locked
BSOD on Windows 7 x64 SP1 RRS feed

  • Question

  • Hi

     

    Can anyone help me. i expierience BSOD on Windows 7 SP1. I have an idea that it's caused by Symantec Endpoint Protection. I've seen it on 2 PC's can anyone confirm?

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    
    
    
    Loading Dump File [C:\Users\xxx\Desktop\BlueScreen\041111-52790-01.dmp]
    
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`00b9c500?
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    
    Executable search path is: 
    
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    
    Product: WinNt, suite: TerminalServer SingleUserTS
    
    Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
    
    Machine Name:
    
    Kernel base = 0xfffff800`02a1f000 PsLoadedModuleList = 0xfffff800`02c64e90
    
    Debug session time: Fri Apr 8 21:40:29.669 2011 (UTC + 2:00)
    
    System Uptime: 0 days 9:39:10.648
    
    Loading Kernel Symbols
    
    ...............................................................
    
    ................................................................
    
    ..........................................
    
    Loading User Symbols
    
    Loading unloaded module list
    
    ............
    
    *******************************************************************************
    
    *                    *
    
    *      Bugcheck Analysis         *
    
    *                    *
    
    *******************************************************************************
    
    
    
    Use !analyze -v to get detailed debugging information.
    
    
    
    BugCheck 9F, {3, fffffa800667dbb0, fffff80000b9c518, fffffa8006de7010}
    
    
    
    Unable to load image \SystemRoot\system32\DRIVERS\teefer2.sys, Win32 error 0n2
    
    *** WARNING: Unable to verify timestamp for teefer2.sys
    
    *** ERROR: Module load completed but symbols could not be loaded for teefer2.sys
    
    Probably caused by : ntkrnlmp
    
    
    
    Followup: MachineOwner
    
    ---------
    
    
    
    0: kd> !analyze -v
    
    *******************************************************************************
    
    *                    *
    
    *      Bugcheck Analysis         *
    
    *                    *
    
    *******************************************************************************
    
    
    
    DRIVER_POWER_STATE_FAILURE (9f)
    
    A driver is causing an inconsistent power state.
    
    Arguments:
    
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    
    Arg2: fffffa800667dbb0, Physical Device Object of the stack
    
    Arg3: fffff80000b9c518, Functional Device Object of the stack
    
    Arg4: fffffa8006de7010, The blocked IRP
    
    
    
    Debugging Details:
    
    ------------------
    
    
    
    
    
    DRVPOWERSTATE_SUBCODE: 3
    
    
    
    IMAGE_NAME: ntkrnlmp
    
    
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 0
    
    
    
    FAULTING_MODULE: fffff880053c6000 teefer2
    
    
    
    IRP_ADDRESS: fffffa8006de7010
    
    
    
    DEVICE_OBJECT: fffffa8009ef2050
    
    
    
    DRIVER_OBJECT: fffffa8009ef4bd0
    
    
    
    CUSTOMER_CRASH_COUNT: 1
    
    
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    
    
    BUGCHECK_STR: 0x9F
    
    
    
    PROCESS_NAME: System
    
    
    
    CURRENT_IRQL: 2
    
    
    
    STACK_TEXT: 
    
    fffff800`00b9c4c8 fffff800`02b0bb52 : 00000000`0000009f 00000000`00000003 fffffa80`0667dbb0 fffff800`00b9c518 : nt!KeBugCheckEx
    
    fffff800`00b9c4d0 fffff800`02aab062 : fffff800`00b9c618 fffff800`00b9c618 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34a90
    
    fffff800`00b9c570 fffff800`02aaaf06 : fffffa80`0a43e8f0 fffffa80`0a43e8f0 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
    
    fffff800`00b9c5e0 fffff800`02aaadee : 00000050`e9002923 fffff800`00b9cc58 00000000`0021fd87 fffff800`02c15368 : nt!KiProcessExpiredTimerList+0xc6
    
    fffff800`00b9cc30 fffff800`02aaabd7 : 00000019`396b4fc5 00000019`0021fd87 00000019`396b4faa 00000000`00000087 : nt!KiTimerExpiration+0x1be
    
    fffff800`00b9ccd0 fffff800`02a9736a : fffff800`02c11e80 fffff800`02c1fcc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    
    fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    
    
    
    STACK_COMMAND: kb
    
    
    
    FOLLOWUP_NAME: MachineOwner
    
    
    
