BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a especially during shutdown

piotrusx · 31 Dec 2018

Hi.
I need your help.
Last time I have very often blue screen Windows 10 errors. Details in the attachment.
I did long hardware test. It passed all test.
Could you look at my log files and suggest me what is a problem in my operating system?

Thank you in advance.
Peter.

Spectrum · 31 Dec 2018

Are you getting the same bugcheck code, 0000000A, every time?

The event log was cleared on the 28th, and I only see one crash dump which is pointing towards a built-in kernel tracing session which is pretty unusual.

Ztruker · 31 Dec 2018

I asked if any of the folks in the AntiVirus, Firewalls and System Security forum could take a look at this. The dump showed q problem with CI.dll which is often caused by a boot sector virus.

I'm not saying that is the problem here but I would like some one of those folk to check in and offer their opinion. I'm don't feel qualified to handle it if it is.

zbook · 31 Dec 2018

1) There are two log collectors: DM and BETA.
The BETA log collector will collect more useful files and folders.
At some time the BETA log collector will replace the DM log collector.
Please run the BETA log collector and post a zip into the thread:
BSOD - Posting Instructions - Windows 10 Forums

2) See if you can fix the driver problems related to: VBoxNetLwf.sys
Oracle VirtualBox NDIS 6.0 Lightweight Filter Driver
Downloads â€“ Oracle VM VirtualBox

3) Uninstall and reinstall or uninstall this software during the troubleshooting process

4) Run Memtest 86+ version 5.01 if the RAM is DDR3: Memtest86+ - Advanced Memory Diagnostic Tool or run Memtest86 version 8.0: MemTest86 - Official Site of the x86 Memory Testing Tool if the RAM is DDR4.
Testing is not done by time but by passes.
The more the passes the better the testing environment.
Testing must be continuous.
Make 8 ore more passes and then take a picture using a camera or smartphone camera > post an image of the results into the thread.
If there are any problems posting images please use share links (one drive, drop box, or google drive)

5) Turn off Windows fast startup:
Turn On or Off Fast Startup in Windows 10 | Tutorials

6) For the next BSOD open file explorer > this PC > C: > in the right upper corner search for C:\windows\memory.dmp > if the file size is < 1.5 GB then zip and post a share link into the thread

The logs displayed many:

Code:

Event[1201]:
  Log Name: System
  Source: VBoxNetLwf
  Date: 2018-12-31T10:43:37.954
  Event ID: 12
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: NOTEBOOK-PCH
  Description: 
The driver detected an internal driver error on \Device\VBoxNetLwf.

Code:

Event[979]:
  Log Name: System
  Source: Application Popup
  Date: 2018-12-29T16:16:54.043
  Event ID: 26
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: NOTEBOOK-PCH
  Description: 
Application popup: googledrivesync.exe - Application Error : The instruction at 0x0000000003FF5B30 referenced memory at 0xFFFFFFFFFFFFFFFF. The memory could not be read.

Click on OK to terminate the program

Code:

Event[1147]:
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2018-12-31T10:41:43.818
  Event ID: 29
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: NOTEBOOK-PCH
  Description: 
Windows failed fast startup with error status 0xC00000D4.

simrick · 31 Dec 2018

Hi.
Theoretically, with Secure Boot enabled, it should not boot, but you never know...if this is a W7 upgrade to W10, it's quite possible Secure Boot/UEFI is not running on it. I see that this model was released originally with W7, and later made available with W8.x
I would suggest the OP run a few programs to see if anything turns up:

Rootkit Remover Bitdefender Labs

Anti-Rootkit Scanner | Free Rootkit Detection and Removal Tool | Sophos Virus Protection

and the Kaspersky TDSS Killer (which is very good).
https://usa.kaspersky.com/downloads/tdsskiller

Since Bitdefender can run without a reboot, or need of Safe Mode, I'd start with that one.

Another option is to boot to Kyhi's Rescue Media, connect to the internet, open Malwarebytes, update the virus definitions, and run a scan on the OS drive that way. You'll have to manually check the box to scan for rootkits, as it's unchecked by default.

Also could try ADWCleaner
AdwCleaner - Free Adware Cleaner & Removal Tool | Malwarebytes

But a lot of what I am reading on the 0xA bugcheck is driver and BIOS related, meaning updates are needed. If this thing originally came with W7 and has not had any BIOS updates, I would start there.

If things are found in the AV scans, it would be helpful to see the log files.

Hope that helps. I'll try and keep an eye on this thread.

zbook · 31 Dec 2018

Ztruker said:

I asked if any of the folks in the AntiVirus, Firewalls and System Security forum could take a look at this. The dump showed q problem with CI.dll which is often caused by a boot sector virus.

I'm not saying that is the problem here but I would like some one of those folk to check in and offer their opinion. I'm don't feel qualified to handle it if it is.

Please post an image of what you saw.

Ztruker · 01 Jan 2019

>dps ffff93868181c000 ffff938681822000

Code:

ffff9386`81821378  fffff80d`2703a500Unable to load image \SystemRoot\system32\CI.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for CI.dll
*** ERROR: Module load completed but symbols could not be loaded for CI.dll
 CI+0x6a500

zbook · 01 Jan 2019

The brand new windbg can debugg other dump files but for this one it displayed:
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
3: kd> !thread
ffff838c42695080: Unable to get thread contents
3: kd> !verifier
fffff80666c38a60: Unable to get verifier list.
3: kd> !sysinfo smbios
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
3: kd> !process
Error in reading nt!_EPROCESS at ffff838c448ea08

Using another computer that still has the oldest edition of windbg (Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64) there were no misbehaving drivers displayed in the debugging.

The only CI displayed was:

Code:

ffff9386`81821378  fffff80d`2703a500 CI!SIPolicyQueryWindowsLockdownMode+0x44

Code:

ffff9386`81821378  fffff80d`2703a500Unable to load image \SystemRoot\system32\CI.dll, Win32 error 0n2

It was the identical hexadecimal characters.

So CI.dll may just be a symbol problem.

Ztruker · 01 Jan 2019

There is a definite problem with your system Z. You need a clean install. !thread worked for me with that dump, as did dps.

Code:

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\Temp\Dumps\piotrusx\123018-6906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*D:\Symbols
Symbol search path is: SRV*D:\Symbols
Executable search path is: 
Windows 10 Kernel Version 17763 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 17763.1.amd64fre.rs5_release.180914-1434

Code:

3: kd> !thread
THREAD ffff838c42695080  Cid 1678.2e40  Teb: 000000654b524000 Win32Thread: 0000000000000000 RUNNING on processor 3
Not impersonating
GetUlongFromAddress: unable to read from fffff80666c22164
Owning Process            ffff838c448ea080       Image:         smss.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      4953211      
Context Switch Count      6              IdealProcessor: 3             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00007ff7754f2ec0
Stack Init ffff938681821c90 Current ffff9386818204c0
Base ffff938681822000 Limit ffff93868181c000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffff9386`81820658 fffff806`669e1369 : 00000000`0000000a 00000000`00000000 00000000`0000000f 00000000`00000000 : nt!KeBugCheckEx
ffff9386`81820660 fffff806`669dd78e : ffff838c`39602000 fffff806`668df3a9 ffff4fef`ffba809c 00000000`674c5057 : nt!KiBugCheckDispatch+0x69
ffff9386`818207a0 fffff806`6698ac31 : fffff806`6698ab89 00000000`00000002 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x44e (TrapFrame @ ffff9386`818207a0)
ffff9386`81820938 fffff806`6698ab89 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00010000 : nt!KiCheckForDuplicateBugCheckCallback+0xd
ffff9386`81820940 fffff80d`27271793 : ffff838c`3a4e6000 00000000`0000ff68 ffff838c`41e8c0a0 ffffe944`33304c57 : nt!KeRegisterBugCheckReasonCallback+0x79
ffff9386`81820980 ffff838c`3a4e6000 : 00000000`0000ff68 ffff838c`41e8c0a0 ffffe944`33304c57 ffff838c`41e8c020 : WppRecorder+0x1793
ffff9386`81820988 00000000`0000ff68 : ffff838c`41e8c0a0 ffffe944`33304c57 ffff838c`41e8c020 ffffe944`f0b83370 : 0xffff838c`3a4e6000
ffff9386`81820990 ffff838c`41e8c0a0 : ffffe944`33304c57 ffff838c`41e8c020 ffffe944`f0b83370 ffff838c`41e8c018 : 0xff68
ffff9386`81820998 ffffe944`33304c57 : ffff838c`41e8c020 ffffe944`f0b83370 ffff838c`41e8c018 fffff80d`27271b7b : 0xffff838c`41e8c0a0
ffff9386`818209a0 ffff838c`41e8c020 : ffffe944`f0b83370 ffff838c`41e8c018 fffff80d`27271b7b ffff838c`41e8c010 : 0xffffe944`33304c57
ffff9386`818209a8 ffffe944`f0b83370 : ffff838c`41e8c018 fffff80d`27271b7b ffff838c`41e8c010 00000000`00000000 : 0xffff838c`41e8c020
ffff9386`818209b0 ffff838c`41e8c018 : fffff80d`27271b7b ffff838c`41e8c010 00000000`00000000 00000000`0000000a : win32kbase!RawInputManagerObject::bTouchInputAllowed+0x4
ffff9386`818209b8 fffff80d`27271b7b : ffff838c`41e8c010 00000000`00000000 00000000`0000000a 000065b8`aecd2b84 : 0xffff838c`41e8c018
ffff9386`818209c0 ffff838c`41e8c010 : 00000000`00000000 00000000`0000000a 000065b8`aecd2b84 ffff9386`81820a08 : WppRecorder+0x1b7b
ffff9386`818209c8 00000000`00000000 : 00000000`0000000a 000065b8`aecd2b84 ffff9386`81820a08 ffff838c`41e8c040 : 0xffff838c`41e8c010

cwsink · 01 Jan 2019

Interesting... I was having what I believe was the same issue zbook was having regarding symbols so I deleted my local symbol cache and now I'm getting results much more inline with Ztrucker. My system was able to resolve more symbols, though, for some reason.

Code:

3: kd> !thread
THREAD ffff838c42695080  Cid 1678.2e40  Teb: 000000654b524000 Win32Thread: 0000000000000000 RUNNING on processor 3
Not impersonating
GetUlongFromAddress: unable to read from fffff80666c22164
Owning Process            ffff838c448ea080       Image:         smss.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      4953211      
Context Switch Count      6              IdealProcessor: 3             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00007ff7754f2ec0
Stack Init ffff938681821c90 Current ffff9386818204c0
Base ffff938681822000 Limit ffff93868181c000 Call 0000000000000000
Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffff9386`81820658 fffff806`669e1369 : 00000000`0000000a 00000000`00000000 00000000`0000000f 00000000`00000000 : nt!KeBugCheckEx
ffff9386`81820660 fffff806`669dd78e : ffff838c`39602000 fffff806`668df3a9 ffff4fef`ffba809c 00000000`674c5057 : nt!KiBugCheckDispatch+0x69
ffff9386`818207a0 fffff806`6698ac31 : fffff806`6698ab89 00000000`00000002 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x44e (TrapFrame @ ffff9386`818207a0)
ffff9386`81820938 fffff806`6698ab89 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00010000 : nt!KiCheckForDuplicateBugCheckCallback+0xd
ffff9386`81820940 fffff80d`27271793 : ffff838c`3a4e6000 00000000`0000ff68 ffff838c`41e8c0a0 ffffe944`33304c57 : nt!KeRegisterBugCheckReasonCallback+0x79
ffff9386`81820980 fffff80d`27271b7b : ffff838c`41e8c010 00000000`00000000 00000000`0000000a 000065b8`aecd2b84 : WppRecorder!WppAutoLogCreateLog+0x147
ffff9386`818209c0 ffffe944`f0bb772a : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe944`f09bd8d6 : WppRecorder!WppAutoLogStart+0x33b
ffff9386`81820b80 ffffe944`f0a34fef : ffff838c`3a9bfe20 00000000`00000000 00000000`00000000 ffff9386`81820d50 : win32kbase!WppInitKm+0x82
ffff9386`81820bc0 ffffe944`f0bd4423 : 00000000`00000000 fffff780`00000004 00000000`00000000 ffffe944`f091ea70 : win32kbase!RIMInitializeAutoLogger+0x7f
ffff9386`81820c50 ffffe944`f0e51030 : 00000000`00000010 00000000`00000000 ffff9386`818216c0 ffff9386`81820ec0 : win32kbase!DriverEntry+0xaa3
ffff9386`81820e70 fffff806`66f1f709 : ffffe944`f0dd0000 ffff9386`81820f00 00000001`00000000 00000005`00020101 : win32k!GsDriverEntry+0x20
ffff9386`81820ea0 fffff806`66dbecb0 : ffffe944`f0dd0000 ffffe944`f0dd00e0 00000000`00000000 ffffae0c`80000005 : nt!ExpInitializeSessionDriver+0x39
ffff9386`81821020 fffff806`669e0d85 : 00000000`00000000 ffff838c`39ca17a0 ffff9386`818216c4 00000000`00000000 : nt!NtSetSystemInformation+0x7a0
ffff9386`818214c0 fffff806`669d3840 : fffff806`66dbeb28 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffff9386`818214c0)
ffff9386`81821658 fffff806`66dbeb28 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
ffff9386`81821660 fffff806`669e0d85 : ffff838c`42695080 00000000`00000003 00000000`00000000 00000065`4b38f828 : nt!NtSetSystemInformation+0x618
ffff9386`81821b00 00007fff`80792ab4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffff9386`81821b00)
00000065`4b38f798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`80792ab4