Jump to content

BSOD Driver IRQL Not Less or Equal


Recommended Posts

Been getting BSOD with same error (listed in title) for a while now. The first time it happened, it was out of the blue. I hadn't installed any new software or hardware. I can't recreate it on cue, but there's a high chance of it happening while starting or playing World of Warcraft. 

After being frustrated by crashes for a few days, I completely reinstalled my OS. After that:

  • I installed all available Windows updates.
  • I installed my graphics driver.
  • I installed Malwarebytes Premium and Webroot Premium. 
  • I installed the Battle.net app and World of Warcraft.

About 5 minutes after WoW was running the system crashed.

I downloaded MemTest86, created a USB booter then tested both of my 4GB memory sticks one at a time. Both passed with 0 errors.

I did a Google search and found this: https://www.reddit.com/r/Malwarebytes/comments/7xesge/blue_screen_of_death/

I followed the directions there and did a clean install of Malwarbytes. 

I started the Battle.net app and the system crashed.

I downloaded 'WhoCrashed' and had it analyze my dump file and got this:

On Thu 6/21/2018 4:47:08 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\062118-14375-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x198330)
Bugcheck code: 0xD1 (0x50, 0x2, 0x0, 0xFFFFF80F54D47304)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.




On Thu 6/21/2018 4:47:08 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: mwac.sys (mwac+0x915B)
Bugcheck code: 0xD1 (0x50, 0x2, 0x0, 0xFFFFF80F54D47304)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\mwac.sys
product: Malwarebytes Web Protection
company: Malwarebytes
description: Malwarebytes Web Protection
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mwac.sys (Malwarebytes Web Protection, Malwarebytes).
Google query: mwac.sys Malwarebytes DRIVER_IRQL_NOT_LESS_OR_EQUAL




On Thu 6/21/2018 3:49:55 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\062118-13078-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x198330)
Bugcheck code: 0xD1 (0x50, 0x2, 0x0, 0xFFFFF8021CA47304)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


 

mb-check-results.zip

mb-clean-results.txt

mbst-grab-results.zip

Link to post
Share on other sites

Thanks. This is the same BSOD other users are reporting that we're working on finding a solution for. There's a couple different things that may be tripping up Web Protection here. First I'd check to make sure you have the latest network drivers from Dell's website, and if that doesn't help, we could be conflicting with Webroot. You could either remove Webroot, or disable Web Protection for the time being.

Link to post
Share on other sites

I also have repeated BSOD, and Who Crashed identifies mwac.sys as the likely culprit. Turning off web protection solves the problem. My  (Dell) system is fully updated with latest drivers, as is Windows 10. I have swapped to another AV product until this issue is identified and resolved.

Link to post
Share on other sites

  • 2 weeks later...

Brand new to this forum. Reason I joined is I too am experiencing a number of BSOD events related back to mwac.sys. I am running  Win 7 64-bit and using the following Malwarebytes product. I have been a long-time Malwarebytes premium customer and this crash history related to this product is very disturbing.

image.png.4b07f538aa4fa2e82019bf8103812bbe.png

Below are WhoCrashed results, twice the same today and I lost some valuable data not saved due to sudden BSOD. Help is very much desired.

On Mon 7/9/2018 4:57:45 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\Minidump\070918-4898-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0xA48A0)
Bugcheck code: 0xD1 (0x88, 0x2, 0x0, 0xFFFFF8800155EAEC)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Mon 7/9/2018 4:57:45 PM your computer crashed or a problem was reported
crash dump file: C:\Windows\MEMORY.DMP
This was probably caused by the following module: mwac.sys (mwac+0x90BF)
Bugcheck code: 0xD1 (0x88, 0x2, 0x0, 0xFFFFF8800155EAEC)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\mwac.sys
product: Malwarebytes Web Protection
company: Malwarebytes
description: Malwarebytes Web Protection
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mwac.sys (Malwarebytes Web Protection, Malwarebytes).
Google query: mwac.sys Malwarebytes DRIVER_IRQL_NOT_LESS_OR_EQUAL


 

Link to post
Share on other sites

Greetings,

I'm sorry that this is happening, but hopefully we have a fix for the issue.  A new component update package was released for Malwarebytes earlier today.  If you open Malwarebytes and navigate to Settings>Application and click on the Install Application Updates button found there it should download and install the new update package for you which will bring your installed Component package version: to 1.0.391 (you currently have 1.0.374 installed according to the image you posted, which was the previous version known to be affected by this problem on some systems).

Hopefully that corrects the issue, but please let us know how it goes and if any new problems occur.

