BSODs on Windows 7 Ultimate 64 bit, IRQL_NOT_LESS_OR_EQUAL

partypoison1993 · 09 Aug 2013

Hi, im having blue screens on my pc running windows 7 ultimate 64-bit (SP1). Im experiancing random Bsods while working, and sometimes when the system is idle. When looked in Whocrashed, the bsods have something to do with ntoskrnl.exe and wow64.sys. My pc is 1 year old and im getting bsods from the very begining. Due to this, i re-installed windows 7 three days before and still getting bsods. Its really a pain. The programs i mostly use are Autodesk Maya 2014, Adobe After Effects CS6 and Adobe Photoshop CS6 in which all of these are 64-bit. Also, i constantly use CCleaner to clean my system and registry. im using avast free antivirus 8.

My system specs are :- intel core i5 3450 @ 3.1 Ghz
2 x 4 Gb Corsair Vengeance Memory @ 1600 Mhz ( or 1333 Mhz ? )
Asus P8H77 V-Le Mobo
Asus Gtx 560 1 GB GDDR5
WD Cavier Green 1 TB
Cooler Master eXtreme Power Plus 600W PSU
Monitor Resolution 1920 x 1080

Info from WhoCrashed :-

On Fri 09-08-2013 4:11:21 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080913-26800-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0xA (0xFFFFFFFFFFFFFFFF, 0x2, 0x1, 0xFFFFF80002CA8622)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Fri 09-08-2013 4:11:21 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: wow64.sys (wow64!Wow64EmulateAtlThunk+0x4C5D)
Bugcheck code: 0xA (0xFFFFFFFFFFFFFFFF, 0x2, 0x1, 0xFFFFF80002CA8622)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: wow64.sys .
Google query: wow64.sys IRQL_NOT_LESS_OR_EQUAL

Dump file attached.

Please help as soon as possible.

Thanks.

Arc · 09 Aug 2013

Apparently the BSOD is caused by avast! Self Protection Driver.

Code:

fffff880`0d594d98  fffff880`04131dd1Unable to load image \SystemRoot\System32\Drivers\aswSP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
 aswSP+0x10dd1

Description here: Driver Reference Table - aswSP.SYS

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.
_____________________________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffffffffffffffff, 2, 1, fffff80002ca8622}

Probably caused by : ntkrnlmp.exe ( nt!KxWaitForLockOwnerShip+12 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffffffffffffff, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ca8622, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eaf100
GetUlongFromAddress: unable to read from fffff80002eaf1c0
 ffffffffffffffff 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KxWaitForLockOwnerShip+12
fffff800`02ca8622 48890a          mov     qword ptr [rdx],rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  chrome.exe

TRAP_FRAME:  fffff8800d594e00 -- (.trap 0xfffff8800d594e00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8800d595020
rdx=ffffffffffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca8622 rsp=fffff8800d594f90 rbp=fffff8800d595000
 r8=0000000000000000  r9=0000000000000000 r10=fffffa80065e5470
r11=fffff80002eb2ac0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!KxWaitForLockOwnerShip+0x12:
fffff800`02ca8622 48890a          mov     qword ptr [rdx],rcx ds:ffffffff`ffffffff=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c771a9 to fffff80002c77c00

STACK_TEXT:  
fffff880`0d594cb8 fffff800`02c771a9 : 00000000`0000000a ffffffff`ffffffff 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0d594cc0 fffff800`02c75e20 : fffffa80`05be3720 fffff800`02cd32a0 00000000`00000898 fffffa80`0562e060 : nt!KiBugCheckDispatch+0x69
fffff880`0d594e00 fffff800`02ca8622 : 00000000`00000000 fffff800`02c871e3 00000000`00000010 00000000`00000202 : nt!KiPageFault+0x260
fffff880`0d594f90 fffff800`02c874fd : fffffa80`0562e060 fffff880`009ed180 00000000`00000000 00000000`00000000 : nt!KxWaitForLockOwnerShip+0x12
fffff880`0d594fc0 fffff800`02c6c6c8 : 00000000`00000000 fffffa80`0562e060 0000000f`ffffffff fffff800`02e45f40 : nt!MiInsertPageInFreeOrZeroedList+0x55d
fffff880`0d5950d0 fffff800`02c6cb0f : deb00001`00000000 fffff680`00072000 00000000`00000200 000fffff`00000001 : nt!MiDeletePteList+0x14e
fffff880`0d595150 fffff800`02c64162 : fffff880`0d595a88 00000000`00000000 fffffa80`0a6ce620 fffffa80`0a6ce9b8 : nt!MiDecommitPages+0x30f
fffff880`0d5959e0 fffff800`02c76e93 : ffffffff`ffffffff 00000000`030ce800 00000000`030ce7f8 00000000`00004000 : nt!NtFreeVirtualMemory+0x382
fffff880`0d595ae0 00000000`77a714fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`030ce7c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a714fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KxWaitForLockOwnerShip+12
fffff800`02ca8622 48890a          mov     qword ptr [rdx],rcx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KxWaitForLockOwnerShip+12

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d9c6

FAILURE_BUCKET_ID:  X64_0xA_nt!KxWaitForLockOwnerShip+12

BUCKET_ID:  X64_0xA_nt!KxWaitForLockOwnerShip+12

Followup: MachineOwner
---------

partypoison1993 · 09 Aug 2013

Hey, thanks for the reply. i'll do what you said. but just before that, i got a bsod right after my first post. so please take a look at these. dump attached.

