?
Solved

Bluescreens on shutdown with XP SP1

Posted on 2005-05-17
15
Medium Priority
?
638 Views
Last Modified: 2012-08-13
Hi,

I'm running Windows XP Pro SP1 on my system and whenever I shut down I get a bluescreen.
There are two different ones which I have recorded:

IRQL_NOT_LESS_OR_EQUAL
* STOP: 0x0000000A (0x99AB5B14, 0x00000002, 0x00000000, 0x804E8785)

and

IRQL_NOT_LESS_OR_EQUAL
* STOP: 0x0000000A (0x8000000B, 0x00000002, 0x00000000, 0x804DF6AC)

I have been resorting to holding the off button on the front of my computer, but that eventually caused bad sectors which I had to fix (took about 6 hours with chkdsk).

I used WinDbg to read the MEMORY.DMP file generated by the second BSOD:


-------------------------------------------------------------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 8000000b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804df6ac, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  8000000b

CURRENT_IRQL:  2

FAULTING_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

TRAP_FRAME:  f008da70 -- (.trap fffffffff008da70)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=80000007 edx=00000003 esi=8226cc48 edi=8226cc48
eip=804df6ac esp=f008dae4 ebp=f008db18 iopl=0         nv up ei pl nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KeSetEvent+0xd:
804df6ac 8b7904           mov     edi,[ecx+0x4]     ds:0023:8000000b=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8051adc6 to 804df6ac

STACK_TEXT:  
f008daec 8051adc6 80000007 00000000 00000000 nt!KeSetEvent+0xd
f008db18 804f024d 8226cc48 821ca5d0 821ca501 nt!MiCheckControlArea+0x148
f008dbc0 804fbf7f 821ca5d0 8226cc30 821ca5d0 nt!MiRemoveMappedView+0x253
f008dbfc 805757a5 011ca5d0 82992020 82992268 nt!MmCleanProcessAddressSpace+0x266
f008dca4 80558bc5 00000001 82992020 00000000 nt!PspExitThread+0x668
f008dca8 00000001 82992020 00000000 fff0bdc0 nt!ExWaitForRundownProtectionRelease


FOLLOWUP_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KeSetEvent+d

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  422517e4

STACK_COMMAND:  .trap fffffffff008da70 ; kb

BUCKET_ID:  0xA_nt!KeSetEvent+d

Followup: MachineOwner
-------------------------------------------------------------

I've tried removing non-necsesary hardware and updating drivers, but have had no luck.
It's odd, the bluescreens just started to happen one day without any new hardware being added or updates being done.


Hope somebody can help,
Graham Sutherland.
0
Comment
Question by:burningmace
  • 9
  • 5
15 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 14017889
IRQL_NOT_LESS_OR_EQUAL Stop Errors

Possibly the most annoying Stop error that you will ever see, essentially is a memory error caused by a driver or piece of software that has caused an error accessing memory, It can also be caused by defective/unsupported hardware, so pretty much anything :0(

When you get the stop error it will be accompanied by some information i.e.

Stop: 0x0000000A (parameter1, parameter2, parameter3, parameter4) IRQL_NOT_LESS_OR_EQUAL*** Address x has base at x - filename

The parameters refer to the specific issues that are involved:
Parameter 1 - An address that was referenced improperly
Parameter 2 - An IRQL that was required to access the memory
Parameter 3 - The type of access, where 0 is a read operation and 1 is a write operation
Parameter 4 - The address of the instruction that referenced memory in parameter 1

Make a note of the stop error ESPECIALLY the "filename" as this can point you to a defective driver or the software/hardware at the root of the problem. do a Google search on the "filename" To help you narrow it down.

This is what M$ has to say

>>Stop error 0x0000000A (Stop 0x0A) shows that there was an attempt in kernel
>>mode to touch pageable memory at too high a process internal request level
>>(IRQL). This error usually occurs when a driver uses an incorrect memory
>>address. Other possible causes of this error are an incompatible device driver,
>>a general hardware problem, and incompatible software.

