BSOD, help would be appreciated.

[chipsndukes]

Hello Gentlemen,

I ask this question on this site, partly because the BSOD appeared for the first time while downloading WinFF, but also because I'm sure that you all know a lot about computers, too.

AMD Athlon XP 2800
512 MB RAM
EPOX 8DRA3+ Motherboard

Hijackthis log attached, the crash dump, a photo of the BSOD itself, and also an error I found in the Event Viewer "System" log. I had to compress everything into one .zip file "Crash", below.

It happens when:

-I download WinFF, when it almost reaches the end, the computer shuts down.
-I try to run SUPER
-during a full scan by Kaspersky

I also downloaded and ran memtest86, there were no issues.

Does anyone know what might be causing this or could help ?

Thanks,
Chipsndukes

crash.zip

[cd090580]

IRQ_NOT_LESS_OR_EQUAL is generally caused by a faulty device driver.

Do you install beta version of some drivers ? or a wrong OS version of a driver ?

[chipsndukes]

Thanks, cd090580. I am trying to think...

I installed some software recently, maybe 4-5 days ago, but the first problem was Saturday.
If I just format the harddrive and reload all the software, I'm afraid it would just happen again, though.

The first BSOD was just before the WinFF download finished, "BLINK".
Everytime I now try that download, the same thing. I downloaded SUPER, it installed fine, but run it, and "BLINK".

I copied the dump below, indicates kl1.sys, I guess a Kaspersky product, I run Kaspersky 2009.

I went to the Device Manager and selected "View>Show hidden devices". There is a lot in there, but nothing not "functioning correctly", no yellow "?".

I am looking on the Kaspersky forums now, appreciate and and all help!

Thanks,
Chipsndukes


DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000000

CURRENT_IRQL: ff

FAULTING_IP:
+17b596
00000000 ?? ???

PROCESS_NAME: avp.exe

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804df048 to 00000000

FAILED_INSTRUCTION_ADDRESS:
+17b596
00000000 ?? ???

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b827ca94 804df048 0000001f 000000fe b827caa8 0x0
b827ca94 f819f596 0000001f 000000fe b827caa8 nt!KiUnexpectedInterruptTail+0xbd
00000000 00000000 00000000 00000000 00000000 kl1+0x17b596


STACK_COMMAND: kb

FOLLOWUP_IP:
kl1+17b596
f819f596 c3 ret

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: kl1+17b596

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: kl1

IMAGE_NAME: kl1.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48849e41

FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_kl1+17b596

BUCKET_ID: 0xD1_CODE_AV_NULL_IP_kl1+17b596

Followup: MachineOwner
---------

kd> lmvm kl1
start end module name
f8024000 f8543000 kl1 T (no symbols)
Loaded symbol image file: kl1.sys
Image path: kl1.sys
Image name: kl1.sys
Timestamp: Mon Jul 21 10:33:37 2008 (48849E41)
CheckSum: 00025C80
ImageSize: 0051F000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

[fritzi93]

I'm thinking bad device driver as well.

I've had that problem from installing new graphics drivers. BSOD, error message, same. Uninstalling and re-installing the old drivers cures it. IIRC, I once had that from an overclocking utility as well. Clearing CMOS fixed that one.

Good luck.

[EDIT] If you think it may be Kaspersky, there's one way to find out. Uninstall, run a registry cleaner, test. You can always re-install, not?

[chipsndukes]

Thanks Fritzi93, that was good advice.

I uninstalled Kaspersky and the problem went away, the kl1.sys driver disappeared.

I tried running SUPER, no problem, everything that caused the BSOD before was fine.

The acid test was reloading Kaspersky and trying the WinFF download again, where it all began.
BSOD again, this time I'm off to the Kaspersky forums, but at least there is a clear direction.

Thanks for your help,
Chipsndukes

[fritzi93]

Thanks for letting us know the cause of the problem. Good going. Would you mind posting what you find out at the Kaspersky forums? It might be valuable information for someone else here.

[chipsndukes]

Thanks for letting us know the cause of the problem. Good going. Would you mind posting what you find out at the Kaspersky forums? It might be valuable information for someone else here.

I would be glad to.
Chipsndukes

[chipsndukes]

The problem appears to be with Kaspersky and the heueristic detection.

Here is the thread.

When these options are unchecked in Kaspersky, everything runs normally again.

One day lost...

Chipsndukes

[fritzi93]

So in your thread you say you're using Avast right now. Good one, always liked that one. Been running ClamWin for months now without complaint along with the Windows firewall.

Dunno what to tell you about Kaspersky. You paid for it and would like it to work properly, of course. You'd think they'd have a fix for the problem presently though.

Personally, I don't depend heavily on an AV program, and make do with free ones. I'm behind a router, have services locked down fairly well, and use the following:

1) SpywareBlaster, basically it's a blacklist with more than 13,000 entries currently. Stuff on the list is blocked.
2) Malwarebytes anti-malware.
3) SuperAntiSpyware.
4) I do a monthly AV scan and never find anything. Also MBam and SAS probably weekly and never find more than a tracking cookie. Occasionally I'll do a free online scan to double-check. There are several out there.

I guess it's not too strange an AV program would cause symptoms usually associated with bad device drivers. I was surprised though when a Biostar overclocking utility did it on one of my machines. Good luck.

[chipsndukes]

I appreciate your post back. I agree that the lighter (and cheaper), the better.

Kaspersky is good, but it checks EVERYTHING and I can't help but feeling it is complete overkill.

I don't surf where I shouldn't, don't do "dangerous" things...am thinking about keeping Avast! and calling it done.

Chipsndukes

[fritzi93]

That would probably be best. Good piece of detective work on your part, I learned something new. It might come in useful if someone posts a similar problem in future.

[freebird73717]

I don't surf where I shouldn't, don't do "dangerous" things...am thinking about keeping Avast! and calling it done.

Avast is very good IMHO. I use it in my personal systems and that is what I install when working on systems for others. When put together with the other programs that fritzi mentioned you will be very well protected.