003eab530
     
    STACK_TEXT:
    fffff880`03dc5cb0 fffff880`03eb59c8 : fffffa80`09992780
    00000000`00000080 fffff880`03ec84e0 fffff880`03ec82e0 : teefer2+0x5530
    fffff880`03dc5cb8 fffffa80`09992780 : 00000000`00000080
    fffff880`03ec84e0 fffff880`03ec82e0 fffff880`03eab680 : teefer2+0xf9c8
    fffff880`03dc5cc0 00000000`00000080 : fffff880`03ec84e0
    fffff880`03ec82e0 fffff880`03eab680 fffff880`00000000 : 0xfffffa80`09992780
    fffff880`03dc5cc8 fffff880`03ec84e0 : fffff880`03ec82e0
    fffff880`03eab680 fffff880`00000000 fffffa80`05e01010 : 0x80
    fffff880`03dc5cd0 fffff880`03ec82e0 : fffff880`03eab680
    fffff880`00000000 fffffa80`05e01010 00000000`00000001 : teefer2+0x224e0
    fffff880`03dc5cd8 fffff880`03eab680 : fffff880`00000000
    fffffa80`05e01010 00000000`00000001 00000000`0001bf23 : teefer2+0x222e0
    fffff880`03dc5ce0 fffff880`00000000 : fffffa80`05e01010
    00000000`00000001 00000000`0001bf23 00000000`00000001 : teefer2+0x5680
    fffff880`03dc5ce8 fffffa80`05e01010 : 00000000`00000001
    00000000`0001bf23 00000000`00000001 fffff880`03eab78c : 0xfffff880`00000000
    fffff880`03dc5cf0 00000000`00000001 : 00000000`0001bf23
    00000000`00000001 fffff880`03eab78c 00000000`0001bf23 : 0xfffffa80`05e01010
    fffff880`03dc5cf8 00000000`0001bf23 : 00000000`00000001
    fffff880`03eab78c 00000000`0001bf23 fffffa80`056b1000 : 0x1
    fffff880`03dc5d00 00000000`00000001 : fffff880`03eab78c
    00000000`0001bf23 fffffa80`056b1000 ffffffff`ff85ee00 : 0x1bf23
    fffff880`03dc5d08 fffff880`03eab78c : 00000000`0001bf23
    fffffa80`056b1000 ffffffff`ff85ee00 00000000`00000080 : 0x1
    fffff880`03dc5d10 00000000`0001bf23 : fffffa80`056b1000
    ffffffff`ff85ee00 00000000`00000080 fffffa80`03b4e040 : teefer2+0x578c
    fffff880`03dc5d18 fffffa80`056b1000 : ffffffff`ff85ee00
    00000000`00000080 fffffa80`03b4e040 fffff800`03378a86 : 0x1bf23
    fffff880`03dc5d20 ffffffff`ff85ee00 : 00000000`00000080
    fffffa80`03b4e040 fffff800`03378a86 00000000`00000001 : 0xfffffa80`056b1000
    fffff880`03dc5d28 00000000`00000080 : fffffa80`03b4e040
    fffff800`03378a86 00000000`00000001 fffffa80`0574ab60 : 0xffffffff`ff85ee00
    fffff880`03dc5d30 fffffa80`03b4e040 : fffff800`03378a86
    00000000`00000001 fffffa80`0574ab60 00000000`00000080 : 0x80
    fffff880`03dc5d38 fffff800`03378a86 : 00000000`00000001
    fffffa80`0574ab60 00000000`00000080 fffffa80`0574ab60 : 0xfffffa80`03b4e040
    fffff880`03dc5d40 fffff800`030b1b06 : fffff880`02fd3180
    fffffa80`0574ab60 fffff880`02fddfc0 fffff880`01230a90 :
    nt!PspSystemThreadStartup+0x5a
    fffff880`03dc5d80 00000000`00000000 : fffff880`03dc6000
    fffff880`03dc0000 fffff880`03dc4850 00000000`00000000 :
    nt!KxStartSystemThread+0x16
     SYMBOL_STACK_INDEX:  0
     
    SYMBOL_NAME:  teefer2+5530
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: teefer2
     
    IMAGE_NAME:  teefer2.sys
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a0b1ec0
     
    STACK_COMMAND:  .cxr 0xfffff88003dc52e0 ; kb
     
    FAILURE_BUCKET_ID:  X64_0x7E_teefer2+5530
     
    BUCKET_ID:  X64_0x7E_teefer2+5530
     
    Followup: MachineOwner
    ---------
     

    -- Mike Burr
    Tuesday, July 27, 2010 9:34 PM
  • are you using the latest Symantec version? The driver which caused the BSOD ( \SystemRoot\system32\DRIVERS\teefer2.sys ) is a bit old (Wed May 13 21:25:52 2009).

    remove Symantec and use other free tools like MSE or AntiVir.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, July 27, 2010 11:06 PM
  • Yes, the teefer2.sys appears to be the problem.

    If you uninstall Symantec Enpoint Protection and still have blue screens can you provide the resulting minidump files.

    In the following thread "Mike Groenewald" had to take some extra steps to solve the problem:

    http://social.answers.microsoft.com/Forums/en-US/w7repair/thread/e671b55e-8cfc-41cf-a686-67524c2fe485

    Hopefully that will not be necessary in your case.  

    Tuesday, July 27, 2010 11:26 PM
  • First of all, remove all unnecessary hardware devices from the computer, try entering Windows safe mode to test whether it is a third-party software/hardware compatibility issue. If so, please download and run Windows 7 Upgrade Advisor to check the reason for the issue. If the issue is caused by some incompatible driver, you might go to Device Manager, right click your hardware device in the list and select Update Driver Software; then click Search automatically for updated driver software.

    If you still get the BSOD error after installing the latest driver, please understand that Windows system uses separated user mode and kernel mode memory space, stop errors are always caused by kernel portion components, such as a hardware device, third-party drivers, backup software or anti-virus services (buggy services).

    The system goes to a blue screen because there is some exceptions happened in the kernel (either the device driver errors or the service errors), and Windows implements this mechanism: When it detects some errors occur in the kernel, it will kill the box in case some more severe damage happens. Then we get a blue screen or the system reboots (it depends on what the system settings are).

    To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. Please be advised that contacting phone support will be a charged call.


    To obtain the phone numbers for specific technology request please take a look at the web site listed below:

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.
    Wednesday, July 28, 2010 9:42 AM
  • Thank you all for the help.   I really appreciate the feedback.

    I contacted Symantec and they also reported that this is a known issue, though not terribly frequent.  They said there is a patch that is believed to resolve the issue.  I installed the patch and thus far no BSOD, but I will give it a few days before officially concluding it is completely resolved.

    Thursday, July 29, 2010 2:40 PM