BleepingComputer.com: Blue Screen With This Error Driver_irql_not_less_or_equal ?

My blue screen problem seems to be back again. Just looking around the net and all of a sudden my PC goes dead and I get a blue screen with this error DRIVER_IRQL_NOT_LESS_OR_EQUAL along with other mumble jumble, I have no clue what it could be.

I am moving you to the XP forum(as I believe you had an XP system). I am almost certain this is a driver issue,perhaps your wireless card and not malwware.
Any way can you post back the rest of the error ,example
Technical information: STOP: 0x000000D1 (0x00000008, 0x00000002, 0x00000001, 0xF643EDCF)

Actually I have Windows Vista home premium.

Mod Edit; Moving to Vista from XP ~~boopme

Try updating your the hardware drivers on your computer such as: chipset drivers, videocard drivers, soundcard drivers, network card drivers, etc.etc. Hope this helps you out.

Ok, This is the error I get.

technical info
*** STOP: 0X000000D1 (0X00000000,0X00000002,0X00000008,0X00000000)


My PC isn't wireless either

boopme, on Aug 8 2008, 10:44 PM, said:

Ok, This is the error I get.

technical info
*** STOP: 0X000000D1 (0X00000000,0X00000002,0X00000008,0X00000000)


My PC isn't wireless either

An error of this sort is usually caused by a corrupt driver, although it can be caused by bad RAM or a corrupt pagefile.
To figure out which, try this link: http://forums.majorgeeks.com/showthread.php?t=35246
If you don't find the minidumps recorded in the C:\Windows\Minidump folder, check in C:\Windows for a file named Memory.dmp. I'm finding more and more Vista systems with this set as the default.

Post the results of the analysis here for us to have a look at.

While you're waiting, you can use this free tool to check your memory: http://www.memtest86.com/
Let it run for at least 3 passes, but overnight is better. If it starts generating errors, you can stop the test immediately (as the memory is most likely bad).

As for the pagefile corruption, you can use this procedure to recreate the pagefile:

Quote

"An error of this sort is usually caused by a corrupt driver, although it can be caused by bad RAM or a corrupt pagefile.
To figure out which, try this link: http://forums.majorgeeks.com/showthread.php?t=35246
If you don't find the minidumps recorded in the C:\Windows\Minidump folder, check in C:\Windows for a file named Memory.dmp. I'm finding more and more Vista systems with this set as the default."


Ok, I went to my computer and right clicked, went into advanced and made sure the right boxes were checked as they were in your picture.

My setting were set at "kernel dump" whatever that is. (See attached picture).
I then went to http://forums.majorgeeks.com/showthread.php?t=35246 and really didn't do anything there.
I did a search in my PC and did find a file named Memory.dmp. (See attached picture)
This is where I am now, stuck. I'm not sure what I need to do next.

What's the date on the memory.dmp file? Have you looked for the C:\Windows\Minidump directory? It may be hidden, so you'd have to enable viewing of Hidden Files in order to see it.

Then, just follow the directions in the first link that I gave you (with the most recent .dmp file)

Ok the memory.dmp file is dated for yesterday. Picture attached. Also i did a search for the C:\Windows\Minidump directory with no results found. See picture for that screen shot as well.

So now should I continue to the Geek squad link? or delete the memory.dmp file?

I am still a bit confused.

The blue screen hit again! After restarting the PC Windows Defender started scanning. Additionally I got an error box with the so called problem reported.

See Below

I don't have a clue what to do.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional information about the problem:
BCCode: 100000d1
BCP1: 00000000
BCP2: 00000002
BCP3: 00000008
BCP4: 00000000
OS Version: 6_0_6001
Service Pack: 1_0
Product: 768_1
Files that help describe the problem:
C:\Windows\Minidump\Mini081908-01.dmp
C:\Users\Terri\AppData\Local\Temp\WER-77579-0.sysdata.xml
C:\Users\Terri\AppData\Local\Temp\WERE80.tmp.version.txt
Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x0409

1) Locate the dump file on your pc (the latest one is at C:\Windows\Minidump\Mini081908-01.dmp )
2) Go to the link that I mentioned in my first post
3) Perform the analysis as indicated there
4) Copy and paste the results of the analysis into your next post here.

Ok, I'll admit it I'm an idiot with PC's at times. I did find where the dump file is on my PC. I went to the link that takes me to Geek Squad and downloaded the debugger. I got as far as loading the file into the debugger. It (the dmp file was not in the list). I'm lost and hopeless.

Not a problem, first, make sure you're connected to the internet, then...

A) Copy the .dmp file to your Desktop (I do this at work because it's easier than trying to navigate to the folder that contains the file)
1) Open the Debugging tools program (WinDbg)
2) Click on File...Symbol File Path.
3) Copy and paste everything inside of the following code block into the Symbol File Path window and click on OK

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

4) If it asks to Save the workspace, choose Yes
5) Click and hold the .dmp file and drag it over the Debugging Tools window - once there, let go of the mouse and it'll launch.

After it's run the program and given you some results, type "!analyze -v" (without the quotes) in the long box at the bottom of the program - then press Enter and wait for it to generate more info. Copy and paste all of that into your next post.

