BSOD Hal.dll with IRQL_NOT_LESS_OR_EQUAL and SYSTEM_SERVICE_EXCEPTION

ItsThatGuy · 13 Jun 2018

Hi all,

First post. Thanks for the terrific forum.

So sometimes I get either one of these:
IRQL_NOT_LESS_OR_EQUAL and SYSTEM_SERVICE_EXCEPTION

I took out most of my RAM and thought that fixed it. I slowly added RAM back in and I've been running on 3(24GB) out 4 sticks or RAM for a while (maybe a week) and haven't had a problem until the last 24hrs where I've had 3 BSODs. So I thought it was RAM but it might not be. Usually, I was getting a BSOD everyday or more. I have been using Blue Screen View to look at the dump files but it seems like you guys have some better analysis so that's why I'm here.

I've run the memtest86 USB stick a few times but I haven't been able to wait for 8 passes since I had 32GB installed and that was going to require me to run the test for many days. Left overnight, I think it made it through 2 passes with no errors but I realize this is considered inconclusive.

In the collection of dump files attached, you'll see some from May and then there's a gap until yesterday when it started happening again.

zbook · 13 Jun 2018

Hi ItsThatGuy ,

Welcome to the the Ten Forums BSOD forum.

There were 3 mini dumps debugged and there were multiple drivers in the crashes.
The RAM is mismatched.

Perform the following steps:

1) Update the system specs in the "My Computer" section:
System Specs - Fill in at Ten Forums:
System Specs - Fill in at Ten Forums | Windows 10 Tutorials
In the left corner below in your post you find 'My System Specs'.
After clicking it you can find a link a little below that says 'Update your System Spec', click on this link to get to the page where you can fill in your system specs.
System Info - See Your System Specs - Windows 7 Help Forums

Include PSU. cooler, case, peripherals and anything attached to the computer by wired or wireless (mouse, keyboard, headset, printer, xbox, port replicator, docking station, USB wireless network card, etc.)
https://www.tenforums.com/profile.php?do=extra

2) Open administrative command prompt and type or copy and paste:
3) sfc /scannow
4) dism /online /cleanup-image /restorehealth
5) chkdsk /scan
6) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

7) If the computer has Ccleaner > click windows tab > scroll down to system and advanced > post an image into the thread

8) In the left lower corner search type: system or system control > open system control panel > on the left pane click advanced system settings
a) > on the advanced tab under startup and recovery > click settings > post an image of the startup and recovery into the thread.
b) > on the advanced tab under performance > click on settings > under performance options > click on the advanced tab > under virtual memory > click on change > post an image of the virtual memory tab into the thread

9) There are two log collectors: DM and BETA. The beta log collector at some time will replace the DM log collector as it collects more useful files. Run the beta log collector and post a zip into this thread:
BSOD - Posting Instructions - Windows 10 Forums
(extract > open)
Use the text and images in this thread in case there are any problems running the beta log collector: (post #5)
DM Log tool problem Solved - Windows 10 Forums

10) Uninstall Avast AV using the applicable uninstall tool:
Avast Uninstall Utility | Download aswClear for Avast Removal
Using the Uninstall Utility for Avast Antivirus | Official Avast Support

11) Turn on Windows defender

12) Wait for one week after the last BSOD to reinstall Avast.
If there are recurrent BSOD then find an alternative AV software product.
If there are no recurrent BSOD then continue using Avast.
The longer the period of stability before reinstalling the stronger the cause and effect when the AV software is reinstalled.

13) Uninstall and reinstall this driver:
fireface_64.sys
Fireface firewire sound card driver
RME: Downloads

14) Make sure that there is no over clocking during the troubleshooting process

15) Turn off fast startup:
Turn On or Off Fast Startup in Windows 10 | Windows 10 Tutorials

16) For any BSOD, after all of the above steps, run the beta log collector and post a zip into this thread

Code:

Name    RME Fireface UFX
Manufacturer    RME
Status    OK
PNP Device ID    1394\RME!&FIREFACE_UFX\000A350215744623
Driver    c:\windows\system32\drivers\fireface_64.sys (3.1.23.0, 131.98 KB (135,152 bytes), 3/22/2018 5:00 PM)

Code:

fireface64    RME Fireface Audio Device    c:\windows\system32\drivers\fireface_64.sys

Code:

fireface.exe    c:\windows\system32\fireface.exe    9280    8    200    1380    6/13/2018 9:09 AM    3.1.23.0    421.47 KB (431,584 bytes)    3/22/2018 5:00 PM

Code:

fireface    3.1.23.0    421.47 KB (431,584 bytes)    3/22/2018 5:00 PM    RME    c:\windows\system32\fireface.exe

Code:

6/13/2018 12:44 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 3b
P2: c0000005
P3: fffff801644209db
P4: ffff8607f5a04dc0
P5: 0
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\061318-62578-01.dmp
\\?\C:\WINDOWS\TEMP\WER-528171-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER456E.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER457F.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER45EB.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER462B.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_3b_f957121419b38557f5281debd5b32c8a9adb7e6_00000000_cab_028c462a

