Windows 7: Windows 7 - BSOD: IRQL_NOT_LESS_OR_EQUAL with ntoskrnl.exe

ellipsoid · 12 Feb 2012

Hi,

I have had this BSOD a couple time over the last 9 months or so. The first few times it happened maybe every couple months. But it has now happened twice in the last two days.

I used a program called BSOD viewer to search the issue. At first I found something related to Logitech's setpoint software so I updated that and the BSOD didn't happen for a while. But now I am getting them again, and at least the most recent two times I was watching a video on youtube.

I am running Win 7 Pro (my key is from MSDNAA). System specs are as listed in my profile. The system is about 1 year old ditto for OS install.

Edit: I forgot to mention I ran memtest 4.2 for a total of 13 passes (4 + 9) and no errors were found.

Edit 2: In the mean time I have had another BSOD. This is very strange normally it happens once then it doesn't for a couple months. I have redone the perfmon and the other procedure so as to include the newest info. This BSOD also occurred while watching a video, though this time it was on TSN.ca. Also these videos are watched using chrome.

writhziden · 13 Feb 2012

Older versions of ASACPI.SYS are a known BSOD problem on Windows 7. Update the driver by:

Going to the Asus motherboard support site
When you reach the website:
Scroll down the page and click Utilities
Hold Ctrl and press f (ctrl+f) to enter the browser's find feature
Search for "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit" (without quotes)
Download and install the driver.
After installation is complete, verify that it installed correctly.
- Click Start Menu
- Click My Computer
- Go to C:\WIndows\System32\drivers\
- Verify that the ASACPI.SYS file is dated 2009 or newer (2010,etc.)

Thanks to JMH and zigzag3143 for the above information.

ellipsoid · 13 Feb 2012

Thanks for the help writhziden.

Guess I now have to play the waiting game.

writhziden · 13 Feb 2012

No problem. Post back whether it helped or not after you've waited a sufficient amount of time (longer than it usually takes or until you get another crash). Best wishes it is stable.

ellipsoid · 25 Feb 2012

Well it happened again though this time I wasn't watching a video, my pc was just idle.

writhziden · 25 Feb 2012

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Kingston\BSODDmpFiles\ellipsoid\Windows_NT6_BSOD_jcgriff2\022512-6021-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02ea2670
Debug session time: Sat Feb 25 19:22:56.714 2012 (UTC - 7:00)
System Uptime: 0 days 11:32:42.947
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1000, 2, 0, fffff80002ce5442}

Probably caused by : ntkrnlmp.exe ( nt!KiProcessExpiredTimerList+72 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000001000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ce5442, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0c100
 0000000000001000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiProcessExpiredTimerList+72
fffff800`02ce5442 803818          cmp     byte ptr [rax],18h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002ffd450 -- (.trap 0xfffff88002ffd450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000001000 rbx=0000000000000000 rcx=fffffa800816b970
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ce5442 rsp=fffff88002ffd5e0 rbp=000000000028a752
 r8=fffff88002fd7301  r9=0000000000000004 r10=0000000000000052
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KiProcessExpiredTimerList+0x72:
fffff800`02ce5442 803818          cmp     byte ptr [rax],18h ds:00000000`00001000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cd91e9 to fffff80002cd9c40

STACK_TEXT:  
fffff880`02ffd308 fffff800`02cd91e9 : 00000000`0000000a 00000000`00001000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02ffd310 fffff800`02cd7e60 : fffff880`02ffd480 00000000`00000000 00000000`00000001 fffffa80`0816b990 : nt!KiBugCheckDispatch+0x69
fffff880`02ffd450 fffff800`02ce5442 : fffffa80`0816b990 fffffa80`09c96c68 00000000`00537bd6 00000000`00000102 : nt!KiPageFault+0x260
fffff880`02ffd5e0 fffff800`02ce537e : 00000060`c5728a79 fffff880`02ffdc58 00000000`0028a752 fffff880`02fd7fc8 : nt!KiProcessExpiredTimerList+0x72
fffff880`02ffdc30 fffff800`02ce5167 : 00000025`ed24d5c3 00000025`0028a752 00000025`ed24d5dd 00000000`00000052 : nt!KiTimerExpiration+0x1be
fffff880`02ffdcd0 fffff800`02cd196a : fffff880`02fd5180 fffff880`02fdffc0 00000000`00000000 fffff880`052b5588 : nt!KiRetireDpcList+0x277
fffff880`02ffdd80 00000000`00000000 : fffff880`02ffe000 fffff880`02ff8000 fffff880`02ffdd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiProcessExpiredTimerList+72
fffff800`02ce5442 803818          cmp     byte ptr [rax],18h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiProcessExpiredTimerList+72

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+72

BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+72

Followup: MachineOwner
---------

Unfortunately, the crash was fairly inconclusive. Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

The best steps to start with based on analyzing all the reports contained in the files you uploaded:

Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.

ellipsoid · 25 Feb 2012

Well I guess if I get another one within the next week or so that is just as inconclusive I'll just do a fresh install of Windows 7.

Thanks again for the help writhziden

writhziden · 17 Mar 2012

You're welcome. How is the system running now?

ellipsoid · 17 Mar 2012

Well haven't had any BSODs since *knock on wood*

Windows 7: Windows 7 - BSOD: IRQL_NOT_LESS_OR_EQUAL with ntoskrnl.exe

Windows 7 - BSOD: IRQL_NOT_LESS_OR_EQUAL with ntoskrnl.exe problems?