BleepingComputer.com: IRQL_Not_Less_Or_Equal

Well I hate to be back here for another terrible reason like this already, but I have no choice. Recently my computer seems to have fallen into a blue screen of death frenzy, and I don't know what in the world to do. I have it booted into safe mode right now, but let me explain what has happened os far. Well yesterday I was going to shut down, but I randomly got a blue screen of death midway, and it restarted my computer. In a scared frenzy I safely turned it off when I could and booted it up in safe mode and scaned with both McAfee, and Malware Anti-bytes, nothing. From here, thinking the problem to be over, I booted off without worry, and when I tried to boot up again, blue screen of death. I got a "Driver_IrQL_Not_Less_or_equal" BSOD. Doing a little research I booted back into safe mode and freed some space by deleting some of my ranom video making junk (I have a bunch of raw footage I needed to delete). From there things seemed to work fine, trying to make sure the problem didn't happen again I booted into safe mode again, and system restored to two days ago and recieved a BSOD. Trying again I manage to do it, but now it feels like a random chance to access the main system, only safe mode seems to be unaffected from the BSOD. Another "IRAL_Not_Less_Or_Equal" it seems. So I'm at wits end here, I really don't know what to do. If anybody can please help help me.

I'll try my best to follow up with what I can, but I'm not sure about how much I can do in safe mode.
(P.S. I'm posting this from another computer, and I can transfer items between the two with a Jumpdrive).

Thank you....

First thing to do...from safe mode...Disable Auto Reboot On System Crash - http://www.theeldergeek.com/auto_reboot_on_system_crash.htm

Second...take a look in Event Viewer, How To Use Event Viewer - http://www.bleepingcomputer.com/forums/topic40108.html

You would be looking for detail on errors (not information items) which may correspond with your problems.

FWIW: See 0x0000000A: IRQL_NOT_LESS_OR_EQUAL at http://www.aumha.org/a/stop.htm

Louis

hamluis, on Jul 1 2009, 07:13 AM, said:

Yes sir, on my way.
Also one last thing, I did noticed that when I do manage to get it to boot normally opening something like McAfee will cause it to crash. I don't know what causes it, but I thought I might throw that in.
Also this part didn't happen till after I SR'd so that's most likely my fault. I'll be back shortly.

Alright did a quick look around, and noticed a few things in Eventvwr. One being that the errors seem to relate to two things, being DCOM or Service Control Manger. I've written down every single BSOD I've recieved so far (Even the numbers at the bottom) shall I post the information I wrote?

Also for some odd reason...my automatic reboot from crash is off, yet it still rebooted. I'm deeply confused and I hope you can anser my questions.

Like I said I don't think its a virus and I can show you the logs if need be to prove that it says I have nothing. I'm also taking a look at the other link you've posted.

Also for the information, all the recent BSODs have been 0X0000000A errors so....
Let's just see if we can go on the best we can.

I don't think the content of the BSOD screens will be meaningful...if all the errors are 0x0000000A.

Is there anything in those that specifies a driver or file which might be causing the problem?

The DCOM and Service Control Manager errors...all specify event IDs. Can you post those, while indicating if the designated Source is DCOM or SCM. I don't want to be hopeful...but errors with those two sources are fairly common, IMO.

You might see if you can complete the procedures detailed at Help Diagnosing BSODs And Crashes (BC) - http://www.bleepingcomputer.com/forums/topic176011.html

Even though you don't think malware is a contributor, I'd appreciate it if you would please try a couple of these free online scanners to see if anything has slipped by your protection:
(Be advised that some of these scanners will pickup things in "quarantine" from other anti-virus programs - so review the results carefully)

http://www.pandasecurity.com/homeusers/solutions/activescan/
http://us.mcafee.com/root/mfs/default.asp
http://housecall.trendmicro.com
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://onlinescan.avast.com/
http://ca.com/us/securityadvisor/virusinfo/scan.aspx
http://www.eset.com/onlinescan/

http://www.kaspersky.com/virusscanner Scan Only - no removal
<links compiled on 02/14/2008>

Just trying to eliminate something from the "potential cause list."

Louis

hamluis, on Jul 1 2009, 10:10 AM, said:

Yes sir on my way!

anyway, most of the source code that contribute to said problems are Service Code Manger - 7001, and DCOM being 10005.
However one stood out of the SCM side, and said 7026, and listed a set of things that failed to start it seems. Being AFD, FIPSI, Interlppm, Ipses, mfehidk, mpfp, mrxsmb, netbios, netbt, rasacd, rdbss, sedemu, and tepio. Most of hte errors are one after the other. Excuse me a moment while I try the other things you suggest I thought I might wanna post that first.

Alright sir, I found three minidumps that were close to the time of crashing, while not the full amount of crashes that happen (Odd) they all say the same thing so let me post them here just in case my eyes miss something. Also I cannot connect to the internet in safe mode on my "sick" computer, I'm currently on another system typing this.

