Author Topic: DRIVER_IRQL_NOT_LESS_OR_EQUAL  (Read 3253 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
DRIVER_IRQL_NOT_LESS_OR_EQUAL
« on: April 22, 2016, 11:53:59 PM »
Hi, I hope this is the correct forum for my post.
After about 15 mins or so on the internet my PC crashes and I get a blue screen with the message DRIVER_IRQL_NOT_LESS_OR_EQUAL. I used  NirSoft BlueScreenView to access the dump file and give me information regarding the crash. The info is below:

Dump File: Mini042216-01.dmp   
Crash Time: 22/04/2016 21:53:12   
Bug Check String: DRIVER_IRQL_NOT_LESS_OR_EQUAL   
Bug Check Code: 0x100000d1   
Parameter 1: 0x00000000   
Parameter 2: 0x00000002   
Parameter 3: 0x00000008   
Parameter 4: 0x00000000   
Caused by Driver: SbFw.sys   
Caused by Address: SbFw.sys+13332   
File Description: Sunbelt Personal Firewall driver   
Product Name: Sunbelt Personal Firewall   
Company: Sunbelt Software, Inc.   
File Version: 4.6.1860.0   
Processor: 32-bit      
Stack Address 1: SbFw.sys+1291c   
Stack Address 2: SbFw.sys+1335b   
Stack Address 3: aswStmXP.sys+e23a      
Full Path: C:\WINDOWS\Minidump\Mini042216-01.dmp   
Processors Count: 4   
Major Version: 15   
Minor Version: 2600   
Dump File Size: 110,592   
Dump File Time: 22/04/2016 21:54:24   

Now I know that the driver at fault is indicated as Sunbelt Firewall, but at Stack Address 3 it shows an Avast Antivirus driver. Does this mean that the Sunbelt driver is having problems with the Avast driver?

If so, any advice as to what to do would be welcome.
Thanks,
Mike

REDACTED

  • Guest
Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL
« Reply #1 on: April 23, 2016, 04:44:59 AM »
May I ask which Windows version are you using? Also knowing the Avast! version, any other security programs installed is a good idea.

I remember that some time ago, I also got a BSOD with the same message (but I didn't used any program to see the reason for the blue screen).

I will try use the program you said to see the reason of the BSOD.

Offline pk

  • Avast team
  • Super Poster
  • *
  • Posts: 2078
Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL
« Reply #2 on: April 23, 2016, 06:47:00 PM »
BSOD was caused in SbFw.sys, Avast or other drivers may be on stack, because these network requests are processed by several drivers (e.g. firewalls: sunbelt, scanning: avast, ...), etc. In this case you should contact sunbelt forum and send them minidump file.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89034
  • No support PMs thanks
Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL
« Reply #3 on: April 23, 2016, 07:40:50 PM »
I think it is time to get another firewall as the Sunbelt Personal Firewall hasn't been updated since November 11th, 2008 (last release version 4.6.1861.0).

I don't even know if there is an active Sunbelt forum or what it could do even if dumps are able to be sent.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

REDACTED

  • Guest
Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL
« Reply #4 on: April 24, 2016, 06:03:32 PM »
Thanks for replies. Sunbelt is not available any more but I've kept using it because I like it and it works. I think it probably is time to change.
I'm not that computer literate and wasn't sure what the stack information actually meant, but from your answer it seems it definitely is Sunbelt that is causing the problem.
Never had trouble with Avast before and didn't really think it was causing this problem. Got the daunting task now of finding another firewall that works in a similar manner to Sunbelt.
Just as a matter of interest, I'm still using Win XP, and also have Spybot installed.
Thanks again.

Offline pk

  • Avast team
  • Super Poster
  • *
  • Posts: 2078
Re: DRIVER_IRQL_NOT_LESS_OR_EQUAL
« Reply #5 on: April 24, 2016, 06:11:43 PM »
Great. Example of callstack: when you type a URL in your browser, it tries to generate a website request. This request is inspected by scanning engine (e.g. Avast), then it may be examined by Firewall, when this connection is allowed, then it may be inspected by other component(s) and when it reaches the lowest device (your physical network card), then this request is leaving your computer.

Web browser -> Avast Scan -> Firewall -> ... -> network card

when the website request processing fails in Firewall component, you'll see all previous layers (in callstack). That's why you see Avast in callstack, although this request has been already forwarded to next layer. It's good to see callstacks, because you know which layers inspected (and possibly modified) these requests.