Solved

DRIVER_IRQL_NOT_LESS_OR_EQUAL BSOD

Posted on 2011-02-23
9
838 Views
Last Modified: 2012-05-11
We have two users getting constant BSOD with the error DRIVER_IRQL_NOT_LESS_OR_EQUAL on the netbt.sys driver - how can I resolve this?

Debugging information below:

Loading Dump File [C:\Documents and Settings\pstiff\Desktop\Mini122310-022211\Mini022211-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Feb 22 20:43:35.281 2011 (GMT-6)
System Uptime: 0 days 1:35:31.972
Loading Kernel Symbols
...............................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {a8997101, 2, 8, a8997101}

Unable to load image dne2000.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dne2000.sys
*** ERROR: Module load completed but symbols could not be loaded for dne2000.sys
Probably caused by : netbt.sys ( netbt!TdiBindHandler+ff )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: a8997101, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: a8997101, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  a8997101

CURRENT_IRQL:  2

FAULTING_IP:
netbt!TdiBindHandler+ff
a8997101 6a01            push    1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from ba429d80 to a8997101

FAILED_INSTRUCTION_ADDRESS:
netbt!TdiBindHandler+ff
a8997101 6a01            push    1

STACK_TEXT:  
a72bb608 ba429d80 00000002 8a426550 8a579bd8 netbt!TdiBindHandler+0xff
a72bb634 ba42a2f5 ba42b408 8a579bd8 00000000 TDI!TdiNotifyPnpClientList+0xd0
a72bb658 ba42a70e 00000000 02ae73e8 00000000 TDI!TdiExecuteRequest+0x19b
a72bb694 ba42a7e5 8a426510 0000000e a72bb6ec TDI!TdiHandleSerializedRequest+0x1c4
a72bb6a4 a8a59d8f 8a426510 00000000 8aa05928 TDI!TdiDeregisterDeviceObject+0xf
a72bb6ec a8a549aa 8a0b62f0 00000001 8a8ec770 tcpip!IPDelInterface+0x1b2
a72bb708 b9de7803 a72bb7d4 8aa05928 a72bb728 tcpip!ARPUnbindAdapter+0x72
a72bb7dc b9de8b8b 8a8ec770 a72bb800 8a473ad0 NDIS!ndisUnbindProtocol+0x157
a72bb830 b9de9dc6 8a725ae8 8a473ad0 c0000001 NDIS!ndisCloseMiniportBindings+0x1f7
a72bb95c b9de9f27 b93bcc68 89d9d7c0 806e7830 NDIS!ndisPnPRemoveDevice+0x142
a72bb970 b93b0167 8a473ad0 89d42008 8a78cd40 NDIS!NdisIMDeInitializeDeviceInstance+0x44
a72bb988 b9de7803 a72bba54 01d9d7c0 a72bb9a8 psched!ClUnbindFromLowerMp+0xc9
a72bba5c b9de8b8b 89d42008 a72bba80 8a808ad0 NDIS!ndisUnbindProtocol+0x157
a72bbab0 b9de9dc6 8aa82bc8 8a808ad0 c0000001 NDIS!ndisCloseMiniportBindings+0x1f7
a72bbbdc b9de9f27 a72bbccc 89dab020 89dabad4 NDIS!ndisPnPRemoveDevice+0x142
a72bbbf0 b93e15da 8a808ad0 00000000 8aa6ae18 NDIS!NdisIMDeInitializeDeviceInstance+0x44
WARNING: Stack unwind information not available. Following frames may be wrong.
a72bbc34 b9ddefe6 a72bbccc a72bbc5c 89aa556c dne2000+0xa5da
a72bbcd0 b9de163d 806e7830 8a052130 8052b326 NDIS!ndisInitializeBinding+0x189
a72bbd58 b9de16d6 8a8b9fe0 80564820 89bbbba8 NDIS!ndisCheckAdapterBindings+0x13a
a72bbd6c b9dddbfe 8a8b9fd8 00052130 a72bbdac NDIS!ndisQueuedCheckAdapterBindings+0x83
a72bbd7c 805387cb 8a8b9fd8 00000000 89bbbba8 NDIS!ndisWorkItemHandler+0xe
a72bbdac 805cffa8 8a8b9fd8 00000000 00000000 nt!ExpWorkerThread+0xef
a72bbddc 8054615e 805386dc 80000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
netbt!TdiBindHandler+ff
a8997101 6a01            push    1

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  netbt!TdiBindHandler+ff

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: netbt

IMAGE_NAME:  netbt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025d1b

FAILURE_BUCKET_ID:  0xD1_CODE_AV_BAD_IP_netbt!TdiBindHandler+ff

BUCKET_ID:  0xD1_CODE_AV_BAD_IP_netbt!TdiBindHandler+ff

Followup: MachineOwner
---------

0
Comment
Question by:pstiffsae
9 Comments
 
LVL 37

Accepted Solution

by:
Neil Russell earned 500 total points
Comment Utility
First of all, have you applied ALL latest windows updates? Have you installed any new hardware lately? Have you updated any drivers lately?

I would start by making sure ALL windows updates are aplied and then checking you have the latest drivers installed for your network cards.
0
 
LVL 5

Expert Comment

by:ccns
Comment Utility
According to Microsoft Support Online article Q243478, Microsoft released a bug fix for netbt.sys on October 11. You can obtain the updated version only from Microsoft Support
you may want to go down that road, unless you feel easier reinstalling the systems.
0
 

Author Comment

by:pstiffsae
Comment Utility
Care to link the article? All I'm getting is http://support.microsoft.com/kb/243478
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
it can be malware, in which case i suggest to run these  :
      Spybot :        http://www.download.com/3000-8022-10122137.html
http://www.malwarebytes.org/mbam.php                         MBAM

info on netbt.sys :  http://www.file.net/process/netbt.sys.html
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 

Author Comment

by:pstiffsae
Comment Utility
When updating his NetXtreme 57XX Gigabit Ethernet adapter, it immediately gives the BSOD. Is the NIC card bad?
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
that is possible - you can test with another card, or test this one on another pc (if separate)
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
or - if you want to know it's ok or not, run from the knoppix live cd, and check your internet connection - it should work : ftp://ftp.kernel.org/pub/dist/knoppix/KNOPPIX_V6.4.4CD-2011-01-30-EN.iso  
0
 

Author Comment

by:pstiffsae
Comment Utility
Since updating his BIOS and Network card drivers, I've not heard of anymore errors, however that was only as of yesturday
0
 
LVL 91

Expert Comment

by:nobus
Comment Utility
ok - keep us posted..
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now