    MODULE_NAME: ntkrnlmp
    
    
    
    FAILURE_BUCKET_ID: X64_0x9F_3_IMAGE_ntkrnlmp
    
    
    
    BUCKET_ID: X64_0x9F_3_IMAGE_ntkrnlmp
    
    
    
    Followup: MachineOwner
    
    ---------
    
    
    
    0: kd> !analyze -v
    
    *******************************************************************************
    
    *                    *
    
    *      Bugcheck Analysis         *
    
    *                    *
    
    *******************************************************************************
    
    
    
    DRIVER_POWER_STATE_FAILURE (9f)
    
    A driver is causing an inconsistent power state.
    
    Arguments:
    
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    
    Arg2: fffffa800667dbb0, Physical Device Object of the stack
    
    Arg3: fffff80000b9c518, Functional Device Object of the stack
    
    Arg4: fffffa8006de7010, The blocked IRP
    
    
    
    Debugging Details:
    
    ------------------
    
    
    
    
    
    DRVPOWERSTATE_SUBCODE: 3
    
    
    
    IMAGE_NAME: ntkrnlmp
    
    
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 0
    
    
    
    FAULTING_MODULE: fffff880053c6000 teefer2
    
    
    
    IRP_ADDRESS: fffffa8006de7010
    
    
    
    DEVICE_OBJECT: fffffa8009ef2050
    
    
    
    DRIVER_OBJECT: fffffa8009ef4bd0
    
    
    
    CUSTOMER_CRASH_COUNT: 1
    
    
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    
    
    BUGCHECK_STR: 0x9F
    
    
    
    PROCESS_NAME: System
    
    
    
    CURRENT_IRQL: 2
    
    
    
    STACK_TEXT: 
    
    fffff800`00b9c4c8 fffff800`02b0bb52 : 00000000`0000009f 00000000`00000003 fffffa80`0667dbb0 fffff800`00b9c518 : nt!KeBugCheckEx
    
    fffff800`00b9c4d0 fffff800`02aab062 : fffff800`00b9c618 fffff800`00b9c618 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34a90
    
    fffff800`00b9c570 fffff800`02aaaf06 : fffffa80`0a43e8f0 fffffa80`0a43e8f0 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
    
    fffff800`00b9c5e0 fffff800`02aaadee : 00000050`e9002923 fffff800`00b9cc58 00000000`0021fd87 fffff800`02c15368 : nt!KiProcessExpiredTimerList+0xc6
    
    fffff800`00b9cc30 fffff800`02aaabd7 : 00000019`396b4fc5 00000019`0021fd87 00000019`396b4faa 00000000`00000087 : nt!KiTimerExpiration+0x1be
    
    fffff800`00b9ccd0 fffff800`02a9736a : fffff800`02c11e80 fffff800`02c1fcc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    
    fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    
    
    
    STACK_COMMAND: kb
    
    
    
    FOLLOWUP_NAME: MachineOwner
    
    
    
    MODULE_NAME: ntkrnlmp
    
    
    
    FAILURE_BUCKET_ID: X64_0x9F_3_IMAGE_ntkrnlmp
    
    
    
    BUCKET_ID: X64_0x9F_3_IMAGE_ntkrnlmp
    
    
    
    Followup: MachineOwner
    
    ---------
    
    
    
    0: kd> !drvobj fffffa8009ef4bd0 f
    
    fffff80002c477d0: Unable to get value of ObpRootDirectoryObject
    
    fffff80002c477d0: Unable to get value of ObpRootDirectoryObject
    
    Driver object (fffffa8009ef4bd0) is for:
    
     \Driver\Teefer2
    
    Driver Extension List: (id , addr)
    
    
    
    Device Object list:
    
    fffffa800a3a6060: Could not read device object
    
    
    
    
    
    DriverEntry: fffff880053ea000	teefer2
    
    DriverStartIo: 00000000	
    
    DriverUnload: fffff880016d5470	ndis!ndisMUnload
    
    AddDevice:  00000000	
    
    
    
    Dispatch routines:
    
    [00] IRP_MJ_CREATE      fffff88001629d20	ndis!ndisCreateIrpHandler
    
    [01] IRP_MJ_CREATE_NAMED_PIPE   fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [02] IRP_MJ_CLOSE      fffff88001629560	ndis!ndisCloseIrpHandler
    
