New
#1
I can only speak for the last 2 crashes.
Although different drivers, they're from Norton.
Ironically, the same invalid memory address is being used in both situations, but the instructions to them are different.Code:DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000008, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff80185f2cb15, address which referenced memory TRAP_FRAME: ffff8303b0ad5c60 -- (.trap 0xffff8303b0ad5c60) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=00000000000000cd rbx=0000000000000000 rcx=0000000000000008 rdx=00000000000000cd rsi=0000000000000000 rdi=0000000000000000 rip=fffff80185f2cb15 rsp=ffff8303b0ad5df0 rbp=ffffcc8d3e9c6a74 r8=ffffcc8d3e972cd8 r9=0000000000000000 r10=9d0cfb8e00000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc symnets+0xcb15: fffff801`85f2cb15 f60101 test byte ptr [rcx],1 ds:00000000`00000008=?? 0: kd> k # Child-SP RetAddr Call Site 00 ffff8303`b0ad5b18 fffff801`7fe08b69 nt!KeBugCheckEx 01 ffff8303`b0ad5b20 fffff801`7fe04e69 nt!KiBugCheckDispatch+0x69 02 ffff8303`b0ad5c60 fffff801`85f2cb15 nt!KiPageFault+0x469 03 ffff8303`b0ad5df0 ffffcc8d`3e9c6a20 symnets+0xcb15 04 ffff8303`b0ad5df8 fffff801`85f97b88 0xffffcc8d`3e9c6a20 05 ffff8303`b0ad5e00 ffffcc8d`419ee510 symnets+0x77b88 06 ffff8303`b0ad5e08 fffff801`85f2c6a1 0xffffcc8d`419ee510 07 ffff8303`b0ad5e10 ffffcc8d`442cc2a0 symnets+0xc6a1 08 ffff8303`b0ad5e18 ffff8303`b0ad5e90 0xffffcc8d`442cc2a0 09 ffff8303`b0ad5e20 ffffcc8d`3e9c6a74 0xffff8303`b0ad5e90 0a ffff8303`b0ad5e28 ffffcc8d`442cc2a0 0xffffcc8d`3e9c6a74 0b ffff8303`b0ad5e30 ffffcc8d`3e9c6a74 0xffffcc8d`442cc2a0 0c ffff8303`b0ad5e38 fffff801`85f2c742 0xffffcc8d`3e9c6a74 0d ffff8303`b0ad5e40 ffffcc8d`400d0dc0 symnets+0xc742 0e ffff8303`b0ad5e48 ffff8303`b0ad5e90 0xffffcc8d`400d0dc0 0f ffff8303`b0ad5e50 ffffcc8d`3e9c6a58 0xffff8303`b0ad5e90 10 ffff8303`b0ad5e58 ffffcc8d`442cc2a0 0xffffcc8d`3e9c6a58 11 ffff8303`b0ad5e60 00000000`00000003 0xffffcc8d`442cc2a0 12 ffff8303`b0ad5e68 fffff801`85f2d2ac 0x3 13 ffff8303`b0ad5e70 ffffcc8d`3e9c6a74 symnets+0xd2ac 14 ffff8303`b0ad5e78 ffffcc8d`3e9c6cc0 0xffffcc8d`3e9c6a74 15 ffff8303`b0ad5e80 ffffcc8d`442cc2a0 0xffffcc8d`3e9c6cc0 16 ffff8303`b0ad5e88 00000000`00000000 0xffffcc8d`442cc2a0 0: kd> lmvm symnets Browse full module list start end module name fffff801`85f20000 fffff801`85faf000 symnets T (no symbols) Loaded symbol image file: symnets.sys Image path: \SystemRoot\System32\drivers\NGCx64\1615050.02C\symnets.sys Image name: symnets.sys Browse all global symbols functions data Timestamp: Sat Feb 8 06:47:17 2020 (5E3E4B65) CheckSum: 000975A1 ImageSize: 0008F000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 Information from resource tables:
Check Norton for software updates, or reinstall Norton.Code:DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000008, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff803164d9bb4, address which referenced memory TRAP_FRAME: ffffc101305177b0 -- (.trap 0xffffc101305177b0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000001 rbx=0000000000000000 rcx=ffffaf0d35898ab8 rdx=ffffaf0d3e5f8170 rsi=0000000000000000 rdi=0000000000000000 rip=fffff803164d9bb4 rsp=ffffc10130517940 rbp=0000000000000001 r8=0000000000000000 r9=0000000000000002 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc IDSvia64+0x59bb4: fffff803`164d9bb4 418b4008 mov eax,dword ptr [r8+8] ds:00000000`00000008=???????? 0: kd> k # Child-SP RetAddr Call Site 00 ffffc101`30517668 fffff803`0fe08b69 nt!KeBugCheckEx 01 ffffc101`30517670 fffff803`0fe04e69 nt!KiBugCheckDispatch+0x69 02 ffffc101`305177b0 fffff803`164d9bb4 nt!KiPageFault+0x469 03 ffffc101`30517940 ffffaf0d`40e546a8 IDSvia64+0x59bb4 04 ffffc101`30517948 fffff803`14e02caa 0xffffaf0d`40e546a8 05 ffffc101`30517950 fffff803`14e4880a fwpkclnt!FwppProxyTransactionCommit+0x26 06 ffffc101`30517990 00000000`00000000 fwpkclnt!FwpmEngineClose0+0x2a 0: kd> lmvm IDSvia64 Browse full module list start end module name fffff803`16480000 fffff803`165ee000 IDSvia64 T (no symbols) Loaded symbol image file: IDSvia64.sys Image path: \??\C:\Program Files\Norton Security\NortonData\22.16.4.15\Definitions\IPSDefs\20210714.061\IDSvia64.sys Image name: IDSvia64.sys Browse all global symbols functions data Timestamp: Thu Feb 11 23:22:34 2021 (6025AE2A) CheckSum: 0017633E ImageSize: 0016E000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 Information from resource tables:
If additional BSOD crashes occur after updating or reinstalling Norton, please run the V2 log collector again and upload a new zip file.
There wasn't any update from Norton.
I removed and reinstalled it again.
Will monitor before marked close. Thanks, Axe0