xp wont boot into safe mode gives a BSOD

[Guest]

I am helping a friend with his computer. It works in normal mode fine but
recently when he tried to install Microsoft Flight simulator 2004 he said it
kept crashing and booting to safe mode. It also was infested with viruses
and spyware. He then asked me to help find out what was wrong. When
cleaning the infestations you have to boot to safe mode in order to clean
certain trojans and spyware. When I try to boot to safe mode it crashes to
the blue screen of death screen error message page. It a gives the
messages: IRQL_NOT_LESS_OR_EQUAL and the STOP 0a:
(0xF899F354,0x000000FF,0x00000001,0x80513D7F).

It also displays messages ocassionally after logon that I thought were the
result of the Flight Simulator failed install because after completely
cleaning the viruses and spyware I then uninstalled Flight Simulator
according to the instructions on its web page and the error messages stopped
for a while. But after attempting to boot to safe mode the error messages
have returned. The error messages are "Error signature--BCCode:a BCP1:
0008C910,BCP2:00000002,BCP3:00000000,BCP4:804ED834 and another BCCode:a
BCP1:00003010,BCP2:00000002,BCP3:00000000,BCP4:804ED834.

I have a feeling that some system files are damaged by the viruses or failed
flight simulator install.
I have ran sfc /scannow several times which has seemed to help. Is there
a way to force system file checker to replace all system files instead of
just checking them?

I have disabled almost all devices that can be disabled in device manager
which did not help. Except for the error messages I mentioned above
everything seems to work ok in normal mode. What would cause the computer
to crash when attempting to boot to safe mode?

AMD Athlon XP 1700+ 1.4GHz -- 504MB Ram-- Windows XP Pro
Thanks

 

[MatthewBrown]

Get your hands on a Windows CD, boot up and run a repair (you do not
want to run the recovery console).

Running a repair on a windows installation re-copies the original
Windows files off the CD onto the Harddrive.


Hook your friend up with:

1) AVG Anti-virus:
http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10342876.html?tag=lst-0-1
2) Microsoft Anti-Spyware:
http://www.download.com/Microsoft-Windows-AntiSpyware/3000-8022_4-10418686.html?tag=lst-0-2
[to download w.out Genuine Advantage check, search google]
3) Tell him/her to run chkdsk monthly/bi-weekly, and defrag weekly.
[scheduling tasks for defrag is fairly easy... scheduling chkdsk
requires some scripting... search google]


I can't answer your last question, and it doesn't matter if it's fixed,
right?


Peace,

Matt

 

[MatthewBrown]

oh yea, running a repair will not make him/her lose any programs, or
files. In fact, it won't even move his/her icons around on their
desktop, or change the desktop background.

Pretty nice, 'ey?

 

[Guest]

Thanks for answering my post! I have a question though. How do you run the
repair. The cd boot gives only 3 options --1."to set up windows xp now,
press enter", 2.--to repair a windows xp installation using Recovery console,
press R, and 3.--To quit Setup without installing Windows XP, press F3. Are
you referring to the automantic recovery option that shows when the cd first
boots up?

I have read a MS KB article about the repair feature you are talking about
but when I read more it seemed to be the recovery console the article
described.

 

[Peter Foldes]

IRQL_NOT_LESS_OR_EQUAL usually signifies a hardware problem

 

[Guest]

Thanks for your help!!! I did a google and answered my question about the
repair feature. I hadn't gone far enough in the windows xp setup to reach
the repair
option you were talking about. "a bit confusing to press r for both the
recovery console repair and also the copy files repair otion"

 

[David Candy]

804ED834

The driver at this address is most likely at fault.

I don't use safe mode (or recovery console) and nor will I be using it. So i don't know what works in it or not.

This is what one does in Normal mode to solve errors.

Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).

If this doesn't work try

Get your XP CD and install Windows Support Tools.


Type in start run after installing and rebooting


pstat > "%userprofile%\desktop\driverl­ist.txt"


The last table in this file is a list of loaded drivers. Other things apart
from hardware uses drivers. Post the list of drivers (the last table only -
REPEAT THE LAST TABLE O N L Y ) or match the fault address to the driver.

This will allow you to match memory addresses to a driver.

 

[David Candy]

No it doesn't. It is a driver error.