Every day, at work, at least one person will come in and tell me how much they don't know about computers (usually using derogatory terms such as "stupid", "idiot", "ignorant", etc). My reply to them is "We've each got different stuff that we're good at - mine just happens to be computers. I'm sure that you know much more about your line of work than I ever will!"

And, I've got to give you credit for trying to fix it yourself, not many people will do this - they'd rather take their PC to a shop and have them do the worrying, despite the cost.

Loading Dump File [C:\Users\Terri\Documents\Mini073008-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81e0e000 PsLoadedModuleList = 0x81f25c70
Debug session time: Wed Jul 30 16:34:11.779 2008 (GMT-4)
System Uptime: 0 days 1:52:22.371
Loading Kernel Symbols
..............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 8, 0}

Unable to load image \SystemRoot\System32\Drivers\nnrnstdi.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nnrnstdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for nnrnstdi.SYS
*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
Unable to load image \SystemRoot\system32\DRIVERS\yk60x86.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for yk60x86.sys
*** ERROR: Module load completed but symbols could not be loaded for yk60x86.sys
Probably caused by : nnrnstdi.SYS ( nnrnstdi+20f4 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81f45868
Unable to read MiSystemVaType memory at 81f25420
00000000

CURRENT_IRQL: 2

FAULTING_IP:
+0
00000000 ?? ???

PROCESS_NAME: svchost.exe

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: 8059d7fc -- (.trap 0xffffffff8059d7fc)
ErrCode = 00000010
eax=8b5ee0c6 ebx=8059d98c ecx=8b56bd02 edx=00000000 esi=8444d31c edi=8059d990
eip=00000000 esp=8059d870 ebp=8059d8ac iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
00000000 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 00000000 to 81e68d84

FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???

STACK_TEXT:
8059d7fc 00000000 badb0d00 00000000 00000000 nt!KiTrap0E+0x2ac
WARNING: Frame IP not in any known module. Following frames may be wrong.
8059d86c 8b5ee0f4 00000000 00000016 8059d990 0x0
8059d8ac 8b5694ba 8444d31c 00000016 8059d990 nnrnstdi+0x20f4
8059d8f4 8b53e392 8444d31c 00000016 8059d990 aswTdi+0x44ba
8059da1c 8607d3b2 85239600 8059da3c 85eb11a2 tdx!TdxEventReceiveMessagesTransportAddress+0x48e
8059da54 86075e12 00000000 00000002 00000000 tcpip!UdpDeliverDatagrams+0x23b
8059daa0 86075eb1 84dc8688 00dc1000 8059dadc tcpip!UdpReceiveDatagrams+0x112
8059dab0 86073fef 8059dac4 c000023e 00000000 tcpip!UdpNlClientReceiveDatagrams+0x12
8059dadc 86073db2 860cafdc 8059db30 c000023e tcpip!IppDeliverListToProtocol+0x49
8059dafc 86073cd9 860cac68 00000011 8059db30 tcpip!IppProcessDeliverList+0x2a
8059db54 860734cc 860cac68 00000011 00000000 tcpip!IppReceiveHeaderBatch+0x1eb
8059dbe4 86071fc6 85ffc5d0 00000000 81ef1501 tcpip!IpFlcReceivePackets+0xbe1
8059dc60 8607250e 85ffc620 85ecc708 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x6e3
8059dc88 82b4b0b0 85ffc620 85ecc708 00000000 tcpip!FlReceiveNetBufferListChain+0x104
8059dcbc 82b3d919 00fdcc50 85ecc708 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0xab
8059dce4 82b3d890 00000000 00000000 85dd0000 ndis!ndisIndicateSortedNetBufferLists+0x4a
8059de60 82a7e57f 85b750e8 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129
8059de7c 82b3daba 85b750e8 85ecc708 00000000 ndis!ndisMTopReceiveNetBufferLists+0x2c
8059de98 82a7e54a 85b750e8 85ecc708 00000000 ndis!ndisMIndicateReceiveNetBufferListsInternal+0x27
8059deb4 8a35ff82 85b750e8 85ecc708 00000000 ndis!NdisMIndicateReceiveNetBufferLists+0x20
8059deec 8a35598c 85dd0000 85ecc538 00000000 yk60x86+0x13f82
8059df28 8a3561e7 01710100 00000002 85ef45e8 yk60x86+0x998c
8059df40 82b3d11c 85dd0000 00000000 00000000 yk60x86+0xa1e7
8059df64 82a7e468 85ef45fc 8a35d220 00000000 ndis!ndisMiniportDpc+0x81
8059df88 81ec4510 85ef45fc 85b750e8 00000000 ndis!ndisInterruptDpc+0xc4
8059dff4 81ec29f5 9f0af810 00000000 00000000 nt!KiRetireDpcList+0x147
8059dff8 9f0af810 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x45
81ec29f5 00000000 0000001b 00c7850f bb830000 0x9f0af810


STACK_COMMAND: kb

FOLLOWUP_IP:
nnrnstdi+20f4
8b5ee0f4 ?? ???

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nnrnstdi+20f4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nnrnstdi

IMAGE_NAME: nnrnstdi.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 46698812

FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_nnrnstdi+20f4

BUCKET_ID: 0xD1_CODE_AV_NULL_IP_nnrnstdi+20f4

Followup: MachineOwner
---------