Thanks.

Arc · 09 Aug 2013

Report us back only after you have uninstalled it....

Code:

Start Menu\Programs\avast! Free Antivirus

as suggested earlier.

partypoison1993 · 09 Aug 2013

i've uninstalled avast antivirus with the avast uninstall tool in safe mode, cleaned the system with ccleaner, installed Microsoft security essentials, updated it, scanned and evrything is fine. also, installed malware-byte's anti-malware, updated it, scanned it and no detections. i hav'nt got any bsods after installing the above programs. i'll report soon if i get anymore Bsods.

Thanks.

partypoison1993 · 09 Aug 2013

just wanted to let you know that, my ram, which is Corsair Vengeance 1600 4GB ( CMZ4GX3M1A1600C9 ) is not listed in the compatible memory list of my motherboard which is Asus P8H77 V-LE. if this means anything. Thanks.

Arc · 09 Aug 2013

Code:

[32Bit Memory Error Information (Type 18) - Length 23 - Handle 005dh]
[Memory Device (Type 17) - Length 34 - Handle 005eh]
  Physical Memory Array Handle  005ch
  Memory Error Info Handle      [No Errors]
  Total Width                   64 bits
  Data Width                    64 bits
  Size                          4096MB
  Form Factor                   09h - DIMM
  Device Set                    [None]
  Device Locator                ChannelA-DIMM1
  Bank Locator                  BANK 1
  Memory Type                   18h - Specification Reserved
  Type Detail                   0080h - Synchronous
  Speed                         1600MHz
  Manufacturer                  029E
  Serial Number                         
  Asset Tag Number                        
  Part Number                   CMZ4GX3M1A1600C9  
[32Bit Memory Error Information (Type 18) - Length 23 - Handle 0062h]
[Memory Device (Type 17) - Length 34 - Handle 0063h]
  Physical Memory Array Handle  005ch
  Memory Error Info Handle      [No Errors]
  Total Width                   64 bits
  Data Width                    64 bits
  Size                          4096MB
  Form Factor                   09h - DIMM
  Device Set                    [None]
  Device Locator                ChannelB-DIMM1
  Bank Locator                  BANK 3
  Memory Type                   18h - Specification Reserved
  Type Detail                   0080h - Synchronous
  Speed                         1600MHz
  Manufacturer                  029E

Apparently there is nothing to panic. Let us report after an week or occurrence of another BSOD whichever is earlier.

partypoison1993 · 09 Aug 2013

Im unlucky ! just got another BSOD while i rebooted my pc. and this time the BSOD has new friends to make me sad. after the bsod, it rebooted automaticaly, and now my pc is running in low resolution(no Aero), like huge taskbar and big cursor, i can only see a portion of this webpage indeed.

. also my pc is making loud fan noise after the reboot. really starting to panic. i hope my pc will never explode. here is the bsod info :-

On Fri 09-08-2013 11:21:08 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080913-23634-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0xA (0xFFFFFFFFFFFFFFFF, 0x2, 0x1, 0xFFFFF80002CFD622)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Fri 09-08-2013 11:21:08 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: hal.dll (hal!HalSendSoftwareInterrupt+0x47)
Bugcheck code: 0xA (0xFFFFFFFFFFFFFFFF, 0x2, 0x1, 0xFFFFF80002CFD622)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\hal.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Hardware Abstraction Layer DLL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.

dump attached

partypoison1993 · 09 Aug 2013

things are getting worse i think. after my last post, i rebooted again (with no bsod) to get the correct resolution, but all i saw was a blank white screen at the bios, instead of the windows 7 load animation, vista animation played, and now my desktop looks like a really low resolution. i mean, its now like the old super mario game graphics that we used to play on nintendo es.

. this has happened before, 1 time , but when i rebooted it was corrected. what should i do.? will it be a graphics card issue..? my card is Asus gtx 560 1gb gddr5. the driver is up to date. also i remember one time there were sparks coming from my psu, no smokes, but smoky smell and all. but never happened again. please help me really man.

Thanks.

Arc · 09 Aug 2013

Your crash dumps are not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

If those tests comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.