BSOD: Driver Irql Not Less Or Equal

[boombrakh]

I've been browsing the forums for a while now trying to solve my own problems but I've reached a point where I am about to throw my new computer out the window. So, this is me reaching out before I give up.

Having gone through the posting guidelines for these kind of problems, I've prepared with everything I could think of. I went ahead and updated my system specs as well under my profile. I am running an OEM license Windows 7 Home Premium 64-bit and the hardware is about a week old (and i've had the problem since day 1). Since then, I've re-installed the OS twice, updated all the drivers several times (over the course of three installments of the OS)

Without further ado, I give you a problem:

For the past week now, Ive been struggling with BSOD's occuring when I stream large quantities of data (such as Youtube, Flash and Torrents). I have no idea if it is a network problem, but it's what it feels like. I can watch movies just fine without interruptions.

I get the DRIVER_IRQL_NOT_LESS_OR_EQUAL error message and then either the tcpip.sys or the e1q62x64.sys file gets a special mention. I am completely lost as to what to do at this point. I just hope that someone out there is savvy enough to actually help me out here.

I've attached everything I should (hopefully) and if there is something I've missed, just ask for it and I shall delivereth.

Thank you!

 

[yowanvista]

e1q62x64.sys is your Intel Network adapter
Update it using the Intel update utility
Intel® Driver Update Utility

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {68, 2, 1, fffff88004355e60}

Unable to load image \SystemRoot\system32\DRIVERS\e1q62x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for e1q62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1q62x64.sys
Probably caused by : e1q62x64.sys ( e1q62x64+18e60 )


DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000068, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88004355e60, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0f0e0
 0000000000000068 

CURRENT_IRQL:  2

FAULTING_IP: 
e1q62x64+18e60
fffff880`04355e60 f00fc14168      lock xadd dword ptr [rcx+68h],eax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800367a7e0 -- (.trap 0xfffff8800367a7e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa800d346cd0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004355e60 rsp=fffff8800367a970 rbp=00000000000001f2
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=000000000000fffb r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
e1q62x64+0x18e60:
fffff880`04355e60 f00fc14168      lock xadd dword ptr [rcx+68h],eax ds:00000000`00000068=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ad6ca9 to fffff80002ad7740

STACK_TEXT:  
fffff880`0367a698 fffff800`02ad6ca9 : 00000000`0000000a 00000000`00000068 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0367a6a0 fffff800`02ad5920 : fffffa80`0f73abb0 00000000`00000000 00000000`00000001 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`0367a7e0 fffff880`04355e60 : fffffa80`0f729250 fffffa80`0f6848f8 00000000`00000000 00000000`00000009 : nt!KiPageFault+0x260
fffff880`0367a970 fffffa80`0f729250 : fffffa80`0f6848f8 00000000`00000000 00000000`00000009 00000000`00000000 : e1q62x64+0x18e60
fffff880`0367a978 fffffa80`0f6848f8 : 00000000`00000000 00000000`00000009 00000000`00000000 fffff880`0435e3b4 : 0xfffffa80`0f729250
fffff880`0367a980 00000000`00000000 : 00000000`00000009 00000000`00000000 fffff880`0435e3b4 fffffa80`00000000 : 0xfffffa80`0f6848f8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
e1q62x64+18e60
fffff880`04355e60 f00fc14168      lock xadd dword ptr [rcx+68h],eax

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  e1q62x64+18e60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: e1q62x64

IMAGE_NAME:  e1q62x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4af31807

FAILURE_BUCKET_ID:  X64_0xD1_e1q62x64+18e60

BUCKET_ID:  X64_0xD1_e1q62x64+18e60

Followup: MachineOwner
---------

 

[boombrakh]

Trying to update the driver using the Intel Driver Update Utility abruptly prompted a new BSOD that I hadn't gotten before. I tried to reproduce the problem, and when I am asked to install the utility I get a BSOD. This time it was cpudrv64.sys that got it.

Uploading the dump file.

