Driver_irql_not_les_or_equal

nico_world · Apr 6, 2008, 06:55 PM

Hello,

I am getting a blue screen with the following message
DRIVER_IRQL_NOT_LES_OR_EQUAL

STOP: 0x000000D1 (0xB8EFBFFE, 0x00000002, 0x00000000, 0xF5FA3808)

SYMNDIS.SYS - Address F5FA3808 base at F5FA1000, Date Stamp 46bd1f10

I am getting this message from time to time - only when I am connected to my work VPN. It used to occur a couple of times a week ... and now it is more a few times a day.

Any suggestion? Thanks.
Nicolas

Vikingod · Apr 6, 2008, 07:46 PM

WElcome to DH

First, we are going to need your system specs, including your OS.

Here is a description of what causes your problem:

Quote:

Stop 0x000000D1 or DRIVER_IRQL_NOT_LESS_OR_EQUAL

The Stop 0xD1 messages indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high. Drivers that have used improper addresses typically cause this error.

Possible Resolutions:
Stop 0xD1 messages can occur after installing faulty drivers or system services. If a driver is listed by name, disable, remove, or roll back that driver to confirm that this resolves the error. If so, contact the manufacturer about a possible update. Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools.

Here are some links to the MS support site.
Stop 0x000000D1 Error Message When You Turn Your Computer Off
"STOP:0xD1" Error Message When You Start Your Windows XP-Based Computer
Adding a Second Mylex AcceleRAID SCSI Controller Causes an Error Message
WRQ AtGuard Program Causes Error Message in Windows XP

With some more info from you, we can give you some more direction.

CDsDontBurn · Apr 6, 2008, 07:46 PM

First of all, hello nico_world, and welcome to Driverheaven!

I found some of these links here that would hopefully get this fixed for you. It seems to be an issue with some symantec software to my understanding.

symndis.sys Windows process - What is it?

Sysinternals Forums: blue screen caused by symndis.sys

ISS X-Force Database: symantec-firewall-tcp-dos(15936): Symantec Firewalls TCP attack denial of service

i hope that they help you out!

IEMC · Apr 6, 2008, 07:57 PM

Had this same issue about 3 years ago on an older computer. I tried getting answers here, but everything we tried failed.

Only solution was a reformat. Hopefully you can find the cause.

Chaos · Apr 6, 2008, 08:06 PM

SYMNDIS.SYS is a Norton file that can be used malicious behaviour. Try Google there is a ton of links related to that file. Here is one very similar to your issue,

Sysinternals Forums: blue screen caused by symndis.sys

swimtech · Apr 6, 2008, 09:20 PM

Do you use Norton Internet Security or other Symantec products on your computer.

The Norton product might be interfering with your VPN client or with how the VPN server you're connecting through interacts with the VPN client or other network monitoring software you're using.

Just some other suggestions to check...

nico_world · Apr 6, 2008, 10:28 PM

Hi everyone,

Thanks for the hints.

My PC specs are: HP Intel Core 2 CPU, T400 @ 2.16 GHz; 2 GB of RAM. And system: Windows XP Pro Version 2002, SP2

I do have Norton Internet Security v 15.0.0.60 - and that seems to be the issue when my work VPN is active.

I have deactivated the Norton Firewall (and activated the Windows firewall) and I have not had any crash in the last few hours. Is this safe to do this?

Thanks again for your precious help. For sure, I am not a software guru but I am happy when I can solve by myself that kind of issue ...

Nicolas

IEMC · Apr 6, 2008, 10:42 PM

Unless you paid for Norton (eg. you 'acquired' it, or it came free for a limited time), I suggest AVG virus scanner. It will replace Norton, and is much better, anyways.

http://free.grisoft.com/

That way you still have the security for your computer that you just deactivated.

PangingJr · Apr 7, 2008, 10:07 AM

btw, always remind yourself to create backup copies of your important files, then even in the worst case scenario, you still have your important files and it will be just a loss of your time to get the Windows running again.

CDsDontBurn · Apr 7, 2008, 06:29 PM

Quote:

Originally Posted by PangingJr

btw, always remind yourself to create backup copies of your important files, then even in the worst case scenario, you still have your important files and it will be just a loss of your time to get the Windows running again.

to add to that, you want to be double cautious and create a back up of a back up. because you never know if your spare HDD (if you have one) or the CD/DVD you burned important files to will go bad or get scratched.

PangingJr · Apr 7, 2008, 06:50 PM

i think that is very improvement in you, CD.
not just a 'just format it' like i used see.

CDsDontBurn · Apr 7, 2008, 08:07 PM

that's because i've come to realize that formatting is not the only answer and should be used as a last resort to solve any software based problems. and a backup should always be made on a regular basis.

PangingJr · Apr 7, 2008, 08:12 PM

like i siad i think that is very improvement in you, CD.
+Rep

oho sorry i must spread some Reputation around before giving it to you again.
but i will later.

lol and now i get a "You have given out too much Reputation in the last 24 hours, try again later."

