Bsod irql_not_less_or_equal

sandman77 · 06 Sep 2011

Hi,

I receive BSOD IRQL_NOT_LESS_OR_EQUAL around once a week. I always have more applications running, so it is hard to tell which is causing it. And it also happens, when I dont touch computer in that moement at all...
Please find attached zip with more information and also perfmon html file.
Specs:
OS: Win 7 enterprice x64
Machine old appox. 2 years
Reinstalled approx half year ago.

Please look at it if possible, thanks!

LS

yowanvista · 06 Sep 2011

A program from Juniper Networks caused the crash, remove any of these program
Remove any McAfee software and use MSE

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff8000303ab10, 2, 8, fffff8000303ab10}

Unable to load image \??\C:\Windows\system32\Drivers\NEOFLTR_700_18107.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NEOFLTR_700_18107.SYS
*** ERROR: Module load completed but symbols could not be loaded for NEOFLTR_700_18107.SYS
Probably caused by : NEOFLTR_700_18107.SYS ( NEOFLTR_700_18107+964b )

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8000303ab10, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000303ab10, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f030e0
 fffff8000303ab10 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!RtlUpperChar+0
fffff800`0303ab10 80f97a          cmp     cl,7Ah

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  FrameworkServi

TRAP_FRAME:  fffff80000ba20d0 -- (.trap 0xfffff80000ba20d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000e rbx=0000000000000000 rcx=fffff80000ba2364
rdx=fffff88001bd7430 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000303ab10 rsp=fffff80000ba2268 rbp=fffffa8002c0f410
 r8=fffff80000ba2301  r9=000000000000000e r10=7d00fefcfcfefefe
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!RtlUpperChar:
fffff800`0303ab10 80f97a          cmp     cl,7Ah
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ccab29 to fffff80002ccb5c0

FAILED_INSTRUCTION_ADDRESS: 
nt!RtlUpperChar+0
fffff800`0303ab10 80f97a          cmp     cl,7Ah

STACK_TEXT:  
fffff800`00ba1f88 fffff800`02ccab29 : 00000000`0000000a fffff800`0303ab10 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff800`00ba1f90 fffff800`02cc97a0 : fffff800`00ba0075 fffff800`00ba2328 00000000`0000aedc fffff800`00ba076c : nt!KiBugCheckDispatch+0x69
fffff800`00ba20d0 fffff800`0303ab10 : fffff800`02d1edc4 00000000`00000002 fffffa80`01c3a170 fffffa80`01d37b00 : nt!KiPageFault+0x260
fffff800`00ba2268 fffff800`02d1edc4 : 00000000`00000002 fffffa80`01c3a170 fffffa80`01d37b00 fffff880`01bd73e0 : nt!RtlUpperChar
fffff800`00ba2270 fffff880`01bca64b : fffffa80`03c23c00 fffffa80`06172b58 00000000`00000004 fffff800`00ba2380 : nt! ?? ::FNODOBFM::`string'+0x32e8
fffff800`00ba22a0 fffffa80`03c23c00 : fffffa80`06172b58 00000000`00000004 fffff800`00ba2380 00000000`80000009 : NEOFLTR_700_18107+0x964b
fffff800`00ba22a8 fffffa80`06172b58 : 00000000`00000004 fffff800`00ba2380 00000000`80000009 fffff800`00ba2380 : 0xfffffa80`03c23c00
fffff800`00ba22b0 00000000`00000004 : fffff800`00ba2380 00000000`80000009 fffff800`00ba2380 00000000`00000000 : 0xfffffa80`06172b58
fffff800`00ba22b8 fffff800`00ba2380 : 00000000`80000009 fffff800`00ba2380 00000000`00000000 fffffa80`06172b8c : 0x4
fffff800`00ba22c0 00000000`80000009 : fffff800`00ba2380 00000000`00000000 fffffa80`06172b8c 00000000`00000000 : 0xfffff800`00ba2380
fffff800`00ba22c8 fffff800`00ba2380 : 00000000`00000000 fffffa80`06172b8c 00000000`00000000 fffffa80`01deb1b0 : 0x80000009
fffff800`00ba22d0 00000000`00000000 : fffffa80`06172b8c 00000000`00000000 fffffa80`01deb1b0 fffffa80`06213500 : 0xfffff800`00ba2380


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NEOFLTR_700_18107+964b
fffff880`01bca64b ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NEOFLTR_700_18107+964b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NEOFLTR_700_18107

IMAGE_NAME:  NEOFLTR_700_18107.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4da4baed

FAILURE_BUCKET_ID:  X64_0xA_CODE_AV_BAD_IP_NEOFLTR_700_18107+964b

BUCKET_ID:  X64_0xA_CODE_AV_BAD_IP_NEOFLTR_700_18107+964b

Followup: MachineOwner
---------