Windows 7: driver irql not less or equal

Jazzel · 14 Jun 2011

Yeah, so had this bsod.. i replaced my old rams and gpu.. got rid of ati problems now this popped out.

- x86 (32-bit) or x64 x64
- the original installed OS on the system= win 7 home premium x64
- an OEM or full retail version? Retail.

- What is the age of system (hardware)? 6 months
- What is the age of OS installation 1 month? or so.

Also running atm driver verifier.. but will see does it crash.

**yowanvista** · 14 Jun 2011

No dumps were collected by the jcgriff2 tool, dumps may have been deleted. Did you run any system cleaners(such as Ccleaner) after the crash?
If so wait for the computer to crash and re-upload the file

Jazzel · 14 Jun 2011

what i did accidently was, i took them away from the minidump folder and placed them to the uploaded folder. Its in seperate folder inside: Minidumps.

Jazzel · 14 Jun 2011

reupload, even i dont think its needed

**yowanvista** · 14 Jun 2011

Run Prime 95 to test your CPU. Carefully the instructions in this tutorial: CPU - Stress Test with Prime95. Run 3 separate tests, one on each of the settings (Blend, Small FFTs, Large FFTs). Post back with your results.

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
You can use MagicDisc as an alternative.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff8000310d327

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880061ff488 -- (.exr 0xfffff880061ff488)
ExceptionAddress: fffff800030fc9bd (nt!RtlLookupFunctionEntry+0x0000000000000212)
   ExceptionCode: 10000004
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000

TRAP_FRAME:  fffff880061ff530 -- (.trap 0xfffff880061ff530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000c46 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030fc9bd rsp=fffff880061ff6c0 rbp=000000000002fff4
 r8=0000000000000c43  r9=0000000000000c40 r10=fffff800032da324
r11=fffff880061ff778 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!RtlLookupFunctionEntry+0x212:
fffff800`030fc9bd 8906            mov     dword ptr [rsi],eax ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030d12a9 to fffff800030d1d00

STACK_TEXT:  
fffff880`031dbce8 fffff800`030d12a9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`031dbcf0 fffff800`030cf772 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`031dbe30 fffff800`0310d327 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`061fecb0 fffff800`030d1382 : fffff880`061ff488 00000000`000aa9bd fffff880`061ff530 00000000`00000000 : nt!KiDispatchException+0xab
fffff880`061ff350 fffff800`030cfefa : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`000aa9bd : nt!KiExceptionDispatch+0xc2
fffff880`061ff530 fffff800`030fc9bd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`061ff6c0 fffff800`030fbff0 : fffff800`030fc9bd fffff880`061ff778 00000000`00000002 00000000`00000000 : nt!RtlLookupFunctionEntry+0x212
fffff880`061ff730 fffff800`0310d3b1 : fffff880`062005e8 fffff880`061ffe40 fffff880`00000000 fffff800`032d1000 : nt!RtlDispatchException+0xd0
fffff880`061ffe10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x135


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDoubleFaultAbort+b2
fffff800`030cf772 90              nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd5b

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Jazzel · 14 Jun 2011

before had chance to do anything, i got BSODs 3 times in a row. Turned off verifier.

**yowanvista** · 15 Jun 2011

Quote: Originally Posted by Jazzel

before had chance to do anything, i got BSODs 3 times in a row. Turned off verifier.

Boot in safemode and remove Nvidia nTune, it was the cause of the last BSODs

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {6, 103, fffff980055d6e10, 0}

Unable to load image \SystemRoot\system32\DRIVERS\nvoclk64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvoclk64.sys
*** ERROR: Module load completed but symbols could not be loaded for nvoclk64.sys
Probably caused by : nvoclk64.sys ( nvoclk64+b264 )

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000000000000006, IRP passed to IoCompleteRequest contains invalid status
Arg2: 0000000000000103, the status
Arg3: fffff980055d6e10, the IRP
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc9_6

DRIVER_VERIFIER_IO_VIOLATION_TYPE:  6

IRP_ADDRESS:  fffff980055d6e10

DEVICE_OBJECT: fffffa80079e7df0

DRIVER_OBJECT: fffffa8007a5a290

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800035810c2 to fffff800030e4d00

STACK_TEXT:  
fffff880`033a8528 fffff800`035810c2 : 00000000`000000c9 00000000`00000006 00000000`00000103 fffff980`055d6e10 : nt!KeBugCheckEx
fffff880`033a8530 fffff880`04694264 : fffff880`033a8640 00000000`00000000 00000000`00000103 fffff980`055d6e10 : nt!IovCompleteRequest+0xc2
fffff880`033a8600 fffff880`033a8640 : 00000000`00000000 00000000`00000103 fffff980`055d6e10 00000000`00000000 : nvoclk64+0xb264
fffff880`033a8608 00000000`00000000 : 00000000`00000103 fffff980`055d6e10 00000000`00000000 00000000`00000002 : 0xfffff880`033a8640


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nvoclk64+b264
fffff880`04694264 ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nvoclk64+b264

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvoclk64

IMAGE_NAME:  nvoclk64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ab00e3d

FAILURE_BUCKET_ID:  X64_0xc9_6_VRF_nvoclk64+b264

BUCKET_ID:  X64_0xc9_6_VRF_nvoclk64+b264

Followup: MachineOwner
---------

Jazzel · 17 Jun 2011

removed drivers, including ntune.. been fine for two days.

**yowanvista** · 18 Jun 2011

An unknown module is mentioned in the dump, it could be malware. Run a scan of Malwarebytes

Jazzel · 18 Jun 2011

scanned with malwarebytes, according to logs - nothing. Another BSOD this time leaving no minidump.

Windows 7: driver irql not less or equal

driver irql not less or equal problems?