• Happy holidays, folks! Thanks to each and every one of you for being part of the Tom's Hardware community!

Blue Screen on Windows 8.1 mostly IRQL_NOT_LESS_OR_EQUAL

ErikCJ

Reputable
Jun 12, 2015
36
0
4,530
Hi everyone, I'm new here and I don't know where to post, so I post this thread under Windows 8, but maybe it should be under Drivers/Motherboard. So I'm getting frustrated with blue screens that are occurring on my computer and it seems I ran out of solutions or maybe I'm not such an expert to solve it. So let's better describe my problem. Blue screens happen randomly, it could be 5 mins after startup, it could be 8 hours or more(record was 3 days). Blue screens have many different bug checks, most of them are IRQL_NOT_LESS_OR_EQUAL. How it all started - my old motherboard died, computer didn't boot, no beep sounds after breadboarding and no beeps after removing all devices from motherboard, so I bought new one and new processor, all other hardware I didn't change I just adjusted motherboard to it. After installing new motherboard the problems occurred. I tried many solutions, one of them was Memtest x86 and I tried to find some errors on RAM, but there were none. I did this 3 times and ran through all passes with 0 errors. Then I tired driver verifier and found that drivers from Saitek(I'm using RAT 7 mouse) were causing blue screens on startup so I thought maybe this was the problem. I uninstalled the drivers and removed mouse, plugged in another wireless mouse and waited if the blue screen would occur and it did later on. Now I'm using it back and I'm certain that mouse is the part of the problem and maybe there are more devices causing BSOD. I used bluescreenviewer to see what service/program crashed and it was mainly ntoskrnl.exe. I then updated drivers for Intel network adapter, graphics, downloaded all drivers from official site of motherboard and updated Saitek drivers and still no luck. I also noticed something strange, my computer needs a long time to POST and the beep sometimes occurs after 20 seconds. I didn't have any other PSU to try if that's the problem, and the old PSU is 5-6 years old. I also tried solution posted on this forum which is focused on IRQL_NOT_LESS_OR_EQUAL and I didn't work, I also used many cleaners so I lost many dump files, but I still have more recent ones. The problem still persist if I format computer, so my closest bet is that the new motherboard is not working properly or maybe it's the PSU, but I doubt it. I also tried running in safe mode and had no bluescreens which indicates that there's maybe driver problem, I don't know anymore what it could be. I would be gratefully thankful if someone would take some time and tried to solve my problem.

My rig:
Motherboard: Gigabyte GA-H97-D3H (new)
Processor: Intel Xeon E3 1231 v3 (new)
Graphics: AMD Radeon 7970
Ram: DDR3 1333 MHz
SSD: Crucial BX100 250 GB
PSU: Chieftec APS-650C

So yeah maybe I forgot something, just ask me and if you have any solutions I'll gladly try them out, otherwise I'm thinking of returning motherboard and processor, maybe it's something wrong with new hardware.
Here are also dump files from blue screens:
Dump files
 
Solution
generally, audio driver conflicts are in the DMA channel used. Two or more audio devices using the same DMA channel.
in my experience people often have audio sources on their machine that don't actually have speakers connected to them and they don't realize that the system still sends signals to the device. You might look in your windows control panel hardware for devices like your video card that have High definition sound support and disable them if you don't get sound to your speakers in your monitor VIA a displayport or HDMI port. (just disable the driver in control panel, if you remove it it will be reinstalled by plug and play if you don't use the motherboard sound you and disable it in BIOS and the driver should not load in...
suspect drivers:
\SystemRoot\system32\DRIVERS\SaiK0BD0.sys Wed Jul 07 09:44:59 2010
\SystemRoot\System32\drivers\SaiU0BD0.sys Wed Jul 07 09:44:55 2010

guessing they are some http://www.saitek.com/uk/down/drivers.php
usb driver that should be updated or removed.
usb device drivers built in 2012 and earlier don't work well with updated (post 2013) builds of windows and BIOS versions.

I could tell you the problem but I would have to have a kernel memory dump to debug USB problems and have you run verifier flags to find USB problems that corrupt other device drivers memory.

