Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD - DRIVER_IRQL_NOT_LESS_OR_EQUAL


  • Please log in to reply
12 replies to this topic

#1 batdog

batdog

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chester, UK
  • Local time:07:20 PM

Posted 09 June 2009 - 03:18 PM

Hello,

I was getting frequent BSODs on my PC, sometimes occurring within minutes of switching on the PC, occasionally after a few hours.

My PC is a Mesh (not sure of the model) - the OS is Windows XP Home with SP3, the processor is an AMD Athlon 64 3500+ and it has 512 MB of RAM. Probably not needed but the graphics card is a GeForce 6600 GT.

I haven't used the computer since the end of last year. I've now switched it on to recover some photos and having realised it would produce a mini dump from the last crash back in December I decided to finally debug the dump file. Here is my output. It seems as though there may be a driver issue (is that right?). Can anyone point me in the right direction?

Thanks

Ian



Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini060909-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Sun Dec 21 13:15:06.359 2008 (GMT+1)
System Uptime: 0 days 0:33:41.952
Loading Kernel Symbols
....................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {77c3ef4b, 2, 8, 77c3ef4b}

Probably caused by : ntkrnlpa.exe ( nt!KiTrap0E+233 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 77c3ef4b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 77c3ef4b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 77c3ef4b

CURRENT_IRQL: 2

FAULTING_IP:
+77c3ef4b
77c3ef4b ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 77c3ef4b to 80540693

FAILED_INSTRUCTION_ADDRESS:
+77c3ef4b
77c3ef4b ?? ???

STACK_TEXT:
b9e13d64 77c3ef4b badb0d00 77c61ae8 00000000 nt!KiTrap0E+0x233
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007ff48 00000000 00000000 00000000 00000000 0x77c3ef4b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+233
80540693 f7457000000200 test dword ptr [ebp+70h],20000h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiTrap0E+233

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd8

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:20 PM

Posted 09 June 2009 - 04:36 PM

Background reading: http://blogs.msdn.com/ndis/archive/2006/11...s-or-equal.aspx

I don't see anything that points to a specific driver, so I can't hazard a guess what the problem might be.

FWIW: http://www.techspot.com/vb/all/windows/t-7...tkrnlpaexe.html

Based on that link and the non-specification of a given driver...I suggest running Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

I would run Memtest86+ for a minimum of an hour, but probably through a complete cycle. A cycle takes about 2.5 hours on this system I'm on.

In the event of any errors, note the error (write down the details reflected onscreen). Any errors indicate a potential RAM problem.

Louis

One other thing which you can do is Disable Auto Reboot On System Crash - http://www.theeldergeek.com/auto_reboot_on_system_crash.htm

Doing that might possibly provide more details of BSODs in Event Viewer.

Edited by hamluis, 09 June 2009 - 04:38 PM.


#3 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 12 June 2009 - 09:00 PM

I am having the same problem

I get the IRQ_NOT_LESS_OR_EQUAL error message as well.

The files involved are

nv4_mini.sys
usbohci.sys
usbport.sys

ipnat.sys has shown up one time, but the above files show up quite a bit. The error code, almost without exception is 0x000000d1, or 0x0000000A on some occasions.

I can boot in safe mode, but in normal mode, I can only get into Windows for so long before it crashes to a BSOD.

I have an HP Pavilion n463a, AMD processor, and a nVidia GeForce 7600 video card, I have 1GB of system memory. 200GB hard drive with WinXP SP2 On board sound, and networking.

Now, this is what I have done so far.
Ran Memtest86+ for 24 hours with no errors.
Ran diagnostics out the wazoo (disk check, defragmenter, memory tests, video memory tests, tested the network card, etc) I have uninstalled the video drivers and I still get the error message.
swapped the system memory for known-good memory, and still got the problem.

I do not know what to do next. I am in the middle of trying to get a book project going, and this computer has been driving me nuts for the last 3 weeks. I have some experience fixing computer systems, but this problem has me running in circles.

Another note: This system has run without problem for the last 4 years, and the errors just started ocurring 3 weeks ago (May 22nd, to be exact) Virus scan, Malware, spyware, and otherware scans have come up empty. The only change I made was to install an (older) HP All-in-One (Model PSC1610) but the computer ran fine for 2 weeks prior to the errors showing up. I uninstalled the printers and drivers, and that didn't help the problem.

As a side note, not sure if it has anything to do with it, but when viewing event viewer there are errors. The services "mrtrate" and "hpdj00" fail to start, but I am not sure if that has anything to do with my issue. I know the "mrtrate" service has to do with the Quicken automatic updater. I am assuming the "hpdj00" service has something to do with Hewlett Packard DeskJet printers.

Any help would be appreciated. I will try to post a minidump when I get the chance.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:20 PM

Posted 13 June 2009 - 09:35 AM

Well...it appears to me that all your driver problems...point to chipset drivers.

The nv4 file is a video driver, the other two point to USB.

I would uninstall all USB controllers and the video card (via Device Manager)...then reboot and reinstall those particular drivers.

