Solved BSOD driver_irql_not_less_or_equal

[dudismo]

Hey guys,
I'm running windows 7 x64 on a Lenovo Thinkpad.
Been getting the BSOD with the message IRQL_NOT_LESS_OR_EQUAL error for a while now, and was wondering if someone could please please help me out!
I've attached the zip file with the information.
Thanks!

 

[koolkat77]

Welcome

Your crashes seem to be network related.

Norton often contributes in such crashes, I'd consider uninstalling it with the Norton Removal Tool and replace with Microsoft Security Essentials TO TEST.

• Norton Removal Tool

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-
​

• Microsoft Security Essentials - Free Antivirus for Windows
  
  • Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
    • http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

:ar: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.
Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

-ESET online scanner

• Free Online Virus Scanner | ESET

Perform a System File Check:

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Disk Check on your hard drive for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

The Assumptions You Make About Your Slow PC (and Why They're Probably Wrong)
Reduce items at start-up. Nothing except anti-virus is required:

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Update the following drivers:

Driver Reference Table - DzHDD64.sys
Driver Reference Table - igdkmd64.sys​

[FONT="Lucida Console"]lmvm DzHDD64
start             end                 module name
fffff880`019ed000 fffff880`019f8000   DzHDD64  T (no symbols)           
    Loaded symbol image file: DzHDD64.sys
    Image path: \SystemRoot\System32\DRIVERS\DzHDD64.sys
    Image name: DzHDD64.sys
    Timestamp:        Tue Nov 10 19:47:48 2009 (4AF96F04)
    CheckSum:         000124E1
    ImageSize:        0000B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
===================================================================
lmvm igdkmd64
start             end                 module name
fffff880`04e0d000 fffff880`055b76c0   igdkmd64 T (no symbols)           
    Loaded symbol image file: igdkmd64.sys
    Image path: \SystemRoot\system32\DRIVERS\igdkmd64.sys
    Image name: igdkmd64.sys
    Timestamp:        Sat Dec 19 01:38:51 2009 (4B2BDA4B)
    CheckSum:         007AF9B6
    ImageSize:        007AA6C0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4[/FONT]

Go to this link: Intel® Driver Update Utility. Check the system for latest updates and download and install them one by one.

BUGCHECK:

[FONT="Lucida Console"]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa800a11ce48, 2, 0, fffff88006013a60}

*** WARNING: Unable to verify timestamp for NETw5s64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETw5s64.sys
Probably caused by : NETw5s64.sys ( NETw5s64+373a60 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa800a11ce48, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88006013a60, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310d100
GetUlongFromAddress: unable to read from fffff8000310d1c0
 fffffa800a11ce48 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
NETw5s64+373a60
fffff880`06013a60 488b040a        mov     rax,qword ptr [rdx+rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9c000 -- (.trap 0xfffff80000b9c000)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000003c rbx=0000000000000000 rcx=fffff88007320000
rdx=0000020002dfce48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88006013a60 rsp=fffff80000b9c198 rbp=fffff88005e67450
 r8=000000000000003c  r9=0000000000000001 r10=fffffa800a10afb0
r11=fffff88007320000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
NETw5s64+0x373a60:
fffff880`06013a60 488b040a        mov     rax,qword ptr [rdx+rcx] ds:fffffa80`0a11ce48=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002edd569 to fffff80002eddfc0

STACK_TEXT:  
fffff800`00b9beb8 fffff800`02edd569 : 00000000`0000000a fffffa80`0a11ce48 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9bec0 fffff800`02edc1e0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`0000000e : nt!KiBugCheckDispatch+0x69
fffff800`00b9c000 fffff880`06013a60 : fffff880`05e6b805 00000000`00000000 fffff880`050edc2d fffffa80`073b4b40 : nt!KiPageFault+0x260
fffff800`00b9c198 fffff880`05e6b805 : 00000000`00000000 fffff880`050edc2d fffffa80`073b4b40 00000000`00000000 : NETw5s64+0x373a60
fffff800`00b9c1a0 00000000`00000000 : fffff880`050edc2d fffffa80`073b4b40 00000000`00000000 fffffa80`0b2b65c0 : NETw5s64+0x1cb805


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETw5s64+373a60
fffff880`06013a60 488b040a        mov     rax,qword ptr [rdx+rcx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  NETw5s64+373a60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETw5s64

IMAGE_NAME:  NETw5s64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ba1b871

FAILURE_BUCKET_ID:  X64_0xD1_NETw5s64+373a60

BUCKET_ID:  X64_0xD1_NETw5s64+373a60

Followup: MachineOwner
---------[/FONT]

Hope this helps for now.

 

[dudismo]

Hi,

Thanks for your response!

I don't have norton, but symantec endpoint protection - I ran a scan using symantec
and the only thing it found was a tracking cookie called c.atdmt.com, which it deleted.

TDSKiller found one threat (C:\Windows\system32\Drivers\sptd.sys), which it deleted.

ESET online scanner found 0 infected files

System file checker said Windows Resource Protection did not find any integrity violations

The disk check ran smoothly (as far as I can remember) - it was taking too long so i let it run while i went out, my machine was booted and ready to go when i came back.

As far as updating the drivers, I couldn't find individual updates for them, so I ran lenovo update as well as the Intel driver update utility.

The computer seems to be working fine at the moment, its been a few hours and no BSOD so that's a good thing I guess. Please let me know if there's anything else I should do!

Thanks a lot for your help!

 

[koolkat77]

Thanks for the update.
Keep us posted.

 

[koolkat77]

Any updates?