Blue Screen of Death: Driver IRQL Not Less or Equal (Windows 7)

My pleasure, I look forward to your update.

I would not by any means reinstall Norton, it is not a good antivirus despite what many say. I'd stay far away from Norton + McAfee. For now, go several days without any 3rdparty antivirus. If the crashes cease, you know it was both conflicting and you can move on to try others... although I dislike most as I see how many conflicts they can cause, and I deal with it on a daily basis.

For the record though, Malwarebytes is fantastic and you would be just fine installing that right now if you wish.

Regards,

Patrick

Perfect, thank you! You should also be happy to know that this at first glance appears to be a very simple and easy to solve issue.

Right, so all of the attached DMP files are of the DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) bug check.

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

If we take a look at the call stack:

1: kd> kvChild-SP          RetAddr           : Args to Child                                                           : Call Sitefffff8800c070a58 fffff8000308f169 : 000000000000000a 0000000000000008 0000000000000002 0000000000000000 : nt!KeBugCheckExfffff8800c070a60 fffff8000308dde0 : fffff8800c070c20 fffffa800edcc4d8 0000000000000000 fffff8800c070f50 : nt!KiBugCheckDispatch+0x69fffff8800c070ba0 fffff88001928a1d : fffffa8005a44338 fffffa8005a44330 0000000000000001 fffff8800193c827 : nt!KiPageFault+0x260 (TrapFrame @ fffff8800c070ba0)fffff8800c070d30 fffff880019320d4 : fffff8800c070f50 fffff8800c070f50 fffff8800c071150 fffffa800db76280 : NETIO!CalloutStreamDataInit+0x1dfffff8800c070d70 fffff8800193de98 : 0000000000000000 fffff8800c071150 fffff8800c070f00 fffff8800c070f88 : NETIO!StreamInvokeCalloutAndNormalizeAction+0x54fffff8800c070e10 fffff8800193ee91 : fffffa800f81e5f0 fffff8800c071150 fffff8800c070f50 fffff8800c0715a0 : NETIO!StreamCalloutProcessData+0x48fffff8800c070e60 fffff8800193fee8 : fffff8800c070f50 fffff8800c0715a0 fffff8800c071101 fffffa800f81e5f0 : NETIO!StreamCalloutProcessingLoop+0xa1fffff8800c070ef0 fffff88001920a2a : fffff8800c071150 fffff88009b8e690 0000000000000000 fffffa800e550014 : NETIO!StreamProcessCallout+0x1e8fffff8800c070fe0 fffff88001907f58 : fffff8a00fc50014 fffffa800ea8dc30 fffffa800593ae08 fffff8800c0715a0 : NETIO! ?? ::FNODOBFM::string'+0x71f2fffff8800c071100 fffff880019095d2 : fffff8800c070014 fffffa800ea8dc30 fffffa800e55b4e0 0000000000000000 : NETIO!ArbitrateAndEnforce+0x238fffff8800c0711d0 fffff880019423b3 : fffff8800c071674 fffffa800ea8dc30 0000000000000001 fffff8800c0715a0 : NETIO!KfdClassify+0x934fffff8800c071540 fffff8800194299a : 0000000000000000 0000000000010000 00000000003793f8 fffffa800e55b420 : NETIO!StreamInternalClassify+0xf3fffff8800c071610 fffff88001942d8e : 0000000000000014 0000000000000100 0000000000000000 fffffa800e7a98e0 : NETIO!StreamInject+0x1cafffff8800c0716e0 fffff88001997dd7 : fffffa800e55b370 000000000000015c fffffa800dcd5be0 fffff800031c3d00 : NETIO!FwppStreamInject+0x12efffff8800c071770 fffff88009afec44 : fffffa800e081360 0000000000000000 fffffa801084e1c0 fffffa8005b61c10 : fwpkclnt!FwpsStreamInjectAsync0+0xcffffff8800c0717d0 fffffa800e081360 : 0000000000000000 fffffa801084e1c0 fffffa8005b61c10 fffff8a00000015c :UrlFilter+0x1c44fffff8800c0717d8 0000000000000000 : fffffa801084e1c0 fffffa8005b61c10 fffff8a00000015c fffff80000000014 : 0xfffffa80`0e081360

We can see a UrlFilter.sys call which is a component of IObit. After we have that call, it leads into MANY Network I/O Subsystem routine calls, which goes directly into a page fault and then the bug check itself.

Unable to load image ??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64*UrlFilter.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for UrlFilter.sys*** ERROR: Module load completed but symbols could not be loaded for UrlFilter.sys*

Overall, what's happening? IObit Malware Fighter of no surprise to me (as I always see it) is causing NETBIOS conflicts with Norton which then causes memory corruption. Ultimately, this crashes your computer.

------------------

1. Uninstall IObit.
2. Remove and replace Norton with Microsoft Security Essentials for temporary troubleshooting purposes:

Norton removal -https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=841A6D40BA6872C47697C6C6B19C8E11.4?entsrc=redirect_pubweb&pvid=f-home

MSE -  http://windows.microsoft.com/en-us/windows/security-essentials-download

Your crashes should cease after this, so please keep me updated.

Also, you may want to read this about IObit - IOBit Steals Malwarebytes' Intellectual Property.

Regards,

Patrick****