Is XP up to date with critical updates? I would also run sfc /scannow on the system.

I would also temporarily uninstall that printer...in an effort to remove potential sources of the problem.

Louis

If all else fails, I would do a repair install or (if that proves ineffective) a clean install. The fact that your error messages seem to point to multiple devices...is not good, IMO.

#5 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 13 June 2009 - 10:40 AM

Well...it appears to me that all your driver problems...point to chipset drivers.

The nv4 file is a video driver, the other two point to USB.

I would uninstall all USB controllers and the video card (via Device Manager)...then reboot and reinstall those particular drivers.

Is XP up to date with critical updates? I would also run sfc /scannow on the system.

I would also temporarily uninstall that printer...in an effort to remove potential sources of the problem.

Louis

If all else fails, I would do a repair install or (if that proves ineffective) a clean install. The fact that your error messages seem to point to multiple devices...is not good, IMO.


The printer was uninstalled as soon as the problem started. I guess I will have to go and uninstall the USB drivers, and then try to reinstall. (I have already uninstalled the video drivers)

I would really hate to have to do a reformat, and then a clean re-install, but, if I have to, then, I have to.

As far as I know, all critical updates are installed, I haven't gone to SP3 yet and will do that once I get this problem figured out, and fixed.

I have a spare hard drive that I can do the clean reinstall on. Hopefully that works.

I have four computers in this house, and for the moment, only one works, so, I guess I have my work cut out for me. Fortunately, the rest of the problems just involve some hardware replacement/upgrade. My only fear is that my motherboard is going bad......that, I don't need.

Edited by TimChgo9, 13 June 2009 - 10:41 AM.


#6 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 14 June 2009 - 02:20 PM

All of the drivers (USB, video, etc) have been removed.

Still getting the BSOD

Now I am getting the error code 0x0000008e

The possibility exists that I might have the RustockC rootkit... but I am not sure.

I think I am just going to go with a clean install on the new HDD, and see what happens.

Any additional help would be appreciated...

Edited by TimChgo9, 14 June 2009 - 02:22 PM.


#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:20 PM

Posted 14 June 2009 - 04:07 PM

http://pcsupport.about.com/b/2009/02/13/st...errors-0x8e.htm

I'm not even going to ask about the rootkit comment...I tend to look for simple answers when things go awry and "rootkit" never enters my brain.

But, of course, my two systems are always (except for one instance) adequately defended and I have had only one instance in 12-plus years...to suspect malware as being the cause of my computer situations.

If you think you are infected...there's a forum for that with personnel adept at dealing with malware.

BleepingComputer.com - Am I infected What do I do - http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

Louis

#8 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 15 June 2009 - 09:55 AM

I am going to get the OS installed on the new HDD, and then see how the system works.

I actually think the motherboard might be failing, in some way, not sure what is going on though.

As far as the rootkit goes, I ran across some information about it, and some of the errors it creates are similar to mine, but, I am probably going to rule that out, because the one registry entry that is created by this rootkit (Rustock C) is not in my registry.

Once I get the OS on the new HDD, I will post how it turned out, and how well the system is operating. The HDD is a new, formatted, never used 160GB Western Digital that sat in a computer that was rebuilt, never got used, and then replaced, so, I took the hard drive out, and discarded the rest of the system (which means it's in storage in the attic, minus the HDD, video card, and network card)

I (again) ran the latest Memtest for 17 hours....no errors. Swapped memory, and did it again for 12 more, no errors.

#9 hamluis

hamluis

    Moderator


  • Moderator
  • 55,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:20 PM

Posted 15 June 2009 - 10:27 AM

The one other thing I would do...is replace the CMOS battery, although I wouldn't really expect anything to change. Just a standard step I employ in situations where there doesn't seem to be any real pattern (that I can discern).

Louis

#10 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 16 June 2009 - 11:05 PM

Well, I tried to restore to the new HDD....

The restore process got as far as the "Copying files" screen..... and then I got a BSOD.. Didn't even get as far as installing the OS. All that happened was the creation of the HP "recovery partition". Then the recovery process partitioned the drive, and then began copying files, and about 30 seconds into the copy process, I got a BSOD....

I am convinced now that I have a bad motherboard.

#11 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 17 June 2009 - 01:42 PM

Just to be sure, I tried the restore a 2nd and 3rd time.

BSOD at about the same point. atapi.sys is the file name that comes up on the blue screen.

It has to be a motherboard problem, I can't think of anything else.

Just to be sure, I connected the hard drives to another computer, and scanned them for defects. None found.

So, now I am looking for a Micro-ATX motherboard, with IDE controllers, and an AGP 4x/8x slot. Pricewatch has quite a few, but the product notes seem to indicate they are refurbs.

#12 TimChgo9

TimChgo9

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:20 PM

Posted 26 June 2009 - 12:15 PM

New motherboard installed. Problem solved.

#13 hamluis

hamluis

    Moderator


  • Moderator
  • 55,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:20 PM

Posted 26 June 2009 - 12:59 PM

Glad you resolved it, feedback on resolution appreciated. Happy computing :thumbsup:.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users