BSOD IRQL_NOT_LESS_OR_EQUAL while playing SW:TOR and idling

writhziden · 04 Feb 2012

XplicitMind said:

writhziden said:

CPU temperatures look a little high. What do they get to under stress?

Should be mid 30s during idle and 50s during stress. Yours are 43 during idle...

During stress it was around 54-58C. I'll be getting thermal paste today so should expect dip in temp. Just hope not much damage has been done to it.

Back to my recent BSOD, did it indicate anything other than memory corruption?

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\Kingston\BSODDmpFiles\XplicitMind\Windows_NT6_BSOD_jcgriff2\020412-22713-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a55000 PsLoadedModuleList = 0xfffff800`02c9a670
Debug session time: Sat Feb  4 13:39:40.268 2012 (GMT-7)
System Uptime: 0 days 6:57:57.439
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffffffffffffff8b, 2, 1, fffff80002aaf733}

Probably caused by : win32k.sys ( win32k!SetForegroundPriorityProcess+ce )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffffffffffff8b, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002aaf733, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d04100
 ffffffffffffff8b 

CURRENT_IRQL:  2

FAULTING_IP: 
nt! ?? ::FNODOBFM::`string'+6ee0
fffff800`02aaf733 4088788b        mov     byte ptr [rax-75h],dil

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  explorer.exe

TRAP_FRAME:  fffff88007c886d0 -- (.trap 0xfffff88007c886d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80095c1a20
rdx=fffff88007c88898 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002aaf733 rsp=fffff88007c88860 rbp=0000000000000012
 r8=0000000000000012  r9=0000000000000000 r10=fffff900c0580a70
r11=fffff900c06aa6a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
nt! ?? ::FNODOBFM::`string'+0x6ee0:
fffff800`02aaf733 4088788b        mov     byte ptr [rax-75h],dil ds:ffffffff`ffffff8b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ad11e9 to fffff80002ad1c40

STACK_TEXT:  
fffff880`07c88588 fffff800`02ad11e9 : 00000000`0000000a ffffffff`ffffff8b 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`07c88590 fffff800`02acfe60 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`095c19f0 : nt!KiBugCheckDispatch+0x69
fffff880`07c886d0 fffff800`02aaf733 : fffffa80`095c19f0 fffff960`0004fbfd 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`07c88860 fffff800`02a9e8f5 : fffff900`c28d42a0 fffff800`02adb800 00000000`00000000 fffff900`c06aa6a0 : nt! ?? ::FNODOBFM::`string'+0x6ee0
fffff880`07c88890 fffff960`00134c32 : 00000000`00000000 00000000`00000000 00000000`00000012 00000000`00000000 : nt!KeSetPriorityAndQuantumProcess+0x31
fffff880`07c88940 fffff960`00085c88 : fffff880`07c88c20 fffff900`c2906610 00000000`00000000 fffff880`07c88aa0 : win32k!SetForegroundPriorityProcess+0xce
fffff880`07c88980 fffff960`0006c0a5 : fffff900`c2906610 00000000`02c2ec30 00000000`00000018 fffff880`07c88aa8 : win32k!xxxSetForegroundThread+0x150
fffff880`07c889c0 fffff960`00085a08 : 00000000`00000001 fffff900`c0858080 fffff880`07c88ca0 fffff900`c2906610 : win32k!xxxSetForegroundWindow2+0x1b5
fffff880`07c88ad0 fffff960`001425e0 : fffff900`c0858080 00000000`00000001 00000000`00000001 00000000`00000000 : win32k!xxxSetForegroundWindow+0x274
fffff880`07c88b60 fffff960`0010b342 : 00000000`00000000 00000000`001002d6 00000000`00000003 fffff960`00109df6 : win32k!xxxSwitchToThisWindow+0xa4
fffff880`07c88bd0 fffff800`02ad0ed3 : fffffa80`09511580 fffff880`07c88ca0 00000000`001002d6 00000000`02c2f338 : win32k!NtUserCallHwndParamLock+0xc6
fffff880`07c88c20 00000000`7749cc3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c2f438 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7749cc3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SetForegroundPriorityProcess+ce
fffff960`00134c32 0fba630c16      bt      dword ptr [rbx+0Ch],16h

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k!SetForegroundPriorityProcess+ce

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5a

FAILURE_BUCKET_ID:  X64_0xA_win32k!SetForegroundPriorityProcess+ce

BUCKET_ID:  X64_0xA_win32k!SetForegroundPriorityProcess+ce

Followup: MachineOwner
---------

Your most recent was rather inconclusive.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.
The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.
If you encounter bug check 0xA while upgrading to a later version of Windows, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

From Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

XplicitMind · 04 Feb 2012

Hmm well I guess I'll upload more BSOD when/if I get them.