I would just remove the drivers and only debug if you can not get rid of the problem.

Note: I looked a 3 more of your bugchecks, looks like a driver is modifing other drivers data and causing the second driver to fail when it accesses the its data (and it has been changed)

if it is not the saitek driver or if you want to prove that it is.
then run cmd.exe as an admin then run
verifier.exe /standard /all
then change your memory dump type to kernel and reboot your machine.
https://www.sophos.com/en-us/support/knowledgebase/111474.aspx

the veifier will force windows to check drivers for common bugs and will bugcheck and name the bad driver if it is found.

the kernel memory dump will contain the driver name and info about the failure. it will be located at
c:\windows\memory.dmp
(different locataion and name than a mini memory dump, and the file is much larger because it contains the internal error logs and info about all of the drivers running on your system)

you might also run cmd.exe as an admin then run
dism.exe /online /cleanup-image /restorehealth
just to confirm malware has not modified your system binaries.
 


Thanks for replying, I did as you asked and here are two memory.dmp files, one is from driver verifier as you wanted to and the other one was again another random as always. I'll post both.

Driver Verifier Dump
Normal Blue Screen Dump

I also tried checking for changed files and it returns me this error code: 0x800f0906
Here's the log: dism.log



 
\SystemRoot\System32\drivers\SaiMini.sys
Timestamp: Tue Apr 16 10:17:23 2013
CompanyName: Saitek
ProductName: Configuration Software
InternalName: SaiMini.sys

this driver was completing request that don't belong to it. It should pass the request to the next driver in the chain.

looked like it caused other drivers not to get a response to their requests.

-I would remove all of the saitek drivers or look for updates if you must have them installed.
it looks like you have a saitek mouse, keyboard and keyboard hotkey driver so I expect you will still want them unless you have another set.

i looked at the internal logs for the saitek devices, only one had log entries and that was for
SaitekMagicBus\SaitekKeyboard it was returning (STATUS_NOT_SUPPORTED) error to other drivers.

I would update that driver first. or remove the other drivers and reinstall them so they get first chance at processing the data on your usb ports.

you might also be able to set your system to high performance mode on the assumption that the system is telling the driver to go to a low power state and the driver is trying to tell the system it can not do that. (invalid request) But just better to get a updated fixed driver.

check here for and enter your keyboard model/name and see if there is a update.
http://www.saitek.com/uk/down/drivers.php

note: looks like the two older drivers were removed ok,




 


So now I removed Saitek drivers and downloaded new ones. I prevented Windows from downloading new drivers and installed drivers that I downloaded. I must also tell you that I have tried removing drivers before and I even remove the mouse from computer and used another mouse and still got blue screen. Anyway should I remove all drivers that came with motherboard and do the same like I did with Saitek drivers? I did update them before, but I think I didn't delete them before updating.
 
- usb drivers have issues when your remove them, often they are not actually removed, just marked as hidden.
(you have have device manager display hidden devices and they show up again)
-you have to turn off the windows plug and play service or it just installs the drivers a few seconds after you uninstall them.
if you just delete the drivers the drivers are restored by the hidden driverstore when you reboot.

best to remove the entire package from the driverstore using the pnpnutil.exe command.
take a look at this:https://technet.microsoft.com/en-us/library/cc730875.aspx

you would then reboot and confirm they are removed, run cmd.exe as an admin then run
driverquery.exe /v > out.txt
notepad.exe out.txt
and look at the list and confirm the driver is not in the list.




 


So I should do this to Saitek drivers or any other particular drivers, maybe both? I checked CD that I got with motherboard and the only driver that mentions USB is INF Update Utility which are chipset drivers I believe.
 
I removed Saitek drivers, deleted them from driverstore and waited to see what would happen. I also disconnected Saitek mouse. And although I didn't yet have blue screen, my compter shut down without any warning, It just reset without bluescreen. I'm guessing something is wrong with hardware and not drivers.
 