    [03] IRP_MJ_READ      fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [04] IRP_MJ_WRITE      fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [05] IRP_MJ_QUERY_INFORMATION   fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [06] IRP_MJ_SET_INFORMATION    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [07] IRP_MJ_QUERY_EA     fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [08] IRP_MJ_SET_EA      fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [09] IRP_MJ_FLUSH_BUFFERS    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [0a] IRP_MJ_QUERY_VOLUME_INFORMATION fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [0b] IRP_MJ_SET_VOLUME_INFORMATION  fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [0c] IRP_MJ_DIRECTORY_CONTROL   fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [0d] IRP_MJ_FILE_SYSTEM_CONTROL   fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [0e] IRP_MJ_DEVICE_CONTROL    fffff880016c0020	ndis!ndisDeviceControlIrpHandler
    
    [0f] IRP_MJ_INTERNAL_DEVICE_CONTROL  fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [10] IRP_MJ_SHUTDOWN     fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [11] IRP_MJ_LOCK_CONTROL    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [12] IRP_MJ_CLEANUP      fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [13] IRP_MJ_CREATE_MAILSLOT    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [14] IRP_MJ_QUERY_SECURITY    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [15] IRP_MJ_SET_SECURITY    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [16] IRP_MJ_POWER      fffff88001673f80	ndis!ndisPowerDispatch
    
    [17] IRP_MJ_SYSTEM_CONTROL    fffff88001694ee0	ndis!ndisWMIDispatch
    
    [18] IRP_MJ_DEVICE_CHANGE    fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [19] IRP_MJ_QUERY_QUOTA     fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [1a] IRP_MJ_SET_QUOTA     fffff880016c0490	ndis!ndisDummyIrpHandler
    
    [1b] IRP_MJ_PNP       fffff880016cc110	ndis!ndisPnPDispatch
    
    
    
    0: kd> !devobj fffffa8009ef2050 f
    
    fffff80002c477d0: Unable to get value of ObpRootDirectoryObject
    
    Device object (fffffa8009ef2050) is for:
    
     InfoMask field not found for _OBJECT_HEADER at fffffa8009ef2020
    
     \Driver\Teefer2 DriverObject fffffa8009ef4bd0
    
    Current Irp 00000000 RefCount 0 Type 00000017 Flags 00002050
    
    DevExt fffffa8009ef21a0 DevObjExt fffffa8009ef38c0 
    
    ExtensionFlags (0x00000800) 
    
            Unknown flags 0x00000800
    
    AttachedTo (Lower) fffffa800667dbb0 \Driver\PnpManager
    
    Device queue is not busy.

    And the other pc:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    
    
    
    Loading Dump File [C:\Users\xxx\Desktop\040711-25849-01.dmp]
    
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`041c2500?
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    
    Executable search path is: 
    
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    
    Product: WinNt, suite: TerminalServer SingleUserTS
    
    Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
    
    Machine Name:
    
    Kernel base = 0xfffff800`02a67000 PsLoadedModuleList = 0xfffff800`02cace90
    
    Debug session time: Wed Apr 6 13:00:57.257 2011 (UTC + 2:00)
    
    System Uptime: 0 days 19:29:28.221
    
    Loading Kernel Symbols
    
    ...............................................................
    
    ................................................................
    
    .............................
    
    Loading User Symbols
    
    Loading unloaded module list
    
    ...........
    
    *******************************************************************************
    
    *                    *
    
    *      Bugcheck Analysis         *
    
    *                    *
    
    *******************************************************************************
    
    
    
    Use !analyze -v to get detailed debugging information.
    
    
    
    BugCheck 9F, {3, fffffa800667bbb0, fffff800041c2518, fffffa800c489e50}
    
    
    
    Unable to load image \SystemRoot\system32\DRIVERS\teefer2.sys, Win32 error 0n2
    
    *** WARNING: Unable to verify timestamp for teefer2.sys
    
    *** ERROR: Module load completed but symbols could not be loaded for teefer2.sys
    
    Probably caused by : ntkrnlmp
    
    
    
    Followup: MachineOwner
    
    ---------
    
    
    
    0: kd> !analyze -v
    
    *******************************************************************************
    
    *                    *
    
    *      Bugcheck Analysis         *
    
    *                    *
    
    *******************************************************************************
    
    
    
    DRIVER_POWER_STATE_FAILURE (9f)
    
    A driver is causing an inconsistent power state.
    