Apr 6, 2008, 06:55 PM	#1
nico_world DriverHeaven Newbie Join Date: Apr 2008 Posts: 2 Rep Power: 0	Driver_irql_not_les_or_equal Hello, I am getting a blue screen with the following message DRIVER_IRQL_NOT_LES_OR_EQUAL STOP: 0x000000D1 (0xB8EFBFFE, 0x00000002, 0x00000000, 0xF5FA3808) SYMNDIS.SYS - Address F5FA3808 base at F5FA1000, Date Stamp 46bd1f10 I am getting this message from time to time - only when I am connected to my work VPN. It used to occur a couple of times a week ... and now it is more a few times a day. Any suggestion? Thanks. Nicolas

Apr 6, 2008, 07:46 PM	#3
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,794 Rep Power: 235 System Specs	First of all, hello nico_world, and welcome to Driverheaven! I found some of these links here that would hopefully get this fixed for you. It seems to be an issue with some symantec software to my understanding. symndis.sys Windows process - What is it? Sysinternals Forums: blue screen caused by symndis.sys ISS X-Force Database: symantec-firewall-tcp-dos(15936): Symantec Firewalls TCP attack denial of service i hope that they help you out! __________________ Her First Day \| A year later

Apr 6, 2008, 07:57 PM	#4
IEMC Neighborhood screw up. Join Date: Dec 2005 Location: MI, US Posts: 770 Rep Power: 55 System Specs	Had this same issue about 3 years ago on an older computer. I tried getting answers here, but everything we tried failed. Only solution was a reformat. Hopefully you can find the cause. __________________

Apr 6, 2008, 09:20 PM	#6
swimtech HardwareHeaven Extreme Member Join Date: May 2002 Location: North Carolina Posts: 4,040 Rep Power: 124 System Specs	Do you use Norton Internet Security or other Symantec products on your computer. The Norton product might be interfering with your VPN client or with how the VPN server you're connecting through interacts with the VPN client or other network monitoring software you're using. Just some other suggestions to check... __________________ It's not so much getting your way that matters or not - what matters is how you go about getting it.

Apr 6, 2008, 10:42 PM	#8
IEMC Neighborhood screw up. Join Date: Dec 2005 Location: MI, US Posts: 770 Rep Power: 55 System Specs	Unless you paid for Norton (eg. you 'acquired' it, or it came free for a limited time), I suggest AVG virus scanner. It will replace Norton, and is much better, anyways. http://free.grisoft.com/ That way you still have the security for your computer that you just deactivated. __________________

Apr 6, 2008, 08:06 PM	#5
Chaos Number Nine Join Date: May 2002 Location: Nova Scotia Posts: 5,268 Rep Power: 167 System Specs	SYMNDIS.SYS is a Norton file that can be used malicious behaviour. Try Google there is a ton of links related to that file. Here is one very similar to your issue, Sysinternals Forums: blue screen caused by symndis.sys

Apr 6, 2008, 10:28 PM	Thread Starter #7
nico_world DriverHeaven Newbie Join Date: Apr 2008 Posts: 2 Rep Power: 0	Hi everyone, Thanks for the hints. My PC specs are: HP Intel Core 2 CPU, T400 @ 2.16 GHz; 2 GB of RAM. And system: Windows XP Pro Version 2002, SP2 I do have Norton Internet Security v 15.0.0.60 - and that seems to be the issue when my work VPN is active. I have deactivated the Norton Firewall (and activated the Windows firewall) and I have not had any crash in the last few hours. Is this safe to do this? Thanks again for your precious help. For sure, I am not a software guru but I am happy when I can solve by myself that kind of issue ... Nicolas

Apr 7, 2008, 10:07 AM	#9
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 71	btw, always remind yourself to create backup copies of your important files, then even in the worst case scenario, you still have your important files and it will be just a loss of your time to get the Windows running again.

Apr 7, 2008, 06:50 PM	#11
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 71	i think that is very improvement in you, CD. not just a 'just format it' like i used see.

Apr 7, 2008, 08:07 PM	#12
CDsDontBurn Lurking DriverHeaven Join Date: May 2003 Location: Southern California Posts: 22,794 Rep Power: 235 System Specs	that's because i've come to realize that formatting is not the only answer and should be used as a last resort to solve any software based problems. and a backup should always be made on a regular basis. __________________ Her First Day \| A year later

Apr 7, 2008, 08:12 PM	#13
PangingJr Member Join Date: Mar 2003 Posts: 5,989 Rep Power: 71	like i siad i think that is very improvement in you, CD. +Rep oho sorry i must spread some Reputation around before giving it to you again. but i will later. lol and now i get a "You have given out too much Reputation in the last 24 hours, try again later." Last edited by PangingJr; Apr 7, 2008 at 08:31 PM.