Link to home
Start Free TrialLog in
Avatar of burningmace
burningmaceFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Bluescreens on shutdown with XP SP1

Hi,

I'm running Windows XP Pro SP1 on my system and whenever I shut down I get a bluescreen.
There are two different ones which I have recorded:

IRQL_NOT_LESS_OR_EQUAL
* STOP: 0x0000000A (0x99AB5B14, 0x00000002, 0x00000000, 0x804E8785)

and

IRQL_NOT_LESS_OR_EQUAL
* STOP: 0x0000000A (0x8000000B, 0x00000002, 0x00000000, 0x804DF6AC)

I have been resorting to holding the off button on the front of my computer, but that eventually caused bad sectors which I had to fix (took about 6 hours with chkdsk).

I used WinDbg to read the MEMORY.DMP file generated by the second BSOD:


-------------------------------------------------------------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 8000000b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804df6ac, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  8000000b

CURRENT_IRQL:  2

FAULTING_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

TRAP_FRAME:  f008da70 -- (.trap fffffffff008da70)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=80000007 edx=00000003 esi=8226cc48 edi=8226cc48
eip=804df6ac esp=f008dae4 ebp=f008db18 iopl=0         nv up ei pl nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KeSetEvent+0xd:
804df6ac 8b7904           mov     edi,[ecx+0x4]     ds:0023:8000000b=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8051adc6 to 804df6ac

STACK_TEXT:  
f008daec 8051adc6 80000007 00000000 00000000 nt!KeSetEvent+0xd
f008db18 804f024d 8226cc48 821ca5d0 821ca501 nt!MiCheckControlArea+0x148
f008dbc0 804fbf7f 821ca5d0 8226cc30 821ca5d0 nt!MiRemoveMappedView+0x253
f008dbfc 805757a5 011ca5d0 82992020 82992268 nt!MmCleanProcessAddressSpace+0x266
f008dca4 80558bc5 00000001 82992020 00000000 nt!PspExitThread+0x668
f008dca8 00000001 82992020 00000000 fff0bdc0 nt!ExWaitForRundownProtectionRelease


FOLLOWUP_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KeSetEvent+d

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  422517e4

STACK_COMMAND:  .trap fffffffff008da70 ; kb

BUCKET_ID:  0xA_nt!KeSetEvent+d

Followup: MachineOwner
-------------------------------------------------------------

I've tried removing non-necsesary hardware and updating drivers, but have had no luck.
It's odd, the bluescreens just started to happen one day without any new hardware being added or updates being done.


Hope somebody can help,
Graham Sutherland.
Avatar of Pete Long
Pete Long
Flag of United Kingdom of Great Britain and Northern Ireland image

IRQL_NOT_LESS_OR_EQUAL Stop Errors

Possibly the most annoying Stop error that you will ever see, essentially is a memory error caused by a driver or piece of software that has caused an error accessing memory, It can also be caused by defective/unsupported hardware, so pretty much anything :0(

When you get the stop error it will be accompanied by some information i.e.

Stop: 0x0000000A (parameter1, parameter2, parameter3, parameter4) IRQL_NOT_LESS_OR_EQUAL*** Address x has base at x - filename

The parameters refer to the specific issues that are involved:
Parameter 1 - An address that was referenced improperly
Parameter 2 - An IRQL that was required to access the memory
Parameter 3 - The type of access, where 0 is a read operation and 1 is a write operation
Parameter 4 - The address of the instruction that referenced memory in parameter 1

Make a note of the stop error ESPECIALLY the "filename" as this can point you to a defective driver or the software/hardware at the root of the problem. do a Google search on the "filename" To help you narrow it down.

This is what M$ has to say

>>Stop error 0x0000000A (Stop 0x0A) shows that there was an attempt in kernel
>>mode to touch pageable memory at too high a process internal request level
>>(IRQL). This error usually occurs when a driver uses an incorrect memory
>>address. Other possible causes of this error are an incompatible device driver,
>>a general hardware problem, and incompatible software.

