IRQL_NOT_LESS_OR_EQUAL STOP: 0x0000000A on blue screen Windows XP

I have a Dell Dimension 2350  with Windows XP with original configuration and is about 2 years old.  While starting the operating system, I received the error listed above.  The system was working perfectly until last Sunday.  No new hardware or software has been added to the system.  In following the directions listed on the screen, I have not found a way to disable BIOS memory (caching or shadowing).  I can operate under Safe Mode, but have not found the offending problem.  Additional information on the blue screen includes:
***STOP: 0x0000000A (0xFF??????, 0x00000002, 0x00000000, 0x????????)
?? represents changing numbers.
Also, listed is "woouhwq -= Address F9817484, Base @ F9817000, Datestamp 4263c4d4".  The numbers may change on this one, but I have not validated this.
 
The operating system appears to start fine under normal mode, everything loads such as everything that I can notice listed under the msconfig.  I tried eliminating items under services and startup.  All accounts will fail near the end of the OS startup.  

I have tried to eliminate possibilities except a failing hardware device, but do not know where to start.  I perform all of the startup and memory diagnostics on the system, but all items passed.  

Can someone lead me to the solution?  Do I have a corrupted device driver (from memory corruption or virus)?  Am I having a problem with a hardware device?  Is there some diagnostic tools available to determine the problem?  At this point, I am grasping for straws.  I can run in Safe Mode with Networking which has kept the computer alive temporarily.

Thanks for your help.

Sincerely,
Randy
clownfish3Asked:
Who is Participating?
 
cpc2004Commented:
If your windows still crashes, attach the latest dump.
0
 
cpc2004Commented:
When Windows crashes with blue screen, it writes a system event 1001 and a minidump to the folder windows\minidump. Check system event 1001 and it has the content of the blue screen

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content and paste it back here

Zip 3 to 4 minidumps and attach the zip files at any webspace. I will study the dump and find out the culprit.
0
 
clownfish3Author Commented:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x000000d1 (0xfee55000, 0x00000002, 0x00000000, 0xf9775484). A dump was saved in: C:\WINDOWS\Minidump\Mini050405-04.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Minidumps located at
http://rjshaver.home.mindspring.com/dumps/minidump.zip
0
Cloud Class® Course: Microsoft Windows 7 Basic

This introductory course to Windows 7 environment will teach you about working with the Windows operating system. You will learn about basic functions including start menu; the desktop; managing files, folders, and libraries.

 
cpc2004Commented:
Probably caused by : woouhwq ( woouhwq+484 )

The culprit is woouhwq. I've searched google and there has no hit for this module.
0
 
clownfish3Author Commented:
I did a search for this file on the hard drive and it was not found on the computer.  Should I try to search for it in the registry or on a start up file?
0
 
cpc2004Commented:
It is very strange that there have no hit at internet. Maybe it is a new virus. From the datestamp of the module it is very new (Apr 18 22:31:48 2005).  I see this problem at another forum computing.net and failing module is another name and the datestamp is the same. However the author does not respond to my comment. Run virus scan and make sure that your computer is free of virus and spyware.

woouhwq      Mon Apr 18 22:31:48 2005 (4263C4D4)
0
 
cpc2004Commented:
The url which has the same datestamp of the failing module
http://www.computing.net/windows2000/wwwboard/forum/62004.html


STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
80541a78 f9775a1a fee54a48 000005b4 80541a98 woouhwq+0x484
80541b98 f9775a95 fee54a48 000005b4 81240198 woouhwq+0xa1a
80541be0 f9775f9e fee54a20 fee54a34 000005c8 woouhwq+0xa95
80541c14 f03355e7 000005dc 00000002 80541c58 woouhwq+0xf9e
80541c84 f0325d35 ff36ea50 81198f40 ff8f182e tcpip!IPInjectPkt+0x95b
80541d30 f030d3b0 81198f40 ff8f1842 000005c8 tcpip!IPSetIPSecStatus+0x2a03
80541d70 f030cc15 00000000 ff8dcf30 ff8f1820 tcpip+0x13b0
80541dac f91265ec 811da900 00000000 8120aad8 tcpip+0xc15
80541e0c f8a45c0b f030cbc4 80541e48 00000001 NDIS!FddiFilterDprIndicateReceive+0xa78
80541e3c f91265ec 0195ddb0 ff8dcf30 00000000 psched!RegisterPsComponent+0x69f5
80541e9c f93a1b05 f8a45b12 80541ec0 00000001 NDIS!FddiFilterDprIndicateReceive+0xa78
00000800 00000000 00000000 00000000 00000000 bcm4sbxp+0xb05

Name: ASUSTeK/Broadcom 440x 10/100 Integrated Controller
Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_80A81043&REV_01\4&3B90381F&0&28F0
Driver: C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys, 3.48.0000.0000 (English), 9/10/2002 09:45:50, 41728 bytes

From the stack trace, the crash is caused by network. Maybe woouhwq is a firewall or anti-virus software.
0
 
cpc2004Commented:
I find a more hit.  Your failing module has the same datestamp as this problem. The failing module name is different and their names are very strange.

http://forums.tomcoyote.org/Help_Badly_Infected_Computer-t35912.html
http://www.computing.net/windows2000/wwwboard/forum/62004.html

There have cases that failing modules are different and the datestamp is the same. They are all occured within 10 days. Most likely this is new virus Fortunately it changes the failing module but it does not change the datestamp of the failing module, I believe that your windows is infected with virus.
0
 
cpc2004Commented:
After I review the webpage http://forums.tomcoyote.org/Help_Badly_Infected_Computer-t35912.html and I confirm that your problem is exactly the same.

Your crash informtion
STOP: 0x000000D1 (FF429000, 00000002, 00000000, F97C5484)
f9775000 f97765e0
***  woouhwq - Address  F97C5484 base FF429000 Datestamp  4263c4d4

His crash information
STOP: 0x000000D1 (FF93E000, 00000002, 00000000, F97AB484)
*** wwackxt - Address F97AB484 base at F97AB000, Datestamp 4263c4d4

Refer that webpage and implement the solution.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.