Windows 7: Occasional BSOD on Startup Only IRQL_NOT_LESS_OR_EQUAL

MassivePlasma · 04 Oct 2012

Hello. I came to this forum requesting help with a bsod that occurs randomly after the "Starting Windows" splash screen. It only happens sometimes, but it is annoying nonetheless. The bugcheck code is 0xa and the cause according to WhoCrashed and BlueScreenView is the Windows NT Kernel (ntoskrnl.exe).

This bsod has happened since the beginning of September, however I used system restore and most of my dmp files were deleted in the process. I do have one more dmp file backed up on a usb from earlier but I have one new dump from today.

I attached the diagnostic zip file as the directions state.

I appreciate all of the help in advance!

**koolkat77** · 04 Oct 2012

Welcome

ntoskrnl.exe is not the true cause of your crash.

Quote:

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Problematic software
Norton is a known cause of BSODs, please uninstall with the Norton Removal Tool and replace it with Microsoft Security Essentials.

Additional suggestions
Run the system file checker so that it finds any corrupted files within windows. If it does find and is unable to repair the files, upload the CBS log here.

Run disk check on your hard disk for file system errors and bad sectors on it

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002ea1174}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ea1174, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bb100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c64
fffff800`02ea1174 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  csrss.exe

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff880030265a0 -- (.trap 0xfffff880030265a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88003025818 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ea1174 rsp=fffff88003026730 rbp=0000000000000000
 r8=0000000000000000  r9=fffffa800a005810 r10=0000000000000002
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc64:
fffff800`02ea1174 488b09          mov     rcx,qword ptr [rcx] ds:b6cc:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e8b769 to fffff80002e8c1c0

STACK_TEXT:  
fffff880`03026458 fffff800`02e8b769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03026460 fffff800`02e8a3e0 : 00000000`00000100 fffff880`03026858 fffffa80`09feeb78 fffffa80`0876d860 : nt!KiBugCheckDispatch+0x69
fffff880`030265a0 fffff800`02ea1174 : 00000000`00000001 00000000`00000000 fffff880`20206f49 fffff880`03026a18 : nt!KiPageFault+0x260
fffff880`03026730 fffff800`02e7ebd7 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff8a0`00000000 : nt!IopCompleteRequest+0xc64
fffff880`03026800 fffff800`02e35a85 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`03026880 fffff800`030d796a : fffffa80`0a00f990 fffffa80`09ff0b30 fffff880`03026a10 fffff880`03026a08 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`030268b0 fffff800`031a142e : fffffa80`00000004 fffffa80`09ff0b30 fffff880`03026a10 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x2a53a
fffff880`030269a0 fffff800`02e8b453 : 00000000`00000014 fffffa80`090ae640 00000000`001de858 00000000`001dea01 : nt!NtMapViewOfSection+0x2bd
fffff880`03026a70 00000000`76d4159a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001de838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d4159a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02e8a3e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4fa390f3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------

Let us know your feedback, we'll do more troubleshooting if needed

MassivePlasma · 04 Oct 2012

Thank you for your reply! I will try your suggestions and report back if anything else goes wrong.

**koolkat77** · 04 Oct 2012

No problem, take your time

MassivePlasma · 04 Oct 2012

Okay, I uninstalled Norton, installed MSE, ran Malwarebytes just in case uneventfully (I had to update definitions anyway since they were removed by system restore), and ran sfc /scannow and it found no integrity problems. I will hold off on check disk until the weekend because I know it takes very long to complete from my previous hard drive failure fiasco early in the year

. So far, no problems on my end, very happy since it went out of warranty a few months ago. I didn't want to buy a new laptop either!

**koolkat77** · 04 Oct 2012

Okay, do it when you're comfortable.
Observe your computer and let us know you get more BSoDs

**koolkat77** · 15 Oct 2012

Hello,
Did you get more BSoDs after your last post?

**koolkat77** · 04 Nov 2012

Any updates?

Windows 7: Occasional BSOD on Startup Only IRQL_NOT_LESS_OR_EQUAL

Occasional BSOD on Startup Only IRQL_NOT_LESS_OR_EQUAL problems?