Constant BSOD on windows 10

Toggle sidebar Toggle sidebar
S

Shauqat

Commendable
Jul 24, 2016
17
0
1,520
Hello i have been getting alot of BSOD and the recent error being something along the lines of irql_not_less_or_equal

i have had many other BSOD error messages before this such as watchdog time out, dpc violation, memory management...

i have a fresh install of windows 10 on my machine and constantly getting the irql_not_less_or_equal bsod error message. completely new install of windows 10 as i thought i maybe having driver issues etc... but its not the case as i fix one bsod error i get another one.

i uploaded the dump file and got the following results which i dont know how to solve:

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.162.amd64fre.th2_release_sec.160223-1728
Machine Name:
Kernel base = 0xfffff801`bca73000 PsLoadedModuleList = 0xfffff801`bcd51cd0
Debug session time: Sun Jul 24 10:48:45.127 2016 (UTC - 4:00)
System Uptime: 0 days 0:01:45.762
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff67e6080c278, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff801bcabe447, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffff67e6080c278

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiDeleteVirtualAddresses+347
fffff801`bcabe447 488b09 mov rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: backgroundTask

TRAP_FRAME: ffffd001477351b0 -- (.trap 0xffffd001477351b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000fe5 rbx=0000000000000000 rcx=fffff67e6080c278
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801bcabe447 rsp=ffffd00147735340 rbp=ffffd00147735440
r8=0000000000000fe5 r9=00007ff81f6c0001 r10=0000ffffffffffff
r11=fffff58010804000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiDeleteVirtualAddresses+0x347:
fffff801`bcabe447 488b09 mov rcx,qword ptr [rcx] ds:fffff67e`6080c278=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff801bcbc02e9 to fffff801bcbb5760

STACK_TEXT:
ffffd001`47735068 fffff801`bcbc02e9 : 00000000`0000000a fffff67e`6080c278 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd001`47735070 fffff801`bcbbeac7 : 00000000`00000000 0000000f`ffffffff 00000000`00000000 fffff801`bca9ead6 : nt!KiBugCheckDispatch+0x69
ffffd001`477351b0 fffff801`bcabe447 : fffff6bf`fc0fb8d0 ffffe000`b16cf080 ffffe000`b16cf080 fffff6bf`fc0ec928 : nt!KiPageFault+0x247
ffffd001`47735340 fffff801`bcaa5654 : 00000000`00000000 ffffd001`47735609 00000000`00000000 00007ff8`20646156 : nt!MiDeleteVirtualAddresses+0x347
ffffd001`47735540 fffff801`bcea5c02 : fffff801`00000000 ffffe000`ad4a9270 ffffe000`b0a14080 ffffe000`b16cf080 : nt!MiDeleteVad+0x4b4
ffffd001`47735670 fffff801`bcea5a62 : 00000000`00040000 ffffe000`b0a14080 00000000`00000001 ffffe000`b16cf080 : nt!MmCleanProcessAddressSpace+0xea
ffffd001`477356d0 fffff801`bce3d19b : ffffe000`b16cf080 ffffc000`4a778060 ffffd001`477357c0 ffffe000`b0a14080 : nt!PspRundownSingleProcess+0x1be
ffffd001`47735750 fffff801`bceecc16 : ffffd001`00000001 ffffe000`b0a14080 ffffd001`47735b00 ffffe000`b0a14128 : nt!PspExitThread+0x4f7
ffffd001`47735890 fffff801`bcaece22 : 00000000`00000000 fffff801`bcd87b48 00000000`45d1f100 ffffe000`00000000 : nt!KiSchedulerApcTerminate+0x2e
ffffd001`477358c0 fffff801`bcbb8af0 : 00000000`00000002 00000000`00000002 00000000`000001ec 00000000`00000000 : nt!KiDeliverApc+0x2f2
ffffd001`47735950 fffff801`bcbc004a : 00000057`df8bf300 00000000`00000000 ffffe000`b0a14080 00000057`df8bf128 : nt!KiInitiateUserApc+0x70
ffffd001`47735a90 00007ff8`1fce5c24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000057`df8bf108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff8`1fce5c24