If the "filename" above yields no results you need to do some basic troubleshooting

1. First check your Hardware is supported by Microsoft
http://www.microsoft.com/hcl/

2. Then Check you RAM either by swapping it out or using...
http://www.memtest86.com/
http://www.simmtester.com/page/products/doc/docfeat.asp

3. Use the following to discover what is on your PC and get ALL the latest drivers, start with your graphics card.
Everest Home Edition
http://www.lavalys.com/products/download.php?dlid=1&lang=en
Belarc Advisor
http://www.belarc.com/free_download.html

*****Links and Further Reading*****

Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/reskit/prmd_stp_tnvo.asp

NT - Stop 0xA IRQL_NOT_LESS_OR_EQUAL
http://support.microsoft.com/default.aspx?scid=kb;en-us;162838

2000 - Troubleshooting "Stop 0x0A" Messages in Windows 2000 and Windows NT
http://support.microsoft.com/default.aspx?scid=kb;en-us;165863

XP - Troubleshooting a Stop 0x0000000A Error in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314063

XP - "Stop 0x0000000A Irql_Not_Less_or_Equal" Error Message During Windows XP Upgrade
http://support.microsoft.com/default.aspx?scid=kb;en-us;311564

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
http://aumha.org/win5/kbestop.php#0x0a
0
 
LVL 5

Author Comment

by:burningmace
ID: 14017979
I already read your article at www.experts-exchange.com/ Operating_Systems/WinXP/Q_20936254.html
There was no file name specified, in fact, I've never seen any BSOD specify a filename.
0
 
LVL 5

Author Comment

by:burningmace
ID: 14018002
There was something else which I forgot to mention...

Every time I let the memory dump finish and my PC reboots, I am presented with my usual login screen with this message box:


Internal Window - Application Error
----------------------------------------
An error occured in svchost.exe
The specified memory reigon could not be "read".


Then when I click OK and type in my password, it locks up when I press enter.
I have to reboot manually (button on the front of my machine).
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 20

Expert Comment

by:cpc2004
ID: 14018428
Your symptom is faulty memory.  nt!KeSetEvent+0xd is windows task management routine and it is a well-tested routine. It only fails unless it is hardware error. You can double check whether it is ram problem or not.  Check Dr Watson log and if you find a lot of access violation error at  different windows modules recently at C:\Documents and Settings\All Users\Documents\DrWatson\drwtsn32.log.  It is confirmed it is RAM error. Try reseat the memory stick to another memory slot. Maybe it can resolve the problem.
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 14018467
Whenever windows takes a full memory dump and the minidump is also written as well. Can the attach the analyze report of your first dump and you can find the minidump at the folder \windows\minidump? It can give us more clues.
0
 
LVL 5

Author Comment

by:burningmace
ID: 14019079
C:\Documents and Settings\All Users\Documents\DrWaton\ doesn't exist.

I did a search and found drwatson.log in C:\Windows\
Here's the contents:

------------------------------------------------------------
Start Dr. Watson 1.00b - Thu Oct 23 16:09:26 2003
Stop Dr. Watson 1.00b - Thu Oct 23 16:09:37 2003
------------------------------------------------------------

Erm, yay?

I wasn't quite sure what you meant by your second post... so I'll post the analysis of my most recent minidump:

-------------------------------------------------------------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 8000000b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804df6ac, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  8000000b

CURRENT_IRQL:  2

FAULTING_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

TRAP_FRAME:  f008da70 -- (.trap fffffffff008da70)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=80000007 edx=00000003 esi=8226cc48 edi=8226cc48
eip=804df6ac esp=f008dae4 ebp=f008db18 iopl=0         nv up ei pl nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KeSetEvent+0xd:
804df6ac 8b7904           mov     edi,[ecx+0x4]     ds:0023:8000000b=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8051adc6 to 804df6ac

STACK_TEXT:  
f008daec 8051adc6 80000007 00000000 00000000 nt!KeSetEvent+0xd
f008db18 804f024d 8226cc48 821ca5d0 821ca501 nt!MiCheckControlArea+0x148
f008dbc0 804fbf7f 821ca5d0 8226cc30 821ca5d0 nt!MiRemoveMappedView+0x253
f008dbfc 805757a5 011ca5d0 82992020 82992268 nt!MmCleanProcessAddressSpace+0x266
f008dca4 80558bc5 00000001 82992020 00000000 nt!PspExitThread+0x668
f008dca8 00000001 82992020 00000000 fff0bdc0 nt!ExWaitForRundownProtectionRelease


FOLLOWUP_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KeSetEvent+d

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  422517e4

STACK_COMMAND:  .trap fffffffff008da70 ; kb

BUCKET_ID:  0xA_nt!KeSetEvent+d

Followup: MachineOwner
-------------------------------------------------------------

That's it....
I'll try re-seating the RAM later... I have no clue why it would have a fault, it's been fine for about 5 years.
It's a 512MB PC133 SDRAM stick too, which aren't cheap or easy for me to get my hands on any more.

