BSOD: Seemingly random during use (IRQL_NOT_LESS_OR_EQUAL)

Enewarf

New Member
Messages
3
Hello,

Have repeatedly gotten BSOD while in use. Usually not while playing games, but browsing the web or working out of excel.

Sager NP8265 (Clevo P150SM)
16GB Ram
W8.1 64-bit
i7-4700MQ

Ran a BlueScreenViewer and seems ntoskrnl.exe+ 150aa0 is a major culprit along with hal.dll.

Dump files attached - any help would be appreciated!

Thanks,
 

My Computer

System One

  • OS
    Windows 8.1
Hi enewarf & Welcome to the forums ^_^,

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high.
Code:
6: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`207b8c98 fffff801`80fd95e9 nt!KeBugCheckEx
01 ffffd000`207b8ca0 fffff801`80fd7e3a nt!KiBugCheckDispatch+0x69
02 ffffd000`207b8de0 fffff801`80f5e4fe nt!KiPageFault+0x23a
03 ffffd000`207b8f70 fffff801`80fcef2a nt!KiCallInterruptServiceRoutine+0xee
04 ffffd000`207b8fb0 fffff801`80fcf30f nt!KiInterruptSubDispatchNoLockNoEtw+0xea
05 ffffd000`207aaad0 00000000`00000000 nt!KiInterruptDispatchLBControl+0x11f
So, according to the stack, the function which was calling the ISR (Interrupt Service Routine) to service the interrupts, encountered a page fault? Seems strange because this is a Windows function. Also, remember that whenever you see that ntoskrnl.exe is blamed, the chance of it being not at fault is 99.999% because it is the Kernel of the Operating System. If there was a problem with that, we would have been seeing a lot more problems.


KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine.
Code:
7: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`2129dfd8 fffff802`cc7df5e9 nt!KeBugCheckEx
01 ffffd000`2129dfe0 fffff802`cc7df910 nt!KiBugCheckDispatch+0x69
02 ffffd000`2129e120 fffff802`cc7deb34 nt!KiFastFailDispatch+0xd0
03 ffffd000`2129e300 fffff801`f3b8d3d4 nt!KiRaiseSecurityCheckFailure+0xf4
04 ffffd000`2129e498 fffff801`f3b8d520 tcpip!IppInsertPhysicalInterfaceRequest+0x58
05 ffffd000`2129e4a0 fffff801`f3b8ce45 tcpip!IppCreatePhysicalInterfaceRequest+0x144
06 ffffd000`2129e4f0 fffff801`f386f7d3 tcpip!IpGetAllTunnelPhysicalInterface+0x85
07 ffffd000`2129e540 fffff801`f37e2677 NETIO!NsiGetAllParametersEx+0x1f8
08 ffffd000`2129e650 fffff801`f37e2c20 nsiproxy!NsippGetAllParameters+0x1d7
09 ffffd000`2129e840 fffff802`cca641ef nsiproxy!NsippDispatch+0x90
0a ffffd000`2129e880 fffff802`cca6378e nt!IopXxxControlFile+0xa4f
0b ffffd000`2129ea20 fffff802`cc7df2b3 nt!NtDeviceIoControlFile+0x56
0c ffffd000`2129ea90 00007ffd`39200cba nt!KiSystemServiceCopyEnd+0x13
0d 000000c4`d686d2d8 00000000`00000000 0x00007ffd`39200cba
So, in this stack, we see the Networking Drivers of Windows at work trying to query the network adapters and then trying to add/insert a physical interface which caused the system to crash.
Let's take a look at the 3rd party drivers present on your system -
Code:
**************************Tue Jan 27 02:53:32.363 2015 (UTC + 5:30)**************************
[U][B]MBfilt64.sys                Fri Jul 31 09:10:32 2009 (4A7267B0)
[COLOR=#FF0000]tap0901.sys                 Fri Nov 25 00:20:27 2011 (4ECE91F3)
[/COLOR]ctxusbm.sys                 Fri Feb  3 20:06:13 2012 (4F2BF0DD)
GEARAspiWDM.sys             Fri May  4 01:26:17 2012 (4FA2E2E1)[/B][/U]
Rt630x64.sys                Fri Jun 21 14:59:10 2013 (51C41CE6)
AirplaneModeHid.sys         Fri Jun 28 02:58:59 2013 (51CCAE9B)
RtsBaStor.sys               Fri Jul 12 09:11:18 2013 (51DF7ADE)
btmaux.sys                  Mon Jul 22 19:49:46 2013 (51ED3F82)
SynTP.sys                   Wed Aug 14 08:23:25 2013 (520AF125)
Smb_driver_Intel.sys        Wed Aug 14 08:25:42 2013 (520AF1AE)
intelppm.sys                Thu Aug 22 14:16:35 2013 (5215CFEB)
dump_storahci.sys           Thu Aug 22 17:10:39 2013 (5215F8B7)
RTKVHD64.sys                Tue Aug 27 18:01:56 2013 (521C9C3C)
btmhsf.sys                  Thu Sep  5 17:42:49 2013 (52287541)
TeeDriverx64.sys            Thu Sep  5 23:32:18 2013 (5228C72A)
ibtusb.sys                  Fri Sep 13 21:36:04 2013 (523337EC)
NETwbw02.sys                Thu Oct 31 22:07:18 2013 (5272873E)
hcmon.sys                   Tue Dec 10 04:34:02 2013 (52A64C62)
iwdbus.sys                  Wed Jun 18 03:24:22 2014 (53A0B90E)
igdkmd64.sys                Mon Sep 29 23:21:21 2014 (54299C19)
nvvad64v.sys                Thu Nov 20 21:03:54 2014 (546E09E2)
nvpciflt.sys                Sat Jan 10 03:44:01 2015 (54B052A9)
nvlddmkm.sys                Sat Jan 10 03:52:06 2015 (54B0548E)
NvStreamKms.sys             Mon Jan 12 23:26:42 2015 (54B40ADA)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Jan 18 00:58:08.896 2015 (UTC + 5:30)**************************
NvStreamKms.sys             Sat Nov 22 13:16:45 2014 (54703F65)
nvpciflt.sys                Sat Dec 13 12:18:02 2014 (548BE122)
nvlddmkm.sys                Sat Dec 13 12:23:17 2014 (548BE25D)
http://www.carrona.org/drivers/driver.php?id=MBfilt64.sys
http://www.carrona.org/drivers/driver.php?id=tap0901.sys
http://www.carrona.org/drivers/driver.php?id=ctxusbm.sys
http://www.carrona.org/drivers/driver.php?id=GEARAspiWDM.sys
http://www.carrona.org/drivers/driver.php?id=Rt630x64.sys
http://www.carrona.org/drivers/driver.php?id=AirplaneModeHid.sys
http://www.carrona.org/drivers/driver.php?id=RtsBaStor.sys
http://www.carrona.org/drivers/driver.php?id=btmaux.sys
http://www.carrona.org/drivers/driver.php?id=SynTP.sys
http://www.carrona.org/drivers/driver.php?id=Smb_driver_Intel.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=dump_storahci.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=btmhsf.sys
http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys
http://www.carrona.org/drivers/driver.php?id=ibtusb.sys
http://www.carrona.org/drivers/driver.php?id=NETwbw02.sys
http://www.carrona.org/drivers/driver.php?id=hcmon.sys
http://www.carrona.org/drivers/driver.php?id=iwdbus.sys
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys
http://www.carrona.org/drivers/driver.php?id=nvpciflt.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys
http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys
http://www.carrona.org/drivers/driver.php?id=nvpciflt.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys

Kindly perform the following steps -

  1. Please remove OpenVPN till the time we are troubleshooting as it is known to cause problems.
  2. Kindly update the drivers highlighted in BLACK, UNDERLINE & BOLD.
  3. Kindly turn on Driver Verifier according to this **GUIDE** and make sure you let the system crash for few times. Once the system has crashed for a few times, re-run the SF Diagnostic Tool and upload a freshly generated ZIP File.

Let me know how it goes ^_^
-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Thanks for getting back to me Pranav! Glad to be here :D.

So I have updated the drivers you highlighted, but having difficulties uninstalling OpenVPN as it does not appear in the uninstaller. I have uninstalled any software I have that uses OpenVPN to my knowledge, but tap0901.sys still appears in the verifier. Any thoughts?

Nonetheless I am using Driver Verifier and will update with the results.

Thanks again!
 

My Computer

System One

  • OS
    Windows 8.1
Thanks for getting back to me Pranav! Glad to be here :D.

So I have updated the drivers you highlighted, but having difficulties uninstalling OpenVPN as it does not appear in the uninstaller. I have uninstalled any software I have that uses OpenVPN to my knowledge, but tap0901.sys still appears in the verifier. Any thoughts?

Nonetheless I am using Driver Verifier and will update with the results.

Thanks again!
Hi Enewarf ^_^,

I am also glad to help you out ^_^.
Kindly do a system-wide manual search for the "tap0901.sys" and rename it to "tap0901bak.sys". Once you have renamed the driver file, kindly restart the system and do the manual search again. If you find the driver again, let me know.

Let me know how it goes ^_^
-Pranav
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Code:
4: kd> k
Child-SP          RetAddr           Call Site
ffffd000`bd9a27a8 fffff802`71bea4e9 nt!KeBugCheckEx
ffffd000`bd9a27b0 fffff802`71be8d3a nt!KiBugCheckDispatch+0x69
ffffd000`bd9a28f0 fffff802`71b2d0ab nt!KiPageFault+0x23a
ffffd000`bd9a2a80 fffff800`3b88e817 nt!KeSetEvent+0x3fb
ffffd000`bd9a2b40 00000000`00000004 MBfilt64+0x1817
ffffd000`bd9a2b48 ffffe000`00000008 0x4
ffffd000`bd9a2b50 ffffe000`defa4b00 0xffffe000`00000008
ffffd000`bd9a2b58 00000000`00000000 0xffffe000`defa4b00

4: kd> lmvm MBfilt64
start             end                 module name
fffff800`3b88d000 fffff800`3b89b000   MBfilt64 T (no symbols)           
    Loaded symbol image file: MBfilt64.sys
    Image path: \SystemRoot\system32\drivers\MBfilt64.sys
    Image name: MBfilt64.sys
    Timestamp:        Fri Jul 31 04:40:32 2009 (4A7267B0)
    CheckSum:         0000FF02
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

MBfilt64, the Realtek HiDefinition Audio driver, causes a page fault by using an bad IP when setting an event to a signaled state.
You need to update your creative audio driver, it's nearly six years old.
 

My Computer

System One

  • OS
    Windows 7
Back
Top