DRIVER_IRQL_NOT_LESS_OR_EQUAL

Avast Free Antivirus / Premium Security
1

Hi, I hope this is the correct forum for my post.
After about 15 mins or so on the internet my PC crashes and I get a blue screen with the message DRIVER_IRQL_NOT_LESS_OR_EQUAL. I used NirSoft BlueScreenView to access the dump file and give me information regarding the crash. The info is below:

Dump File: Mini042216-01.dmp
Crash Time: 22/04/2016 21:53:12
Bug Check String: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code: 0x100000d1
Parameter 1: 0x00000000
Parameter 2: 0x00000002
Parameter 3: 0x00000008
Parameter 4: 0x00000000
Caused by Driver: SbFw.sys
Caused by Address: SbFw.sys+13332
File Description: Sunbelt Personal Firewall driver
Product Name: Sunbelt Personal Firewall
Company: Sunbelt Software, Inc.
File Version: 4.6.1860.0
Processor: 32-bit
Stack Address 1: SbFw.sys+1291c
Stack Address 2: SbFw.sys+1335b
Stack Address 3: aswStmXP.sys+e23a
Full Path: C:\WINDOWS\Minidump\Mini042216-01.dmp
Processors Count: 4
Major Version: 15
Minor Version: 2600
Dump File Size: 110,592
Dump File Time: 22/04/2016 21:54:24

Now I know that the driver at fault is indicated as Sunbelt Firewall, but at Stack Address 3 it shows an Avast Antivirus driver. Does this mean that the Sunbelt driver is having problems with the Avast driver?

If so, any advice as to what to do would be welcome.
Thanks,
Mike

2

May I ask which Windows version are you using? Also knowing the Avast! version, any other security programs installed is a good idea.

I remember that some time ago, I also got a BSOD with the same message (but I didn’t used any program to see the reason for the blue screen).

I will try use the program you said to see the reason of the BSOD.

3

BSOD was caused in SbFw.sys, Avast or other drivers may be on stack, because these network requests are processed by several drivers (e.g. firewalls: sunbelt, scanning: avast, …), etc. In this case you should contact sunbelt forum and send them minidump file.

4

I think it is time to get another firewall as the Sunbelt Personal Firewall hasn’t been updated since November 11th, 2008 (last release version 4.6.1861.0).

I don’t even know if there is an active Sunbelt forum or what it could do even if dumps are able to be sent.

5

Thanks for replies. Sunbelt is not available any more but I’ve kept using it because I like it and it works. I think it probably is time to change.
I’m not that computer literate and wasn’t sure what the stack information actually meant, but from your answer it seems it definitely is Sunbelt that is causing the problem.
Never had trouble with Avast before and didn’t really think it was causing this problem. Got the daunting task now of finding another firewall that works in a similar manner to Sunbelt.
Just as a matter of interest, I’m still using Win XP, and also have Spybot installed.
Thanks again.

6

Great. Example of callstack: when you type a URL in your browser, it tries to generate a website request. This request is inspected by scanning engine (e.g. Avast), then it may be examined by Firewall, when this connection is allowed, then it may be inspected by other component(s) and when it reaches the lowest device (your physical network card), then this request is leaving your computer.

Web browser → Avast Scan → Firewall → … → network card

when the website request processing fails in Firewall component, you’ll see all previous layers (in callstack). That’s why you see Avast in callstack, although this request has been already forwarded to next layer. It’s good to see callstacks, because you know which layers inspected (and possibly modified) these requests.