The only people here that I've seen attempt to solve stop screens in a thoughtful manner is Nutcase which is what Rick Rogers posted as till he became an MVP. [Which reminds me - whatever happened to Golem]

I post this crap over and over again not for the poster's benefit but for people like you. The answerers.

If you follow my procedure you will solve most problems that can be solved by a non MS or hardware mfg programmer. The only thing I don't include is advanced cleanboot troubleshooting (cause I find it too boring to do). If you followed my procedure you would have found the below info,

All of you except Rick are ordered to report to Sydney so I can bang your heads together. [I love giving orders - wonder if anyone will obey?]

Driver Development Tools: Windows DDK

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read
1: Write

4 Address which referenced memory


Cause
This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.

The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of Microsoft® Windows®, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

Resolving the Problem
If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or BIOS

1.. Restart your computer.
2.. Press F8 at the character-based menu that displays the operating system choices.
3.. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool

1.. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
2.. Try disabling memory caching of the BIOS.
3.. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner’s manual for your computer.
4.. Make sure the latest Service Pack is installed.
5.. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.
6.. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/slave/stand-alone setting. Try removing all IDE devices except for hard disks.
If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed on the Microsoft Windows Hardware Compatibility List (HCL).

Here is a debugging example:

kd> .bugcheck [Lists bugcheck data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb [Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv [Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is NULL.]

kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
Comments
Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.

Send feedback on this topic. / Built on Thursday, February 13, 2003

 

[Peter Foldes]

Thanks David. I will go there after you guys settled that political storm that is occasionally in your postings. I keep reading them. Very interesting. <g>
As far as Golem it now might be Galen who dropped out and is now back. Just speculating on my part.

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"David Candy" <.> wrote in message No it doesn't. It is a driver error.

The only people here that I've seen attempt to solve stop screens in a thoughtful manner is Nutcase which is what Rick Rogers posted as till he became an MVP. [Which reminds me - whatever happened to Golem]

I post this crap over and over again not for the poster's benefit but for people like you. The answerers.

If you follow my procedure you will solve most problems that can be solved by a non MS or hardware mfg programmer. The only thing I don't include is advanced cleanboot troubleshooting (cause I find it too boring to do). If you followed my procedure you would have found the below info,

All of you except Rick are ordered to report to Sydney so I can bang your heads together. [I love giving orders - wonder if anyone will obey?]

Driver Development Tools: Windows DDK

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read
1: Write

4 Address which referenced memory


Cause
This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.

The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of Microsoft® Windows®, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

Resolving the Problem
If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or BIOS

1.. Restart your computer.
2.. Press F8 at the character-based menu that displays the operating system choices.
3.. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool

1.. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
2.. Try disabling memory caching of the BIOS.
3.. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner’s manual for your computer.
4.. Make sure the latest Service Pack is installed.
5.. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.
6.. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/slave/stand-alone setting. Try removing all IDE devices except for hard disks.
If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed on the Microsoft Windows Hardware Compatibility List (HCL).

Here is a debugging example:

kd> .bugcheck [Lists bugcheck data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb [Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv [Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is NULL.]

kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
Comments
Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.

Send feedback on this topic. / Built on Thursday, February 13, 2003

 

[Gerry Cornell]

Now now stop squabbling <g>.

Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors
http://support.microsoft.com/?kbid=183169&sd=RMVP

