BleepingComputer.com: Blue screen of death, require assistance.

Hello BleepingComputer.com

I've been getting a lot of blue screens lately. I have bits and pieces of the error message

Something IRQL_NOT_EQUAL_OR_LESS

error contains 0x00000002 0x00000008

Contains more sequels, I haven't written it down.

My computer runs on Vista Ultimate. Vista stated it was a problem with my Kaspersky internet security. I haven't tried uninstalling it because I brought a legit version with limited keys. I don't want to risk it being wasted after uninstall. I did a Dell memory test and there was no sign of any faulty sectors in my RAM. I would appreciate it if someone would point me in the right direction or give proper instructions on how I can find the primary source of this BSoD. Thank you very much.

Tio

(Moderator edit: added Topic Description. jgw)

This post has been edited by jgweed: 13 January 2009 - 11:42 AM

Quote

http://www.bleepingcomputer.com/forums/topic176011.html

Here is my computer dump. What do I do from here? I appreciate the help. Thank you.




Microsoft ® Windows Debugger Version 6.10.0003.233 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini010309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista SP1 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0x82c10000 PsLoadedModuleList = 0x82d27c70
Debug session time: Sat Jan 3 02:32:46.643 2009 (GMT-5)
System Uptime: 0 days 8:55:57.578
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 8, 0}

Unable to load image \SystemRoot\system32\DRIVERS\kl1.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for kl1.sys
*** ERROR: Module load completed but symbols could not be loaded for kl1.sys
Probably caused by : kl1.sys ( kl1+3bded )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82d47868
Unable to read MiSystemVaType memory at 82d27420
00000000

CURRENT_IRQL: 2

FAULTING_IP:
+0
00000000 ?? ???

PROCESS_NAME: System

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: 8bf6f9f8 -- (.trap 0xffffffff8bf6f9f8)
ErrCode = 00000010
eax=00000016 ebx=8bf6fb44 ecx=00000000 edx=00000000 esi=85e724c0 edi=881ea528
eip=00000000 esp=8bf6fa6c ebp=00000001 iopl=0 nv up ei ng nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292
00000000 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 00000000 to 82c6ad24

FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???

STACK_TEXT:
8bf6f9f8 00000000 badb0d00 00000000 82d48d7f nt!KiTrap0E+0x2ac
WARNING: Frame IP not in any known module. Following frames may be wrong.
8bf6fa68 98044ded 00000000 00000016 8bf6fb44 0x0
8bf6faa8 839b6392 881ea528 00000016 8bf6fb44 kl1+0x3bded
8bf6fbb4 8b2809c1 00000000 8bf6fc08 8b280280 tdx!TdxEventReceiveMessagesTransportAddress+0x48e
8bf6fbcc 8bf6fc08 8b2803b2 86424bb8 8bf6fbf0 tcpip!InetFilterDatagramBySessionInformationAf+0x27
8bf6fc08 8b278e12 00000000 00000001 00000000 0x8bf6fc08
8bf6fc54 8b278eb1 868e04e8 0003f1e0 8bf6fc90 tcpip!UdpReceiveDatagrams+0x112
8bf6fc64 8b276fef 8bf6fc78 c000023e 00000000 tcpip!UdpNlClientReceiveDatagrams+0x12
8bf6fc90 8b276db2 8b2cdfdc 8bf6fce4 c000023e tcpip!IppDeliverListToProtocol+0x49
8bf6fcb0 8b276cd9 8b2cdc68 00000011 8bf6fce4 tcpip!IppProcessDeliverList+0x2a
8bf6fd08 8b26e147 8b2cdc68 00000011 82d1213c tcpip!IppReceiveHeaderBatch+0x1eb
8bf6fd30 82e2c33b 869d1c90 002cdc68 85783ad0 tcpip!IppLoopbackTransmit+0x52
8bf6fd44 82c48445 85787040 00000000 85783ad0 nt!IopProcessWorkItem+0x23
8bf6fd7c 82de5b18 85787040 a18e9131 00000000 nt!ExpWorkerThread+0xfd
8bf6fdc0 82c3ea2e 82c48348 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
kl1+3bded
98044ded ?? ???

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: kl1+3bded

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: kl1

IMAGE_NAME: kl1.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48849e41

FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_kl1+3bded

BUCKET_ID: 0xD1_CODE_AV_NULL_IP_kl1+3bded

Followup: MachineOwner
---------

bump. Can anyone help?

Hi rsx1212,

If you have the activation key for Kaspersky, you can uninstall it and reinstall it as often as you want within the year that the key is valid. I recommend that you locate the key to make sure yoiu have it and know what it is, and then follow Kaspersky's uninstall instructions which you can look at here:

http://www.kaspersky.com/support/kav6/install?qid=193239348

You should not run your computer without an antivirus program, even if you decide to test what happens by uninstalling Kaspersky. For that reason, I recommend that you download one of the following installer programs for a free antivirus to your desktop, then disconnect from the internet, uninstall Kaspersky, install the new antivirus program and then reconnect to the internet. This will leave your computer with the least amount of vulnerability while you check if removing Kaspersky is the problem. Here are links for two free antivirus programs that are both good and light-weight, and after you decide what to do about Kaspersky, you can either uninstall the free one and reinstall Kaspersky, or keep the free one.

Download and install either of the following, and be sure to allow it to update when it finishes installing. [/indent]

• Avast!
  
• Antivir
  
  Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.

Zllio