IRQL_NOT_LESS_OR_EQUAL & Bugcheck

Admin: Split from other thread

Hi All, First time poster here. I have been following this thread and I have almost verbatim the same exact problem this guy does. (Different hardware however) I have tried to follow your advice to him as closely as possible. Downloaded all the files and diagnostic utilities, and got my debuglog.txt. Would you like me to start a new thread or post it here? (not sure which was appropriate)

Thanks JD

 

Hi jaydee2202 and welcome to the forum.

Please do start a new thread. We try to keep tech issues to a single issue on a thread to avoid confusion.

 

Roger That.

Hope everyones holidays are going smoothly. Here is the debug log for my dump. Tell me if missed a step or if somthing seems out of place/you need more information to help me solve my problem. I apprecaite any help that anyone can provide. Im including the contents of debuglog.txt in the next post because Im getting the msg that my post is too long.

Thanks in advance!

JD

 

Ok, didnt fit here either, not sure how to attach a file either. So I hosted it here

Thanks Again.

JD

 

http://www.engr.uconn.edu/~jdoctor/debuglog.txt

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 805214b7, address which referenced memory

Debugging Details:
------------------

Database SolnDb not connected

READ_ADDRESS: 00000008

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExRemoveHeadNBQueue+61
805214b7 8b5108 mov edx,[ecx+0x8]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

TRAP_FRAME: f459a6f4 -- (.trap fffffffff459a6f4)
.trap fffffffff459a6f4
ErrCode = 00000000
eax=c03df21c ebx=c03df21c ecx=00000000 edx=00026ba5 esi=827fc008 edi=827fc010
eip=805214b7 esp=f459a768 ebp=f459a794 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExRemoveHeadNBQueue+61:
805214b7 8b5108 mov edx,[ecx+0x8] ds:0023:00000008=????????
.trap
Resetting default context

LAST_CONTROL_TRANSFER: from 8052eeec to 805214b7

STACK_TEXT:
f459a794 8052eeec c03df21c f459a7ac 822fcb58 nt!ExRemoveHeadNBQueue+0x61
f459a7b4 804fb5cd 00000001 00000000 0000005c nt!MiReserveSystemPtes+0x38
f459a7e0 f7b49b99 822fcb74 00000000 00000001 nt!MmMapLockedPagesSpecifyCache+0xbb
f459a810 f773c7c8 f459a83c 00000000 0000005c TDI!TdiCopyBufferToMdl+0x47
f459a8a4 f5df3720 00000000 00344b2c 822fcb58 wanarp!WanIpQueryInfo+0x179
f459a9a8 f5df3ad5 82344b2c 822fcb58 f459ab00 tcpip!IPQueryInfo+0x91
f459aad8 f5df25db f459ab24 82344b2c 822fcb58 tcpip!TdiQueryInformationEx+0x21c
f459ab5c f5df26d3 822cd898 822cd908 822cd908 tcpip!TCPQueryInformationEx+0x1c0
f459ab7c f5df2685 822cd898 822cd908 822cd92c tcpip!TCPDispatchDeviceControl+0x1be
f459abb4 804e6215 8264d958 822cd898 822cd950 tcpip!TCPDispatch+0x127
f459abc4 f4633ecb 8248d230 8269c740 822cd908 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f459abe0 f4633bf6 826622e8 f4622c8b 00000000 SYMTDI!rHeapFree+0x1503
f459abf8 f4633ab3 826622e8 824a2338 00000000 SYMTDI!rHeapFree+0x122e
f459ac20 f46357ea 824c33d8 822cd898 824c33d8 SYMTDI!rHeapFree+0x10eb
f459ac34 804e6215 824c33d8 822cd898 806a3180 SYMTDI!rHeapFree+0x2e22
f459ac44 80556cf8 8241df90 822cd92c 822cd898 nt!IopfCallDriver+0x31
f459ac58 80557a23 824c33d8 822cd898 8241df90 nt!IopSynchronousServiceTail+0x5e
f459ad00 805508e4 0000031c 00000518 00000000 nt!IopXxxControlFile+0x5a5
f459ad34 805287b1 0000031c 00000518 00000000 nt!NtDeviceIoControlFile+0x28
f459ad34 7ffe0304 0000031c 00000518 00000000 nt!KiSystemService+0xc4
013af51c 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4

 

Have you updated norton internet security yet? Looking for an update to symtdi.sys.
From this crash it looks like it probably passed a bad MDL, which is a no-no.

Do your other crashes look like this in the STACK_TEXT: section?

 

Thanks for your response. The only norton product I have right now is norton antivirus 2002 ver: 8.07.17c What does it mean to pass bad MDL's? can you enlighten me? That post was the first documented crash, ive got another located here The stack text is considerably shorter. Any ideas?

Also, when it blue screen'd i got this "technical information"

STOP: 0x0000008E (0xc0000005, 0x805214B7, 0xF3F1B6AC, 0x00000000)

Im not sure if thats even remotely helpful looks like some random mem addys to me but then again I wouldnt be here if i knew what they meant

Thanks in advance,

JD

 

Page_fault_in_nonpaged_area

Here is are more dump files, different problems. If somone can help me out with this Id highly apprecaite it. I just dont know where to start

Thanks,
JD

http://www.engr.uconn.edu/~jdoctor/debuglog2.txt
http://www.engr.uconn.edu/~jdoctor/debuglog3.txt
http://www.engr.uconn.edu/~jdoctor/debuglog4.txt
http://www.engr.uconn.edu/~jdoctor/debuglog5.txt

 

Hi JD,

After reviewing your logs, I tend to agree with Ben in that the crash is being caused by a Norton driver. However, Norton itself may not be responsible for this. It appears that although you have applied some Windows Security Updates as recently as at least July 2004, you haven't applied any Service Packs, eg. SP1 or SP2. My recommendation is to visit Windows Update and apply ALL available critical updates, rebooting when prompted and checking for more, until no more are offered. Then empty all temp folders and run disk cleanup, checking all boxes except compress old files. Reboot and see how things are behaving. If still having problems, check for an updated symtdi.sys, as mentioned above (your is dated Jun 29 2004) and/or try upgrading/replacing your Norton AV 2002.