[nkk9960]

Hello,

This is my first time posting here so please be gentle!

Several days ago, I managed to pick up a virus. I "think" I've gotten rid of it, but in the process I started getting the IRQL_NOT_LESS_OR_EQUAL Blue Screen of Death. It seems to happen randomly, but maybe more often when I'm using my PC's docking port (but the docking port is not new). I definately started getting the BSOD after I installed the latest version of Symantec Endpoint (our company's virus protection). I've read the other posts about this error here, although I have to say that I don't really understand most of it. I can get to and provide the files in \Windows\Minidump if needed. This is Windows XP.

How can I get rid of this error? Thanks in advance!

[IMiteBable2help]

WTF is going on here? is it an epidemic or something? sure seems to be happening a lot lately. I got it too. 3 times last week. Nothing since though. I don't run symantec software.

[Claymore]

We would need to know the failing file or module. You can sometimes get this from the Event Viewer or a crash dump file. Here's the instructions;

Create a minidump crash log

Right-click My Computer and click on Properties.
Click the Advanced tab and in the 'Startup and Recovery' section click Settings.
In the 'System Failure' section check these boxes:
'Write an event to the system log'.
'Send an Administrative alert'.
Uncheck the 'Automatically restart' box.

In the 'Write debugging information' section, select 'Small memory dump (64KB)'.

The next time you experience a crash, the computer will blue screen, an event will be written to the Event Viewer, and a minidump file will be created.
The minidump file(s) are located in C:\Windows\minidump. They are dated - month-day-year. You can attach this folder to your next post. If possible, zip it first.

[IMiteBable2help]

My settings are set that way. I got the same BSOD, and still got no dump file, and nothing in the event viewer. Therefore, no clue as to the cause.

[Claymore]

That's odd. A blue screen with nothing in the Event Viewer. Event Viewer set correctly?

Event Viewer

Right-click My Computer and click on Properties.
Click the Advanced tab and in the 'Startup and Recovery' section click Settings.
In the 'System Failure' section check these boxes:
'Write an event to the system log'.
'Send an Administrative alert'.
Uncheck the 'Automatically restart' box.

And ...

In Services, the Event Log service set to Automatic and Started?

[nkk9960]

I'm already getting the minidumps. I'm attaching the latest one.

[IMiteBable2help]

Originally Posted by Claymore

That's odd. A blue screen with nothing in the Event Viewer. Event Viewer set correctly?

Event Viewer

Right-click My Computer and click on Properties.
Click the Advanced tab and in the 'Startup and Recovery' section click Settings.
In the 'System Failure' section check these boxes:
'Write an event to the system log'.
'Send an Administrative alert'.
Uncheck the 'Automatically restart' box.

And ...

In Services, the Event Log service set to Automatic and Started?

Everything is set exactly as you say. I still got nothing. Odd indeed, isn't it?
Just out of curiosity, how do we read a dump file. I opened this one with notepad, but that doesn't reveal anything.

[Claymore]

IMite

http://www.microsoft.com/whdc/DevToo...g/default.mspx

You need two of the first 3 downloads on this page. The Symbol Packages are fairly large downloads. The Symbol Package depends on which Service pack you have installed. After installing the Symbol Package, in WinDbg you have to set the Symbol path in File.

[IMiteBable2help]

OK, well nevermind. I don't have any memory dumps of my own anyway. And what did you mean by "this page" ? did you forget to include a link?

Don't worry about my questions just yet. Check out the dump file and see if you can help nkk9960. Maybe it will help me too.

[Claymore]

nkk9960,

Your crash dump file indicates that the failing driver (DRIVER_FAULT) was sysplant.sys which caused ntoskrnl to error out thus causing the blue screen. This has happened 3 times. This driver is part of Symantec's (Norton's) firewall.

You may want to try re-installing Norton.

[Claymore]

what did you mean by "this page" ? did you forget to include a link?

Yes, sorry about that. I've added it in.

[Jason08]

I got it nearly 3 months ago immediately after getting "Unmountable Boot Volume." It was weird, because no new software or hardware had just been installed.

[IMiteBable2help]

No new software or hardware here either. I haven't seen this BSOD for about a week of heavy use now. Weird.

[Jason08]

Did you have another blue screen of death shortly before it?

[IMiteBable2help]

Jason08 If you're addressing me, it happened 3 times in about 3 days. Nothing in perhaps 7 or 8 days now.