If the "filename" above yields no results you need to do some basic troubleshooting

1. First check your Hardware is supported by Microsoft
http://www.microsoft.com/hcl/

2. Then Check you RAM either by swapping it out or using...
http://www.memtest86.com/
http://www.simmtester.com/page/products/doc/docfeat.asp

3. Use the following to discover what is on your PC and get ALL the latest drivers, start with your graphics card.
Everest Home Edition
http://www.lavalys.com/products/download.php?dlid=1&lang=en
Belarc Advisor
http://www.belarc.com/free_download.html

*****Links and Further Reading*****

Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/reskit/prmd_stp_tnvo.asp

NT - Stop 0xA IRQL_NOT_LESS_OR_EQUAL
http://support.microsoft.com/default.aspx?scid=kb;en-us;162838

2000 - Troubleshooting "Stop 0x0A" Messages in Windows 2000 and Windows NT
http://support.microsoft.com/default.aspx?scid=kb;en-us;165863

XP - Troubleshooting a Stop 0x0000000A Error in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314063

XP - "Stop 0x0000000A Irql_Not_Less_or_Equal" Error Message During Windows XP Upgrade
http://support.microsoft.com/default.aspx?scid=kb;en-us;311564

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
http://aumha.org/win5/kbestop.php#0x0a
Avatar of burningmace

ASKER

I already read your article at https://www.experts-exchange.com/ Operating_Systems/WinXP/Q_20936254.html
There was no file name specified, in fact, I've never seen any BSOD specify a filename.
There was something else which I forgot to mention...

Every time I let the memory dump finish and my PC reboots, I am presented with my usual login screen with this message box:


Internal Window - Application Error
----------------------------------------
An error occured in svchost.exe
The specified memory reigon could not be "read".


Then when I click OK and type in my password, it locks up when I press enter.
I have to reboot manually (button on the front of my machine).
Your symptom is faulty memory.  nt!KeSetEvent+0xd is windows task management routine and it is a well-tested routine. It only fails unless it is hardware error. You can double check whether it is ram problem or not.  Check Dr Watson log and if you find a lot of access violation error at  different windows modules recently at C:\Documents and Settings\All Users\Documents\DrWatson\drwtsn32.log.  It is confirmed it is RAM error. Try reseat the memory stick to another memory slot. Maybe it can resolve the problem.
Whenever windows takes a full memory dump and the minidump is also written as well. Can the attach the analyze report of your first dump and you can find the minidump at the folder \windows\minidump? It can give us more clues.
C:\Documents and Settings\All Users\Documents\DrWaton\ doesn't exist.

I did a search and found drwatson.log in C:\Windows\
Here's the contents:

------------------------------------------------------------
Start Dr. Watson 1.00b - Thu Oct 23 16:09:26 2003
Stop Dr. Watson 1.00b - Thu Oct 23 16:09:37 2003
------------------------------------------------------------

Erm, yay?

I wasn't quite sure what you meant by your second post... so I'll post the analysis of my most recent minidump:

-------------------------------------------------------------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 8000000b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804df6ac, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  8000000b

CURRENT_IRQL:  2

FAULTING_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

TRAP_FRAME:  f008da70 -- (.trap fffffffff008da70)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=80000007 edx=00000003 esi=8226cc48 edi=8226cc48
eip=804df6ac esp=f008dae4 ebp=f008db18 iopl=0         nv up ei pl nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KeSetEvent+0xd:
804df6ac 8b7904           mov     edi,[ecx+0x4]     ds:0023:8000000b=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8051adc6 to 804df6ac

STACK_TEXT:  
f008daec 8051adc6 80000007 00000000 00000000 nt!KeSetEvent+0xd
f008db18 804f024d 8226cc48 821ca5d0 821ca501 nt!MiCheckControlArea+0x148
f008dbc0 804fbf7f 821ca5d0 8226cc30 821ca5d0 nt!MiRemoveMappedView+0x253
f008dbfc 805757a5 011ca5d0 82992020 82992268 nt!MmCleanProcessAddressSpace+0x266
f008dca4 80558bc5 00000001 82992020 00000000 nt!PspExitThread+0x668
f008dca8 00000001 82992020 00000000 fff0bdc0 nt!ExWaitForRundownProtectionRelease