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeleteVirtualAddresses+347
fffff801`bcabe447 488b09 mov rcx,qword ptr [rcx]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!MiDeleteVirtualAddresses+347

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 56cd4410

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_AV_nt!MiDeleteVirtualAddresses+347

BUCKET_ID: X64_AV_nt!MiDeleteVirtualAddresses+347
 
Solution
S
MAJOR UPDATE:

increased the voltage to 1.307 from the auto assigned one of 1.246 and manage to stress load all the cpus at 100% with out getting a BSOD(temps were around 70 degrees which i think is fine with that load and temps on idle is around 35). hopefully this also helps others getting BSOD.

will update if i get BSOD hopefully not!!

update: i think i fixed my issue by upping the voltage, been a day now and no BSOD!!

thanks for your help johnbl!
Sort by date Sort by votes
the memory address looked ok, (not obviously corrupted)
I would update the the storage drivers (from the motherboard vendor)(****most likely fix***)
- you might run crystaldiskinfo.exe and look at the SMART errors for your drive.
you might turn off the systems virtual memory to delete the c:\pagefile.sys and turn it back on to make a new pagefile.
(make sure there is plenty of space on the drive)

you might consider putting the hard drive data cable on a different sata port.
- remove any overclocking in case you are getting memory errors related to overclocking
(run memtest to confirm your memory is ok)

other than than I would have to look at the actual memory dump file located at c:\windows\minidump directory. You would have to put it on a server, share it as public and post a link.



 
Upvote 0 Downvote


Thank you for your response,

i tried everything you said.

updatd the storage drivers from my vendors website (gigabyte for my z97x gaming 7 motherboard), no fix, still kept getting the error.

ran crystaldiskinfo.exe all hard drives check out fine with no errors and healths status was green.

turned of the systems virtual memory and on to no avail as i got the BSOD.

switched around the cables for the hard drives to no avail.

ran memtest with no errors. (took a long time hence the slow reply).


heres the shared link to my dump file.

https://1drv.ms/f/s!Aki9KSSDY3aIhBtEFF-To4yJfpKA

thanks in advance for taking your time to respond

 
Upvote 0 Downvote
change the memory dump type to kernel memory dump
https://community.sophos.com/kb/en-US/111474

this will store the memory dump as C:\windows\memory.dmp and it will save extra debug info the next time the system bugchecks.

run verifier: it will make it easier to find problems in the memory dump.

start cmd.exe as an admin then run
verifier.exe /standard /all

note after you test be sure to turn verifier off by running
verifier.exe /reset

also be sure you know how to get into safe mode, if your sysemt bugchecks during the next boot. Ie you might have to turn off verifier to boot up.

put the next bughceck on a server and post a link. the file will be c:\windows\memory.dmp



-------------
you only have two suspect drivers from Samsung Kies
ssudbus.sys Thu Apr 21 22:09:54 2016
ssudmdm.sys Thu Apr 21 22:09:57 2016
(you might remove the software until you figure out this problem)
(you might also go into bios and reset it to default and reconfigure it. it will make the bios rescan the hardware and assign resources again)

i don't see how it would cause this error though.
bugcheck was a CPU internal cache error.
 
Upvote 0 Downvote


Hello john,

did what you recommended, would have done it sooner but constantly kept crashing... the upload of the memory dump file was taking too long and couldnt out last the BSOD coming in, so had to go in to safe mode...put it on usb and then upload to it one drive(on my laptop). the file is around 1.1gb i dont know if this normal or not.

heres the link:
https://1drv.ms/u/s!Aki9KSSDY3aIhDHkm1pLniqL2H5u


thanks
 
Upvote 0 Downvote
does anyone have any other sort of advice i could use? it happens soo often and makes my computer unsable. could it be a hardware issue, if so how do i find out which hardware is causing it? since i have tried to unplug the hard drives one by one and installing os on each one... taking out each ram piece one by one. i have also unplugged the gpu completely and installed an os without it but it has not fixed the issue. could there be something wrong with the cpu or motherboard?
 