I hope it's OK :(
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 14019254
1. Can you activate Dr Watson? http://support.microsoft.com/default.aspx?scid=kb;en-us;308538
2. Do you find any minidump at the folder \windows\minidump? If yes, run windbg and post the output of !analyze -v of the last three minidumps here.  
0
 
LVL 5

Author Comment

by:burningmace
ID: 14019316
1) ok... I activated Dr Watson. Now what? lol.
2) 1st minidump's analysis is above. 2nd one is corrupt (throws error when opened), third one sits there and doesn't attach the debugger, then when I try to do anything useful with the program, it crashes.
0
 
LVL 20

Accepted Solution

by:
cpc2004 earned 375 total points
ID: 14020001
Corrupt memory dump is the indication of hardware problem.  When windows encounter sever problem, it writes the memory to the paging space and hardware occurs. Windows cannot writes the dump complete and reboot to occur recursive error recovery loop.  (ie example of recursive error :  hardware error -->  taking dump --> hardware error --> dump taking)

Either the ram or m/b is faulty.
0
 
LVL 5

Author Comment

by:burningmace
ID: 14020638
D'oh! I'll investigate the RAM.

"hardware error -->  taking dump"... lol... bwahaahaha.
Sorry, I know you're not English so I shouldn't laugh at your mistake, but that last bit made me crack up. I'm not trying to be horrible or anything but:

"Taking a dump" is a metaphor for "having a poo" in most places where English is the main language.

Sorry, but I had to explain that before you accidentaly do that one again and get laughed at... in an evil way that is.

(I now have a mental picture in my head of a PCI card on the toilet...)

Anyhoo, thanks for the help, I'll check into my hardware.
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 14022264
Thanks for your comment for "taking dump". A dump is a snapshot of the memory.  What is the proper way to mean the system is taking a snapshot of the memory?
0
 
LVL 5

Author Comment

by:burningmace
ID: 14045247
You could say that the computer does a memory dump or writes the RAM data to the hard drive...
Still, I reseated the RAM into another slot and should be able to check if it's worked in a bit (takes ages to boot my PC back up, can't be bothered to do it until I need to).

Sorry for my lack of response in the last couple of days, I've been away with no access to my PC.
0
 
LVL 5

Author Comment

by:burningmace
ID: 14050969
Hasn't worked.

I've tried putting the RAM in all 3 sockets and had no luck.
I think the problem may have occurred when I took the RAM out to stop my brother from using my PC. I kept it in a static bag, but I have a feeling he might have found it and put his hands all over it. Grr.

I'll have to try to get somebody to look at the mobo... could be expensive.
0
 
LVL 5

Author Comment

by:burningmace
ID: 14050986
I've done some research on that KeSetEvent command and found this:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/kmarch/hh/kmarch/k105_0b9a87b5-bdf2-4449-81f6-1836ea47f038.xml.asp

They define the command as:
LONG
  KeSetEvent(
    IN PRKEVENT  Event,
    IN KPRIORITY  Increment,
    IN BOOLEAN  Wait
    );

An extract from the article:

If Wait is set to FALSE, the caller can be running at IRQL <= DISPATCH_LEVEL. Otherwise, callers of KeSetEvent must be running at IRQL = PASSIVE_LEVEL and in a nonarbitrary thread context.

I think what's happening is that the kernel tries to call the function when the IRQL of the caller is above the dispatch level or is calling it with Wait = TRUE, meaning that the IRQL_NOT_LESS_OR_EQUAL is even more likely to get thrown.

I have no idea how to fix it, I just thought that I'd find out some more about the problem.
0
 
LVL 5

Author Comment

by:burningmace
ID: 14093604
I've been away (again) and randomly thought of a solution.

I have some RAM in my second PC (PC100 SDRAM) and was looking over some posts on certain forums and found that my motherboard (in this PC) has certain problems when dealing with PC133, including the IRQL errors, random restarts and other shutdown problems. I switched the RAM over between the two PCs and have had no problem with either so far.

Thanks for the help,

Burningmace
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are 2 things you must have in order to connect to the internet behind a router, The "Gateway IP" of the router, which is usually something like 192.168.xxx.1, I've seen routers with default values of: 192.168.0.1, 192.168.1.1, 192.168.11.1, …
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question