Blue Screen of Death: Driver IRQL Not Less or Equal (Windows 7)

Question

My computer started crashing after I downloaded the latest batch of Windows updates. I presume there's a connection, but I could be mistaken. I was able to photograph the screen this last time. (I'm sorry for the reflection at the top, but it's still readable) Any suggestions? I'd very much appreciate any help y'all can provide.

Thanks!

Answer 1

My pleasure, I look forward to your update.

I would not by any means reinstall Norton, it is not a good antivirus despite what many say. I'd stay far away from Norton + McAfee. For now, go several days without any 3rdparty antivirus. If the crashes cease, you know it was both conflicting and you can move on to try others... although I dislike most as I see how many conflicts they can cause, and I deal with it on a daily basis.

For the record though, Malwarebytes is fantastic and you would be just fine installing that right now if you wish.

Regards,

Patrick

Answer 2

Perfect, thank you! You should also be happy to know that this at first glance appears to be a very simple and easy to solve issue.

Right, so all of the attached DMP files are of the DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) bug check.

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

If we take a look at the call stack:

1: kd> kvChild-SP          RetAddr           : Args to Child                                                           : Call Sitefffff8800c070a58 fffff8000308f169 : 000000000000000a 0000000000000008 0000000000000002 0000000000000000 : nt!KeBugCheckExfffff8800c070a60 fffff8000308dde0 : fffff8800c070c20 fffffa800edcc4d8 0000000000000000 fffff8800c070f50 : nt!KiBugCheckDispatch+0x69fffff8800c070ba0 fffff88001928a1d : fffffa8005a44338 fffffa8005a44330 0000000000000001 fffff8800193c827 : nt!KiPageFault+0x260 (TrapFrame @ fffff8800c070ba0)fffff8800c070d30 fffff880019320d4 : fffff8800c070f50 fffff8800c070f50 fffff8800c071150 fffffa800db76280 : NETIO!CalloutStreamDataInit+0x1dfffff8800c070d70 fffff8800193de98 : 0000000000000000 fffff8800c071150 fffff8800c070f00 fffff8800c070f88 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x54fffff8800c070e10 fffff8800193ee91 : fffffa800f81e5f0 fffff8800c071150 fffff8800c070f50 fffff8800c0715a0 : NETIO!StreamCalloutProcessData+0x48fffff8800c070e60 fffff8800193fee8 : fffff8800c070f50 fffff8800c0715a0 fffff8800c071101 fffffa800f81e5f0 : NETIO!StreamCalloutProcessingLoop+0xa1fffff8800c070ef0 fffff88001920a2a : fffff8800c071150 fffff88009b8e690 0000000000000000 fffffa800e550014 : NETIO!StreamProcessCallout+0x1e8fffff8800c070fe0 fffff88001907f58 : fffff8a00fc50014 fffffa800ea8dc30 fffffa800593ae08 fffff8800c0715a0 : NETIO! ?? ::FNODOBFM::string'+0x71f2fffff8800c071100 fffff880019095d2 : fffff8800c070014 fffffa800ea8dc30 fffffa800e55b4e0 0000000000000000 : NETIO!ArbitrateAndEnforce+0x238fffff8800c0711d0 fffff880019423b3 : fffff8800c071674 fffffa800ea8dc30 0000000000000001 fffff8800c0715a0 : NETIO!KfdClassify+0x934fffff8800c071540 fffff8800194299a : 0000000000000000 0000000000010000 00000000003793f8 fffffa800e55b420 : NETIO!StreamInternalClassify+0xf3fffff8800c071610 fffff88001942d8e : 0000000000000014 0000000000000100 0000000000000000 fffffa800e7a98e0 : NETIO!StreamInject+0x1cafffff8800c0716e0 fffff88001997dd7 : fffffa800e55b370 000000000000015c fffffa800dcd5be0 fffff800031c3d00 : NETIO!FwppStreamInject+0x12efffff8800c071770 fffff88009afec44 : fffffa800e081360 0000000000000000 fffffa801084e1c0 fffffa8005b61c10 : fwpkclnt!FwpsStreamInjectAsync0+0xcffffff8800c0717d0 fffffa800e081360 : 0000000000000000 fffffa801084e1c0 fffffa8005b61c10 fffff8a00000015c :UrlFilter+0x1c44fffff8800c0717d8 0000000000000000 : fffffa801084e1c0 fffffa8005b61c10 fffff8a00000015c fffff80000000014 : 0xfffffa80`0e081360

We can see a UrlFilter.sys call which is a component of IObit. After we have that call, it leads into MANY Network I/O Subsystem routine calls, which goes directly into a page fault and then the bug check itself.

Unable to load image ??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64*UrlFilter.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for UrlFilter.sys*** ERROR: Module load completed but symbols could not be loaded for UrlFilter.sys*

Overall, what's happening? IObit Malware Fighter of no surprise to me (as I always see it) is causing NETBIOS conflicts with Norton which then causes memory corruption. Ultimately, this crashes your computer.

------------------

1. Uninstall IObit.
2. Remove and replace Norton with Microsoft Security Essentials for temporary troubleshooting purposes:

Norton removal -https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=841A6D40BA6872C47697C6C6B19C8E11.4?entsrc=redirect_pubweb&pvid=f-home

MSE -  http://windows.microsoft.com/en-us/windows/security-essentials-download

Your crashes should cease after this, so please keep me updated.

Also, you may want to read this about IObit - IOBit Steals Malwarebytes' Intellectual Property.

Regards,

Patrick****

Answer 3

Hi,

In order to assist you, we will need the DMP files to analyze what exactly occurred at the time of the crash, etc.

If you don't know where DMP files are located, here's how to get to them:

 1.    Navigate to the %systemroot%\Minidump folder.

 2.    Copy any and all DMP files in the Minidump folder to your Desktop and then zip up these files.

 3.    Upload the zip containing the DMP files to Skydrive or a hosting site of your choice and paste in your reply.

If you are going to use Skydrive but don't know how to upload to it, please visit the following:

http://www.wikihow.com/Use-SkyDrive

Please note that any "cleaner" programs such as TuneUp Utilities, CCleaner, etc, by default will delete DMP files upon use.

If your computer is not generating DMP files, please do the following:

1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.
2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.
3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

4. Double check that the WERS is ENABLED:

Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

If you cannot get into normal mode to do any of this, please do this via Safe Mode.

Regards,

Patrick

Answer 4

I solved this problem by replacing my RAM.  Both of my sticks were bad.  Fixed all my issues.

Answer 5

Thank you so much for your help and detailed instructions, Patrick. Here is the DMP zip: Zip.