locked
How I can fix IRQL_NOT LESS OR EQUAL RRS feed

  • Question

  • I have ASUS laptop N series with Window 7 home premium.

    From some months I start to have continue re-booting and appear the following message.

    The blue screen error message that is reads is as follows:

    A problem has been detected and windows has been shut down to prevent damage to your computer.

    IRQL_NOT_LESS_OR_EQUAL

    I have the Dump file but I don't know how to fix the problem. I'm able to start the computer in safe mode and sometimes after different re-starting the computer seems work properly even in normal mode.

    Any suggestion please?

    Saturday, May 23, 2015 11:39 PM

Answers

  • Dome

    Easy and not unexpected.  Symantec.  Remove it and use MSE in its place.  It is IMHO rubbishware.

    http://www.microsoft.com/security_essentials/

    Microsoft (R) Windows Debugger Version 10.0.10075.9 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\New folder\052415-80855-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    Machine Name:
    Kernel base = 0xfffff800`0325d000 PsLoadedModuleList = 0xfffff800`034a4730
    Debug session time: Sun May 24 09:55:15.663 2015 (UTC - 4:00)
    System Uptime: 0 days 0:03:16.568
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    
    Loading User Symbols
    Loading unloaded module list
    .....
    No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\Visualizers.
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {0, 2, 1, fffff800032db96f}
    
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    
    Followup:     MachineOwner
    ---------
    
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032db96f, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    SYSTEM_SKU:                        
    
    SYSTEM_VERSION:  1.0       
    
    BIOS_DATE:  04/13/2012
    
    BASEBOARD_PRODUCT:  N56VM
    
    BASEBOARD_VERSION:  1.0       
    
    BUGCHECK_P1: 0
    
    BUGCHECK_P2: 2
    
    BUGCHECK_P3: 1
    
    BUGCHECK_P4: fffff800032db96f
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350e100
    GetUlongPtrFromAddress: unable to read from fffff8000350e2e0
    GetUlongPtrFromAddress: unable to read from fffff8000350e490
     0000000000000000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+4f
    fffff800`032db96f 488713          xchg    rdx,qword ptr [rbx]
    
    CPU_COUNT: 8
    
    CPU_MHZ: 8f6
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3a
    
    CPU_STEPPING: 9
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  System
    
    ANALYSIS_VERSION: 10.0.10075.9 amd64fre
    
    TRAP_FRAME:  fffff880037cb230 -- (.trap 0xfffff880037cb230)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa80051e1b50 rbx=0000000000000000 rcx=0000000000000000
    rdx=fffff880037cb430 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800032db96f rsp=fffff880037cb3c0 rbp=0000000000000008
     r8=fffff880037cb430  r9=fffff88001d89d00 r10=0000000000000000
    r11=0000000000000040 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f:
    fffff800`032db96f 488713          xchg    rdx,qword ptr [rbx] ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff800032d0e69 to fffff800032d18c0
    
    STACK_TEXT:  
    fffff880`037cb0e8 fffff800`032d0e69 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`037cb0f0 fffff800`032cfae0 : 00000000`00000010 fffff880`037cb420 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`037cb230 fffff800`032db96f : 00000000`00000003 00000000`00000002 00000000`00000003 00000000`00000002 : nt!KiPageFault+0x260
    fffff880`037cb3c0 fffff880`01a2b9c7 : 00000000`00000008 fffff880`037cb6a0 00000000`00008900 fffffa80`063dc7c8 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
    fffff880`037cb410 fffff880`01ce508d : fffffa80`05448a10 fffffa80`0d9a8db0 fffff880`037cb6a0 00000000`00008900 : NETIO!WfpExpireEntryLru+0x17
    fffff880`037cb460 fffff880`01cac7b7 : 00000000`00000004 fffff880`01a00030 fffffa80`05448a60 00000000`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
    fffff880`037cb490 fffff880`01d24e5b : fffffa80`05448a10 fffffa80`0e4188ea 00000000`00000001 fffffa80`05448a10 : tcpip! ?? ::FNODOBFM::`string'+0x20f72
    fffff880`037cb5e0 fffff880`01d251e2 : 00000089`00000000 fffffa80`0e418820 fffffa80`067f01c0 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
    fffff880`037cb700 fffff880`01d2f6b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`067e0a78 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
    fffff880`037cb750 fffff880`01a91af2 : fffffa80`00000089 fffff800`00000089 fffffa80`05590290 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
    fffff880`037cb7f0 fffff880`050687bb : 00000000`00000000 00000000`00000000 fffffa80`0e472b40 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
    fffff880`037cb820 00000000`00000000 : 00000000`00000000 fffffa80`0e472b40 00000000`00000030 00000000`00000089 : SYMNETS+0x1e7bb
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    NETIO!WfpExpireEntryLru+17
    fffff880`01a2b9c7 488b4310        mov     rax,qword ptr [rbx+10h]
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  NETIO!WfpExpireEntryLru+17
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: NETIO
    
