BSOD at random times , playing or in the desktop IRQL_NOT_LESS_OR_E

Chezpaull · 02 Jan 2015

Hi guys , im having this problem i have no idea what to do help plz

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000000, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff800032d8c3f, address which referenced memory
Debugging Details: ------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2 WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003507100 GetUlongFromAddress: unable to read from fffff800035071c0 0000000000000000 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP: nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+4f fffff800`032d8c3f 488713 xchg rdx,qword ptr [rbx]

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: nis.exe

TRAP_FRAME: fffff88008634f30 -- (.trap 0xfffff88008634f30) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8009e7ab50 rbx=0000000000000000 rcx=0000000000000000 rdx=fffff88008635130 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800032d8c3f rsp=fffff880086350c0 rbp=0000000000000008 r8=fffff88008635130 r9=fffff8800178ac90 r10=0000000000000000 r11=0000000000000040 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f: fffff800`032d8c3f 488713 xchg rdx,qword ptr [rbx] ds:00000000`00000000=???????????????? Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800032cf169 to fffff800032cfbc0

STACK_TEXT: fffff880`08634de8 fffff800`032cf169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`08634df0 fffff800`032cdde0 : 00000000`00000010 fffff880`08635120 00000000`0000000b 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`08634f30 fffff800`032d8c3f : 00000000`00000003 00000000`00000002 00000000`00000003 00000000`00000002 : nt!KiPageFault+0x260 fffff880`086350c0 fffff880`0142b9c7 : 00000000`00000008 fffff880`086353a0 00000000`00006c07 fffffa80`0a5b9668 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f fffff880`08635110 fffff880`016e608d : fffffa80`0a629440 fffffa80`0a120db0 fffff880`086353a0 00000000`00006c07 : NETIO!WfpExpireEntryLru+0x17 fffff880`08635160 fffff880`016ad7b7 : 00000000`00000004 fffff8a0`08e10032 fffff880`086353d0 fffffa80`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d fffff880`08635190 fffff880`01725e5b : fffffa80`0a629440 fffffa80`10d7e0da 00000000`00000001 fffffa80`0a629440 : tcpip! ?? ::FNODOBFM::`string'+0x20f72 fffff880`086352e0 fffff880`017261e2 : 0000076c`00000000 fffffa80`10d7e010 fffffa80`0a1c4710 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb fffff880`08635400 fffff880`017306b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`06a4c1c8 : tcpip!WfpAlepAuthorizeSendCompletion+0x32 fffff880`08635450 fffff880`01491af2 : fffffa80`0000076c fffff800`0000076c fffffa80`094c48d0 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162 fffff880`086354f0 fffff880`0d6e57bb : 00000000`00000000 00000000`00000000 fffffa80`0acb6e30 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e fffff880`08635520 00000000`00000000 : 00000000`00000000 fffffa80`0acb6e30 00000000`00000030 00000000`0000076c : SYMNETS+0x1e7bb
STACK_COMMAND: kb

FOLLOWUP_IP: NETIO!WfpExpireEntryLru+17 fffff880`0142b9c7 488b4310 mov rax,qword ptr [rbx+10h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: NETIO!WfpExpireEntryLru+17

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO
IMAGE_NAME: NETIO.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 5294760d
FAILURE_BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17 BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

Followup: MachineOwner

Arc · 02 Jan 2015

Hi Chezpaull.

Uninstall Norton Internet Security and any Symantec products using Norton Removal tool. At least as a test basis.

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Let us know the situation.
_________________________________________

Code:

BugCheck A, {0, 2, 1, fffff800032d8c3f}

*** WARNING: Unable to verify timestamp for SYMNETS.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )

Followup: MachineOwner
---------

Chezpaull · 03 Jan 2015

Hey

I was testing and no blue screen anymore , i think that was the problem :).

Thanks for the help

Arc · 04 Jan 2015

Wait for one more week, and then let us know the situation once more. :)