Upvote 0 Downvote
looks like your motherboard also updated the various drivers just after windows 10 shipped, you have the older windows 10 generic drivers currently installed. you should install the ones for your motherboard.
---------
your killer ethernet driver is older than the one provided on the motherboard vendors website.
you might update it or get it from http://www.killernetworking.com/product-support/driver-downloads

a bug in the ethernet driver could cause the malwarebytes driver to have problems
http://www.gigabyte.com/products/product-page.aspx?pid=4959#driver
bigfoot lan driver is dated 2016/03/22
your version is dated Jan 26 15:58:16 2016
---------

for some reason the debugger thinks you are running your system with out a pagefile.sys
is this correct? if you do this the system will set aside part of your RAM for paging operations.
the system reports you are about out of nonpage pool (limited memory area set aside for drivers to use)

looks like storport.sys is using a lot of your non paged pool.
tag = RaME – storport.sys – RiAllocateMiniportDeviceExtension




--------------
all of your CPU cores were running some filter. I think it would be MBAMProtector
I have heard that some rootkits will fake a bugcheck 0x124 to avoid detection. It is strange that all of the cores were running the filter at the same time.

I would run a rootkit detector
tdsskiller see if you've got a rootkit http://usa.kaspersky.com/downloads/TDSSKiller

you might have to boot into safe mode, remove the malwarebytes driver, reboot and see if windows will boot.
if it does, run cmd.exe as an admin and run
sfc.exe /scannow
dism.exe /online /cleanup-image /restorehealth

and run your rootkit detector.

also, tell me if you think the system was up longer than 30 seconds.
generally i see a bughceck over 15 seconds as a heating problem (stopped or blocked fan)
under 15 seconds often as a GPU power problem that resets the CPU.

neither of these would have all the cores running like your system shows.
I will look at the memory dump a little more to see if I can find a clear cause for all the cores running that filter.
------------
the system timer indicates that the system was up for only 30 seconds. it looks like a power or overheating problem.
if you think the system was up longer than 30 seconds then your CPU might have been reset.
I will look at some of the internal logs to see if any hardware problems show up.

also, take a look at the note I made about your memroy (below)
---------------
second bugcheck 0x124 WHEA_UNCORRECTABLE_ERROR
called by the CPU because of"
Error Type : TLB error
Severity : Fatal
Error : DTLBL0_ERR (Proc 4 Bank 2)
System Uptime: 0 days 0:00:30.519

machine info:
BIOS Version F8
BIOS Release Date 09/18/2015
Manufacturer Gigabyte Technology Co., Ltd.
Product Name Z97X-Gaming 7
Processor Version Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Processor Voltage 8ch - 1.2V
External Clock 100MHz
Max Speed 3800MHz
Current Speed 4000MHz

memory: (check your motherboard manual, generally memory bank slots are paired bank 0 and 2 and banks 2 and 3
and you want the banks to have a matched set. unrelated to the current problem though)

BANK 0 Part Number KHX2133C11D3/8GX <-- 8GB
BANK 1 KHX2133C11D3/4GX <- 4 GB
BANK 2 KHX2133C11D3/4GX <- 4gb
BANK 3 KHX2133C11D3/8GX <-- 8gb









 
Upvote 0 Downvote
Hello, i been trying other stuff while i waited for your reply, i changed the amount of processors running to 7 from the original 8 and it seemed to stop the problem. i did this on msconfig and going to advanced boot options. maybe this could narrow down the solution? how ever it did freeze once.
kind regards
 
Upvote 0 Downvote
you might also run the intel processor test tool (if you can boot ok)
https://downloadcenter.intel.com/download/19792/Intel-Processor-Diagnostic-Tool

just to see if it reports some problem
------------
I added some notes to the previous message.
try some of the changes and see if you still bugcheck.
if the system can not boot, try to boot into safe mode and remove the malwarebytes driver and see if you can boot normally.
if so then do the other driver updates from the motherboard vendor.

something is wrong with your storage system so the driver updates might help,
also something use large amounts of driver memory, guessing it is a bug in the LAN driver that is messing up the malwarebytes scanner.