Analysis symbol: 
Rechecking for solution: 0
Report Id: 5532127a-0b25-42ec-bce6-9162fee7ef39
Report Status: 4
Hashed bucket: 
Cab Guid: 0
6/13/2018 1:01 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: 100000010329
P3: 2
P4: 0
P5: fffff803f19969db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\061318-63593-01.dmp
\\?\C:\WINDOWS\TEMP\WER-275937-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BB6.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BC7.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C43.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C63.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_c9e53931835b4648fbeba82635e454ca0d5382f_00000000_cab_02906c72

Analysis symbol: 
Rechecking for solution: 0
Report Id: 84b04156-d8d6-4487-bd3c-ee92f181e867
Report Status: 4
Hashed bucket: 
Cab Guid: 0
6/12/2018 9:33 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: 2f
P3: 2
P4: 0
P5: fffff803541979db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\061218-37562-01.dmp
\\?\C:\WINDOWS\TEMP\WER-393671-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48E3.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4903.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER497F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER49AF.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_c631bd5c22cf5fdb3649d1625370faec13c6962a_00000000_cab_01e649bd

Analysis symbol: 
Rechecking for solution: 0
Report Id: 6b301d9f-51b9-4916-90a8-d5593ffbc27b
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/17/2018 6:37 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: 327
P3: 2
P4: 0
P5: fffff800d55899db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051718-90312-01.dmp
\\?\C:\WINDOWS\TEMP\WER-670250-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8665.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8685.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER86E2.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8722.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_c028ceae1887f2b819468715c888117ab68b198c_00000000_cab_03ae8721

Analysis symbol: 
Rechecking for solution: 0
Report Id: 395183f2-ad39-4097-a907-12108e788940
Report Status: 4
Hashed bucket: 
Cab Guid: 0
5/23/2018 4:00 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: a
P2: c80000002c
P3: 2
P4: 0
P5: fffff803926309db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\052318-29187-01.dmp
\\?\C:\WINDOWS\TEMP\WER-49156-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2CC.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2DC.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF31A.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF33A.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_a_c05c37bbd78b5ca1121ee28969579e384ed517_00000000_cab_03a4f349

Analysis symbol: 
Rechecking for solution: 0
Report Id: 4158b535-8cb8-4a64-94f3-d4a5414aa690
Report Status: 4
Hashed bucket: 
Cab Guid: 0

Code:

5/17/2018 6:37 PM    Windows Error Reporting    Fault bucket AV_hal!HalPutScatterGatherList, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 2c06d78e-4423-4c86-aab6-5125fc87fcb3

Problem signature:
P1: a
P2: 327
P3: 2
P4: 0
P5: fffff800d55899db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\051718-90312-01.dmp
\\?\C:\WINDOWS\TEMP\WER-670250-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8665.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8685.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER86E2.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8722.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_c028ceae1887f2b819468715c888117ab68b198c_00000000_cab_1e6eb41c

Analysis symbol: 
Rechecking for solution: 0
Report Id: 395183f2-ad39-4097-a907-12108e788940
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
5/23/2018 4:00 PM    Windows Error Reporting    Fault bucket AV_hal!HalPutScatterGatherList, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 44692f57-d41a-43c8-b4be-6d6d3b03ab2b

Problem signature:
P1: a
P2: c80000002c
P3: 2
P4: 0
P5: fffff803926309db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\052318-29187-01.dmp
\\?\C:\WINDOWS\TEMP\WER-49156-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2CC.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2DC.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF31A.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF33A.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_c05c37bbd78b5ca1121ee28969579e384ed517_00000000_cab_15e1299b

Analysis symbol: 
Rechecking for solution: 0
Report Id: 4158b535-8cb8-4a64-94f3-d4a5414aa690
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
6/13/2018 1:10 PM    Windows Error Reporting    Fault bucket AV_hal!HalPutScatterGatherList, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 94477620-39b9-45f4-95dd-4e62417cd844

Problem signature:
P1: a
P2: 100000010329
P3: 2
P4: 0
P5: fffff803f19969db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\061318-63593-01.dmp
\\?\C:\WINDOWS\TEMP\WER-275937-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BB6.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BC7.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C43.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C63.tmp.txt
\\?\C:\Windows\Temp\WERA4F8.tmp.WERDataCollectionStatus.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_c9e53931835b4648fbeba82635e454ca0d5382f_00000000_cab_0cf0dab5

Analysis symbol: 
Rechecking for solution: 0
Report Id: 84b04156-d8d6-4487-bd3c-ee92f181e867
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0
6/12/2018 9:33 PM    Windows Error Reporting    Fault bucket AV_hal!HalPutScatterGatherList, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: b8eb5eef-4960-40df-abde-65ccdb635555

Problem signature:
P1: a
P2: 2f
P3: 2
P4: 0
P5: fffff803541979db
P6: 10_0_17134
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\WINDOWS\Minidump\061218-37562-01.dmp
\\?\C:\WINDOWS\TEMP\WER-393671-0.sysdata.xml
\\?\C:\WINDOWS\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER48E3.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4903.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER497F.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER49AF.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_a_c631bd5c22cf5fdb3649d1625370faec13c6962a_00000000_cab_2e2e6cc6

