IRQ_LESS_THAN_OR_EQUAL BSOD - Windows 8.1 x64

[mbrdfld]

Typically I get the error message when disconnecting from a VPN (I use four or five different VPN Clients) or while using an Internet Browser (I use both IE and Chrome).

Windows 8.1
x64
Original Installed OS was Windows 7, upgraded to 8, then to 8.1
The original OS was OEM, but the upgrades were purchased from the Windows Store.
System was purchased in Jan 2012.
The latest OS was upgraded shortly after it was released - perhaps November or December of 2013.
i7-2770QM CPU
NVIDIA GEFORCE GTX 560M
ASUS G74SX Laptop
16GB RAM

I was unable to produce a PERFMON report - I kept getting an error. I am an admin user and I enabled the ADMIN account, but I still got the error with both users.

Any help would be appreciated!

 

[Jared]

The cause is your ShrewSoft VPN Adapter IM Filter Driver.

BugCheck A, {[COLOR="#FF0000"]0[/COLOR], 2, [COLOR="#FF0000"]0[/COLOR], fffff800474bacbb}

The context probably isn't saved but it's referencing pageable or invalid memory at an IRQL too high (dispatch level or above)

1: kd> [COLOR="#008000"].trap 0xffffd000b4d4b6a0[/COLOR]
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
[COLOR="#FF0000"]rax=0000000000000000[/COLOR] rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800474bacbb rsp=ffffd000b4d4b830 rbp=ffffe000243b4d98
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=ffffe00029c97df0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!KeSetEvent+0x40b:
fffff800`474bacbb 488b00          [COLOR="#FF0000"]mov[/COLOR]     rax,qword ptr [[COLOR="#FF0000"]rax[/COLOR]] ds:00000000`00000000=????????????????

It is trying to move a pointer from rax to rax which doesn't make sense and isn't possible.

It's most likely using a bad instruction pointer.

ffffd000`b4d4b558 fffff800`47579ae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : [COLOR="#0000FF"]nt!KeBugCheckEx[/COLOR]
ffffd000`b4d4b560 fffff800`4757833a : 00000000`00000000 ffffe000`243b4d90 ffffe000`23e7f000 ffffd000`b4d4b6a0 : [COLOR="#0000FF"]nt!KiBugCheckDispatch+0x6[/COLOR]9
ffffd000`b4d4b6a0 fffff800`474bacbb : ffffe000`243b3040 fffff801`2309f280 ffffe000`3374e5c0 fffff801`2309009b : [COLOR="#0000FF"]nt!KiPageFault+0x23a[/COLOR]
ffffd000`b4d4b830 fffff801`23a949a6 : 00000000`00000000 ffffe000`00000000 ffffe000`20ba7600 ffffe000`00000000 : [COLOR="#FF8C00"]nt!KeSetEvent+0x40b[/COLOR]
ffffd000`b4d4b8e0 00000000`00000000 : ffffe000`00000000 ffffe000`20ba7600 ffffe000`00000000 00000000`00000000 : [COLOR="#FF0000"]vfilter+0x29a6[/COLOR]

We can confirm that this is the cause by looking at the callstack.

1: kd> [COLOR="#008000"]lmvm vfilter[/COLOR]
start             end                 module name
fffff801`23a92000 fffff801`23a9c000   vfilter  T (no symbols)           
    Loaded symbol image file: vfilter.sys
    Image path: vfilter.sys
    Image name: vfilter.sys
    Timestamp:        [COLOR="#FF0000"]Thu Nov 19 00:06:23 2009[/COLOR] (4B048BFF)
    CheckSum:         0001348B
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

It's outdated, updating this driver should resolve the issue.

http://www.shrew.net/support

 

[x BlueRobot]

If you do still have problems with the software, then it may be worth filing a bug report to the company - https://www.shrew.net/support/VPN_Bug_Report_Windows

 

[mbrdfld]

Thank you for such a quick reply - I no longer use the ShrewSoft Client and hadn't even thought about it in months. I'll uninstall and see if it clears up the issue.

Thank you!

 

[mbrdfld]

Thank you much to both!

 

[Patrick]

It is trying to move a pointer from rax to rax

:lolg:

 

[Jared]

Makes sense...
:lol:

 

[x BlueRobot]

I thought a mov instruction on the same register would clear that register?

 

[Jared]

I'm not entirely sure to be honest...