Thanks

Link to post
Share on other sites

I too have had a few BSOD's, all with:

Stop code: DRIVER IRQL NOT LESS OR EQUAL

What failed: NETIO.SYS

The times of the BSOD's are 05 July @ 10:43, 06 July @ 07:48 and 12 July @ 05:12.  My current versions of MWB are 3.5.1.2522 with Component Package 1.0.391.

It should be noted that I had been using the beta version (Component package 1.0.390, to cure  the Ransomware/Program Update problem) from 30 June.

Edited by Chris-G
Include component package number of Beta
Link to post
Share on other sites

1 hour ago, Chris-G said:

I too have had a few BSOD's, all with:

Stop code: DRIVER IRQL NOT LESS OR EQUAL

What failed: NETIO.SYS

The times of the BSOD's are 05 July @ 10:43, 06 July @ 07:48 and 12 July @ 05:12.  My current versions of MWB are 3.5.1.2522 with Component Package 1.0.391.

It should be noted that I had been using the beta version (Component package 1.0.390, to cure  the Ransomware/Program Update problem) from 30 June.

Chris-G - The NETIO.SYS BSOD issue is still being worked on and tracked in this thread.

Link to post
Share on other sites

  • 4 weeks later...

I too have the same problem as the original poster.

I have:

MB Premium v3.5.1.2522

Component v1.0391

Update Package v1.06273

Link to dump file: https://we.tl/fQSWBjfnv9

 

WhoCrashed Report:


Conclusion



3 crash dumps have been found and analyzed. Only 2 are included in this report. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

mwac.sys (Malwarebytes Web Protection, Malwarebytes)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination with the errors that have been reported for these drivers. Include the brand and model name of your computer as well in the query. This often yields interesting results from discussions on the web by users who have been experiencing similar problems.

 


Crash Dump Analysis



Crash dumps are enabled on your computer.

Crash dump directories:
C:\WINDOWS
C:\WINDOWS\Minidump

On Thu 8/9/2018 12:15:30 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\080918-40468-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x198560)
Bugcheck code: 0xD1 (0x8, 0x2, 0x0, 0xFFFFF801AFBD714C)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.




On Thu 8/9/2018 12:15:30 PM your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: mwac.sys (mwac+0x8E13)
Bugcheck code: 0xD1 (0x8, 0x2, 0x0, 0xFFFFF801AFBD714C)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\mwac.sys
product: Malwarebytes Web Protection
company: Malwarebytes
description: Malwarebytes Web Protection
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mwac.sys (Malwarebytes Web Protection, Malwarebytes).
Google query: mwac.sys Malwarebytes DRIVER_IRQL_NOT_LESS_OR_EQUAL

 

Link to post
Share on other sites

yep I am in the same boat, been tearing  my hair out for the last 7 weeks, paid a tech to re-install the OS which worked fine until I installed MWB, then smelt a rat.  Seriously not good enough for a so called premium product. I have now uninstalled MWB and no BSOD, cmon guys get it right.

Link to post
Share on other sites

  • 4 months later...

6 months later and this problem is still here? I have it on two computers. One has been flaky, but the other had no problems until I installed malwarebytes.

Removing it.

I do have the latest drivers. Again, this is a Dell system. Came with McAfee.

If you don't fix it, don't renew my malwarebytes subscription.

Link to post
Share on other sites

Greetings,

If you are having system crashes with the latest version of Malwarebytes 3 (currently version 3.6.1.2711, component update 1.0.508) then it isn't the same issue being reported in this thread as there are no crashes caused by the program from that long ago which still exist in the current version of the product.  Just to be clear, I am not saying that Malwarebytes isn't causing the crashes in your case, only that if it is, it is not due to the same issue that users were reporting in this thread.

If you wish to troubleshoot the issue then please provide any crash dumps you have from the crashes as well as the following logs so that the Support team may take a look:

  1. Download and run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

If you decide to cancel your subscription you may find the information in this support article to be helpful.

If you do wish to provide the crash dumps then they likely are too large to attach on the forums here so you'll need to upload them somewhere else such as WeTransfer.com or some other file hosting service and provide the link.

Link to post
Share on other sites

I've already removed Malwarebytes from both computers, so I can't run the diagnostics, and I'm not putting it back until the flaky computer is fully functioning again.

However, Dell went over that computer a week ago and found fully updated drivers, but did ask me to reinstall Windows. I installed Malwarebytes on the other computer, and it hadn't completed the first scan before giving a bluescreen.

Once I have the flaky computer functional, I will be able to try again.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.