Analysis symbol: 
Rechecking for solution: 0
Report Id: 6b301d9f-51b9-4916-90a8-d5593ffbc27b
Report Status: 268435456
Hashed bucket: 
Cab Guid: 0

ItsThatGuy · 06 Jul 2018

Hi zbook,
Sorry for the slow reply work deadlines and vacations have gotten in the way of this. After going out of town for a week, I came back and my computer wouldn't boot. No logo. Just a black screen. Everything sounded like it was turning on normally. At first I thought it was the graphics card but after futzing with RAM, HDs and the like I got it working again. So I thought I had a bad RAM slot, but it started doing it again with RAM in different slots. Currently, I can't get my computer to boot. While it was working though I was able to run more memtest86 tests (and still had more BSODs too). I got one stick of RAM up to 8 passes and then due to work and time constraints the others got up to at least 5 passes with no errors.
I'm unsure what to make of all this now. I'm tempted to just order another motherboard and CPU and go from there. It seems like a hardware issue since the condition seems to be deteriorating.
p.s. I updated my system specs but I haven't had a chance to go through the other steps yet.

zbook · 06 Jul 2018

When possible please update the progress for the steps in post #2.
For any BSOD post a new zip into the thread.
For the next few BSOD also post: C:\Windows\memory.dmp > zip > post a one drive or drop box share link
There are multiple causes for BSOD:
a) misbehaving software drivers
b) misbehaving hardware drivers
c) malfunctioning hardware
The black screens can be troubleshooted simultaneously.
With the troubleshooting the aim is to fix misbehaving drivers. If there is a hardware problem that can be determined by swaps.
At this time it is early in the troubleshooting process and tests can be performed to determine whether there is a driver or hardware problem.
For RAM testing we use a minimum of 8 passes so that there are fewer false negatives. A false negative is a test pass with malfunctioning RAM.
After each RAM test please take a picture with a camera or smart phone camera and post images into the thread.

ItsThatGuy · 08 Jul 2018

Microsoft Windows [Version 10.0.17134.112]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17134.1

Image Version: 10.0.17134.112

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.

Stage 1: Examining basic file system structure ...
563712 file records processed.
File verification completed.
10083 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
15342 reparse records processed.
705136 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
15342 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
70713 data files processed.
CHKDSK is verifying Usn Journal...
34707872 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

975286270 KB total disk space.
198819752 KB in 303906 files.
176060 KB in 70714 indexes.
0 KB in bad sectors.
701798 KB in use by the system.
65536 KB occupied by the log file.
775588660 KB available on disk.

4096 bytes in each allocation unit.
243821567 total allocation units on disk.
193897165 allocation units available on disk.

C:\WINDOWS\system32>3xqFkSzt

ItsThatGuy · 08 Jul 2018

For #7, I'm not sure I understand the instructions. Here's what I have.
Attachment 195045

ItsThatGuy · 08 Jul 2018

Here's for #8a and 8bAttachment 195046 Attachment 195047

ItsThatGuy · 08 Jul 2018

#9 Here's my beta log collectorAttachment 195052

Ztruker · 08 Jul 2018

ItsThatGuy said:

For #7, I'm not sure I understand the instructions. Here's what I have.
Attachment 195045

Uncheck Memory dumps and Windows Log files so if you run CCleaner it won't erase those files.

zbook · 08 Jul 2018

1) For Ccleaner un-check:
a) Memory Dumps
b) Windows log files

2) For startup and recovery system failure:
a) un-check automatically restart

With automatically restart unchecked when there is a BSOD you should see a bugcheck and : (
Sometimes you may see a misbehaving driver in the form *.sys
If you see a misbehaving driver please record it and post it into the thread.
If you witness a BSOD it typically starts with a % counter. Allow this to rise to 100% so that there is sufficient time to create the dump file. The mini dump file then can be found manually or using the log collector. If necessary the memory.dmp file can be found manually then zipped and posted into the thread using a one drive or drop box share link.

3) After making changes to startup and recovery system failure > reboot

The operating system was corrupt and was fixed by running sfc /scannow.
4) Run the sfc /scannow command again to make sure that it remains fixed and displays that no integrity violations were found.

5) There were two mini dumps on 7/5/2018 that were not collected by the beta log collector.
See if you can find the mini dumps and then post a one drive or drop box share link into the thread:
C:\windows\minidump
(They may have been removed by software)
For the next dump see if you can find the memory dump > zip > post a one drive or drop box share link into the thread:
C:\windows\memory.dmp

6) In the earlier post Avast was supposed to be uninstalled and Windows defender turned on.
Was this done?
Please update the progress with the steps in post #2.

Code:

Event[2204]:  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2018-07-06T13:48:38.912
  Event ID: 29
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DBeck-DESKTOP
  Description: 
Windows failed fast startup with error status 0xC00000D4.

Code:

-a----         7/5/2018   4:58 PM              0 070518-32578-01.dmp                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
-a----         7/5/2018  11:44 AM              0 070518-40250-01.dmp