I don't want to be annoying, but could anyone help? I'm really frustrated with this computer. I tried playing some games and sometimes my computer sometimes just freezes or resets itself. I once also got PAGE_FAULT_IN_NONPAGED_AREA blue screen and that was 3 days ago. I also deleted Saitek drivers that caused IRQL_NOT_LESS_OR_EQUAL bsod. What could it be? I'm still thinking it's hardware related. Could be that the new mobo is faulty? Or dying PSU? Any ideas?

Here's the link to the dump file of last BSOD: Dump file
 
I would also run cmd.exe as an admin and run
sfc.exe /scannow
(and confirm all errors are fixed)
if there are errors run
dism.exe /online /cleanup-image /restorehealth

(there was a bad link in a filter driver)
-----
I looked at the memory dump, they system looked pretty good, it was up for 16 hours and basically a bunch of the video memory was tied up by the system.
I would suspect that the raptor program or one of the graphic program is holding the memory until the program actually exits. Sorry if this is not too helpful
-----------
system failed in because of a video problem. (lots of memory being used by the AMD video driver and windows directx subsystem.
Looks like you have several graphics (game) apps in memory and I would suspect they are still holding memory until they actually exit.

bunch of raptor programs, age3.exe, csgo.exe. you might use task manager and kill the programs and see if your video resources are restored.
Most likely I would suspect a bug in the raptor program as the cause of the failure.

----------
you might want to confirm you have your graphics drivers installed correctly(correct versions) I was not sure because when I looked up your machine, I could not tell what your GPU was for some reason. (I might have hit the wrong motherboard version)

here are the drivers that are installed:
\SystemRoot\system32\drivers\AMDACPKSL.SYS Sat Dec 20 19:38:02 2014 (5496409A)
\SystemRoot\System32\drivers\amdkmpfd.sys Mon Oct 27 16:26:38 2014 (544ED4AE)
\SystemRoot\system32\drivers\AtihdWB6.sys Sat Dec 20 19:38:19 2014 (549640AB)
\SystemRoot\system32\DRIVERS\atikmdag.sys Tue Mar 31 13:31:21 2015 (551B0419)
\SystemRoot\system32\DRIVERS\atikmpag.sys Tue Mar 31 13:09:30 2015 (551AFEFA)

two distinct driver dates, might be two different builds. You might want to check:
http://support.amd.com/en-us/download
---------

you have some type of logitech inc device that is being sent invaild commands:
you might need to update a device driver for it.
the device looks like it is attached to a usb port:
USB\VID_046D&PID_C316&MI_01\6&2afb0272&0&0001
( I would guess it is a logitech mouse? or maybe the keyboard, look for a driver update)









-------------
looks like you have a saitek service trying to run on your machine, with a driver failing to load:
4: kd> !devnode ffffe00087672d30
DevNode 0xffffe00087672d30 for PDO 0xffffe000876dae50
Parent 0xffffe000876e0d30 Sibling 0xffffe00087762d30 Child 0000000000
InstancePath is "ROOT\PROGRAMMING_SUPPORT\0000"
ServiceName is "SaiNtBus"


you should go into control panel, find the services and disable the one with the service name listed above.



machine info:
CPU:Intel(R) Xeon(R) CPU E3-1231 v3 @ 3.40GHz
released: Q2'14 BIOS installed 06/26/2014
Manufacturer Gigabyte Technology Co., Ltd.
Product H97-D3H-CF

you might want to pick up the current version:
http://www.gigabyte.com/products/product-page.aspx?pid=4962#bios

