IRQL not less or equal BSOD

Hoovy · 08 Jun 2016

Hi all. This is my first post on the forums so please guide me along.

Toshiba PORTEGE R380 x64 based processor, 64bit OS.

Before wanting to post on the forums, I tried to solve the solution using a couple of methods. The first was to check if there was malware on my computer. After using malwarebytes it seemed to work, but it was just a while before the next bsod came. I then tried to use the driver verifier to see if it was a BIOS problem but that ended in a endless BSOD loop too. Next, I downloaded WindowsDebuggingTools and tried to analyse the crash dump files for myself but I couldn't really understand and hoped that someone could shed some light and educate me on how to solve this problem.

oh and fyi, while typing this thread my computer bsod on me again. Just goes to show unpredictable the current state of this laptop is. Sometimes by just using spotify or surfing google chrome only, it will just bsod. I really appreciate the help of everyone. thank you.

I will copy and paste the wall of text of the analysis of the most recent dump file from the WinDbg here too:

Code:

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff80375e6a310, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000066, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80375e6a310, address which referenced memory


Debugging Details:
------------------




DUMP_CLASS: 1


DUMP_QUALIFIER: 400


BUILD_VERSION_STRING:  10240.16590.amd64fre.th1_st1.151104-1714


SYSTEM_MANUFACTURER:  TOSHIBA


SYSTEM_PRODUCT_NAME:  PORTEGE R830


SYSTEM_SKU:  0000000000


SYSTEM_VERSION:  PT321L-01H01H


BIOS_VENDOR:  TOSHIBA


BIOS_VERSION:  Version 4.10  


BIOS_DATE:  01/08/2013


BASEBOARD_MANUFACTURER:  TOSHIBA


BASEBOARD_PRODUCT:  Portable PC


BASEBOARD_VERSION:  Version A0


DUMP_TYPE:  2


DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump


BUGCHECK_P1: fffff80375e6a310


BUGCHECK_P2: ff


BUGCHECK_P3: 66


BUGCHECK_P4: fffff80375e6a310


READ_ADDRESS: fffff803759db500: Unable to get MiVisibleState
 fffff80375e6a310 


CURRENT_IRQL:  0


FAULTING_IP: 
hal!KeQueryPerformanceCounter+0
fffff803`75e6a310 4056            push    rsi


IP_IN_PAGED_CODE: 
hal!KeQueryPerformanceCounter+0
fffff803`75e6a310 4056            push    rsi


CPU_COUNT: 4


CPU_MHZ: a83


CPU_VENDOR:  GenuineIntel


CPU_FAMILY: 6


CPU_MODEL: 2a


CPU_STEPPING: 7


CPU_MICROCODE: 6,2a,7,0 (F,M,S,R)  SIG: 29'00000000 (cache) 29'00000000 (init)


CUSTOMER_CRASH_COUNT:  1


DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT


BUGCHECK_STR:  AV


PROCESS_NAME:  System


ANALYSIS_SESSION_HOST:  YQH


ANALYSIS_SESSION_TIME:  06-09-2016 00:02:52.0371


ANALYSIS_VERSION: 10.0.10586.567 x86fre


TRAP_FRAME:  ffffd00088d9b6f0 -- (.trap 0xffffd00088d9b6f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000040678 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff8037593c948 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80375e6a310 rsp=ffffd00088d9b888 rbp=ffffd00083bee180
 r8=ffffe0015ed3fbd8  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl zr na po nc
hal!KeQueryPerformanceCounter:
fffff803`75e6a310 4056            push    rsi
Resetting default scope


LAST_CONTROL_TRANSFER:  from fffff80375770ea9 to fffff803757664d0


FAILED_INSTRUCTION_ADDRESS: 
hal!KeQueryPerformanceCounter+0
fffff803`75e6a310 4056            push    rsi


STACK_TEXT:  
ffffd000`88d9b5a8 fffff803`75770ea9 : 00000000`0000000a fffff803`75e6a310 00000000`000000ff 00000000`00000066 : nt!KeBugCheckEx
ffffd000`88d9b5b0 fffff803`7576f6c8 : 00000000`00000001 ffffe001`5f0e1230 ffffe001`5f0e1230 fffff803`75e6cca6 : nt!KiBugCheckDispatch+0x69
ffffd000`88d9b6f0 fffff803`75e6a310 : fffff803`75624d17 ffffe001`5ff118b0 ffffe001`5ecd7300 00000000`00000000 : nt!KiPageFault+0x248
ffffd000`88d9b888 fffff803`75624d17 : ffffe001`5ff118b0 ffffe001`5ecd7300 00000000`00000000 ffffe001`5ff118b0 : hal!KeQueryPerformanceCounter
ffffd000`88d9b890 fffff803`75623ded : 00000000`00000000 00000000`00000002 00000000`00000000 00000000`00000000 : nt!PpmIdleExecuteTransition+0xd77
ffffd000`88d9bb00 fffff803`757691fc : ffffd000`83bee180 ffffd000`83bee180 ffffd000`83bfabc0 ffffe001`5b20c800 : nt!PoIdle+0x33d
ffffd000`88d9bc60 00000000`00000000 : ffffd000`88d9c000 ffffd000`88d96000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c




STACK_COMMAND:  kb


THREAD_SHA1_HASH_MOD_FUNC:  b69565281c35e22a5b2efb28ef63a2bf8496d0c7


THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  e98975e3100bd24cfb6ed68aa3ed1af6e4da4225