FOLLOWUP_IP:
nt!KeSetEvent+d
804df6ac 8b7904           mov     edi,[ecx+0x4]

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KeSetEvent+d

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  422517e4

STACK_COMMAND:  .trap fffffffff008da70 ; kb

BUCKET_ID:  0xA_nt!KeSetEvent+d

Followup: MachineOwner
-------------------------------------------------------------

That's it....
I'll try re-seating the RAM later... I have no clue why it would have a fault, it's been fine for about 5 years.
It's a 512MB PC133 SDRAM stick too, which aren't cheap or easy for me to get my hands on any more.

I hope it's OK :(
1. Can you activate Dr Watson? http://support.microsoft.com/default.aspx?scid=kb;en-us;308538
2. Do you find any minidump at the folder \windows\minidump? If yes, run windbg and post the output of !analyze -v of the last three minidumps here.  
1) ok... I activated Dr Watson. Now what? lol.
2) 1st minidump's analysis is above. 2nd one is corrupt (throws error when opened), third one sits there and doesn't attach the debugger, then when I try to do anything useful with the program, it crashes.
ASKER CERTIFIED SOLUTION
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
D'oh! I'll investigate the RAM.

"hardware error -->  taking dump"... lol... bwahaahaha.
Sorry, I know you're not English so I shouldn't laugh at your mistake, but that last bit made me crack up. I'm not trying to be horrible or anything but:

"Taking a dump" is a metaphor for "having a poo" in most places where English is the main language.

Sorry, but I had to explain that before you accidentaly do that one again and get laughed at... in an evil way that is.

(I now have a mental picture in my head of a PCI card on the toilet...)

Anyhoo, thanks for the help, I'll check into my hardware.
Thanks for your comment for "taking dump". A dump is a snapshot of the memory.  What is the proper way to mean the system is taking a snapshot of the memory?
You could say that the computer does a memory dump or writes the RAM data to the hard drive...
Still, I reseated the RAM into another slot and should be able to check if it's worked in a bit (takes ages to boot my PC back up, can't be bothered to do it until I need to).

Sorry for my lack of response in the last couple of days, I've been away with no access to my PC.
Hasn't worked.

I've tried putting the RAM in all 3 sockets and had no luck.
I think the problem may have occurred when I took the RAM out to stop my brother from using my PC. I kept it in a static bag, but I have a feeling he might have found it and put his hands all over it. Grr.

I'll have to try to get somebody to look at the mobo... could be expensive.
I've done some research on that KeSetEvent command and found this:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/kmarch/hh/kmarch/k105_0b9a87b5-bdf2-4449-81f6-1836ea47f038.xml.asp

They define the command as:
LONG
  KeSetEvent(
    IN PRKEVENT  Event,
    IN KPRIORITY  Increment,
    IN BOOLEAN  Wait
    );

An extract from the article:

If Wait is set to FALSE, the caller can be running at IRQL <= DISPATCH_LEVEL. Otherwise, callers of KeSetEvent must be running at IRQL = PASSIVE_LEVEL and in a nonarbitrary thread context.

I think what's happening is that the kernel tries to call the function when the IRQL of the caller is above the dispatch level or is calling it with Wait = TRUE, meaning that the IRQL_NOT_LESS_OR_EQUAL is even more likely to get thrown.

I have no idea how to fix it, I just thought that I'd find out some more about the problem.
I've been away (again) and randomly thought of a solution.

I have some RAM in my second PC (PC100 SDRAM) and was looking over some posts on certain forums and found that my motherboard (in this PC) has certain problems when dealing with PC133, including the IRQL errors, random restarts and other shutdown problems. I switched the RAM over between the two PCs and have had no problem with either so far.

Thanks for the help,

Burningmace