    IMAGE_NAME:  NETIO.SYS
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5294760d
    
    IMAGE_VERSION:  6.1.7601.18327
    
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    
    BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    
    PRIMARY_PROBLEM_CLASS:  X64_0xA_NETIO!WfpExpireEntryLru+17
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xa_netio!wfpexpireentrylru+17
    
    FAILURE_ID_HASH:  {fcdee258-ad7b-b100-5f3a-ac9544c5fd1f}
    
    Followup:     MachineOwner
    ---------
    


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Sunday, May 24, 2015 4:12 PM
    • Marked as answer by Dome19-7-63 Sunday, May 24, 2015 9:54 PM
    Sunday, May 24, 2015 4:12 PM
  • Dome

    My mistake. 

    These are the 5 most recent  Still Symantec.  You should see that it is Symantec

    [CODE]
    Debug session time: Sun May 24 09:55:15.663 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052415-80855-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:16.568
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032db96f}
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032db96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 17:46:58.148 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-85020-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:47.053
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032e396f}
    
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032e396f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 17:41:59.773 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-91931-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:48.678
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032cc96f}
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032cc96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 17:26:31.828 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-95129-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:04:03.733
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff8000327e96f}
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff8000327e96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_VRF_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 12:20:49.356 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-88967-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:51.262
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032de96f}
    BugCheck Info: [url=http://www.carrona.org/bsodindx.html#Example]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032de96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_VRF_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    
    


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Sunday, May 24, 2015 10:12 PM
    • Marked as answer by Dome19-7-63 Tuesday, May 26, 2015 8:55 PM
    Sunday, May 24, 2015 10:11 PM

All replies

  • A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article:

    https://support.microsoft.com/en-us/kb/979444?wa=wsignin1.0


    S.Sengupta, Windows Experience MVP

    Saturday, May 23, 2015 11:52 PM
  •  
    We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask


    Wanikiya and Dyami--Team Zigzag

    • Marked as answer by Dome19-7-63 Sunday, May 24, 2015 3:44 AM
    • Unmarked as answer by Dome19-7-63 Sunday, May 24, 2015 3:44 AM
    Sunday, May 24, 2015 12:21 AM
  • Thank you,

    I made the zip file with the DMP and ht MSinfo. I shared on OneDrive.

    I create a link but seems I can publish the link here before my accont is controlled.

    How I can do?

    Dome

    Sunday, May 24, 2015 3:44 AM
  • Dome

    You can replace the http:// with hxxp:// and you should

    If you are being told you cant post a link, or embed a picture (or any other restriction) you just need to post to this thread saying your account has not been validated

    Look for the verify your account thread that is stuck to the top of the page.

    http://social.technet.microsoft.com/Forums/en-US/home?forum=reportabug


    Wanikiya and Dyami--Team Zigzag

    Sunday, May 24, 2015 10:15 AM
  • I'm asking for my account to be verified. While this happened I tried your tip.

    but it doesn't work. I cope the link here and change the "tt" with the "xx". It says that my account need to be verified.

    I as trying to write it even without the http:/ part, but for some reason recognize that is a link.

    I have to wait they recognize me?

    Thank you,

    Dome

    Sunday, May 24, 2015 2:59 PM
  • Dome

    Just do this.  take the entire http:// off and put the rest. 