 
Upvote 0 Downvote
i once again formatted my hard drives and fresh installed windows 10 i turned of the virtual memory stuff for a bit and i guess thats why it says no pagefilesys was running however i formatted the drives so it should be back to normal.

the thing about the bugchecks. i dont quiete understand this point. sometimes the bsod stays for a while and sometimes it goes quickly and restarted, i dont think its a problem with the gpu as i have tested with no gpu in attached the motherboard and the computer still BSOD. As for the over heating issues, i monitored the temperatures use hardware monitor and they seemed normal when idle(ranged around 50 degrees).

i ran your commands and there was in a error 'Error: 0x800f081f'
and link to the file created is below:
https://1drv.ms/u/s!Aki9KSSDY3aIhDKmLBH0bIVWYuh8


 
Upvote 0 Downvote
i was trying this earlier and got this error Module - SPBC.exe did not create a Results file.

and the test wouldnt finish.



 
Upvote 0 Downvote
the log error indicats that it could not find the source files to compare to.
other people with this problem found that if they run the windows 10 upgrade on their windows 10 machine
then the commands started working again. You might give that a try particularly since some of your windows core files seem to have been modified. (time and date stamps set to -1)


 
Upvote 0 Downvote
you would just run the windows 10 installer again while you already have windows 10 installed.
if would refresh the missing files/modified windows files in your hidden driver store on your machine.
you can get a copy of window 10 from microsoft and it will just use the key you already have installed.
https://www.microsoft.com/en-us/software-download/windows10/



 
Upvote 0 Downvote
thank you will try and let you know the results
----
update: got an error saying that my current version isnt supported by the tool.

in addition to my previous post on IPTD, i manage to fix that error and ran the test, everything passed until it came to CPU load and it crashed and BSOD with clock_watchdog_timeout----TIME TO GET A NEW PROCESSOR MAYBE 🙁?

another update: it crashed and then froze in the BSOD and had to force shut down and no dump file was created damn it.

update on the update:

i try to recreate the error by running IPTD again, it froze again on cpu load however a different BSOD error:

machine_check_exception: i have the file on one drive:
https://1drv.ms/u/s!Aki9KSSDY3aIhDPBfHGYItC5eOJ4




 
Upvote 0 Downvote
looks like you had two network drivers:
killer ethernet e2200 (wired ethernet) but not connected to anything
and
qualcomm atheros AR938x wireless network adaptor
\SystemRoot\System32\drivers\athw8x.sys Sun Apr 26 19:56:12 2015
(you can check for a update if you can find the vendor that sold the device to you)

Looks like Qualcomm owns killer networking now. I guess their killernetwork service will work on their wireless cards?
you might disable the KillerService.exe to see if it is causing a problem running on the qualcomm wireless driver rather than on the normal
motherboard killer ethernet chip. (wired connection)
i think the killer service tweaks the network functions so you get an advantage in online games. (kind of like a cheat that is hard to detect, they accelerate incoming packets so you can see your opponents position in the game, then they delay your packets so your opponent shoots at you where you were 1/3 second before (so they miss hitting you unless you stop moving)

turn it off and see if it has any effect.
i think the service would be talking to this driver:
Killer Bandwidth Control Filter Driver
\SystemRoot\system32\DRIVERS\bwcW10x64.sys Tue Feb 09 10:23:57 2016

the last error before the system crashed was
Error code: (NTSTATUS) 0xc00000d8 (3221225688) - Used to indicate that an operation cannot continue without blocking for I/O.