    Arguments:
    
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    
    Arg2: fffffa800667bbb0, Physical Device Object of the stack
    
    Arg3: fffff800041c2518, Functional Device Object of the stack
    
    Arg4: fffffa800c489e50, The blocked IRP
    
    
    
    Debugging Details:
    
    ------------------
    
    
    
    
    
    DRVPOWERSTATE_SUBCODE: 3
    
    
    
    IMAGE_NAME: ntkrnlmp
    
    
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 0
    
    
    
    FAULTING_MODULE: fffff8800183b000 teefer2
    
    
    
    IRP_ADDRESS: fffffa800c489e50
    
    
    
    DEVICE_OBJECT: fffffa8009e5c050
    
    
    
    DRIVER_OBJECT: fffffa8009e525f0
    
    
    
    CUSTOMER_CRASH_COUNT: 1
    
    
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    
    
    BUGCHECK_STR: 0x9F
    
    
    
    PROCESS_NAME: System
    
    
    
    CURRENT_IRQL: 2
    
    
    
    STACK_TEXT: 
    
    fffff800`041c24c8 fffff800`02b53b52 : 00000000`0000009f 00000000`00000003 fffffa80`0667bbb0 fffff800`041c2518 : nt!KeBugCheckEx
    
    fffff800`041c24d0 fffff800`02af3062 : fffff800`041c2600 fffff800`041c2600 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34a90
    
    fffff800`041c2570 fffff800`02af2f06 : fffffa80`072567f8 fffffa80`072567f8 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
    
    fffff800`041c25e0 fffff800`02af2dee : 000000a3`5f84d6da fffff800`041c2c58 00000000`0044a20e fffff800`02c5c448 : nt!KiProcessExpiredTimerList+0xc6
    
    fffff800`041c2c30 fffff800`02af2bd7 : 00000032`eeb488c2 00000032`0044a20e 00000032`eeb4888b 00000000`0000000e : nt!KiTimerExpiration+0x1be
    
    fffff800`041c2cd0 fffff800`02adf36a : fffff800`02c59e80 fffff800`02c67cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    
    fffff800`041c2d80 00000000`00000000 : fffff800`041c3000 fffff800`041bd000 fffff800`041c2d40 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    
    
    
    STACK_COMMAND: kb
    
    
    
    FOLLOWUP_NAME: MachineOwner
    
    
    
    MODULE_NAME: ntkrnlmp
    
    
    
    FAILURE_BUCKET_ID: X64_0x9F_3_IMAGE_ntkrnlmp
    
    
    
    BUCKET_ID: X64_0x9F_3_IMAGE_ntkrnlmp
    
    
    
    Followup: MachineOwner
    
    ---------
    
    
    
    0: kd> !devobj fffffa8009e5c050 f
    
    fffff80002c8f7d0: Unable to get value of ObpRootDirectoryObject
    
    Device object (fffffa8009e5c050) is for:
    
     InfoMask field not found for _OBJECT_HEADER at fffffa8009e5c020
    
     \Driver\Teefer2 DriverObject fffffa8009e525f0
    
    Current Irp 00000000 RefCount 0 Type 00000017 Flags 00002050
    
    DevExt fffffa8009e5c1a0 DevObjExt fffffa8009e5d8c0 
    
    ExtensionFlags (0x00000800) 
    
            Unknown flags 0x00000800
    
    AttachedTo (Lower) fffffa800667bbb0 \Driver\PnpManager
    
    Device queue is not busy.
    
    0: kd> !drvobj fffffa8009e525f0 f
    
    fffff80002c8f7d0: Unable to get value of ObpRootDirectoryObject
    
    fffff80002c8f7d0: Unable to get value of ObpRootDirectoryObject
    
    Driver object (fffffa8009e525f0) is for:
    
     \Driver\Teefer2
    
    Driver Extension List: (id , addr)
    
    
    
    Device Object list:
    
    fffffa8009ac6060: Could not read device object
    
    
    
    
    
    DriverEntry: fffff8800185f000	teefer2
    
    DriverStartIo: 00000000	
    
    DriverUnload: fffff880016ec470	ndis!ndisMUnload
    
    AddDevice:  00000000	
    
    
    
    Dispatch routines:
    
