Solved

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

Posted on 2006-06-19
14
1,964 Views
Last Modified: 2012-05-11
Hello Experts,

My XP SP2 crashes a lot when at at LAN.

Below is the minidump analysis

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b84d3ce3, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS:  00000000

CURRENT_IRQL:  2

FAULTING_IP:
vsdatant+5ce3
b84d3ce3 668b12           mov     dx,[edx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

LAST_CONTROL_TRANSFER:  from b84f0060 to b84d3ce3

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
f7a07af0 b84f0060 00010001 00000002 00000040 vsdatant+0x5ce3
f7a07af4 00010001 00000002 00000040 00000080 vsdatant+0x22060
f7a07af8 00000000 00000040 00000080 0000000a 0x10001


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
vsdatant+5ce3
b84d3ce3 668b12           mov     dx,[edx]

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  vsdatant+5ce3

MODULE_NAME:  vsdatant

IMAGE_NAME:  vsdatant.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  3e5ed7b1

FAILURE_BUCKET_ID:  0xD1_vsdatant+5ce3

BUCKET_ID:  0xD1_vsdatant+5ce3

Followup: MachineOwner

Any Help....

Regards,

Max
0
Comment
Question by:mkumar23
  • 5
  • 5
  • 4
14 Comments
 
LVL 34

Expert Comment

by:jamietoner
ID: 16935277
looks like what causing it is the TrueVector Device Driver which is part of zone alarm (zone labs), i would suggest uninstalling and reinstalling to program so it reinstalls that driver file
0
 
LVL 4

Author Comment

by:mkumar23
ID: 16935410
Can you suggest... How to do that?
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 16935489
  >DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1 <
Your error is generally described under sub-heading "Driver issue" with associated comments:
http://www.computerhope.com/issues/ch000365.htm
0
 
LVL 34

Expert Comment

by:jamietoner
ID: 16935572
go into the control panel-> add/remove programs and uninstall zone alarm, then to reinstall it either use the orginal software cd or the file that you downloaded to install the program, if you downloaded it you might want to check for an updated version and download the newest version.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 16935629
Max:
It could also be a RAM problem.  It was this previous E-E thread i'd been searching for:

"DRIVER_IRQL_NOT_LESS_OR_EQUAL":
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21518760.html
0
 
LVL 4

Author Comment

by:mkumar23
ID: 16935662
I do not have Zone Alarm in add and remove program list,

I'm not sure, if I have installed/uninstalled it ever by my own.

Is there can be a posiablity through which it could have installed by it self during my web access.

I might have clicked on some link and didn't noticed.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 16935722
 > could have installed by it self during my web access <    
ZoneAlarm ?   Inclined to say "no way" !

After you've checked out jamietoner's comment, and if you still have an issue, there are a number of useful checks you could make by following the suggestions in that E-E thread above, it may well resolve your problem.
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 27

Expert Comment

by:Jonvee
ID: 16935751
In particular, note the excellent link and information in the thread above, supplied by LeeTutor >>
http://aumha.org/win5/kbestop.htm
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 16935826
Does the "Cause" in this MS article, linked from the same thread, look familiar (Mylex RAID controller) ?    Will leave you to consider this for a while.

"STOP:0xD1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)":
http://support.microsoft.com/?kbid=316208&sd=RMVP
0
 
LVL 34

Expert Comment

by:jamietoner
ID: 16935863
looked around a little more on vsdaatant.sys and it can be left behind after zone alram is uninstalled and can cause errors including bluescreens. also found some info on zone labs website showing what file have to be manually deleted, here's the link http://nh2.nohold.net/noHoldCust25/Prod_1/Articles55646/CompleteUninstallNonNT.html
0
 
LVL 34

Expert Comment

by:jamietoner
ID: 16935877
hers some better instructions i just found to remove some of those filkes including vsdatant.sys
01.) Restart your computer
02.) When you see the screen go black and it starts booting back up keep tapping the "F8" key (at the top of your keyboard)
03.) This should bring up a menu. Choose Safe Mode off the menu by using the arrow keys on the keyboard to highlight Safe Mode and press Enter
04.) If you get a message asking to go to Safe Mode, choose Yes. If you get a help and support window, close this.
05.) Once you are at the desktop, Click Start, My Computer
06.) Click Tools, Folder Options, View Tab
07.) Place a dot next to "Show Hidden Files and Folders"
08.) Remove the check from "Hide Protected Operating System Files (Recommended)"
09.) Choose Yes to the warning
10.) Click OK
11.) Double click C:

Note: In the future steps if you do not see any files or folders, please click the "Show Files" link to view them.

12.) Double Click the Program Files Folder
13.) Right Click the Zone Labs Folder, click Delete, and choose Yes
14.) Close this window
15.) Click Start, My Computer
16.) Double Click the C:
17.) Double Click the Windows Folder (It may say WinNT if you have Windows 2000)
18.) Right Click the Internet Logs Folder, click Delete, and choose Yes
19.) Double Click the System32 Folder
20.) Right Click the Zone Labs Folder, click Delete, and choose Yes
21.) Right Click the file Vsdatant.sys, click Delete, and choose Yes
22.) Right Click the file VSUtil.dll, click Delete, and choose Yes
23.) Right Click the file VSInit.dll, click Delete, and choose Yes
24.) Restart the computer.

==================
0
 
LVL 4

Author Comment

by:mkumar23
ID: 16971818
Thank you so much for all your efforts and I'm sorry I did not found much time to work on the steps. Today I worked out the steps you have sent.

Jamietoner/Jonvee:

I did not found anything with the name Zone Labs.

I have tried the steps you have mentioned but I can only see Vsdatant.sys file under system32 folder
Though, I have found "Vsdata.dll" file under system32 folder.

I have not deleted any file so far, as I'm not sure what will be the impact on my system. I do not have a backup also of my PC.
0
 
LVL 34

Accepted Solution

by:
jamietoner earned 500 total points
ID: 16971855
so it looks like zone alarm was on the system at one time but it was removed, so all you should need to do now is delete Vsdatant.sys and vsdata.dll they are files that  were left behind after the removal of zonealarm.
0
 
LVL 4

Author Comment

by:mkumar23
ID: 16971913
So does it mean that these files were part of Zone Alarm and not the part of windows system and dll file.

Also, do I need to remove some registery entries for them.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now