Go Back   Tech Support Forum > Microsoft Support > BSOD, App Crashes And Hangs

User Tag List

BSOD IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe

This is a discussion on BSOD IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe within the BSOD, App Crashes And Hangs forums, part of the Tech Support Forum category. Another one of these. I have checked through the forums and can't find a solution. Usually I'm fine with BSOD


Closed Thread
 
Thread Tools Search this Thread
Old 05-18-2016, 01:55 AM   #1
Registered Member
 
Join Date: May 2016
Posts: 4
OS: Windows 7


Roll Eyes

Another one of these. I have checked through the forums and can't find a solution. Usually I'm fine with BSOD and can solve but this has stumped me a bit.

Could someone a little more experienced take a look and see what could possibly be the problem?

I've attached Perfmon report and Minidumps.

Many Thanks
Nat
Attached Files
File Type: zip minidump.zip (192.3 KB, 42 views)
nachonat94 is offline  
Sponsored Links
Advertisement
 
Old 05-18-2016, 03:07 AM   #2
Hardware Team
Games Team
 
Aus_Karlos's Avatar
 
Join Date: Mar 2007
Location: Western Australia, Perth
Posts: 4,651
OS: Windows 10 64-bit Pro

My System


Welcome to TSF,

ssp.exe is more than likely the faulting application i believe its apart of SpyStopper Pro?
Either make sure its up-to-date or remove it for testing purposes.
But i also noticed that the module thats required for the SpyStopper to function was unloaded at the time of the crash.
Code:
GetPointerFromAddress: unable to read from fffff800030f7000
THREAD fffffa800acaf700  Cid 0aec.07d4  Teb: 000000007efa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable
    fffffa800bc37300  NotificationEvent
Not impersonating
GetUlongFromAddress: unable to read from fffff80003036ba4
Owning Process            fffffa800bc3d5c0       Image:         ssp.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      290757       
Context Switch Count      689            IdealProcessor: 0             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000077e13e85
Stack Init fffff88007bf5c70 Current fffff88007bf5680
Base fffff88007bf6000 Limit fffff88007bf0000 Call 0
Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`07bf56c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd800`0303e410 : 0x0
Code:
Unloaded modules:
 fffff880`07749000 fffff880`077ba000   spsys.sys
fffff880`0627e000 fffff880`062f2000   IntcDAud.sys
fffff880`01680000 fffff880`0168e000   crashdmp.sys
fffff880`0168e000 fffff880`01698000   dump_storpor
fffff880`04056000 fffff880`04319000   dump_iaStorA
fffff880`04319000 fffff880`0432c000   dump_dumpfve
Aus_Karlos is offline  
Old 05-18-2016, 04:54 AM   #3
Registered Member
 
Join Date: May 2016
Posts: 4
OS: Windows 7



Hi Aus_Karlos,

When Googling the ssp.exe, it seems it could be Sophos with the problem. Thank you for checking that out for me.

Thanks
Nat
nachonat94 is offline  
Sponsored Links
Advertisement
 
Old 06-22-2016, 07:38 AM   #4
Registered Member
 
Join Date: May 2016
Posts: 4
OS: Windows 7



Hello,

I wonder if you can help again. We have had more of these errors since uninstalling the application that was causing the problem. I have also coincidentally upgraded to PC to Windows 10.

When i put the dump through the Debug Tool, its still showing the SSP.exe application.

Quote:
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*https://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`0308d6d0
Debug session time: Wed May 18 07:51:42.859 2016 (UTC + 1:00)
System Uptime: 0 days 1:15:35.851
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffffd8000303e410, 2, 1, fffff80002ecac86}

Probably caused by : ntkrnlmp.exe ( nt!KiInsertTimerTable+c6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffd8000303e410, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ecac86, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: ffffd8000303e410

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInsertTimerTable+c6
fffff800`02ecac86 4c894008 mov qword ptr [rax+8],r8

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: ssp.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME: fffff88007bf5610 -- (.trap 0xfffff88007bf5610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd8000303e408 rbx=0000000000000000 rcx=000000000e495e99
rdx=fffffa800bc68c30 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ecac86 rsp=fffff88007bf57a0 rbp=fffffa800bc68c30
r8=fffffa800acaf7e0 r9=000000000000008c r10=fffff8000303ae80
r11=00000000000f0000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
nt!KiInsertTimerTable+0xc6:
fffff800`02ecac86 4c894008 mov qword ptr [rax+8],r8 ds:ffffd800`0303e410=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002ebf169 to fffff80002ebfbc0