    [00] IRP_MJ_CREATE      fffff88001640d20	ndis!ndisCreateIrpHandler
    
    [01] IRP_MJ_CREATE_NAMED_PIPE   fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [02] IRP_MJ_CLOSE      fffff88001640560	ndis!ndisCloseIrpHandler
    
    [03] IRP_MJ_READ      fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [04] IRP_MJ_WRITE      fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [05] IRP_MJ_QUERY_INFORMATION   fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [06] IRP_MJ_SET_INFORMATION    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [07] IRP_MJ_QUERY_EA     fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [08] IRP_MJ_SET_EA      fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [09] IRP_MJ_FLUSH_BUFFERS    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [0a] IRP_MJ_QUERY_VOLUME_INFORMATION fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [0b] IRP_MJ_SET_VOLUME_INFORMATION  fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [0c] IRP_MJ_DIRECTORY_CONTROL   fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [0d] IRP_MJ_FILE_SYSTEM_CONTROL   fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [0e] IRP_MJ_DEVICE_CONTROL    fffff880016d7020	ndis!ndisDeviceControlIrpHandler
    
    [0f] IRP_MJ_INTERNAL_DEVICE_CONTROL  fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [10] IRP_MJ_SHUTDOWN     fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [11] IRP_MJ_LOCK_CONTROL    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [12] IRP_MJ_CLEANUP      fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [13] IRP_MJ_CREATE_MAILSLOT    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [14] IRP_MJ_QUERY_SECURITY    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [15] IRP_MJ_SET_SECURITY    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [16] IRP_MJ_POWER      fffff8800168af80	ndis!ndisPowerDispatch
    
    [17] IRP_MJ_SYSTEM_CONTROL    fffff880016abee0	ndis!ndisWMIDispatch
    
    [18] IRP_MJ_DEVICE_CHANGE    fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [19] IRP_MJ_QUERY_QUOTA     fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [1a] IRP_MJ_SET_QUOTA     fffff880016d7490	ndis!ndisDummyIrpHandler
    
    [1b] IRP_MJ_PNP       fffff880016e3110	ndis!ndisPnPDispatch
    
    
    
    

    Thanks for your help

     


    Thursday, April 14, 2011 6:50 AM

Answers

  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver is causing an inconsistent power state.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: fffffa800667dbb0, Physical Device Object of the stack
    Arg3: fffff80000b9c518, Functional Device Object of the stack
    Arg4: fffffa8006de7010, The blocked IRP
    Debugging Details:
    ------------------
    DRVPOWERSTATE_SUBCODE:  3
    IRP_ADDRESS:  fffffa8006de7010
    DEVICE_OBJECT: fffffa8009ef2050
    DRIVER_OBJECT: fffffa8009ef4bd0
    IMAGE_NAME:  teefer2.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c6985e2
    MODULE_NAME: teefer2
    FAULTING_MODULE: fffff880053c6000 teefer2
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0x9F
    PROCESS_NAME:  System
    CURRENT_IRQL:  2
    LAST_CONTROL_TRANSFER:  from fffff80002b0bb52 to fffff80002a9f640
    STACK_TEXT:  
    fffff800`00b9c4c8 fffff800`02b0bb52 : 00000000`0000009f 00000000`00000003 fffffa80`0667dbb0 fffff800`00b9c518 : nt!KeBugCheckEx
    fffff800`00b9c4d0 fffff800`02aab062 : fffff800`00b9c618 fffff800`00b9c618 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34a90
    fffff800`00b9c570 fffff800`02aaaf06 : fffffa80`0a43e8f0 fffffa80`0a43e8f0 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
    fffff800`00b9c5e0 fffff800`02aaadee : 00000050`e9002923 fffff800`00b9cc58 00000000`0021fd87 fffff800`02c15368 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`00b9cc30 fffff800`02aaabd7 : 00000019`396b4fc5 00000019`0021fd87 00000019`396b4faa 00000000`00000087 : nt!KiTimerExpiration+0x1be
    fffff800`00b9ccd0 fffff800`02a9736a : fffff800`02c11e80 fffff800`02c1fcc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    STACK_COMMAND:  kb
    FOLLOWUP_NAME:  MachineOwner
    FAILURE_BUCKET_ID:  X64_0x9F_IMAGE_teefer2.sys
    BUCKET_ID:  X64_0x9F_IMAGE_teefer2.sys
    Followup: MachineOwner
    ---------
    0: kd> lmvm teefer2
    start             end                 module name
    fffff880`053c6000 fffff880`053ec000   teefer2  T (no symbols)           
        Loaded symbol image file: teefer2.sys
        Image path: \SystemRoot\system32\DRIVERS\teefer2.sys
        Image name: teefer2.sys
        Timestamp:        Mon Aug 16 20:39:30 2010 (4C6985E2)
        CheckSum:         00013DBA
        ImageSize:        00026000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    |||||||||||||||||||||||
    The BSOD was caused by teefer2.sys. It belongs to Symantec so I confirm that the BSODs are caused by Symantec Endpoint.