 

[yowanvista]

Boot in safe mode with networking
The file cpudrv64.sys may be a virus. Download Malwarebytes and run a full scan.

 

[boombrakh]

Time for some updates.

Boot in safe mode with networking
The file cpudrv64.sys may be a virus. Download Malwarebytes and run a full scan.

I downloaded the Anti-Malware program and found nothing. Not surprising though, considering it's a clean OS install. I followed your advice and booted the computer in safe mode with networking to try and run the Update utility. It ran, but didn't find anything at all.

e1q62x64.sys is your Intel Network adapter
Update it using the Intel update utility
Intel® Driver Update Utility

I tried to get the Update utility thing to work, but with no success. Trying to run it forces a BSOD. I did however download it manually after looking up what I needed from the Device Manager. (Intel 82583V Gigabit Network Connection). Updating the driver did absolutely nothing though. I rebooted the computer, started up Steam and put the card to work. First thing that happened was that the music in the background got all sluggish and then finally the same problem with e1q62x64.sys as before.

Attached file is with the latest dumps.

 

[boombrakh]

I got the utility to work and it reports everything is nice and dandy.

 

[cluberti]

Cpudrv64.sys seems to come from this program:
Systems Requirements Lab, creator of Instant Expert Analysis
So, my belief that this is a "clean" OS install is now suspect - this doesn't get installed by Windows . Might want to consider what you've installed since Windows, because this might have something to do with it. See below for further data.

As to the crash, it's still a page fault coming out of that driver - not sure 100% it's the culprit, but it's likely at least:

// The trap frame for the stack which points to the crashing thread:
2: kd> .trap 0xfffff8800367a7e0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa800d346cd0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004355e60 rsp=fffff8800367a970 rbp=00000000000001f2
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=000000000000fffb r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
e1q62x64+0x18e60:
fffff880`04355e60 f00fc14168 lock xadd dword ptr [rcx+68h],eax ds:00000000`00000068=????????
 
// The thread itself - you can see that e1q62x64 tried to write invalid memory from the EAX register to RCX in the trap frame above:
2: kd> !thread
GetPointerFromAddress: unable to read from fffff80002d0f000
THREAD fffffa800d31f660 Cid 0004.0cbc Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80002c4dba4
Owning Process fffffa800ca96040 Image: System
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 94434 
Context Switch Count 18 
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address ndis!ndisReceiveWorkerThread (0xfffff880014be9e0)
Stack Init fffff8800367adb0 Current fffff8800367aa00
Base fffff8800367b000 Limit fffff88003675000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`0367a698 fffff800`02ad6ca9 : 00000000`0000000a 00000000`00000068 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0367a6a0 fffff800`02ad5920 : fffffa80`0f73abb0 00000000`00000000 00000000`00000001 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`0367a7e0 fffff880`04355e60 : fffffa80`0f729250 fffffa80`0f6848f8 00000000`00000000 00000000`00000009 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`0367a7e0)
fffff880`0367a970 fffffa80`0f729250 : fffffa80`0f6848f8 00000000`00000000 00000000`00000009 00000000`00000000 : e1q62x64+0x18e60
fffff880`0367a978 fffffa80`0f6848f8 : 00000000`00000000 00000000`00000009 00000000`00000000 fffff880`0435e3b4 : 0xfffffa80`0f729250
fffff880`0367a980 00000000`00000000 : 00000000`00000009 00000000`00000000 fffff880`0435e3b4 fffffa80`00000000 : 0xfffffa80`0f6848f8
 
// The driver you installed was from 2009???
2: kd> lmvim e1q62x64
start end module name
fffff880`0433d000 fffff880`04387000 e1q62x64 T (no symbols) 
Symbol file: e1q62x64.sys
Image path: \SystemRoot\system32\DRIVERS\e1q62x64.sys
Image name: e1q62x64.sys
Timestamp: Thu Nov 05 13:23:03 2009 (4AF31807)
CheckSum: 0004943F
ImageSize: 0004A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

According to Intel's site on downloads for your NIC, the latest driver package is here. The driver in that package is from July 8, 2010, and is version 11.7.32.0. You are not running that driver, so it might make sense to try and update again. Download the PROWinx64 package from the link above, extract it, and try to update again. If it still fails, you're probably looking at running an sfc /scannow on that system at this point, after removing any antivirus, firewall, and any other security or network driver-based software (including this "Expert analysis" software). Could be something's either hooked the driver, or has messed with/corrupted the network filter driver stack.

