Windows Forum

Ask something
Question Locked

XP BSOD IRQL not less or equal error

0 helpful
13 replies

by sheerluck.holmes

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When doing a refresh view of comm ports I get the BSOD...error 0x1000000a (0x0000ffdf, 0x00000002, 0x00000001, 0x806e6a8e)

I've updated the bios, updated windows etc...and to no avail, this BSOD keeps repeating...

Any clues on how to fix this once and for all would be oh-so-welcome!!!

13 replies

by rob miners

Click Start, right mouse click Computer and select Properties. Select Advanced System Properties, continue. Select Settings for Startup and Recovery. Untick Automatically Restart.

Minidump Files can be found here. C:\WINDOWS\Minidump\Mini******-**.dmp

How to read the small memory dump files that Windows creates for debugging

http://support.microsoft.com/kb/315263

To download and install the Windows debugging tools, visit the following Microsoft Web site:

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Instructions on using Windbg.

Open Windbg and select file, Symbol file path and brows to the Symbol folder that you have downloaded and installed Symbols to, select OK.

Close the workpage and save the Workspace information. This should lock in the Symbol path.

Open Windbg and select file and select Open Crash Dump then navigate to the minidump, highlight it and select Open.

There are two ways to use !analyze -v the easiest is to click on !analyze -v under Bugcheck Analysis.

When you have ran the initial dump if you look to the bottom of the screen you will see kd> to the right of that type in !analyze -v and press the Enter key.

Ctrl + a will let you copy the information and paste it into notepad.

Look to the bottom of the page for information like this. This was fixed by updating the Graphics Drivers.

FAULTING_THREAD: 864f6a98

DEFAULT_BUCKET_ID: GRAPHICS_DRIVER_FAULT

CUSTOMER_CRASH_COUNT: 1

BUGCHECK_STR: 0xEA

PROCESS_NAME: logon.scr

LAST_CONTROL_TRANSFER: from 00000000 to bfef0fea

STACK_TEXT: f6434e6c 00000000 00000000 00000000 00000000 sgiul50!DrvBitBlt+0x585

STACK_COMMAND: .thread 0xffffffff864f6a98 ; kb

FOLLOWUP_IP: sgiul50!DrvBitBlt+585 bfef0fea 75f9 jne sgiul50!DrvBitBlt+0x580 (bfef0fe5)

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: sgiul50!DrvBitBlt+585

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: sgiul50

IMAGE_NAME: sgiul50.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7dfec7

FAILURE_BUCKET_ID: 0xEA_IMAGE_sgiul50.dll_DATE_2001_08_18

BUCKET_ID: 0xEA_IMAGE_sgiul50.dll_DATE_2001_08_18

Keep us informed as to your progress if you require further assistance. ;) :D

by sheerluck.holmes

After 18 hours, symbols finally downloaded...they installed to c:/windows/symbols which is the path i then specified in windbg...i opened the minidump file and got this:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini043009-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Thu Apr 30 21:00:16.562 2009 (GMT-4)
System Uptime: 0 days 0:04:45.226
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
...........
*** WARNING: Unable to verify timestamp for hal.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {ffdf, 2, 1, 80723a8e}

Unable to load image btport.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for btport.sys
*** ERROR: Module load completed but symbols could not be loaded for btport.sys
Probably caused by : btport.sys ( btport+3fa4 )

Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000ffdf, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80723a8e, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 0000ffdf

CURRENT_IRQL: 2

FAULTING_IP:
hal!HalpAllocateAdapterCallback+2c
80723a8e 8902 mov dword ptr [edx],eax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: CDR.EXE