    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner

    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    • Marked as answer by Henrik_a Thursday, April 14, 2011 9:10 AM
    Thursday, April 14, 2011 8:52 AM

All replies

  • Bug Check Code 0x9F: http://msdn.microsoft.com/en-us/library/ff559329(VS.85).aspx

    I am unable to determine the cause of your problem from what you posted.

    Please use Microsoft Skydrive to upload the dump files and post a link here.

    You can use Microsoft Driver Verifier to determine the faulty driver: http://msdn.microsoft.com/en-us/library/ff545448(v=VS.85).aspx

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner

    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Thursday, April 14, 2011 8:13 AM
  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver is causing an inconsistent power state.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: fffffa800667dbb0, Physical Device Object of the stack
    Arg3: fffff80000b9c518, Functional Device Object of the stack
    Arg4: fffffa8006de7010, The blocked IRP
    Debugging Details:
    ------------------
    DRVPOWERSTATE_SUBCODE:  3
    IRP_ADDRESS:  fffffa8006de7010
    DEVICE_OBJECT: fffffa8009ef2050
    DRIVER_OBJECT: fffffa8009ef4bd0
    IMAGE_NAME:  teefer2.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  4c6985e2
    MODULE_NAME: teefer2
    FAULTING_MODULE: fffff880053c6000 teefer2
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0x9F
    PROCESS_NAME:  System
    CURRENT_IRQL:  2
    LAST_CONTROL_TRANSFER:  from fffff80002b0bb52 to fffff80002a9f640
    STACK_TEXT:  
    fffff800`00b9c4c8 fffff800`02b0bb52 : 00000000`0000009f 00000000`00000003 fffffa80`0667dbb0 fffff800`00b9c518 : nt!KeBugCheckEx
    fffff800`00b9c4d0 fffff800`02aab062 : fffff800`00b9c618 fffff800`00b9c618 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34a90
    fffff800`00b9c570 fffff800`02aaaf06 : fffffa80`0a43e8f0 fffffa80`0a43e8f0 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
    fffff800`00b9c5e0 fffff800`02aaadee : 00000050`e9002923 fffff800`00b9cc58 00000000`0021fd87 fffff800`02c15368 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`00b9cc30 fffff800`02aaabd7 : 00000019`396b4fc5 00000019`0021fd87 00000019`396b4faa 00000000`00000087 : nt!KiTimerExpiration+0x1be
    fffff800`00b9ccd0 fffff800`02a9736a : fffff800`02c11e80 fffff800`02c1fcc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    STACK_COMMAND:  kb
    FOLLOWUP_NAME:  MachineOwner
    FAILURE_BUCKET_ID:  X64_0x9F_IMAGE_teefer2.sys
    BUCKET_ID:  X64_0x9F_IMAGE_teefer2.sys
    Followup: MachineOwner
    ---------
    0: kd> lmvm teefer2
    start             end                 module name
    fffff880`053c6000 fffff880`053ec000   teefer2  T (no symbols)           
        Loaded symbol image file: teefer2.sys
        Image path: \SystemRoot\system32\DRIVERS\teefer2.sys
        Image name: teefer2.sys
        Timestamp:        Mon Aug 16 20:39:30 2010 (4C6985E2)
        CheckSum:         00013DBA
        ImageSize:        00026000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    |||||||||||||||||||||||
    The BSOD was caused by teefer2.sys. It belongs to Symantec so I confirm that the BSODs are caused by Symantec Endpoint.

    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner

    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    • Marked as answer by Henrik_a Thursday, April 14, 2011 9:10 AM
    Thursday, April 14, 2011 8:52 AM
  • Thanks for your help. I have now excluded that in SEP, so I hope that it's solved :)
    Thursday, April 14, 2011 9:10 AM