-------------
4: kd> !poolused /t10 4
........
Sorting by Paged Pool Consumed

NonPaged Paged
Tag Allocs Used Allocs Used

CM31 0 0 18013 80011264 Internal Configuration manager allocations , Binary: nt!cm
MmSt 0 0 8721 38741312 Mm section object prototype ptes , Binary: nt!mm
MmRe 0 0 1683 16773456 ASLR relocation blocks , Binary: nt!mm
CM25 0 0 2875 12365824 Internal Configuration manager allocations , Binary: nt!cm
Ntff 19 6080 5929 7683984 FCB_DATA , Binary: ntfs.sys
FMfn 4 1216 18183 7588544 NAME_CACHE_NODE structure , Binary: fltmgr.sys
ViMm 4931 4449168 10822 4935296 Video memory manager , Binary: dxgkrnl.sys
MINI 2345 1539008 2020 4378032 UNKNOWN pooltag 'MINI', please update pooltag.txt
NtfF 0 0 2193 3228096 FCB_INDEX , Binary: ntfs.sys
Toke 0 0 1523 3222816 Token objects , Binary: nt!se
ClfI 0 0 29 2612512 CLFS Log marshal buffer lookaside list , Binary: clfs.sys
CMAl 0 0 480 1966080 internal registry memory allocator pool tag , Binary: nt!cm
MPsc 0 0 5211 1917648 UNKNOWN pooltag 'MPsc', please update pooltag.txt
DAL2 9 3120 1448 1848000 UNKNOWN pooltag 'DAL2', please update pooltag.txt
MiCf 0 0 1156 1667232 UNKNOWN pooltag 'MiCf', please update pooltag.txt
MZ.k 1 102400 2 1572864 UNKNOWN pooltag 'MZ.k', please update pooltag.txt

TOTAL 137778 107596288 210825 218451504
4: kd> !poolused /t10 3
........
Sorting by NonPaged Pool Consumed

NonPaged Paged
Tag Allocs Frees Diff Used Allocs Frees Diff Used

ismc 2 0 2 34910208 0 0 0 0 UNKNOWN pooltag 'ismc', please update pooltag.txt
ViMm 1121334 1116403 4931 4449168 1432569 1421747 10822 4935296 Video memory manager , Binary: dxgkrnl.sys
File 2488891 2478501 10390 3468384 0 0 0 0 File objects
ConT 410 132 278 3289088 0 0 0 0 UNKNOWN pooltag 'ConT', please update pooltag.txt
EtwB 313 189 124 3166240 4 0 4 262144 Etw Buffer , Binary: nt!etw
Ntfx 66177 57989 8188 2753104 0 0 0 0 General Allocation , Binary: ntfs.sys
FMsl 55000 47023 7977 2297376 0 0 0 0 STREAM_LIST_CTRL structure , Binary: fltmgr.sys
Thre 33186 32073 1113 2291760 0 0 0 0 Thread objects , Binary: nt!ps
FMsc 10720 8257 2463 2246256 0 0 0 0 SECTION_CONTEXT structure , Binary: fltmgr.sys
MmCa 115326 108766 6560 2079840 0 0 0 0 Mm control areas for mapped files , Binary: nt!mm
dump 2 0 2 2007248 0 0 0 0 UNKNOWN pooltag 'dump', please update pooltag.txt
pool 14 0 14 1989296 0 0 0 0 UNKNOWN pooltag 'pool', please update pooltag.txt
VoSm 95 63 32 1905504 0 0 0 0 Bitmap allocations , Binary: volsnap.sys
MmPb 2 0 2 1769472 0 0 0 0 Paging file bitmaps , Binary: nt!mm
Pool 18 11 7 1750592 0 0 0 0 Pool tables, etc.
smNp 3897 3482 415 1699840 0 0 0 0 ReadyBoost store node pool allocations , Binary: nt!store or rdyboost.sys

TOTAL 65044486 64906708 137778 107596288 40159426 39948601 210825 218451504

 
Sorry for my late reply I was on holidays and was busy. I tried all you said and still I'm getting blue screens and it isn't just IRQL_NOT_LESS_OR_EQUAL. I tried solving this problem by removing components, so far I removed GPU and had no luck - still recieved blue screens. Now I replaced my SSD with HDD in case that's the problem. I installed Windows 8.1 x64 on HDD but I didn't install anything else (no drivers, no programs). After a while I recieved BSOD with bugcheck: SYSTEM_SERVICE_EXCEPTION win32K.sys. Here is the dump file: MEMORY.DMP. I didn't turn on Kernel dump yet because I thought there won't be any blue screens until I install drivers or something. I had this blue screen before I formated and reinstalled Windows on HDD so this problem is from before. Now if anyone knows what is wrong I would gladly appreciate it because I'm hopeless and I don't know what to do anymore. Should I return motherboard and processor that I bought just in case they are faulty? RAM didn't return errors on multiple passes while testing it on Memtest. I also didn't try to replace PSU yet and my computer sometimes restarts without BSOD which could lead to bad PSU I guess. I know I'm maybe fustrating you guys because this is taking so long but I don't know where to look for the answers. I hope we could solve this together.
 