this could make sense if something was streaming. Basically all the CPU cores were waiting on some data, coming from some filter driver. ( i guess it was the killer networks filter driver)
 
Upvote 0 Downvote
thanks for replying and taking your time, updated my wireless adapter drivers and the ethernet ones aswell however i do not use it, i try to find the service you mentioned but its not there for me to stop and i tried to delete the sys file but it wouldnt let me as it was saying its being used but i had no application which i could see running or in task manager services which i could stop.

thanks



 
Upvote 0 Downvote
your cpu is current it should run the intel test.
Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz

I have the same cpu, will try to see if it runs for me.
-------------
looking at the current memory dump, looks like the drivers were not updated
and this driver was added for some reason:
\SystemRoot\system32\drivers\MBfilt64.sys Thu Jul 30 20:40:32 2009
it is listed as a realtek audio driver but you already have one loaded at:
\SystemRoot\system32\drivers\RTKVHD64.sys Fri Jan 22 07:09:21 2016

also, the drivers that had the -1 file dates have proper date stamps in this memory dump.
maybe the dism command did do some repairs?

you might want to boot into bios and reset it to defaults, this will force the system to rescan the hardware and reassign interrupts and other hardware settings. It builds a database it sends to windows so windows will know what settings are in use before it makes its settings.

I would then go into control panel and make sure to unhide devices and remove any that are not currently installed on your system.
 
Upvote 0 Downvote
i think your problem is going to be that filter you have installed. the stack shows all of the CPU cores waiting on the other cores.
it would make the system think all of the CPU cores are hung. The last core was waiting for some data operation. (input/output)

you get the same type of problem with some USB wireless cards on windows 7. Plug and play start to install a driver on one core, but another core tries to use the driver and has to wait because the first core failed to install the driver and just goes into a loop trying again and again. Finally the second core calls a bugcheck because it thinks the first core is hung.

try and boot into safe mode or maybe remove the filter.
Fltmc.exe is a command-line tool for loading, unloading, and displaying mini-filters.

start cmd.exe as an admin then run
fltmgr.exe
here are the filters I have on my 64 bit windows 10:

C:\WINDOWS\system32>fltmc

Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
WdFilter 8 328010 0
storqosflt 0 244000 0
FileCrypt 0 141100 0
luafv 1 135000 0
npsvctrig 1 46000 0
FileInfo 8 45000 0
Wof 7 40700 0


you might check to see if you have a different one.
you can run fltmc.exe /?
to see how to unload any extra filters.

if you can not find the problem, you might just want to do a clean install of windows and see if you can get the system working

-- looks like the intel cpu test worked as expected on my CPU.






 
Upvote 0 Downvote
removed unneeded drivers and reseted the bios but stil bsoding with irql not less or equal bs 🙁

and did your computer crash on the cpu load part?




 
Upvote 0 Downvote
i couldnt unload any filters as it gave me and error- i only had 2 filters wof and Fileinfo.
fltmgr.exe command didnt work for me.

will buying an new cpu fix all these issues i am having??






 
Upvote 0 Downvote
i couldnt unload any filters as it gave me and error- i only had 2 filters wof and Fileinfo.
fltmgr.exe command didnt work for me.

will buying an new cpu fix all these issues i am having??






 
Upvote 0 Downvote
nope, but the CPU did get hot.



 
Upvote 0 Downvote
here are the filters that the debug dump shows:

"MBAMProtector" ; malwarebytes filter
"WdFilter" ; Microsoft antimalware file system filter driver
"storqosflt" ; quality of service for storage i/o traffic
"FileCrypt" ; Windows sandboxing and encryption filter
"luafv" ; UAC File Virtualization
"npsvctrig" ; Named pipe service trigger provider

"FileInfo" ; I think this is used by the prefetcher (not sure)
"Wof" ; windows overlay filter driver (I think this helps handle errors)

edit: : removed info about bad chain link. looks like other systems have the same error in the debugger for the named pipe filter.
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom