Posted on 2011-02-23
Last Modified: 2012-05-11
We have two users getting constant BSOD with the error DRIVER_IRQL_NOT_LESS_OR_EQUAL on the netbt.sys driver - how can I resolve this?

Debugging information below:

Loading Dump File [C:\Documents and Settings\pstiff\Desktop\Mini122310-022211\Mini022211-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Feb 22 20:43:35.281 2011 (GMT-6)
System Uptime: 0 days 1:35:31.972
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {a8997101, 2, 8, a8997101}

Unable to load image dne2000.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dne2000.sys
*** ERROR: Module load completed but symbols could not be loaded for dne2000.sys
Probably caused by : netbt.sys ( netbt!TdiBindHandler+ff )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arg1: a8997101, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: a8997101, address which referenced memory

Debugging Details:

READ_ADDRESS:  a8997101


a8997101 6a01            push    1





LAST_CONTROL_TRANSFER:  from ba429d80 to a8997101

a8997101 6a01            push    1

a72bb608 ba429d80 00000002 8a426550 8a579bd8 netbt!TdiBindHandler+0xff
a72bb634 ba42a2f5 ba42b408 8a579bd8 00000000 TDI!TdiNotifyPnpClientList+0xd0
a72bb658 ba42a70e 00000000 02ae73e8 00000000 TDI!TdiExecuteRequest+0x19b
a72bb694 ba42a7e5 8a426510 0000000e a72bb6ec TDI!TdiHandleSerializedRequest+0x1c4
a72bb6a4 a8a59d8f 8a426510 00000000 8aa05928 TDI!TdiDeregisterDeviceObject+0xf
a72bb6ec a8a549aa 8a0b62f0 00000001 8a8ec770 tcpip!IPDelInterface+0x1b2
a72bb708 b9de7803 a72bb7d4 8aa05928 a72bb728 tcpip!ARPUnbindAdapter+0x72
a72bb7dc b9de8b8b 8a8ec770 a72bb800 8a473ad0 NDIS!ndisUnbindProtocol+0x157
a72bb830 b9de9dc6 8a725ae8 8a473ad0 c0000001 NDIS!ndisCloseMiniportBindings+0x1f7
a72bb95c b9de9f27 b93bcc68 89d9d7c0 806e7830 NDIS!ndisPnPRemoveDevice+0x142
a72bb970 b93b0167 8a473ad0 89d42008 8a78cd40 NDIS!NdisIMDeInitializeDeviceInstance+0x44
a72bb988 b9de7803 a72bba54 01d9d7c0 a72bb9a8 psched!ClUnbindFromLowerMp+0xc9
a72bba5c b9de8b8b 89d42008 a72bba80 8a808ad0 NDIS!ndisUnbindProtocol+0x157
a72bbab0 b9de9dc6 8aa82bc8 8a808ad0 c0000001 NDIS!ndisCloseMiniportBindings+0x1f7
a72bbbdc b9de9f27 a72bbccc 89dab020 89dabad4 NDIS!ndisPnPRemoveDevice+0x142
a72bbbf0 b93e15da 8a808ad0 00000000 8aa6ae18 NDIS!NdisIMDeInitializeDeviceInstance+0x44
WARNING: Stack unwind information not available. Following frames may be wrong.
a72bbc34 b9ddefe6 a72bbccc a72bbc5c 89aa556c dne2000+0xa5da
a72bbcd0 b9de163d 806e7830 8a052130 8052b326 NDIS!ndisInitializeBinding+0x189
a72bbd58 b9de16d6 8a8b9fe0 80564820 89bbbba8 NDIS!ndisCheckAdapterBindings+0x13a
a72bbd6c b9dddbfe 8a8b9fd8 00052130 a72bbdac NDIS!ndisQueuedCheckAdapterBindings+0x83
a72bbd7c 805387cb 8a8b9fd8 00000000 89bbbba8 NDIS!ndisWorkItemHandler+0xe
a72bbdac 805cffa8 8a8b9fd8 00000000 00000000 nt!ExpWorkerThread+0xef
a72bbddc 8054615e 805386dc 80000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


a8997101 6a01            push    1


SYMBOL_NAME:  netbt!TdiBindHandler+ff

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  netbt.sys


FAILURE_BUCKET_ID:  0xD1_CODE_AV_BAD_IP_netbt!TdiBindHandler+ff

BUCKET_ID:  0xD1_CODE_AV_BAD_IP_netbt!TdiBindHandler+ff

Followup: MachineOwner

Question by:pstiffsae
LVL 37

Accepted Solution

Neil Russell earned 500 total points
ID: 34964635
First of all, have you applied ALL latest windows updates? Have you installed any new hardware lately? Have you updated any drivers lately?

I would start by making sure ALL windows updates are aplied and then checking you have the latest drivers installed for your network cards.

Expert Comment

ID: 34965363
According to Microsoft Support Online article Q243478, Microsoft released a bug fix for netbt.sys on October 11. You can obtain the updated version only from Microsoft Support
you may want to go down that road, unless you feel easier reinstalling the systems.

Author Comment

ID: 34965690
Care to link the article? All I'm getting is 
LVL 91

Expert Comment

ID: 34967830
it can be malware, in which case i suggest to run these  :
      Spybot :                         MBAM

info on netbt.sys :
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.


Author Comment

ID: 34973325
When updating his NetXtreme 57XX Gigabit Ethernet adapter, it immediately gives the BSOD. Is the NIC card bad?
LVL 91

Expert Comment

ID: 34977521
that is possible - you can test with another card, or test this one on another pc (if separate)
LVL 91

Expert Comment

ID: 34977523
or - if you want to know it's ok or not, run from the knoppix live cd, and check your internet connection - it should work : 

Author Comment

ID: 34989904
Since updating his BIOS and Network card drivers, I've not heard of anymore errors, however that was only as of yesturday
LVL 91

Expert Comment

ID: 34990496
ok - keep us posted..

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
Learn how to create flexible layouts using relative units in CSS.  New relative units added in CSS3 include vw(viewports width), vh(viewports height), vmin(minimum of viewports height and width), and vmax (maximum of viewports height and width).
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now