your copy of the file win32k.sys is corrupted in memory.
240 errors : win32k (fffff960001f1eff-fffff960001f1fff)
2: kd> lmvm win32k
start end module name
fffff960`0018c000 fffff960`005a5000 win32k (pdb symbols) C:\debug\Debuggers\x64\sym\win32k.pdb\9DB5E5D90DEC4452B8616B35764024112\win32k.pdb
Loaded symbol image file: win32k.sys
Mapped memory image file: C:\debug\Debuggers\x64\sym\win32k.sys\5215F86B419000\win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Timestamp: Thu Aug 22 04:39:23 2013 (5215F86B)
CheckSum: 003FF83F
ImageSize: 00419000
File version: 6.3.9600.16384
Product version: 6.3.9600.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: win32k.sys
OriginalFilename: win32k.sys
ProductVersion: 6.3.9600.16384
FileVersion: 6.3.9600.16384 (winblue_rtm.130821-1623)
FileDescription: Multi-User Win32 Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.


this caused the bugcheck.

run cmd.exe as an admin then run
sfc.exe /scannow
then run
dism.exe /online /cleanup-image /restorehealth

reboot and run the system file checker command again to confirm the fixes remain.

Note: this file is a common target for malware/virus and you should run malwarebytes and look for the cause of the corruption.
Note: you also have a Intel(R) Xeon(R) CPU E3-1231 v3 that was released 2Q of 2014 you might want to go to the intel website and pickup the current CPU chipset drivers, these will contain bugfixes for problems in the CPU, these fixes patch the microcode in the BIOS and are loaded via this file:
\SystemRoot\system32\mcupdate_GenuineIntel.dll Thu Aug 22 04:40:16 2013
notice the date, you have the default version that existed before your CPU was released. This is just a guess I have not looked at the known error lists for the CPU.
note: also is a BIOS update dated for april 2015 to support new 5th gen intel cpus (might be microcode updates in BIOS)
http://www.gigabyte.com/products/product-page.aspx?pid=4962#bios
 
Alright I'll do that and then report back but first I gotta do something so I'll be AFK for 1 hour. Now before I go how do I check for malware/viruses? With windows defender? And could it be already hacked infected after installing Windows 8.1 like 4 hours ago? And could this BSOD be caused by hardware? Thanks for reply.
 
It seems there were some errors and I used both sfc.exe /scannow and dism.exe /online /cleanup-image /restorehealth to fix them so image is now healthy I guess. I also updated chipset drivers that were provided on motherboard's official site. I still haven't updated BIOS because I have never done this before and people say it can go really wrong.
 
download and run the free version of malwarebytes.

if you now have windows 8, you can run cmd.exe as an admin, then run
dism.exe /online /cleanup-image /restorehealth

this will go to a trusted location on the internet and replace any corrupted files. (gets the files from the microsoft update servers i think). On windows 7 the sfc.exe command just tries to restore from the hidden driver store. Malware and hacking tools tends to modify both copies.

yes, can have hardware bugs that will show the same problem. Generally you tend to get different bugchecks on each boot of the system. This is caused because windows attempt to load the drivers in different orders on each boot, if there is a hardware problem then different drivers fail on each boot.
The driver that failed handles the interface to any apps on your system and is a target for corruption by malware, virus programs and rootkits.

if you update your BIOS, run memtest86 and confirm your memory timings are good. If you get failures with memtest then at least you know that windows drivers are not the cause. Memtest86 boots off its own boot image independent of windows.



 
Like I said dism.exe has fixed errors. Now I've run Malwarebytes and got 0 threats. And about BIOS, I'll see what can I do, I've never updated BIOS in my life so if I screw anything up then the mobo is done for.
 
BIOS updates on newer boards are pretty painless now. You should not have a problem and you will be surprised on how easy it is gotten. Vendors often have to replace motherboards that failed BIOS updates so the process is much better now.


