Question BSOD for the last two weeks. Ntoskrnl.exe with IRL NOT LESS OR EQUAL all day long.

Status
Not open for further replies.
Mar 31, 2023
5
0
10
Hello, i am writing to anybody who could help me concerning my pc . Since the last 2 weeks i have been experiencing a hell lot of bsod for reason i cannot identify. im gonna explain what i did at this point first:

CPU: I7 9700 GPU: Geforce RTX 2060 RAM: 16gb(2x8) MBD: Predator PO3-600 (i have like 1 ssd for system and 2hdd for games)

So the scenario in wich it bsod most often is when im playing some games and watching a video at the same time, im using this scenario as a test to check if its working again. I have been using BlueScreenViewer and WinDbg to my best despite not being an expert with those. most of the time it just shows "IRQL_NOT_LESS_OR_EQUAL" without anymore info and both BSV and WinDbg cant see any other driver or program as the source of the problem. its just pointing to ntoskrnl.exe everytime

I used Driver Verifier, never returned anything. Im doing Sfc and Dism daily at this point. I already did memtest86, no error showing. my disk are all ok, did chkdsk on all of them. My CPU health is also ok. Im sure the gpu is fine cause i can use it on other pcs without crashes.

here is a drive folder in wich i will put further minidumps when they come in.

thanks for your time already( and sorry for the not really correct english, not my native language)
 

Ralston18

Titan
Moderator
Your English is fine.

PSU: make, model, wattage, age, condition (original to build, new, refurbished, used)?

Look in Reliability History and Event Viewer. Either one or both tools may be capturing some error code, warn ing, or even an informational event just before or at the time of the BSODs.

Reliability History is user friendly and the timeline format can reveal patterns. Look for errors or other changes that started/began during the last two weeks.

You can take a screen shot of Reliability History (expand the window so all can be seen) and post the screenshot here via imgur (www.imgur.com)

Event Viewer requires more time and effort to use and understand.

To help:

http://www.tomshardware.com/faq/id-3128616/windows-event-viewer.html

Take your time with Event Viewer. No need to rush through it all.

Clicking any given error code/entry in either Reliability History or Event Viewer will provide more details about what happened. The details may or may not be helpful.
 
Mar 31, 2023
5
0
10
thanks for the quick response. well my pc juste made like 4 more bsod back to back. The Psu is here, its about 2 years old i would say and was bought for the pc especially. for reliability History we are gonna have a problem, i reinstalled my windows earlier today and like 3 more times before. so i dont have any more than today to show.

For event viewer i have 3 differents warning few times before bsods:

first is the following:
Code:
Log Name:      Application
Source:        Microsoft-Windows-WMI
Date:          3/31/2023 10:56:48 PM
Event ID:      63
Task Category: None
Level:         Warning
Keywords:     
User:          Système
Computer:      DESKTOP-P5CG9JE
Description:
A provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" />
    <EventID>63</EventID>
    <Version>2</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2023-03-31T20:56:48.9924289Z" />
    <EventRecordID>253</EventRecordID>
    <Correlation />
    <Execution ProcessID="2860" ThreadID="2068" />
    <Channel>Application</Channel>
    <Computer>DESKTOP-P5CG9JE</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <data_0x8000003F xmlns="http://manifests.microsoft.com/win/2006/windows/WMI">
      <Provider>IntelMEProv</Provider>
      <Namespace>root\Intel_ME</Namespace>
    </data_0x8000003F>
  </UserData>
</Event>

then right before :

Code:
Log Name:      System
Source:        Netwtw08
Date:          3/31/2023 10:56:51 PM
Event ID:      6062
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-P5CG9JE
Description:
6062 - Lso was triggered
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Netwtw08" />
    <EventID Qualifiers="32768">6062</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2023-03-31T20:56:51.6821734Z" />
    <EventRecordID>441</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="444" />
    <Channel>System</Channel>
    <Computer>DESKTOP-P5CG9JE</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NDMP1</Data>
    <Data>Intel(R) Wireless-AC 9462</Data>
    <Binary>000000000200300000000000AE170080000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

and the final one :

