[SOLVED] BSOD driver irql not less or equal, ntoskrnl.exe

[fgoldy]

Hello all,
I'd appreciate your help with recurring random blue screens: I followed some instructions and am attaching the log from windbg. Thanks very much. I also have bluescreenview installed.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\040312-21106-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03468000 PsLoadedModuleList = 0xfffff800`036ac650
Debug session time: Tue Apr  3 22:04:44.379 2012 (UTC - 6:00)
System Uptime: 0 days 12:55:38.409
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 8, 0}

Unable to load image NEOFLTR_650_16339.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NEOFLTR_650_16339.SYS
*** ERROR: Module load completed but symbols could not be loaded for NEOFLTR_650_16339.SYS
Probably caused by : NEOFLTR_650_16339.SYS ( NEOFLTR_650_16339+d0c7 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003716100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
+6533643937376439
00000000`00000000 ??              ???

PROCESS_NAME:  System

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

TRAP_FRAME:  fffff8800311a0a0 -- (.trap 0xfffff8800311a0a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800d4a3be0 rbx=0000000000000000 rcx=fffffa8014e5b960
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff8800311a238 rbp=0000000000000032
 r8=fffff8800311a420  r9=0000000000000018 r10=0000000000000002
r11=fffff8800311a428 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
00000000`00000000 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034e42e9 to fffff800034e4d40

FAILED_INSTRUCTION_ADDRESS: 
+6533643937376439
00000000`00000000 ??              ???

STACK_TEXT:  
fffff880`0311a238 fffff880`0444d0c7 : 00000000`000005ae 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
fffff880`0311a240 00000000`000005ae : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`12a13110 : NEOFLTR_650_16339+0xd0c7
fffff880`0311a248 00000000`00000000 : 00000000`00000000 00000000`00000000 fffffa80`12a13110 00000000`00001000 : 0x5ae


STACK_COMMAND:  .trap 0xfffff8800311a0a0 ; kb

FOLLOWUP_IP: 
NEOFLTR_650_16339+d0c7
fffff880`0444d0c7 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  NEOFLTR_650_16339+d0c7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NEOFLTR_650_16339

IMAGE_NAME:  NEOFLTR_650_16339.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4c57c2ae

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_650_16339+d0c7

BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_NEOFLTR_650_16339+d0c7

Followup: MachineOwner
---------

[joeten]

Hi and welcome to TSF I have moved you to Bsod's App Crashes and Hangs for further help

[fgoldy]

Attaching requested files for analysis. Thanks.

[joeten]

Awaiting a analyst have made a request for one to look in

[Wrench97]

They appear to be caused by "neofltr_650_16339.sys" I've not run into it before looks like a 3rd party driver part of Secure Application Manager from Juniper Networks
>> Network Security Solutions - Networking Performance Optimization - Juniper Networks is this something you installed?

There is also a very old driver from PDAnet "pnetmdm64.sys Wed Mar 07 13:13:19 2007" from 2007 that predates Win7 see if they have a update>> PdaNet -- Use your Treo smartphone as a Wireless Modem for your PC

And a Conexant modem driver from 2006 "mdmxsdk.sys Mon Jun 19 17:27:26 2006" > Driver Reference Table

Samsung printer driver from 2005 > Driver Reference Table

See if you can find updates for any of these, if not you'll have to uninstall one at a time to see if any are causing the memory over writes.

[fgoldy]

Thanks for your help. Is there a "standard" way to uninstall these? I tried looking for the program in the PRograms and Features control panel and uninstalling it. If I couldn't find it that way, I tried searching for the file name and then deleting the file, but it wouldn't let me get rid of all of them as it wanted permission from SYSTEM. I am an administrator, but maybe the file is in use. I'm always hesitant to just delete a driver as it will likely cause something to not work. The hard part is that I never know when the BSOD will occur so I can't try something and cause the BSOD to happen. Hmmm.

I think the Juniper thing is the Aventail VPN client I use to connect to a remote network. I'll try uninstalling it and see if my client has a newer version. I don't need the 64 bit version although I prefer to use it since my OS is 64 bit.

I do use pdanet but the android version. I don't know how old their driver is. I'll first try reinstalling the newest version. I suppose I could install a 32 bit driver instead of the 64 bit and see if that helps.

I don't know what the conexant modem driver is used for but can look for a newer version.

I've never had a Samsung printer attached so how do I get rid of that?

Thanks again.

[Wrench97]

What printers are listed in the Devices and Printers window?
You may have a Samsung printer labeled as something else, I think a few Dell printer models were made by Samsung for example. :)

Best not to delete any files directly, uninstall the program it's associated should remove it from loading if not from the system.

See if Programs and features in the control panel lists "Juniper Networks Secure Application Manager" (NetBIOS Redirector).


What Antivirus program are you using, I've seen Symantic(norton) have issues with secure network programs.

[fgoldy]

I have a couple of hp lasetjets, hp officejets, and a lexmark c762. The others are an adobe pdf "printer," and a quickbooks pdf converter, a microsfot xps document writer, and a fax printer.

Nothing like Juniper Networks in my program listing. I do use Aventail VPN client, so maybe it is that. I do need that.

I don't have Norton. I use Microsoft Security essentials. I formerly used Systemsuite.

[Wrench97]

Let me see if one of our networking gurus can shed some light on Juniper network software.

A little more digging shows SSPORT.sys could also be part of a scanner driver.

[fgoldy]

Ok, thanks. I use the HP Officejet 8500 five-in-one and often have some problems with it's drivers but it seems to work fine. The device manager on the laptop (and my other machines) says that drivers aren't installed, even though they are and it works fine.

More info on Juniper would be great. I'll check with my client's tech support to see if they have a new version. Aventail updates itself so I don't think there will be a more recent version.

[Wrench97]

It could be that Win7 mis-Id'd the HP 8500 and is using the Samsung driver, that may explain why it says the drivers aren't installed.

[satrow]

Just a thought, if Aventail does use the Juniper drivers and is self-updating, maybe the latest update has caused some problem elsewhere down the chain; networking drivers, antivirus, firewall?

[jcgriff2]

Originally Posted by wrench97

A little more digging shows SSPORT.sys could also be part of a scanner driver.

http://sysnative.com/drivers/driver.php?id=SSPORT.sys

[TheCyberMan]

I believe that juniper and aventail are in compettion so SAM isn't part of aventail.

Sonicwall use aventail and ssl/vpn client.

Juniper have their own network ssl/vpn appliances that use secure application manager and network connect client.

Check in program and features for secure application manager and network connect (SAMNC) and uninstall it. It has been installed at some time from reg entries i see this.

Failing that navigate to the path below:

C:\Program Files (x86)\Juniper Networks\Secure Application Manager\UninstallSAM.exe

It could be conflicting with the aventail ssl/vpn client.

[fgoldy]

Thanks everyone for your help. No blue screens since I've followed your advice. Fingers are crossed. You are fabulous!

[joeten]

Good to hear