 
After running my computer and waiting for any changes, I got one blue screen: LINK I wasn't at home at the time so when I came back I saw that I had a blue screen. So I logged on and another one happened: LINK So first blue screen that happened is minidump, because I didn't save it and computer overwrote it. I only have installed drivers for chipset at the moment. We also repaired Windows image. I didn't yet update BIOS, but I did check since when is my processor supported and on the official site it says since update F3 and I have F5. Should I still update BIOS? It's only for new 5th generation of processors.
 
Also, the debugger does not like your copy of win32k.sys
(you might want to make sure it has not been modified)

yes update the BIOS.
the memory dump shows a problem with the intel processor driver
\SystemRoot\System32\drivers\intelppm.sys
Timestamp: Thu Aug 22 01:46:35 2013

intelppm.sys ( intelppm!PerfSelectionPTStates+8d )

I would think it would be a BIOS problem or you need to update the CPU chipset drivers.

update the drivers from gigabyte http://www.gigabyte.com/products/product-page.aspx?pid=4962#
and update the BIOS. to get support for your newer chip. the date on your bios is about the same time as the CPU was released from intel, Good chance you need the BIOS update to get microcode changes.



 
I already updated chipset drivers. I'll see what can I do with BIOS, but on the support list it says that my processor is compatibile since F3 BIOS update and I have F5 BIOS update. I have Xeon E3-1231 V3 processor if you want to check the support list. You sure that it could be BIOS problem?

Note: I already ran sfc.exe /scannow and dism.exe /online /cleanup-image /restorehealth so how could win32k.sys be modified? It came with no errors.
Note: I don't have any other drivers installed just chipset drivers.
 
most likely the bios has a incorrect setting that it causing your CPU problems. the version is compatible but what happens is bugs. The BIOS settings get tuned as bugs are reported. And check the updates, the updated drivers for the motherboard just came out, they are dated june of 2015, while the driver you have installed is dated in 2013.

you could also go into your bios and start disabling functions but I would not do that if I did not have to.
It can also be a bug in the electronics of the CPU but you have to go to intel and read about the known bugs, and they will be fixed via microcode updates in the CPU chipset drivers and as BIOS patches.




 
the function that got the bad memory address was
!PerfSelectionPTStates

I am not sure what it does. performance selection of processor Timing states ?
the processor sets voltages according to the clock rate that the processor is running at. So disable BIOS functions related to changes in the processor clock rate. IE disable intel speed step and sleeping functions in BIOS (maybe)

the BIOS keeps a table of correct voltages and CPU clock frequencies this is the table that the motherboard vendor would tweak when they do BIOS updates. If you don't update the BIOS you should still reset it to defaults if changes have been made.

here is info on your CPU:
http://ark.intel.com/products/80910/Intel-Xeon-Processor-E3-1231-v3-8M-Cache-3_40-GHz
you might disable Enhanced Intel SpeedStep® Technology in BIOS.



 
I now disabled EIST in BIOS. Now we shall wait I guess. There are still many other options for power but for now I don't want to bother with them or?

Update: I now updated BIOS to verison F6.
 
Alright now we are making some progress. I haven't recieved BSOD in 3 and a half days and computer was running 8 hours per day. But there is a twist. Right now I got HDD plugged in and on it a have recently installed Windows 8.1 x64 as I have mentioned this before. I have only chipset drivers updated to the latest. Other drivers aren't updated (audio, video card, network adapter,...) but I did install some Windows updates and it's working fine like I said no BSOD and I guess BIOS update did fix some issues. BUT if I go to my standard setup (SSD, Saitek mouse plugged in,..) as I had always I still recieve bluescreen or random restart without BSOD. Now I know I could be mouse and I still haven't formated SSD, because I wanna make sure that computer will run on HDD with all drivers updated and no blue screens and now I'm gonna update driver per day so that I could see if drivers are doing something wrong. But if all drivers are updated and I won't get any more blue screens, then it's probably Saitek mouse or SSD (I'll update firmware for it when I'll reinstall Windows) I presume. This is just a report to let you know what's happening.