Code:
Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          3/31/2023 10:56:48 PM
Event ID:      10016
Task Category: None
Level:         Warning
Keywords:      Classic
User:          SERVICE LOCAL
Computer:      DESKTOP-P5CG9JE
Description:
The propres à l’application permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user AUTORITE NT\SERVICE LOCAL SID (S-1-5-19) from address LocalHost (avec LRPC) running in the application container Non disponible SID (Non disponible). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2023-03-31T20:56:48.3392074Z" />
    <EventRecordID>436</EventRecordID>
    <Correlation ActivityID="{998c6e6f-c5f3-4dfe-aaef-f459f71d065a}" />
    <Execution ProcessID="516" ThreadID="1940" />
    <Channel>System</Channel>
    <Computer>DESKTOP-P5CG9JE</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="param1">propres à l’application</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}</Data>
    <Data Name="param5">{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}</Data>
    <Data Name="param6">AUTORITE NT</Data>
    <Data Name="param7">SERVICE LOCAL</Data>
    <Data Name="param8">S-1-5-19</Data>
    <Data Name="param9">LocalHost (avec LRPC)</Data>
    <Data Name="param10">Non disponible</Data>
    <Data Name="param11">Non disponible</Data>
  </EventData>
</Event>

they come back a few times around and are the important ones marked in the system category. let me know if i need to look for specific warnings messages types.
thanks again
 
I suspect that your 500w psu is insufficient to handle gpu peak demands.
That would on occasion give you your symptoms.
See if you can't borrow and try a higher wattage quality power supply.
If you decide to buy a replacement psu, buy a much larger one, in the 750/850w range. A psu will only use the power demanded of it regardless of the max capability.
There is usually minimal price difference between 650/750/850w units.
For good quality, nothing less than a 7 year warranty.
 
the problems below will help fix your machine but do not directly explain the cause of your 2 bugchecks. You should try fixing the problems below, delete your current minidumps. Then provide new ones if you continue to get a bugcheck.

=============
not sure what bertreader.sys is for
========

bugcheck show that the system got an error 0xc0000096
attempt to run a privileged instruction.
========
3 of your windows core files have been modified.

you will want to do the following:
turn off your system virtual memory and turn it back on again to delete the pagefile.sys

start cmd.exe as an admin then run
dism.exe /online /cleanup-image /restorehealth

and reboot.
this should fix the files and pagefile.sys but does not address why the files were modified.

you might consider googling how to make windows delete the pagefile.sys on system shutdown. make the registry change and
do a shutdown more often until the system is stable.

this should fix the 3 files in the pagefile.sys image
==================
now you need to fix or figure out how the files got modified:
your bios is dated 4/2020 you need to apply bios updates and driver updates for your machine: acer predator po3-600
you will need to apply intel ME firmware updates for security reasons.
=============

you also have some old drivers installed:
rt640x64.sys network driver, (old version had a memory leak)
try the windows 10 ndis install version directly from the chip vendor:Realtek PCIe FE / GBE / 2.5G / Gaming Ethernet Family Controller Software - REALTEK
(most likely you are not even using this wired adapter but you should update the driver anyway)

you are running a driver mbfilt64.sys from 2018
Audio Driver from Creative Technology. I would remove it and install the latest version you can get. (for your sound card)
---------------------
you have some microsoft generic intel drivers installed.
you might want to see if intel downloader has a update for them:
Download Intel Drivers and Software
note: it should update
Intel(R) Wireless-AC 9462

------------
this bug check can be associated with power or heat related problems BUT when I see modified windows core files I tend to try to repair the files and dump any malware from the pagefile.sys before looking for overheated cpu or power problems. (deleting the pagefile, and repair of the window files is fast an free)
windows power management updates could be having problems with the old bios version and old intel drivers.
this could cause overheating issues
 
Last edited:
Mar 31, 2023
5
0
10
i manage to borrow a bigger psu. it did well under a stress test. so yeah i guess here is my problem. thanks to all of you for you time, really
 
Status
Not open for further replies.