Irql_Not_Less_or_Equal bsod? Random

PiCo · 29 Oct 2014

So I have had this issue for a couple of months now but I rarely use windows. This bsod first started when clicking on things before the system had completely gotten up and running but now I can just let it sit and it will go. It's very random sometimes it will go through stress tests and not doing anything buggy but If I let it sit it will bsod. I am confused on why it would do that so randomly. I have ran pretty much every test offered by both Alienware and Dell and nothing has came up weird at all. I know that this bsod is normally a memory issue so I ran memtest for 32 hours and nothing happened. When I duel but into Ubuntu nothing is wrong at all. I have a feeling it has to do with a partition inside the main windows drive created by autodesk because I can't see whats in it from either windows and in Ubuntu it just doesn't see it at all. Also while using Ubuntu there are no issue's at all not matter what I do leading me to believe it is a windows propriety driver. With all of that being said I don't really have a clue on whats going on. Some information even though this is probably in the file is that the "STOP" is at 0*00000000000000A

Some more interesting information this bsod is correlating strongly with begging of me using ubuntu. I am pretty sure I had some factory raid settings running when I first got it but now there arn't any presumably due to the formatting I did to get ubuntu to work.

koolkat77 · 30 Oct 2014

Welcome to the forum PiCo,

Looks like Norton is causing the BSOD's for you.

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\admin\Downloads\DCHEYNE-PC-Wed_10_29_2014_201141_85\102914-22198-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`0345a000 PsLoadedModuleList = 0xfffff800`0369d890
Debug session time: Thu Oct 30 05:55:07.859 2014 (UTC + 6:00)
System Uptime: 0 days 0:04:51.718
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, fffff800034d8c3f}

*** WARNING: Unable to verify timestamp for SYMNETS.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800034d8c3f, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003707100
GetUlongFromAddress: unable to read from fffff800037071c0
 0000000000000000 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+4f
fffff800`034d8c3f 488713          xchg    rdx,qword ptr [rbx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880037c4230 -- (.trap 0xfffff880037c4230)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800d39eb50 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff880037c4430 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800034d8c3f rsp=fffff880037c43c0 rbp=0000000000000008
 r8=fffff880037c4430  r9=fffff88001d89cf0 r10=0000000000000000
r11=0000000000000040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f:
fffff800`034d8c3f 488713          xchg    rdx,qword ptr [rbx] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034cf169 to fffff800034cfbc0

STACK_TEXT:  
fffff880`037c40e8 fffff800`034cf169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`037c40f0 fffff800`034cdde0 : 00000000`00000010 fffff880`037c4420 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`037c4230 fffff800`034d8c3f : 00000000`00000003 00000000`00000001 00000000`00000003 00000000`00000001 : nt!KiPageFault+0x260
fffff880`037c43c0 fffff880`01bb09c7 : 00000000`00000008 fffff880`037c46a0 00000000`00008900 fffffa80`0e5117c8 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
fffff880`037c4410 fffff880`01ce508d : fffffa80`0e540e10 fffffa80`1ba71320 fffff880`037c46a0 00000000`00008900 : NETIO!WfpExpireEntryLru+0x17
fffff880`037c4460 fffff880`01cac7b7 : 00000000`00000004 fffff880`00000030 fffff8a0`00004740 00000000`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
fffff880`037c4490 fffff880`01d24e5b : fffffa80`0e540e10 fffffa80`0e52824a 00000000`00000001 fffffa80`0e540e10 : tcpip! ?? ::FNODOBFM::`string'+0x20f72
fffff880`037c45e0 fffff880`01d251e2 : 00000089`00000000 fffffa80`0e528180 fffffa80`17cd05d0 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
fffff880`037c4700 fffff880`01d2f6b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`17cc2c38 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
fffff880`037c4750 fffff880`01a31af2 : fffffa80`00000089 fffff800`00000089 fffffa80`0e55f600 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
fffff880`037c47f0 fffff880`04d537bb : 00000000`00000000 00000000`00000000 fffffa80`0e67a5a0 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
fffff880`037c4820 00000000`00000000 : 00000000`00000000 fffffa80`0e67a5a0 00000000`00000030 00000000`00000089 : SYMNETS+0x1e7bb


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!WfpExpireEntryLru+17
fffff880`01bb09c7 488b4310        mov     rax,qword ptr [rbx+10h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!WfpExpireEntryLru+17

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  5294760d

FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17

BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17

Followup: MachineOwner
---------

Uninstall Norton and replace with MSE.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

Good and Free system security combination.

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Use Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling which allows you to remove leftover registry:-

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Perform a Clean boot:

Troubleshoot Application Conflicts by Performing a Clean Startup

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker