BSOD error 0x0000000a while idling

CC123 · 02 Jan 2013

Hey guys, lately I've been getting an irql_not_less_or_equal BSOD while my computer is idling. This has happened twice so far and I don't know what's causing it since I was away from each time it happened (I never shutdown my computer unless necessary).

What I gathered from the dump files is that the driver hal.dll and ntoskrnl.exe are responsible. My drivers are at their latest version as well. From what I understand, this error occurs when a driver attempts to access a memory location it did not have permission to. Is it possible that it's a memory leak caused by running the computer for too long? Though this error only started appearing during the start of December and my computer has been with me for 2~ years now.

Another interesting thing to note is that the BSODs happened almost a month between each other. The first occurred on 12/1/12 while this second occurred today, 1/2/13.

Arc · 03 Jan 2013

Hello CC123, apparently the crash is caused by CPU-z.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {2126fc00, f, 1, fffff80003234b07}

*** WARNING: Unable to verify timestamp for cpuz136_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for cpuz136_x64.sys
Probably caused by : cpuz136_x64.sys ( cpuz136_x64+1ff2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000002126fc00, memory referenced
Arg2: 000000000000000f, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003234b07, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350e100
GetUlongFromAddress: unable to read from fffff8000350e1c0
 000000002126fc00 Nonpaged pool

CURRENT_IRQL:  f

FAULTING_IP: 
hal!HalpPciReadMmConfigUlong+7
fffff800`03234b07 8902            mov     dword ptr [rdx],eax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  SolutoService.

TRAP_FRAME:  fffff88009f2f3b0 -- (.trap 0xfffff88009f2f3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000001d0c0fef rbx=0000000000000000 rcx=ffffffffffd10000
rdx=000000002126fc00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003234b07 rsp=fffff88009f2f548 rbp=ffffffffffd10000
 r8=00000000000000a4  r9=00000000000000a4 r10=0000000000000000
r11=fffff800032421d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
hal!HalpPciReadMmConfigUlong+0x7:
fffff800`03234b07 8902            mov     dword ptr [rdx],eax ds:00000000`2126fc00=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032de569 to fffff800032defc0

STACK_TEXT:  
fffff880`09f2f268 fffff800`032de569 : 00000000`0000000a 00000000`2126fc00 00000000`0000000f 00000000`00000001 : nt!KeBugCheckEx
fffff880`09f2f270 fffff800`032dd1e0 : 00000000`00000000 00000000`00000000 00000000`2126fc00 00000000`00000004 : nt!KiBugCheckDispatch+0x69
fffff880`09f2f3b0 fffff800`03234b07 : fffff800`03224245 fffff880`09f2f610 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`09f2f548 fffff800`03224245 : fffff880`09f2f610 00000000`00000000 00000000`00000000 fffff800`032240d6 : hal!HalpPciReadMmConfigUlong+0x7
fffff880`09f2f550 fffff800`03224b32 : 00000000`e00c301b 00000000`2126fc00 00000000`00000004 00000000`00000000 : hal!HalpPCIPerformConfigAccess+0x55
fffff880`09f2f580 fffff800`0322402c : 00000000`00000000 fffff800`00000078 fffff880`09f2f780 00000000`00000004 : hal!HalpPciAccessMmConfigSpace+0x196
fffff880`09f2f5d0 fffff800`03223e06 : 00000000`00000004 fffff800`00000078 00000000`000000a4 fffff880`09f2f780 : hal!HalpPCIConfig+0x9c
fffff880`09f2f640 fffff800`032239f8 : 00000000`00000078 90000000`00000078 00000000`000000a4 00000000`00000000 : hal!HalpReadPCIConfig+0x5e
fffff880`09f2f680 fffff800`03224c12 : 00000000`00000000 fffff800`033a7f18 00000000`00000001 00000000`000020fd : hal!HalpGetPCIData+0x100
fffff880`09f2f750 fffff880`099b7ff2 : 00000000`00000004 fffffa80`0772d2c0 00000000`00000005 fffff700`01080000 : hal!HalGetBusDataByOffset+0x86
fffff880`09f2f840 00000000`00000004 : fffffa80`0772d2c0 00000000`00000005 fffff700`01080000 00000000`000000a4 : cpuz136_x64+0x1ff2
fffff880`09f2f848 fffffa80`0772d2c0 : 00000000`00000005 fffff700`01080000 00000000`000000a4 00000000`00000004 : 0x4
fffff880`09f2f850 00000000`00000005 : fffff700`01080000 00000000`000000a4 00000000`00000004 fffffa80`01c9e7e0 : 0xfffffa80`0772d2c0
fffff880`09f2f858 fffff700`01080000 : 00000000`000000a4 00000000`00000004 fffffa80`01c9e7e0 fffff700`01080000 : 0x5
fffff880`09f2f860 00000000`000000a4 : 00000000`00000004 fffffa80`01c9e7e0 fffff700`01080000 00000000`00000000 : 0xfffff700`01080000
fffff880`09f2f868 00000000`00000004 : fffffa80`01c9e7e0 fffff700`01080000 00000000`00000000 00000000`00000001 : 0xa4
fffff880`09f2f870 fffffa80`01c9e7e0 : fffff700`01080000 00000000`00000000 00000000`00000001 7ff00000`00000000 : 0x4
fffff880`09f2f878 fffff700`01080000 : 00000000`00000000 00000000`00000001 7ff00000`00000000 00000000`1f550ca0 : 0xfffffa80`01c9e7e0
fffff880`09f2f880 00000000`00000000 : 00000000`00000001 7ff00000`00000000 00000000`1f550ca0 fffffa80`01c9e7e0 : 0xfffff700`01080000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cpuz136_x64+1ff2
fffff880`099b7ff2 ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  cpuz136_x64+1ff2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cpuz136_x64

IMAGE_NAME:  cpuz136_x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  508c18d9

FAILURE_BUCKET_ID:  X64_0xA_cpuz136_x64+1ff2

BUCKET_ID:  X64_0xA_cpuz136_x64+1ff2

Followup: MachineOwner
---------

2: kd> lmvm cpuz136_x64
start             end                 module name
fffff880`099b6000 fffff880`099bf000   cpuz136_x64 T (no symbols)           
    Loaded symbol image file: cpuz136_x64.sys
    Image path: \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys
    Image name: cpuz136_x64.sys
    Timestamp:        Sat Oct 27 22:54:41 2012 (508C18D9)
    CheckSum:         0000F097
    ImageSize:        00009000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As a test, you uninstall this program (that's a good and widely used program though) and see what happens there.

Free up the startup.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept the restart.

Uninstall all the ASUS bloatware you have installed.

Let us know the results.

CC123 · 10 Jan 2013

Sorry for the late reply but I thought it would be better to only post when a BSOD happens since it's not an every day thing. Uninstalled CPU-z earlier in the week and uninstalled the ASUS bloatware, though I think I might have missed some. Please tell me which ones I missed if you can see it in the .zip attachment. Another BSOD happened while I was away again today with the same code, 0x0000000a. So I take it wasn't CPU-z then? Bluescreen View still tells me that hall.dll and ntoskrnl.exe is responsible.

Arc · 11 Jan 2013

CC123, I took the latest one from the zip, and it indicates the same thing

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {20c1fc90, f, 1, fffff80003817b07}

*** WARNING: Unable to verify timestamp for cpuz136_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for cpuz136_x64.sys
Probably caused by : cpuz136_x64.sys ( cpuz136_x64+1ff2 )

Followup: MachineOwner
---------

If you are sure that you have uninstalled CPU-z, check for the leftover drivers in these locations

C:\Windows\System32\drivers
C:\Windows\SysWOW64\drivers

If the driver cpuz136_x64.sys is present there, delete it manually. Let us know the situation.

CC123 · 11 Jan 2013

Nope, nothing in those folders.

Arc · 11 Jan 2013

Strange! Really strange. A driver is contributing in the crash, but that one does not exist!

Please let me see another crash dump, if it occurs. But dont force it to crash. If within normal usage it crashes again, post in this thread.

CC123 · 27 Jan 2013

Welp, it happened again. Happened when I was browsing with firefox and ordering food on seamless.

Arc · 28 Jan 2013

CC123, I am seeing two things as the problems.

vtany.sys
cpuz136_x64

But I am not getting enough evidence of the existence of those programs in your computer. In such a situation, the first thing strikes in the mind is a malware. Scan the system for possible virus infection.

Let us know the results.

CC123 · 31 Jan 2013

TDSSKiller detected sptd.sys and Windows offline defender detected one adware infection. Removed them both.

Arc · 31 Jan 2013

Good job! sptd.sys is a very common cause of a BSOD. Even if it is removed, make it sure that there is no tress of it anymore. Download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

Double click to open it.
Click this button only:
If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

If there is any further issue, let us know.