IRQL_not_less_or_equal windows 7

Associate
Joined
25 Feb 2010
Posts
476
Location
Bristol / Kent
Recently my Windows 7 has been BSOD with the error message IRQL_not_less_or_equal. Initially I assumed this was to do with my overclock so I went into the BIOS and loaded fail-safe options.
This hasn't solved my issue, I've read it can be caused by driver issues but I haven't installed any new drivers on the machine recently.
Any ideas on how to resolve this? Any help appreciated!
 
Yeh, I've got about 5 files in the minidump folder.
It's x64 with 6GB DDR3 RAM
I'll try safemode tomorrow. Thanks for the help
 
If you want to email me the files (sig) which were created around the times of your crashes (or email me them) I can take a look for you.
 
You don't bank with HSBC and have installed their ecommended "Raport" software by chance have you?

Our array of Windows 7 machines have been rock-solid so far.
No errors, issues or anything.
With 3 exceptions - every single Windows 7 machine that has had "Raport" installed on it has started Blue Screening until we removed it.
 
If you want to email me the files (sig) which were created around the times of your crashes (or email me them) I can take a look for you.

Would you mind? That would be awesome!

You don't bank with HSBC and have installed their ecommended "Raport" software by chance have you?

No, although I'll steer away from it in future! Thanks for the heads up.

do you have an asus mobo?

I'm using a Gigabyte EX-58-UD5. The BIOS has been updated to version F11 released earlier this year. Could it be to do with that?
 
If you've been tweaking the BIOS, overclocking etc it is possible you have introduced some corruption and may have to reinstall. See if Pho finds anything in the crash dump first though.
 
031510-29702-01.dmp
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [031510-29702-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e52000 PsLoadedModuleList = 0xfffff800`0308fe50
Debug session time: Mon Mar 15 20:09:06.534 2010 (GMT+0)
System Uptime: 0 days 3:51:20.439
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800888d4f8, fffff8800888cd50, fffff880012993aa}

Probably caused by : Ntfs.sys ( Ntfs!NtfsTeardownStructures+1aa )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800888d4f8
Arg3: fffff8800888cd50
Arg4: fffff880012993aa

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800888d4f8 -- (.exr 0xfffff8800888d4f8)
ExceptionAddress: fffff880012993aa (Ntfs!NtfsTeardownStructures+0x00000000000001aa)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800888cd50 -- (.cxr 0xfffff8800888cd50)
rax=00500500000d0316 rbx=fffff8a013419b40 rcx=fffffa800602e800
rdx=fffff8a013419c70 rsi=fffff8800888d7e6 rdi=fffffa800610e080
rip=fffff880012993aa rsp=fffff8800888d730 rbp=fffff8800888da80
 r8=0000000000000000  r9=fffff8a013418f08 r10=fffff8800888d840
r11=fffff8800888d780 r12=0000000000000000 r13=fffff8a013419b60
r14=0000000000000000 r15=3f6e070300000007
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtfsTeardownStructures+0x1aa:
fffff880`012993aa 4c8938          mov     qword ptr [rax],r15 ds:002b:00500500`000d0316=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  ccsvchst.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fa0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsTeardownStructures+1aa
fffff880`012993aa 4c8938          mov     qword ptr [rax],r15

FAULTING_IP: 
Ntfs!NtfsTeardownStructures+1aa
fffff880`012993aa 4c8938          mov     qword ptr [rax],r15

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff88001280c50 to fffff880012993aa