Thanks for the help again.

Dave76 · 05 Feb 2012

Can you post the information requested below in post #31 in this thread?

We need to know what hardware you have, in order to try and find the cause of your crashes. Please fill in your system specs.

Did you Uninstall the ASUS utilities for testing purposes, these are known to cause system crashes?

What is the new RAM you installed, what are the settings?

Dave76 said:

Can you post your System Specs?

This is likely a hardware issue, specifically RAM, we need to know what components you have.
Use these links to find your system specs.
Speccy Free System information Utility

System Info - See Your System Specs

D/L CPUZ and post a snip of the CPU, Mainboard, Memory, and SPD tabs.
For posting the information , enter 'Snipping tool' in the Start button > Search box, hit enter. Select the area you want to post and save to a convenient place.
How to Post a Screenshot in Seven Forums

This information will help us analyze your system.

Did you run memtest86+ for a full 7 passes, best to run overnight.
This is recommended over Windows memtest, it will find errors more reliably, it runs without the OS.
RAM - Test with Memtest86+
Run this with both RAM cards installed.

From the Event App dumps:

There are several of these.

Code:

Event[25]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2012-01-08T23:53:11.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: RyRichJ-PC
  Description: 
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: Regutility.exe
P2: 4.1.1.8
P3: 2a425e19
P4: KERNELBASE.dll
P5: 6.1.7601.17651
P6: 4e211319
P7: 0eedfade
P8: 0000b9bc
P9: 
P10: 

Attached files:
C:\Users\RyRichJ\AppData\Local\Temp\WER4B9F.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Regutility.exe_8d866312baecec5be67c375136f718ed3937ebb_0c2b4f95

Analysis symbol: 
Rechecking for solution: 0
Report Id: d3c64cd2-3a7d-11e1-98c7-485b39c633e8
Report Status: 1

Please verify that Regutility has been uninstalled.

Memory corruption.

Code:

Event[58]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2012-01-08T23:19:21.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: RyRichJ-PC
  Description: 
Fault bucket X64_MEMORY_CORRUPTION_ONE_BIT, type 0
Event Name: BlueScreen
Response: http://wer.microsoft.com/responses/resredir.aspx?sid=603&Bucket=X64_MEMORY_CORRUPTION_ONE_BIT&ID=8712bb3f-e690-4869-a5d6-94f8edfaa0e7
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\010812-17050-01.dmp
C:\Users\RyRichJ\AppData\Local\Temp\WER-24804-0.sysdata.xml
C:\Users\RyRichJ\AppData\Local\Temp\WER9BC1.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_090703c7

Analysis symbol: X64_MEMORY_CORRUPTION_ONE_BIT
Rechecking for solution: 0
Report Id: 010812-17050-01
Report Status: 0

Event[158]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2012-01-08T21:34:23.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: RyRichJ-PC
  Description: 
Fault bucket X64_MEMORY_CORRUPTION_STRIDE, type 0
Event Name: BlueScreen
Response: http://wer.microsoft.com/responses/resredir.aspx?sid=603&Bucket=X64_MEMORY_CORRUPTION_STRIDE&ID=12f1de1f-7a76-47c0-a93a-4f455fadbf73
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\010812-14164-01.dmp
C:\Users\RyRichJ\AppData\Local\Temp\WER-21840-0.sysdata.xml
C:\Users\RyRichJ\AppData\Local\Temp\WER8A44.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_08e50740

Analysis symbol: X64_MEMORY_CORRUPTION_STRIDE
Rechecking for solution: 0
Report Id: 010812-14164-01
Report Status: 0

Event[389]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2012-01-08T12:24:50.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: RyRichJ-PC
  Description: 
Fault bucket X64_0xA_nt!MiUnlinkFreeOrZeroedPage+181, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\010812-20077-01.dmp
C:\Users\RyRichJ\AppData\Local\Temp\WER-28532-0.sysdata.xml
C:\Users\RyRichJ\AppData\Local\Temp\WER8600.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_0984be7d

Analysis symbol: X64_0xA_nt!MiUnlinkFreeOrZeroedPage+181
Rechecking for solution: 0
Report Id: 010812-20077-01
Report Status: 0

Skype is also reported crashing.

System Event logs:

Code:

Event[25]:
  Log Name: System
  Source: Microsoft Antimalware
  Date: 2012-01-09T00:06:46.000
  Event ID: 3002
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: RyRichJ-PC
  Description: 
Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.
 	Feature: Behavior Monitoring
 	Error Code: 0x80004005
 	Error description: Unspecified error 
 	Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

Check for updates for MSE on Windows Update.
Install and run full scan from MSE.

Most of this information leads me to suspect your RAM.
Post the CPUZ info requested above,