Blue screen Appeared Randomly


  1. Posts : 31
    Windows 10 Pro 21H1
       #1

    Blue screen Appeared Randomly


    I recently encounter bluescreen either surfing the net or doing office works. It happens randomly.
    From the event viewer, I see the following error message

    Blue screen Appeared Randomly-eventlog.jpg

    I have also attached the logs collected using "log collector V2 log collector".

    Any help and advice will be much be appreciated. Thanks.
    Blue screen Appeared Randomly Attached Files
      My Computer

  2. axe0's Avatar
    Posts : 14,858
    Windows 10 Pro
       #2

    I can only speak for the last 2 crashes.

    Although different drivers, they're from Norton.
    Code:
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000008, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff80185f2cb15, address which referenced memory
    
    TRAP_FRAME:  ffff8303b0ad5c60 -- (.trap 0xffff8303b0ad5c60)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=00000000000000cd rbx=0000000000000000 rcx=0000000000000008
    rdx=00000000000000cd rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80185f2cb15 rsp=ffff8303b0ad5df0 rbp=ffffcc8d3e9c6a74
     r8=ffffcc8d3e972cd8  r9=0000000000000000 r10=9d0cfb8e00000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    symnets+0xcb15:
    fffff801`85f2cb15 f60101          test    byte ptr [rcx],1 ds:00000000`00000008=??
    
    0: kd> k
     # Child-SP          RetAddr           Call Site
    00 ffff8303`b0ad5b18 fffff801`7fe08b69 nt!KeBugCheckEx
    01 ffff8303`b0ad5b20 fffff801`7fe04e69 nt!KiBugCheckDispatch+0x69
    02 ffff8303`b0ad5c60 fffff801`85f2cb15 nt!KiPageFault+0x469
    03 ffff8303`b0ad5df0 ffffcc8d`3e9c6a20 symnets+0xcb15
    04 ffff8303`b0ad5df8 fffff801`85f97b88 0xffffcc8d`3e9c6a20
    05 ffff8303`b0ad5e00 ffffcc8d`419ee510 symnets+0x77b88
    06 ffff8303`b0ad5e08 fffff801`85f2c6a1 0xffffcc8d`419ee510
    07 ffff8303`b0ad5e10 ffffcc8d`442cc2a0 symnets+0xc6a1
    08 ffff8303`b0ad5e18 ffff8303`b0ad5e90 0xffffcc8d`442cc2a0
    09 ffff8303`b0ad5e20 ffffcc8d`3e9c6a74 0xffff8303`b0ad5e90
    0a ffff8303`b0ad5e28 ffffcc8d`442cc2a0 0xffffcc8d`3e9c6a74
    0b ffff8303`b0ad5e30 ffffcc8d`3e9c6a74 0xffffcc8d`442cc2a0
    0c ffff8303`b0ad5e38 fffff801`85f2c742 0xffffcc8d`3e9c6a74
    0d ffff8303`b0ad5e40 ffffcc8d`400d0dc0 symnets+0xc742
    0e ffff8303`b0ad5e48 ffff8303`b0ad5e90 0xffffcc8d`400d0dc0
    0f ffff8303`b0ad5e50 ffffcc8d`3e9c6a58 0xffff8303`b0ad5e90
    10 ffff8303`b0ad5e58 ffffcc8d`442cc2a0 0xffffcc8d`3e9c6a58
    11 ffff8303`b0ad5e60 00000000`00000003 0xffffcc8d`442cc2a0
    12 ffff8303`b0ad5e68 fffff801`85f2d2ac 0x3
    13 ffff8303`b0ad5e70 ffffcc8d`3e9c6a74 symnets+0xd2ac
    14 ffff8303`b0ad5e78 ffffcc8d`3e9c6cc0 0xffffcc8d`3e9c6a74
    15 ffff8303`b0ad5e80 ffffcc8d`442cc2a0 0xffffcc8d`3e9c6cc0
    16 ffff8303`b0ad5e88 00000000`00000000 0xffffcc8d`442cc2a0
    
    0: kd> lmvm symnets
    Browse full module list
    start             end                 module name
    fffff801`85f20000 fffff801`85faf000   symnets  T (no symbols)           
        Loaded symbol image file: symnets.sys
        Image path: \SystemRoot\System32\drivers\NGCx64\1615050.02C\symnets.sys
        Image name: symnets.sys
        Browse all global symbols  functions  data
        Timestamp:        Sat Feb  8 06:47:17 2020 (5E3E4B65)
        CheckSum:         000975A1
        ImageSize:        0008F000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
        Information from resource tables:
    Ironically, the same invalid memory address is being used in both situations, but the instructions to them are different.
    Code:
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000008, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff803164d9bb4, address which referenced memory
    
    TRAP_FRAME:  ffffc101305177b0 -- (.trap 0xffffc101305177b0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000001 rbx=0000000000000000 rcx=ffffaf0d35898ab8
    rdx=ffffaf0d3e5f8170 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff803164d9bb4 rsp=ffffc10130517940 rbp=0000000000000001
     r8=0000000000000000  r9=0000000000000002 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    IDSvia64+0x59bb4:
    fffff803`164d9bb4 418b4008        mov     eax,dword ptr [r8+8] ds:00000000`00000008=????????
    
    0: kd> k
     # Child-SP          RetAddr           Call Site
    00 ffffc101`30517668 fffff803`0fe08b69 nt!KeBugCheckEx
    01 ffffc101`30517670 fffff803`0fe04e69 nt!KiBugCheckDispatch+0x69
    02 ffffc101`305177b0 fffff803`164d9bb4 nt!KiPageFault+0x469
    03 ffffc101`30517940 ffffaf0d`40e546a8 IDSvia64+0x59bb4
    04 ffffc101`30517948 fffff803`14e02caa 0xffffaf0d`40e546a8
    05 ffffc101`30517950 fffff803`14e4880a fwpkclnt!FwppProxyTransactionCommit+0x26
    06 ffffc101`30517990 00000000`00000000 fwpkclnt!FwpmEngineClose0+0x2a
    
    0: kd> lmvm IDSvia64
    Browse full module list
    start             end                 module name
    fffff803`16480000 fffff803`165ee000   IDSvia64 T (no symbols)           
        Loaded symbol image file: IDSvia64.sys
        Image path: \??\C:\Program Files\Norton Security\NortonData\22.16.4.15\Definitions\IPSDefs\20210714.061\IDSvia64.sys
        Image name: IDSvia64.sys
        Browse all global symbols  functions  data
        Timestamp:        Thu Feb 11 23:22:34 2021 (6025AE2A)
        CheckSum:         0017633E
        ImageSize:        0016E000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
        Information from resource tables:
    Check Norton for software updates, or reinstall Norton.

    If additional BSOD crashes occur after updating or reinstalling Norton, please run the V2 log collector again and upload a new zip file.
      My Computers


  3. Posts : 31
    Windows 10 Pro 21H1
    Thread Starter
       #3

    There wasn't any update from Norton.
    I removed and reinstalled it again.
    Will monitor before marked close. Thanks, Axe0
      My Computer

  4. axe0's Avatar
    Posts : 14,858
    Windows 10 Pro
       #4

    Keep me posted.
      My Computers


  5. Posts : 31
    Windows 10 Pro 21H1
    Thread Starter
       #5

    axe0 said:
    Keep me posted.
    Thanks. I will close the thread as I don't face the same issues in the past 2 days.
    Hopefully, it will not come back again.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 12:22.
Find Us




Windows 10 Forums