irql_not_less_or_equal frequent BSODs

kyle15 · 19 Nov 2013

My brother started experiencing these on his Windows 7 64 bit HP laptop purchased last year. It happened for the first time about 2 hours ago, and I've finally been able to get the minidumps & such together after the frequent BSOD hassle. It's doing it right at log-in and if not then, a random time after successful login. I know he hasn't updated with Windows update for awhile and he's hoping that's all he has to do at this point.

Any help will be greatly appreciated!

koolkat77 · 20 Nov 2013

Welcome to Seven Forums.

Norton is a frequent cause of BSOD's. Please remove and use Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:

Note

Do not start the trial version of MalwareBytes

Also take a look at: Good & Free System Security Combination

Virus Check:
- Make scans with these tools below:
  - TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US
  - Online Virus Scanner Eset
Application conflict:
- Reduce the start-up items. This will help avoid software conflicts:
  - Remove Startup Programs in Windows 7
  - Clean Startup in Windows 7

System File Checker
- The SFC /SCANNOW Command - System File Checker scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible. If you have modified your system files as in theming explorer/system files, running sfc /scannow will revert the system files to it's default state.
  - Link to full tutorial: SFC /SCANNOW Command - System File Checker
Run Disk Check in Windows 7
- Run this on your Hard Drive(s). This will show you how to run Check Disk or chkdsk in Windows 7 to check a selected hard disk for file system errors and bad sectors on it. With both boxes checked for all HDDs and with Automatically fix file system errors. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
  - Link to full tutorial: Disk Check

Use Crystal Disk Info to upload a screenshot of your Hard Drives (s).
- Then test your Hard Drives (s) running a Hard Drive Diag.

Test and Diagnose RAM issues with MEMTEST86+
- Pay close attention to Part 3 of the tutorial "If you have errors". Take the test for at least 7-10 passes. It may take up to 22 passes to find problems.
  - Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold. RAM - Test with Memtest86+

Bugcheck Summary:

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\SF_19-11-2013\SF_19-11-2013\111913-23150-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`0201f000 PsLoadedModuleList = 0xfffff800`02263670
Debug session time: Wed Nov 20 08:03:30.581 2013 (UTC + 6:00)
System Uptime: 0 days 0:01:55.455
Loading Kernel Symbols
...............................................................
..............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8001890310, 2, 1, fffff800020c34f0}

Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+c0 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000008001890310, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800020c34f0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800022cd100
GetUlongFromAddress: unable to read from fffff800022cd1c0
 0000008001890310 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReplenishPageSlist+c0
fffff800`020c34f0 f00fba6b1000    lock bts dword ptr [rbx+10h],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  mbam.exe

TRAP_FRAME:  fffff88004281630 -- (.trap 0xfffff88004281630)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000002000083010 rbx=0000000000000000 rcx=0000058000000000
rdx=0000000000000050 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800020c34f0 rsp=fffff880042817c0 rbp=fffffa8001890900
 r8=fffff800022d0500  r9=fffffa80035d0000 r10=fffffa80035d0020
r11=fffff88001e5d180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!MiReplenishPageSlist+0xc0:
fffff800`020c34f0 f00fba6b1000    lock bts dword ptr [rbx+10h],0 ds:00000000`00000010=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000209d569 to fffff8000209dfc0

STACK_TEXT:  
fffff880`042814e8 fffff800`0209d569 : 00000000`0000000a 00000080`01890310 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`042814f0 fffff800`0209c1e0 : 80000000`8685f921 fffff880`00b74000 00000000`00000000 00000080`01890300 : nt!KiBugCheckDispatch+0x69
fffff880`04281630 fffff800`020c34f0 : 000fb4c3`40000026 00000000`00000003 fffff880`00b74000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`042817c0 fffff800`020c1caf : fffffa80`035d0000 00000000`00000000 fffffa80`01892700 00000000`00000000 : nt!MiReplenishPageSlist+0xc0
fffff880`04281830 fffff800`020e5c40 : 2aaaaaaa`aaaaaaab fffffa80`00000000 16900000`8663e225 00000000`04c9a079 : nt!MiRemoveAnyPage+0x24f
fffff880`04281950 fffff800`020aae5d : 00000000`04c9a004 fffff680`000264d0 00000000`00000000 00000000`00000000 : nt!MiCopyOnWrite+0x8a0
fffff880`04281ac0 fffff800`0209c0ee : 00000000`00000001 00000000`04c9a004 fffffa80`058d6b01 00000000`72030000 : nt!MmAccessFault+0xc6d
fffff880`04281c20 00000000`77284cf5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`00188be0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77284cf5


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReplenishPageSlist+c0
fffff800`020c34f0 f00fba6b1000    lock bts dword ptr [rbx+10h],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReplenishPageSlist+c0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReplenishPageSlist+c0

BUCKET_ID:  X64_0xA_nt!MiReplenishPageSlist+c0

Followup: MachineOwner
---------

kyle15 · 20 Nov 2013

Since there's no driver or any sort that the minidumps indicated as the problem, I'm kinda conflicted as to where I should start with narrowing down the problem. The reason being is the laptop has randomly bluescreened BEFORE successfully logging in, like in the middle of it loading into safe mode and right after hitting the log-in button during a normal boot. Since it's presenting itself this way I'm inclined to think it isn't Norton (which is installed on the computer) as the crashes are happening even before it has a chance to load. One other thing I'd like to point out and failed to due so in my last post is the computer doesn't simply immediately bluescreen each time, the screen graphically gargles into a glitched pattern which leads me to believe it could in fact be a fault with the graphics driver.

In an attempt to see if this in fact could be the problem, we managed to get it to stay logged in for about 30 minutes and after visiting a webpage or two beyond say, Google, it bluescreened. I'm going to have a video game tried to see if it does the same thing, that's what the computer is used for the most.

Now if I can narrow it down to that being the problem, how would I go about fixing the driver since the crashes are relatively so random? If it happened during the repair I fear it'd do more harm than good or prove difficult to even get through the repair. Last night for awhile the computer couldn't even be logged into because it would bluescreen before or during log in.

kyle15 · 21 Nov 2013

I cannot complete an instance of sfc /scannow because of the rebooting. The only place it doesn't reboot in is the startup recovery menu. It stays there and doesn't bluescreen at all. I'm not even attempting a checkdsk because that could mess up the hard drive if it crashes.

I just noticed in the debug text it says "memory corruption." I didn't notice that before at all! Could it just be faulty RAM? I don't see anything else indicating a problem. (then again I don't know my way around all that debug stuff)

Arc · 22 Nov 2013

Have you performed the last step of the suggestion you have got?

kyle15 · 22 Nov 2013

Arc said:

Have you performed the last step of the suggestion you have got?

I got to that step and began to prepare for it, but I decided to go ahead and swap out the only stick of RAM in the computer with that of a different one I had on hand. While I haven't run any tests yet, the computer has been on about 4 hours and hasn't bluescreened since! Running games on it, everything. I noticed right off the bat a key difference during boot and logging in so I figured my hunch was right. Appears to have actually been bad RAM!

For now I think I'm going to call this solved since it seems okay, but I think I'm still going to run a test on the RAM that was in it. However on second thought since it does appear to be bad, I know that can mess up a computer so it's probably better to leave alone.