 

[boombrakh]

Cpudrv64.sys seems to come from this program:
Systems Requirements Lab, creator of Instant Expert Analysis
So, my belief that this is a "clean" OS install is now suspect - this doesn't get installed by Windows . Might want to consider what you've installed since Windows, because this might have something to do with it. See below for further data.

Is it possible that there is something that's followed through from one of the disks? A few of the disks in the computer comes from my old rig and one still has an old windows 7 install on it. I tried to disable the disks in BIOS, but windows found them anyways.

According to Intel's site on downloads for your NIC, the latest driver package is here. The driver in that package is from July 8, 2010, and is version 11.7.32.0. You are not running that driver, so it might make sense to try and update again. Download the PROWinx64 package from the link above, extract it, and try to update again. If it still fails, you're probably looking at running an sfc /scannow on that system at this point, after removing any antivirus, firewall, and any other security or network driver-based software (including this "Expert analysis" software). Could be something's either hooked the driver, or has messed with/corrupted the network filter driver stack.

Interesting. It's the exact same file that I've downloaded twice now. I tried to uninstall the drivers for the network through the device manager but that just froze the whole computer. Been looking at it til now. Had to write a reply on the iPad

Is there a way to force the removal of the drivers?

 

[boombrakh]

Update:

I removed the drivers through the use of the PROWinx64.exe program. Made sure that the drivers were gone by checking the Windows/System32/Drivers/ folder, double checked by going through the Device Manager. The driver was deleted. I then proceeded to install the new and updated drivers from the same program (PROWinx64.exe). After it was done, I checked the version under the Device Manager and it was the same as before. (11.7.32.0)

I'm going to download the second newest version and see if that helps.

 

[cluberti]

Good luck - let us know how it goes. This is one of the reasons a lot of us (and even some of the installation guides here) recommend using diskpart clean all from a command prompt after booting into Windows 7 setup before continuing further with setup - this takes awhile, but makes certain the old drive's contents are gone before continuing.

 

[boombrakh]

Good luck - let us know how it goes.

First thing I tried was to simply install the older version (16.0). As you can see from the attached picture, I already had a newer version (even though it was an old one). So I used the 16.1 program to remove the drivers before installing the 16.0 ones. After doing so, I went to check for the version number and to my despair, the 11.7.32 was back.

This is one of the reasons a lot of us (and even some of the installation guides here) recommend using diskpart clean all from a command prompt after booting into Windows 7 setup before continuing further with setup - this takes awhile, but makes certain the old drive's contents are gone before continuing.

I think I wasn't very clear here. I have five disks in the rig, two of them are new and the other three are from my old rig. I've used one of the new ones to install the OS on, one is just empty and the last three just house old files. So it's not like i've just used an old disk and installed a new version of Windows 7 on it.

 

[cluberti]

Gotcha. Yes, once you've updated to a newer driver, it can be difficult to force an older one on. In general, you have to do it manually from the device manager and point to an extracted package.

 

[boombrakh]

ftp://ftp.asus.com.tw/pub/ASUS/mb/socketAM3/Crosshair_IV_Extreme/Intel_LAN_V117321003.zip

Hopefully this right here solves all my problems. Looks like Asus was aware of the problem and released a fix for the motherboard I got. Running Youtube and downloading from Steam at the moment without any problems. I'll see what happens this weekend and if anything changes. If everything works, then no ones happier than me

 

[cluberti]

Whether or not it works (or doesn't), let us know!

 

[boombrakh]

Whether or not it works (or doesn't), let us know!

Nothing new to report, everything is working great.