THREAD_SHA1_HASH_MOD:  e2266a530ca7fbace00cfa9add8dc0ac4504d759


FOLLOWUP_IP: 
nt!KiPageFault+248
fffff803`7576f6c8 33c0            xor     eax,eax


FAULT_INSTR_CODE:  ffb0c033


SYMBOL_STACK_INDEX:  2


SYMBOL_NAME:  nt!KiPageFault+248


FOLLOWUP_NAME:  MachineOwner


MODULE_NAME: nt


IMAGE_NAME:  ntkrnlmp.exe


DEBUG_FLR_IMAGE_TIMESTAMP:  563ad7f4


IMAGE_VERSION:  10.0.10240.16590


BUCKET_ID_FUNC_OFFSET:  248


FAILURE_BUCKET_ID:  AV_CODE_AV_PAGED_IP_nt!KiPageFault


BUCKET_ID:  AV_CODE_AV_PAGED_IP_nt!KiPageFault


PRIMARY_PROBLEM_CLASS:  AV_CODE_AV_PAGED_IP_nt!KiPageFault


TARGET_TIME:  2016-06-08T15:32:24.000Z


OSBUILD:  10240


OSSERVICEPACK:  0


SERVICEPACK_NUMBER: 0


OS_REVISION: 0


SUITE_MASK:  272


PRODUCT_TYPE:  1


OSPLATFORM_TYPE:  x64


OSNAME:  Windows 10


OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS


OS_LOCALE:  


USER_LCID:  0


OSBUILD_TIMESTAMP:  2015-11-05 12:15:48


BUILDDATESTAMP_STR:  151104-1714


BUILDLAB_STR:  th1_st1


BUILDOSVER_STR:  10.0.10240.16590.amd64fre.th1_st1.151104-1714


ANALYSIS_SESSION_ELAPSED_TIME: 12b1


ANALYSIS_SOURCE:  KM


FAILURE_ID_HASH_STRING:  km:av_code_av_paged_ip_nt!kipagefault


FAILURE_ID_HASH:  {50bb7d1a-5796-c44f-b81d-f0fb976295ad}


Followup:     MachineOwner

I'm sorry if this isn't the standard protocol.
But thank you anyway to whoever that helps!

Hoovy

Hoovy · 08 Jun 2016

I went to research a bit more, using info from the 7forums configuring the debugging tools page (here), and realised that the specific stack of threads that caused my laptop to crash was something innate within the computer itself.

# Child-SP RetAddr Call Site
00 ffffd000`88d9b5a8 fffff803`75770ea9 nt!KeBugCheckEx
01 ffffd000`88d9b5b0 fffff803`7576f6c8 nt!KiBugCheckDispatch+0x69
02 ffffd000`88d9b6f0 fffff803`75e6a310 nt!KiPageFault+0x248
03 ffffd000`88d9b888 fffff803`75624d17 hal!KeQueryPerformanceCounter
04 ffffd000`88d9b890 fffff803`75623ded nt!PpmIdleExecuteTransition+0xd77
05 ffffd000`88d9bb00 fffff803`757691fc nt!PoIdle+0x33d
06 ffffd000`88d9bc60 00000000`00000000 nt!KiIdleLoop+0x2c

The top most thread is the chronologically most recent thread before the crash. And this thread is from the NT kernel.
I have read on other forums that some BSOD that other people face is due to the NT system when using a Windows 10 system.
Previously, I had also took the time to update my drivers using DeviceManager.

Just a quick addition to the main thread.

Ztruker · 08 Jun 2016

The zip file you uploaded is empty. Please run it again following directions. Try running it as Administrator by right clicking on DM_Log_collector.exe and select Run as Administrator.

Upload the zip file here. Check it first to make sure it's not empty.

Hoovy · 09 Jun 2016

Hi Ztruker. Thank you for replying this thread.

I followed your instructions, but the resulting was still empty even after running it as administrator.
How do I solve this issue?

axe0 · 09 Jun 2016

Hi Hoovy,

Welcome to the 10forums :)

That is a function that creates the BSOD when something went wrong in kernel mode, this is not the cause but the result.
What the cause is and/or why a crash occured cannot be said properly without the dump itself and possible other data the DM Log Collector provides.

I then tried to use the driver verifier to see if it was a BIOS problem

I hope you mean 'driver problem'...

Try the BAT version.
Attachment 84172

Hoovy · 09 Jun 2016

Hi axe0. Thank you for replying.

axe0 said:

I hope you mean 'driver problem'...
Attachment 84172

Yes, I meant driver problem. Thanks for the clarification.

I tried to use the BAT version as you instructed but I checked the ZIP file and it was also empty. What should I do next?

axe0 · 09 Jun 2016

Before you close the command prompt, does the SF folder on the desktop contain files?
If it does then create a zip of this folder and upload it, then let the DM Log Collector finish.

Hoovy · 09 Jun 2016

@axe0

Here is the zip of SFdebugfiles.

Thanks
Hoovy

axe0 · 09 Jun 2016

I suggest that you cleanup your %systemroot%\minidump folder and delete all dumps BEFORE april 2016 & update Windows 10 to Windows 10586.
Windows 10 - Upgrade Installation - Windows 10 Forums

Hoovy · 09 Jun 2016

Hi axe0.

I have done up the minidump folder to the most recent entries.
I have also updated to windows build 10586, albeit after much difficulty.

What should I do next?