STACK_TEXT:
fffff880`07bf54c8 fffff800`02ebf169 : 00000000`0000000a ffffd800`0303e410 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`07bf54d0 fffff800`02ebdde0 : 00000000`0000027f 00000000`00000000 00000000`00000000 fffffa80`0acaf7c0 : nt!KiBugCheckDispatch+0x69
fffff880`07bf5610 fffff800`02ecac86 : 00000000`00000002 00000000`0000000f 00000008`00000002 fffff880`03165180 : nt!KiPageFault+0x260
fffff880`07bf57a0 fffff800`02eb5752 : fffffa80`0acaf700 00000000`00000002 00000000`00000000 fffffa80`00000000 : nt!KiInsertTimerTable+0xc6
fffff880`07bf5800 fffff800`02ec71e3 : 00000000`00000002 fffffa80`0bc7b060 00000000`0000008c 00000000`00000000 : nt!KiCommitThreadWait+0x332
fffff880`07bf5890 fffff800`031a7937 : fffffa80`00000000 fffffa80`0bc7b001 00000000`00000001 fffffa80`0bc7b060 : nt!KeRemoveQueueEx+0x323
fffff880`07bf5950 fffff800`02eaae06 : fffffa80`00000000 fffff880`07bf5a68 fffff880`07bf5a88 00000000`00000001 : nt!IoRemoveIoCompletion+0x47
fffff880`07bf59e0 fffff800`02ebee53 : fffffa80`0acaf700 00000000`7efa4000 fffff880`07bf5b60 00000000`7efa4000 : nt!NtWaitForWorkViaWorkerFactory+0x285
fffff880`07bf5ae0 00000000`77c32bba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0188e5b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c32bba


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertTimerTable+c6
fffff800`02ecac86 4c894008 mov qword ptr [rax+8],r8

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!KiInsertTimerTable+c6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

IMAGE_VERSION: 6.1.7601.18247

FAILURE_BUCKET_ID: X64_0xA_nt!KiInsertTimerTable+c6

BUCKET_ID: X64_0xA_nt!KiInsertTimerTable+c6

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xa_nt!kiinserttimertable+c6

FAILURE_ID_HASH: {f8f145cf-aba5-aa08-fee9-fd2d9810ba10}

Followup: MachineOwner
---------
Do you have any idea what other problem this could be with?

Thanks
Nachonat
nachonat94 is offline  
Old 06-23-2016, 06:36 PM   #5
Hardware Team
Games Team
 
Aus_Karlos's Avatar
 
Join Date: Mar 2007
Location: Western Australia, Perth
Posts: 4,651
OS: Windows 10 64-bit Pro

My System


I'd suggest running Driver Verifier here.
https://www.techsupportforum.com/foru...ed-473665.html
This can cause your system to BSOD instantly which is what we want, it basically stresses all your drivers to find the faulting one. If it is a Software/driver problem. When it does upload the new dmp files to the forum.

Without been able to debug the file myself its quite hard to know what the cause is as there are many steps to debug a dmp file.
Aus_Karlos is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Similar Threads
Thread Thread Starter Forum Replies Last Post
System Service Exception - ntoskrnl
Hello I have been having these System Service Exception BSODs for quite a long time, they have been coming and going but only occur when i put the computer to sleep. This has been driving me absolutely spare as i have been unable to isolate whats causing the problem. I have attached a .zip of...
robhooley167 BSOD, App Crashes And Hangs 7 04-04-2013 10:58 AM
BSOD intermittently during Windows 7 Startup
Hello, I m new to this forum. I am using this computer on everyday basis. however, BSOD happens to it once in a while during start up to boot into windows. Found this during BSOD, "0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s." I have...
hunterz86 BSOD, App Crashes And Hangs 3 03-13-2013 07:31 AM
Blue screen and slowdowns.
My laptop just crashes randomly when I'm using it. It's frustrating, and it costs me a lot of time. When it's booting my keyboard becomes unresponsive so I have to wait for the countdown to run out (can't just hit enter into boot normally). Sorry for requesting help as this is my first post, but...
zRebellion BSOD, App Crashes And Hangs 0 06-05-2012 10:15 PM
Multiple Blue Screen Errors (VISTA)
I wont post the whole story because it was quite long but here is a link to another help forum I posted on. Vista Multiple Blue Screen Errors - PC Help Forum - Windows Vista Service Pack 2 (x86) - OS came pre-installed on computer - Hardware and OS is about 3-4 years old I believe -AMD...
Npons BSOD, App Crashes And Hangs 7 05-01-2012 12:42 PM
Blue Screen [moved from Vista/7]
I don't know much about the pain in the bum Blue Screen but i have it. I was told to get the info from the Blue screen when it came up. Here it is - 0x00000077 (0xc000009d, 0xc000009d, 0x00000000, 0x289f4000) I just don't know where i got go from here lol. Can anyone help? Please :P
Death Keeper 34 BSOD, App Crashes And Hangs 4 02-02-2011 07:44 AM

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 02:11 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts