BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a especially during shutdown Solved

Page 1 of 2 12 LastLast
  1.    2 Weeks Ago #1

    BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a especially during shutdown


    Hi.
    I need your help.
    Last time I have very often blue screen Windows 10 errors. Details in the attachment.
    I did long hardware test. It passed all test.
    Could you look at my log files and suggest me what is a problem in my operating system?

    Thank you in advance.
    Peter.
    BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a especially during shutdown Attached Files
      My ComputerSystem Spec

  2.    2 Weeks Ago #2

    Are you getting the same bugcheck code, 0000000A, every time?

    The event log was cleared on the 28th, and I only see one crash dump which is pointing towards a built-in kernel tracing session which is pretty unusual.
      My ComputerSystem Spec

  3. Ztruker's Avatar
    Posts : 7,037
    Windows 10 Pro X64 1809 17763.134
       2 Weeks Ago #3

    I asked if any of the folks in the AntiVirus, Firewalls and System Security forum could take a look at this. The dump showed q problem with CI.dll which is often caused by a boot sector virus.

    I'm not saying that is the problem here but I would like some one of those folk to check in and offer their opinion. I'm don't feel qualified to handle it if it is.
      My ComputersSystem Spec


  4. Posts : 22,705
    windows 10 professional version 1607 build 14393.969 64 bit
       2 Weeks Ago #4

    1) There are two log collectors: DM and BETA.
    The BETA log collector will collect more useful files and folders.
    At some time the BETA log collector will replace the DM log collector.
    Please run the BETA log collector and post a zip into the thread:
    BSOD - Posting Instructions - Windows 10 Forums


    2) See if you can fix the driver problems related to: VBoxNetLwf.sys
    Oracle VirtualBox NDIS 6.0 Lightweight Filter Driver
    Downloads – Oracle VM VirtualBox

    3) Uninstall and reinstall or uninstall this software during the troubleshooting process

    4) Run Memtest 86+ version 5.01 if the RAM is DDR3: Memtest86+ - Advanced Memory Diagnostic Tool or run Memtest86 version 8.0: MemTest86 - Official Site of the x86 Memory Testing Tool if the RAM is DDR4.
    Testing is not done by time but by passes.
    The more the passes the better the testing environment.
    Testing must be continuous.
    Make 8 ore more passes and then take a picture using a camera or smartphone camera > post an image of the results into the thread.
    If there are any problems posting images please use share links (one drive, drop box, or google drive)

    5) Turn off Windows fast startup:
    Turn On or Off Fast Startup in Windows 10 | Tutorials

    6) For the next BSOD open file explorer > this PC > C: > in the right upper corner search for C:\windows\memory.dmp > if the file size is < 1.5 GB then zip and post a share link into the thread


    The logs displayed many:

    Code:
    Event[1201]:
      Log Name: System
      Source: VBoxNetLwf
      Date: 2018-12-31T10:43:37.954
      Event ID: 12
      Task: N/A
      Level: Error
      Opcode: N/A
      Keyword: Classic
      User: N/A
      User Name: N/A
      Computer: NOTEBOOK-PCH
      Description: 
    The driver detected an internal driver error on \Device\VBoxNetLwf.





    Code:
    Event[979]:
      Log Name: System
      Source: Application Popup
      Date: 2018-12-29T16:16:54.043
      Event ID: 26
      Task: N/A
      Level: Information
      Opcode: Info
      Keyword: N/A
      User: S-1-5-18
      User Name: NT AUTHORITY\SYSTEM
      Computer: NOTEBOOK-PCH
      Description: 
    Application popup: googledrivesync.exe - Application Error : The instruction at 0x0000000003FF5B30 referenced memory at 0xFFFFFFFFFFFFFFFF. The memory could not be read.
    
    Click on OK to terminate the program
    Code:
    Event[1147]:
      Log Name: System
      Source: Microsoft-Windows-Kernel-Boot
      Date: 2018-12-31T10:41:43.818
      Event ID: 29
      Task: N/A
      Level: Error
      Opcode: Info
      Keyword: N/A
      User: S-1-5-18
      User Name: NT AUTHORITY\SYSTEM
      Computer: NOTEBOOK-PCH
      Description: 
    Windows failed fast startup with error status 0xC00000D4.
      My ComputerSystem Spec

  5.    2 Weeks Ago #5

    Hi.
    Theoretically, with Secure Boot enabled, it should not boot, but you never know...if this is a W7 upgrade to W10, it's quite possible Secure Boot/UEFI is not running on it. I see that this model was released originally with W7, and later made available with W8.x
    I would suggest the OP run a few programs to see if anything turns up:

    Rootkit Remover Bitdefender Labs

    Anti-Rootkit Scanner | Free Rootkit Detection and Removal Tool | Sophos Virus Protection

    and the Kaspersky TDSS Killer (which is very good).
    https://usa.kaspersky.com/downloads/tdsskiller


    Since Bitdefender can run without a reboot, or need of Safe Mode, I'd start with that one.

    Another option is to boot to Kyhi's Rescue Media, connect to the internet, open Malwarebytes, update the virus definitions, and run a scan on the OS drive that way. You'll have to manually check the box to scan for rootkits, as it's unchecked by default.

    Also could try ADWCleaner
    AdwCleaner - Free Adware Cleaner & Removal Tool | Malwarebytes

    But a lot of what I am reading on the 0xA bugcheck is driver and BIOS related, meaning updates are needed. If this thing originally came with W7 and has not had any BIOS updates, I would start there.

    If things are found in the AV scans, it would be helpful to see the log files.

    Hope that helps. I'll try and keep an eye on this thread.
      My ComputerSystem Spec


  6. Posts : 22,705
    windows 10 professional version 1607 build 14393.969 64 bit
       2 Weeks Ago #6

    Ztruker said: View Post
    I asked if any of the folks in the AntiVirus, Firewalls and System Security forum could take a look at this. The dump showed q problem with CI.dll which is often caused by a boot sector virus.

    I'm not saying that is the problem here but I would like some one of those folk to check in and offer their opinion. I'm don't feel qualified to handle it if it is.
    Please post an image of what you saw.
      My ComputerSystem Spec

  7. Ztruker's Avatar
    Posts : 7,037
    Windows 10 Pro X64 1809 17763.134
       2 Weeks Ago #7

    >dps ffff93868181c000 ffff938681822000

    Code:
    ffff9386`81821378  fffff80d`2703a500Unable to load image \SystemRoot\system32\CI.dll, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for CI.dll
    *** ERROR: Module load completed but symbols could not be loaded for CI.dll
     CI+0x6a500
      My ComputersSystem Spec


  8. Posts : 22,705
    windows 10 professional version 1607 build 14393.969 64 bit
       2 Weeks Ago #8

    The brand new windbg can debugg other dump files but for this one it displayed:
    Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
    3: kd> !thread
    ffff838c42695080: Unable to get thread contents
    3: kd> !verifier
    fffff80666c38a60: Unable to get verifier list.
    3: kd> !sysinfo smbios
    sysinfo: could not find necessary interfaces.
    sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
    3: kd> !process
    Error in reading nt!_EPROCESS at ffff838c448ea08



    Using another computer that still has the oldest edition of windbg (Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64) there were no misbehaving drivers displayed in the debugging.

    The only CI displayed was:
    Code:
    ffff9386`81821378  fffff80d`2703a500 CI!SIPolicyQueryWindowsLockdownMode+0x44
    Code:
    ffff9386`81821378  fffff80d`2703a500Unable to load image \SystemRoot\system32\CI.dll, Win32 error 0n2
    It was the identical hexadecimal characters.


    So CI.dll may just be a symbol problem.
    Last edited by zbook; 2 Weeks Ago at 04:49.
      My ComputerSystem Spec

  9. Ztruker's Avatar
    Posts : 7,037
    Windows 10 Pro X64 1809 17763.134
       2 Weeks Ago #9

    There is a definite problem with your system Z. You need a clean install. !thread worked for me with that dump, as did dps.

    Code:
    Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [F:\Temp\Dumps\piotrusx\123018-6906-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols
    Symbol search path is: SRV*D:\Symbols
    Executable search path is: 
    Windows 10 Kernel Version 17763 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 17763.1.amd64fre.rs5_release.180914-1434
    Code:
    3: kd> !thread
    THREAD ffff838c42695080  Cid 1678.2e40  Teb: 000000654b524000 Win32Thread: 0000000000000000 RUNNING on processor 3
    Not impersonating
    GetUlongFromAddress: unable to read from fffff80666c22164
    Owning Process            ffff838c448ea080       Image:         smss.exe
    Attached Process          N/A            Image:         N/A
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      4953211      
    Context Switch Count      6              IdealProcessor: 3             
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address 0x00007ff7754f2ec0
    Stack Init ffff938681821c90 Current ffff9386818204c0
    Base ffff938681822000 Limit ffff93868181c000 Call 0000000000000000
    Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    ffff9386`81820658 fffff806`669e1369 : 00000000`0000000a 00000000`00000000 00000000`0000000f 00000000`00000000 : nt!KeBugCheckEx
    ffff9386`81820660 fffff806`669dd78e : ffff838c`39602000 fffff806`668df3a9 ffff4fef`ffba809c 00000000`674c5057 : nt!KiBugCheckDispatch+0x69
    ffff9386`818207a0 fffff806`6698ac31 : fffff806`6698ab89 00000000`00000002 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x44e (TrapFrame @ ffff9386`818207a0)
    ffff9386`81820938 fffff806`6698ab89 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00010000 : nt!KiCheckForDuplicateBugCheckCallback+0xd
    ffff9386`81820940 fffff80d`27271793 : ffff838c`3a4e6000 00000000`0000ff68 ffff838c`41e8c0a0 ffffe944`33304c57 : nt!KeRegisterBugCheckReasonCallback+0x79
    ffff9386`81820980 ffff838c`3a4e6000 : 00000000`0000ff68 ffff838c`41e8c0a0 ffffe944`33304c57 ffff838c`41e8c020 : WppRecorder+0x1793
    ffff9386`81820988 00000000`0000ff68 : ffff838c`41e8c0a0 ffffe944`33304c57 ffff838c`41e8c020 ffffe944`f0b83370 : 0xffff838c`3a4e6000
    ffff9386`81820990 ffff838c`41e8c0a0 : ffffe944`33304c57 ffff838c`41e8c020 ffffe944`f0b83370 ffff838c`41e8c018 : 0xff68
    ffff9386`81820998 ffffe944`33304c57 : ffff838c`41e8c020 ffffe944`f0b83370 ffff838c`41e8c018 fffff80d`27271b7b : 0xffff838c`41e8c0a0
    ffff9386`818209a0 ffff838c`41e8c020 : ffffe944`f0b83370 ffff838c`41e8c018 fffff80d`27271b7b ffff838c`41e8c010 : 0xffffe944`33304c57
    ffff9386`818209a8 ffffe944`f0b83370 : ffff838c`41e8c018 fffff80d`27271b7b ffff838c`41e8c010 00000000`00000000 : 0xffff838c`41e8c020
    ffff9386`818209b0 ffff838c`41e8c018 : fffff80d`27271b7b ffff838c`41e8c010 00000000`00000000 00000000`0000000a : win32kbase!RawInputManagerObject::bTouchInputAllowed+0x4
    ffff9386`818209b8 fffff80d`27271b7b : ffff838c`41e8c010 00000000`00000000 00000000`0000000a 000065b8`aecd2b84 : 0xffff838c`41e8c018
    ffff9386`818209c0 ffff838c`41e8c010 : 00000000`00000000 00000000`0000000a 000065b8`aecd2b84 ffff9386`81820a08 : WppRecorder+0x1b7b
    ffff9386`818209c8 00000000`00000000 : 00000000`0000000a 000065b8`aecd2b84 ffff9386`81820a08 ffff838c`41e8c040 : 0xffff838c`41e8c010
      My ComputersSystem Spec

  10.    2 Weeks Ago #10

    Interesting... I was having what I believe was the same issue zbook was having regarding symbols so I deleted my local symbol cache and now I'm getting results much more inline with Ztrucker. My system was able to resolve more symbols, though, for some reason.
    Code:
    3: kd> !thread
    THREAD ffff838c42695080  Cid 1678.2e40  Teb: 000000654b524000 Win32Thread: 0000000000000000 RUNNING on processor 3
    Not impersonating
    GetUlongFromAddress: unable to read from fffff80666c22164
    Owning Process            ffff838c448ea080       Image:         smss.exe
    Attached Process          N/A            Image:         N/A
    fffff78000000000: Unable to get shared data
    Wait Start TickCount      4953211      
    Context Switch Count      6              IdealProcessor: 3             
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
    UserTime                  00:00:00.000
    KernelTime                00:00:00.000
    Win32 Start Address 0x00007ff7754f2ec0
    Stack Init ffff938681821c90 Current ffff9386818204c0
    Base ffff938681822000 Limit ffff93868181c000 Call 0000000000000000
    Priority 9 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    ffff9386`81820658 fffff806`669e1369 : 00000000`0000000a 00000000`00000000 00000000`0000000f 00000000`00000000 : nt!KeBugCheckEx
    ffff9386`81820660 fffff806`669dd78e : ffff838c`39602000 fffff806`668df3a9 ffff4fef`ffba809c 00000000`674c5057 : nt!KiBugCheckDispatch+0x69
    ffff9386`818207a0 fffff806`6698ac31 : fffff806`6698ab89 00000000`00000002 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x44e (TrapFrame @ ffff9386`818207a0)
    ffff9386`81820938 fffff806`6698ab89 : 00000000`00000002 00000000`00000000 00000000`00000000 00000000`00010000 : nt!KiCheckForDuplicateBugCheckCallback+0xd
    ffff9386`81820940 fffff80d`27271793 : ffff838c`3a4e6000 00000000`0000ff68 ffff838c`41e8c0a0 ffffe944`33304c57 : nt!KeRegisterBugCheckReasonCallback+0x79
    ffff9386`81820980 fffff80d`27271b7b : ffff838c`41e8c010 00000000`00000000 00000000`0000000a 000065b8`aecd2b84 : WppRecorder!WppAutoLogCreateLog+0x147
    ffff9386`818209c0 ffffe944`f0bb772a : 00000000`00000000 00000000`00000000 00000000`00000000 ffffe944`f09bd8d6 : WppRecorder!WppAutoLogStart+0x33b
    ffff9386`81820b80 ffffe944`f0a34fef : ffff838c`3a9bfe20 00000000`00000000 00000000`00000000 ffff9386`81820d50 : win32kbase!WppInitKm+0x82
    ffff9386`81820bc0 ffffe944`f0bd4423 : 00000000`00000000 fffff780`00000004 00000000`00000000 ffffe944`f091ea70 : win32kbase!RIMInitializeAutoLogger+0x7f
    ffff9386`81820c50 ffffe944`f0e51030 : 00000000`00000010 00000000`00000000 ffff9386`818216c0 ffff9386`81820ec0 : win32kbase!DriverEntry+0xaa3
    ffff9386`81820e70 fffff806`66f1f709 : ffffe944`f0dd0000 ffff9386`81820f00 00000001`00000000 00000005`00020101 : win32k!GsDriverEntry+0x20
    ffff9386`81820ea0 fffff806`66dbecb0 : ffffe944`f0dd0000 ffffe944`f0dd00e0 00000000`00000000 ffffae0c`80000005 : nt!ExpInitializeSessionDriver+0x39
    ffff9386`81821020 fffff806`669e0d85 : 00000000`00000000 ffff838c`39ca17a0 ffff9386`818216c4 00000000`00000000 : nt!NtSetSystemInformation+0x7a0
    ffff9386`818214c0 fffff806`669d3840 : fffff806`66dbeb28 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffff9386`818214c0)
    ffff9386`81821658 fffff806`66dbeb28 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
    ffff9386`81821660 fffff806`669e0d85 : ffff838c`42695080 00000000`00000003 00000000`00000000 00000065`4b38f828 : nt!NtSetSystemInformation+0x618
    ffff9386`81821b00 00007fff`80792ab4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffff9386`81821b00)
    00000065`4b38f798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`80792ab4
      My ComputerSystem Spec


 
Page 1 of 2 12 LastLast

Related Threads
IRQL_NOT_LESS_OR_EQUAL on shutdown/restart in BSOD Crashes and Debugging
I keep having this bsod error appear on shutdown or restart and I am not sure what is causing it. It also has had an additional affect where disk check runs every time the computer restarts, even when the system has shut down normally. Here is the...
IRQL_NOT_LESS_OR_EQUAL BSOD error 0x0000000a in BSOD Crashes and Debugging
This isn't my issue, this is a friends issue that she needs to get sorted due to the fact it's happening at random times and she doesn't have an account on here and does not wish to make one. I have tried looking in BlueScreenView about this DMP...
I've posted this thread in multiple forums and eventually was led to here. I ran the Tenforums Log Zip filer (attached) but below is also attached other links just incase it does not work.
I keep getting a BSOD reading IRQL_NOT_LESS_OR_EQUAL along with instances where my computer just locks up completely. It happens at random and I haven't been able to figure out what's causing it. If my computer doesn't lock up on startup or crashes...
I am looking for some help attempting to find out what might have caused this BSOD. I have attached the appropriate file. Thank you!
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 04:52.
Find Us