STACK_TEXT:  
fffff880`0888d730 fffff880`01280c50 : fffffa80`0610e080 00000000`00000000 00000000`00000001 fffffa80`0610e000 : Ntfs!NtfsTeardownStructures+0x1aa
fffff880`0888d7b0 fffff880`012d1bbd : fffffa80`0610e080 fffffa80`0602e180 00000000`00120101 00000000`00000000 : Ntfs!NtfsFlushVolume+0x530
fffff880`0888d8e0 fffff880`012d25f0 : fffffa80`0610e080 fffffa80`0aa1cb10 fffffa80`0aa942e0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`0888d9c0 fffff880`0113523f : fffffa80`0aa1ceb0 fffffa80`0aa1cb10 fffffa80`0610e080 fffff880`0888d9e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`0888da30 fffff880`011336df : fffffa80`05ec28e0 00000000`00000001 fffffa80`05ec2800 fffffa80`0aa1cb10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0888dac0 fffff800`031d7929 : 00000000`00000002 fffffa80`0aa942e0 00000000`00000001 fffffa80`0aa1cb10 : fltmgr!FltpDispatch+0xcf
fffff880`0888db20 fffff800`031658ad : fffffa80`0aa1cb10 fffffa80`0a7beb60 fffffa80`0aa942e0 fffff880`02f63180 : nt!IopSynchronousServiceTail+0xf9
fffff880`0888db90 fffff800`02ec3153 : fffffa80`0a7beb60 00000000`7ee6f000 fffffa80`05ec28e0 fffffa80`0aa942e0 : nt!NtFlushBuffersFile+0x171
fffff880`0888dc20 00000000`7795036a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0500e7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7795036a


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsTeardownStructures+1aa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff8800888cd50 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownStructures+1aa

BUCKET_ID:  X64_0x24_Ntfs!NtfsTeardownStructures+1aa

Followup: MachineOwner
---------

Never seen that one before. Try running chkdsk /r on your drive to see if it clears it.


031510-31668-01.dmp:
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [031510-31668-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e0b000 PsLoadedModuleList = 0xfffff800`03048e50
Debug session time: Mon Mar 15 22:14:55.593 2010 (GMT+0)
System Uptime: 0 days 0:19:52.499
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff87f8f0f6b5b, 2, 1, fffff80002e88520}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff87f8f0f6b5b, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e88520, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b30e0
 fffff87f8f0f6b5b 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiRetireDpcList+100
fffff800`02e88520 0f95a3dbf9ff8b  setne   byte ptr [rbx-74000625h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xA

PROCESS_NAME:  LCDMon.exe

TRAP_FRAME:  fffff88003126d70 -- (.trap 0xfffff88003126d70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000004403 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e88520 rsp=fffff88003126f00 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=fffffa80078fbb60
r11=000000000488fed0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl zr na po nc
nt!KiRetireDpcList+0x100:
fffff800`02e88520 0f95a3dbf9ff8b  setne   byte ptr [rbx-74000625h] ds:ffffffff`8bfff9db=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e7c469 to fffff80002e7cf00

STACK_TEXT:  
fffff880`03126c28 fffff800`02e7c469 : 00000000`0000000a fffff87f`8f0f6b5b 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`03126c30 fffff800`02e7b0e0 : 00000000`00000190 fffff880`030f7180 00000000`00000206 fffff800`02ed600f : nt!KiBugCheckDispatch+0x69
fffff880`03126d70 fffff800`02e88520 : fffff880`030f7180 fffff880`00012a96 fffffa80`04e72050 00000000`00000096 : nt!KiPageFault+0x260
fffff880`03126f00 fffff800`02e83065 : 9f359f35`c844c844 fffffa80`078fbb60 00000000`00000000 fffff800`02f9bc80 : nt!KiRetireDpcList+0x100
fffff880`03126fb0 fffff800`02e82e7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`086a0bf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002e88521 - nt!KiRetireDpcList+101
	[ 85:95 ]
1 error : !nt (fffff80002e88521)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------


Looks like it might be from overclocking or incorrect voltages. Are your voltages set-up properly for your memory? (lots of BIOSs don't set them properly)

Have you tried testing your memory, with memtest86+ or the windows one? (no idea how good that is though)
 
Last edited:
Thanks guys (esp. Pho for checking through my dump files!) I'm running chkdsk /r currently.
It claims it has removed 2 index entries and corrected minot file name errors in 3 files! Doesn't seem great! A weird thing though, whilst this check is running my HDD is squeaking!?! Is that a to be expected or is it an issue? It's never sqeaked before! (it's a WD Black 500GB)
I'll run the mem test when the chkdsk has finished, see what that finds. Maybe I'll re-install the BIOS anyway, there's a new version out as of a few days ago that's supposed to do 'increased memory compatibillity' might help my cause.
Why should I get rid of Norton? It hasn't caused me any issues that I'm aware of...
 