--

~~~~

Gerry

"David Candy" <.> wrote in message
No it doesn't. It is a driver error.

The only people here that I've seen attempt to solve stop screens in a
thoughtful manner is Nutcase which is what Rick Rogers posted as till he
became an MVP. [Which reminds me - whatever happened to Golem]

I post this crap over and over again not for the poster's benefit but
for people like you. The answerers.

If you follow my procedure you will solve most problems that can be
solved by a non MS or hardware mfg programmer. The only thing I don't
include is advanced cleanboot troubleshooting (cause I find it too
boring to do). If you followed my procedure you would have found the
below info,

All of you except Rick are ordered to report to Sydney so I can bang
your heads together. [I love giving orders - wonder if anyone will
obey?]

Driver Development Tools: Windows DDK

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This
indicates that Windows or a kernel-mode driver accessed paged memory at
DISPATCH_LEVEL or above.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read
1: Write

4 Address which referenced memory


Cause
This bug check is issued if paged memory (or invalid memory) is accessed
when the IRQL is too high.

The error that generates this bug check usually occurs after the
installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of
Microsoft® Windows®, this error might be caused by a device driver, a
system service, a virus scanner, or a backup tool that is incompatible
with the new version.

Resolving the Problem
If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or
BIOS

1.. Restart your computer.
2.. Press F8 at the character-based menu that displays the operating
system choices.
3.. Select the Last Known Good Configuration option from the Windows
Advanced Options menu. This option is most effective when only one
driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system
service, virus scanner, or backup tool

1.. Check the System Log in Event Viewer for error messages that might
identify the device or driver that caused the error.
2.. Try disabling memory caching of the BIOS.
3.. Run the hardware diagnostics supplied by the system manufacturer,
especially the memory scanner. For details on these procedures, see the
owner’s manual for your computer.
4.. Make sure the latest Service Pack is installed.
5.. If your system has small computer system interface (SCSI)
adapters, contact the adapter manufacturer to obtain updated Windows
drivers. Try disabling sync negotiation in the SCSI BIOS, checking the
cabling and the SCSI IDs of each device, and confirming proper
termination.
6.. For integrated device electronics (IDE) devices, define the
onboard IDE port as Primary only. Also, check each IDE device for the
proper master/slave/stand-alone setting. Try removing all IDE devices
except for hard disks.
If the message appears during an installation of Windows, make sure that
the computer and all installed peripherals are listed on the Microsoft
Windows Hardware Compatibility List (HCL).

Here is a debugging example:

kd> .bugcheck [Lists bugcheck data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb [Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv [Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO:
[0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO:
[0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8 [Gets the registers for the trap frame at the
time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000
edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na
pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is
NULL.]

kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002
elnkii!_ElnkiiRcvInterruptDpc+0x1d0
Comments
Before upgrading to a new version of Windows, remove all third-party
device drivers and system services, and disable any virus scanners.
Contact the software manufacturers to obtain updates of these
third-party tools.

Send feedback on this topic. / Built on Thursday, February 13, 2003

 

[Gerry Cornell]

Duc

Perhaps this Article will help you troubleshoot:
Troubleshooting a Stop 0x0000000A error in Windows XP
http://support.microsoft.com/kb/314063/EN-US/

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[David Candy]

http://margokingston.typepad.com/harry_version_2/2005/10/post.html#comment-10738769

My latest post in response to a comment about the chance of a suitcase nuke at the sydney olympics. The man in charge said he took precautions and someone else said it was a waste of time. This is one of my responses on the page I did a couple of hours ago..

--
--------------------------------------------------------------------------------------------------
Read David defending the concept of violence.
http://margokingston.typepad.com/harry_version_2/2005/10/entering_the_ga.html#more
=================================================
Thanks David. I will go there after you guys settled that political storm that is occasionally in your postings. I keep reading them. Very interesting. <g>
As far as Golem it now might be Galen who dropped out and is now back. Just speculating on my part.

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"David Candy" <.> wrote in message No it doesn't. It is a driver error.

The only people here that I've seen attempt to solve stop screens in a thoughtful manner is Nutcase which is what Rick Rogers posted as till he became an MVP. [Which reminds me - whatever happened to Golem]

I post this crap over and over again not for the poster's benefit but for people like you. The answerers.

If you follow my procedure you will solve most problems that can be solved by a non MS or hardware mfg programmer. The only thing I don't include is advanced cleanboot troubleshooting (cause I find it too boring to do). If you followed my procedure you would have found the below info,

All of you except Rick are ordered to report to Sydney so I can bang your heads together. [I love giving orders - wonder if anyone will obey?]

Driver Development Tools: Windows DDK

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Memory referenced
2 IRQL at time of reference
3 0: Read
1: Write

4 Address which referenced memory


Cause
This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.

The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of Microsoft® Windows®, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

Resolving the Problem
If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or BIOS

1.. Restart your computer.
2.. Press F8 at the character-based menu that displays the operating system choices.
3.. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool

1.. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
2.. Try disabling memory caching of the BIOS.
3.. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner’s manual for your computer.
4.. Make sure the latest Service Pack is installed.
5.. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.
6.. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/slave/stand-alone setting. Try removing all IDE devices except for hard disks.
If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed on the Microsoft Windows Hardware Compatibility List (HCL).

Here is a debugging example:

kd> .bugcheck [Lists bugcheck data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb [Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv [Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is NULL.]

kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
Comments
Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.

Send feedback on this topic. / Built on Thursday, February 13, 2003