    Instead of http://onedrive.com put onedrive.com.  If that does not work you may have to wait but I have never seen the HxxP not work


    Wanikiya and Dyami--Team Zigzag

    Sunday, May 24, 2015 3:09 PM
  • I'm trying:

    the link is: (1drv.ms/1enpVgz) of course with (http://) on the front.

    I hope it works.

    Thank you again.

    Dome

    Sunday, May 24, 2015 3:47 PM
  • Dome

    Easy and not unexpected.  Symantec.  Remove it and use MSE in its place.  It is IMHO rubbishware.

    http://www.microsoft.com/security_essentials/

    Microsoft (R) Windows Debugger Version 10.0.10075.9 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\New folder\052415-80855-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    Machine Name:
    Kernel base = 0xfffff800`0325d000 PsLoadedModuleList = 0xfffff800`034a4730
    Debug session time: Sun May 24 09:55:15.663 2015 (UTC - 4:00)
    System Uptime: 0 days 0:03:16.568
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    
    Loading User Symbols
    Loading unloaded module list
    .....
    No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\Visualizers.
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {0, 2, 1, fffff800032db96f}
    
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    
    Followup:     MachineOwner
    ---------
    
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032db96f, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    SYSTEM_SKU:                        
    
    SYSTEM_VERSION:  1.0       
    
    BIOS_DATE:  04/13/2012
    
    BASEBOARD_PRODUCT:  N56VM
    
    BASEBOARD_VERSION:  1.0       
    
    BUGCHECK_P1: 0
    
    BUGCHECK_P2: 2
    
    BUGCHECK_P3: 1
    
    BUGCHECK_P4: fffff800032db96f
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350e100
    GetUlongPtrFromAddress: unable to read from fffff8000350e2e0
    GetUlongPtrFromAddress: unable to read from fffff8000350e490
     0000000000000000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+4f
    fffff800`032db96f 488713          xchg    rdx,qword ptr [rbx]
    
    CPU_COUNT: 8
    
    CPU_MHZ: 8f6
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3a
    
    CPU_STEPPING: 9
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  System
    
    ANALYSIS_VERSION: 10.0.10075.9 amd64fre
    
    TRAP_FRAME:  fffff880037cb230 -- (.trap 0xfffff880037cb230)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa80051e1b50 rbx=0000000000000000 rcx=0000000000000000
    rdx=fffff880037cb430 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800032db96f rsp=fffff880037cb3c0 rbp=0000000000000008
     r8=fffff880037cb430  r9=fffff88001d89d00 r10=0000000000000000
    r11=0000000000000040 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f:
    fffff800`032db96f 488713          xchg    rdx,qword ptr [rbx] ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff800032d0e69 to fffff800032d18c0
    
    STACK_TEXT:  
    fffff880`037cb0e8 fffff800`032d0e69 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`037cb0f0 fffff800`032cfae0 : 00000000`00000010 fffff880`037cb420 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`037cb230 fffff800`032db96f : 00000000`00000003 00000000`00000002 00000000`00000003 00000000`00000002 : nt!KiPageFault+0x260
    fffff880`037cb3c0 fffff880`01a2b9c7 : 00000000`00000008 fffff880`037cb6a0 00000000`00008900 fffffa80`063dc7c8 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
    fffff880`037cb410 fffff880`01ce508d : fffffa80`05448a10 fffffa80`0d9a8db0 fffff880`037cb6a0 00000000`00008900 : NETIO!WfpExpireEntryLru+0x17
    fffff880`037cb460 fffff880`01cac7b7 : 00000000`00000004 fffff880`01a00030 fffffa80`05448a60 00000000`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
    fffff880`037cb490 fffff880`01d24e5b : fffffa80`05448a10 fffffa80`0e4188ea 00000000`00000001 fffffa80`05448a10 : tcpip! ?? ::FNODOBFM::`string'+0x20f72
    fffff880`037cb5e0 fffff880`01d251e2 : 00000089`00000000 fffffa80`0e418820 fffffa80`067f01c0 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
    fffff880`037cb700 fffff880`01d2f6b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`067e0a78 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
    fffff880`037cb750 fffff880`01a91af2 : fffffa80`00000089 fffff800`00000089 fffffa80`05590290 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
    fffff880`037cb7f0 fffff880`050687bb : 00000000`00000000 00000000`00000000 fffffa80`0e472b40 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
    fffff880`037cb820 00000000`00000000 : 00000000`00000000 fffffa80`0e472b40 00000000`00000030 00000000`00000089 : SYMNETS+0x1e7bb
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    NETIO!WfpExpireEntryLru+17
    fffff880`01a2b9c7 488b4310        mov     rax,qword ptr [rbx+10h]
    