Both Norton and McAfee are notorious for bloat factor. Most OcUKers will recommend any of the freebies that begin with an A. Avast!, Avria and AVG. If going for a paid AV, most of us will go with Nod32.
 
I used to use ESET until it became a bit too costly.

Anyway, I did the dskchk and as soon as it re-started after it BSOD :( It then ran start-up repairer and seems to have started up properly now. I have a new mini-dump so would Pho mind having a look at it for me, I'll email it.
 
I used to use ESET until it became a bit too costly.

Anyway, I did the dskchk and as soon as it re-started after it BSOD :( It then ran start-up repairer and seems to have started up properly now. I have a new mini-dump so would Pho mind having a look at it for me, I'll email it.

You could post the minidump here, it's not that difficult to read :)

Have you done a memtest yet?
 
Well, I just downloaded memtest and tried to burn the iso.
And now I have another problem, my optical drive is no longer working and isn't recognized appearing in windows device manager. Any ideas?
Urgh, this is become a bit of a nightmare
 
I did mean to mention about posting the dumps here in the thread when I suggested emailing it to me, however I ended up mentioning email it to me twice :o.

Latest one:
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [031610-25318-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e03000 PsLoadedModuleList = 0xfffff800`03040e50
Debug session time: Tue Mar 16 20:44:30.609 2010 (GMT+0)
System Uptime: 0 days 0:01:09.671
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800802f910, fffffa800802fbf0, fffff8000317d240}

Probably caused by : wininit.exe

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800802f910, Terminating object
Arg3: fffffa800802fbf0, Process image file name
Arg4: fffff8000317d240, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa800802f910

IMAGE_NAME:  wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  wininit.exe

EXCEPTION_CODE: (Win32) 0x5 (5) - Access is denied.

BUGCHECK_STR:  0xF4_5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`029a8b08 fffff800`03200142 : 00000000`000000f4 00000000`00000003 fffffa80`0802f910 fffffa80`0802fbf0 : nt!KeBugCheckEx
fffff880`029a8b10 fffff800`031ac269 : 00000000`00000001 fffffa80`06369310 fffffa80`0802f910 fffffa80`0802f910 : nt!PspCatchCriticalBreak+0x92
fffff880`029a8b50 fffff800`03130c74 : 00000000`00000001 00000000`00000001 fffffa80`0802f910 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x17a06
fffff880`029a8ba0 fffff800`02e74153 : fffffa80`06369310 fffff880`00000005 fffffa80`06369310 00000000`00008000 : nt!NtTerminateProcess+0xf4
fffff880`029a8c20 00000000`7706017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0029f738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7706017a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_5_IMAGE_wininit.exe

BUCKET_ID:  X64_0xF4_5_IMAGE_wininit.exe

Followup: MachineOwner
---------


I don't have a huge amount of time to read over it right now, but I also found mentions of voltages and memory when I Googled it briefly.
 
Well, I just downloaded memtest and tried to burn the iso.
And now I have another problem, my optical drive is no longer working and isn't recognized appearing in windows device manager. Any ideas?
Urgh, this is become a bit of a nightmare

Is it detected in the BIOS? You may have just knocked the cable (if it's SATA some of the cables come out easily). Failing that what about in safe mode?

Also running sfc /scannow may help - it'll check all your Windows files are genuine and will restore them if there's any problems.
 
Back
Top Bottom