Dump 1:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini070109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jul 1 00:56:43.051 2009 (GMT-5)
System Uptime: 0 days 21:55:44.592
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {b8895283, 0, 80576bdc, 0}


Could not read faulting driver name
*** ERROR: Symbol file could not be found. Defaulted to export symbols for halmacpi.dll -
Probably caused by : memory_corruption

Followup: memory_corruption
---------


Dump2:


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini070109-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jul 1 06:18:59.802 2009 (GMT-5)
System Uptime: 0 days 0:02:28.523
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
...........
*** ERROR: Symbol file could not be found. Defaulted to export symbols for halmacpi.dll -
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {ffdf, 2, 1, 806e6a8e}

Probably caused by : memory_corruption ( nt!MiMapViewOfDataSection+128 )

Followup: MachineOwner
---------


Dump 3:



Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini070109-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jul 1 03:45:38.812 2009 (GMT-5)
System Uptime: 0 days 0:02:53.397
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for halmacpi.dll -
Probably caused by : memory_corruption

Followup: memory_corruption
---------

Anyway I wait for your move sir.

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
Requested data was not in memory. An invalid system memory address was referenced. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop message, as may other hardware problems (e.g., incorrect SCSI termination or a flawed PCI card). Use the General Troubleshooting of STOP Messages checklist.


0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Typically due to a bad driver, or faulty or incompatible hardware or software. Use the General Troubleshooting of STOP Messages checklist. Technically, this error condition means that a kernel-mode process or driver tried to access a memory location to which it did not have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was too high. (A kernel-mode process can access only other processes that have an IRQL lower than, or equal to, its own.)

http://support.microsoft.com/?kbid=314063&sd=RMVP

0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP
One of three types of problems occurred in kernel-mode: (1) Hardware failures. (2) Software problems. (3) A bound trap (i.e., a condition that the kernel is not allowed to have or intercept). Hardware failures are the most common cause (many dozen KB articles exist for this error referencing specific hardware failures) and, of these, memory hardware failures are the most common.

http://support.microsoft.com/?kbid=137539&sd=RMVP

Soooo...there are two things that I would definitely do, were I in your shoes:

a. Replace the CMOS battery. I've seen failing batteries cause a plethora of seemingly unrelated BSODS where the only common factor was memory being cited as the problem.

CMOS Battery Replacement - http://www.liverepair.com/encyclopedia/art...cmosreplace.asp

b. Run Memtest86+ for the minimum time, hoping for no errors. It takes about 2-plus hours for a complete pass on either of my systems, some suggest running overnight. If no errors, suspect eliminated. If there are errors, then more investigative work must be done...since the RAM modules themselves could be bad/damaged...the motherboard sockets for the RAM could be bad/damaged...and there may be timing differences which create a problem (either FSB or individual module timings).

Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

Icrontic » Diagnose with Memtest86+ - http://icrontic.com/articles/diagnose_with_memtest86

Louis

Alright, getting inside the PC is easy compared to the inner runnings. Replacing this will be a breeze, I'll be sure to pick one up ASAP.

I'll run the memtest as well, however, I must ask if I can move it to the affected PC via USB drive, and that it can run in safe mode right?

Anyway, thank you so much for all you've done so far, hopefully we're at the bottom of this mystery, I'll keep you updated with each step.

Also sir, I might of mentioned this, but when I do get my computer to run normally, whenever I try to open McAfee, I get an instant BSOD, I don't know what this is from, but perhaps this might shed some light to some future problems.

Thank you once again sir.

Alright...so I haven't got done with the scan yet, however, things don't look good.

Over 2000 errors.....

I'm not really that confident things are going to be easy from here. I'll finish the report once I get back, I wait for your move till then sir.

If you've replaced the CMOS battery...time to do a little experimenting...I know, just what you wanted to hear .

I would start with running Memtest86+...each module of RAM...placed into the same slot. If that produces no errors, then try each other slot in which you currently have RAM placed.

Actually...I would probably change the system bus speed (lower it) first, with all modules in...and see if that brings about a desired change. It's faster to do this and might as well try it first. To do this, you will have to enter your BIOS. Rather than overclocking, we are going to try underclocking (first).

http://en.wikipedia.org/wiki/Underclocking

Louis

hamluis, on Jul 2 2009, 10:40 AM, said:

Well actually sir, I haven't yet, I ran the Memtest, which is still going, and I'm waiting for it to finish.

Alright, so replace the CMOS battery, and then underclock it?
Is that correct sir, or what would you want me to do since I slightly went out of order.
Also the errors have reached to about over 12000 now...
and its only on test 3...

Replace the battery...then try regular check using Memtest86+...with all modules as they are now.

The battery can cause...the types of errors you have described.

Louis

hamluis, on Jul 2 2009, 11:39 AM, said:

Alright, and how will I know when the current memtest is done if I may ask? Will it stop, cycle, what will happen if I may ask. I don't want to stop it midway for fear of anything wrong happening.

See Icrontic link I previously posted.

Louis