    SYMBOL_STACK_INDEX:  4
    
    SYMBOL_NAME:  NETIO!WfpExpireEntryLru+17
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: NETIO
    
    IMAGE_NAME:  NETIO.SYS
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5294760d
    
    IMAGE_VERSION:  6.1.7601.18327
    
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    
    BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    
    PRIMARY_PROBLEM_CLASS:  X64_0xA_NETIO!WfpExpireEntryLru+17
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xa_netio!wfpexpireentrylru+17
    
    FAILURE_ID_HASH:  {fcdee258-ad7b-b100-5f3a-ac9544c5fd1f}
    
    Followup:     MachineOwner
    ---------
    


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Sunday, May 24, 2015 4:12 PM
    • Marked as answer by Dome19-7-63 Sunday, May 24, 2015 9:54 PM
    Sunday, May 24, 2015 4:12 PM
  • So, I have to get rid of Norton suite and everything will work again?

    Actually I have even another problem. I'm trying to uninstall a program "fast connect" it was installed from Comcast suite when I installed Norton. I have device problem Antilog32, which is from this program, but when I'm trying to remove the program with control panel\uninstall program appear this: "invalid uninstall control file".

    How I can uninstall it?

    And, I found an hotfix for the IRQL_NOT LESS OR EQUAL. Is it works? What it will do instead of work on Norton

    Thank you so much. I appreciate your help.

    Sunday, May 24, 2015 8:01 PM
  • Dome

    You gave me one dmp file and for that file Norton was the problem. When you have removed it, and if you continue to crash upload the new DMPS


    Wanikiya and Dyami--Team Zigzag

    Sunday, May 24, 2015 8:16 PM
  • In the .zip file I compressed 50 DMP files. Did you find only one?

    Thank you

    Dome

    Sunday, May 24, 2015 8:40 PM
  • Dome

    My mistake. 

    These are the 5 most recent  Still Symantec.  You should see that it is Symantec

    [CODE]
    Debug session time: Sun May 24 09:55:15.663 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052415-80855-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:16.568
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032db96f}
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032db96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 17:46:58.148 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-85020-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:47.053
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032e396f}
    
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032e396f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 17:41:59.773 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-91931-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:48.678
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032cc96f}
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032cc96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 17:26:31.828 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-95129-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:04:03.733
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff8000327e96f}
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff8000327e96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_VRF_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    Debug session time: Sat May 23 12:20:49.356 2015 (UTC - 4:00)
    Loading Dump File [C:\Users\zigza\SysnativeBSODApps\052315-88967-01.dmp]
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    System Uptime: 0 days 0:03:51.262
    *** WARNING: Unable to verify timestamp for SYMNETS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
    Probably caused by : NETIO.SYS ( NETIO!WfpExpireEntryLru+17 )
    BugCheck A, {0, 2, 1, fffff800032de96f}
    BugCheck Info: [url=http://www.carrona.org/bsodindx.html#Example]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
    Bugcheck code 0000000A
    Arguments: 
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800032de96f, address which referenced memory
    BUGCHECK_STR:  0xA
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    PROCESS_NAME:  System
    FAILURE_BUCKET_ID:  X64_0xA_VRF_NETIO!WfpExpireEntryLru+17
    MaxSpeed:     2300
    CurrentSpeed: 2294
    BiosVersion = N56VM.206
    BiosReleaseDate = 04/13/2012
    SystemManufacturer = ASUSTeK COMPUTER INC.
    SystemProductName = N56VM
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    
    


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Sunday, May 24, 2015 10:12 PM
    • Marked as answer by Dome19-7-63 Tuesday, May 26, 2015 8:55 PM
    Sunday, May 24, 2015 10:11 PM
  • Thank you so much.

    I did uninstall Norton until you told me and seems its works.

    If I have problem I will let you know.

    Dome

    Tuesday, May 26, 2015 8:55 PM