LAST_CONTROL_TRANSFER: from 00000000 to 80723a8e

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: ffffffffb34b6b20

STACK_COMMAND: dds B34B6B20-0x20 ; kb

STACK_TEXT:
b34b6b00 00000002
b34b6b04 80723a8e hal!HalpAllocateAdapterCallback+0x2c
b34b6b08 00000008
b34b6b0c 00010282
b34b6b10 00000002
b34b6b14 804e81c5 nt!MiMakeOutswappedPageResident+0xd
b34b6b18 b34b6b28
b34b6b1c b959ffa4 btport+0x3fa4
b34b6b20 b34b6b24
b34b6b24 89829c70
b34b6b28 b34b6b50
b34b6b2c b959f973 btport+0x3973
b34b6b30 89829c70
b34b6b34 b34b6ba0
b34b6b38 89829c70
b34b6b3c b959f8c2 btport+0x38c2
b34b6b40 89829c70
b34b6b44 89829df4
b34b6b48 89829d00
b34b6b4c 00000000
b34b6b50 b34b6b74
b34b6b54 b959dadd btport+0x1add
b34b6b58 89829d00
b34b6b5c 89829ce4
b34b6b60 b34b6ba0
b34b6b64 00000001
b34b6b68 89829c00
b34b6b6c 89829c70
b34b6b70 00000000
b34b6b74 b34b6bc4
b34b6b78 b959f905 btport+0x3905
b34b6b7c 89829c70

FOLLOWUP_IP:
btport+3fa4
b959ffa4 ?? ???

SYMBOL_NAME: btport+3fa4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: btport

IMAGE_NAME: btport.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 452b28e8

FAILURE_BUCKET_ID: 0xA_btport+3fa4

BUCKET_ID: 0xA_btport+3fa4

Followup: MachineOwner
---------

Next step (lol) ???

by rob miners

CDR CryptDrive? Possibly Malware.

btport.sys Bluetooth Virtual Communications Driver? Did you install this software. You may have to update the drivers if you did.
It won't hurt to try this.

Follow the steps below with the System started and restarted in Safe Mode with Networking. Running in Safe Mode loads a minimal set of drivers for the Operating System. You can use these options to start Windows so that you can modify the registry or load or remove drivers.

With the new strains of Virus that have been created you may find it necessary to rename the executable files so that they will work. Rename mbam-setup.exe and then navigate to the install folder and rename mbam.exe. Do not change the files extension from .exe. Do the same with Spybot.

Removing malware from System Restore points
To remove the malware, you must first disable System Restore, then scan the system with up-to-date antivirus software - allowing it to clean, delete, or quarantine any viruses found. After the system has been disinfected, you may then re-enable System Restore. The steps for disabling System Restore vary, depending on whether the default Start Menu or the Classic Start Menu is being used.

Default Start Menu XP
If using the default Start Menu, click Start | Control Panel | Performance and Maintenance | System. Select the System Restore tab and check "Turn off System Restore".

Classic Start Menu XP
If using the Classic Start Menu, click Start | Settings | Control Panel and double-click the System icon. Select the System Restore tab and check "Turn off System Restore".

Vista
Start, right mouse click Computer and select Properties. Select Advanced System Properties, click contine and then System Protection. Untick the box nect to Local Disk C: and click on Turn System Restore off.

After scanning the system and removing the offending malware, re-enable System Restore by repeating the steps, this time removing the check from "Turn off System Restore".

Download Malwarebytes Anti-Malware, install it and update it.

Malwarebytes

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
mbam-rules

I would keep scanning with it until it is clean by closing out and rebooting and running it again.

Download Spybot - Search & Destroy and install it. Update it and run it.

Spybot

Also run this Rootkit Revealer GMer
http://www.gmer.net/index.php

FAQ
http://www.gmer.net/faq.php

Just to be on the safe side when you finish do an online scan with Bitdefender or Google for an online scanner.

http://www.bitdefender.com/scan8/ie.html

by sheerluck.holmes

You should have said "Send me $40 U.S. for my software which may or may not solve your problem"

Spamming people is no way to promote a product!

by oh smeg

Naturally I didn't download the file as I have no need for it but every place that I looked suggested that as a cure.

Col

by older mycroft

... and guess what?

It found over [b]1400 ERRORS!![/b] which, of course, it refuses to 'fix' until the passing of $39.95 into oblivion.

I wouldn't be at all surprised that it either wouldn't 'fix' them after payment had been made - or to put it in a better way, it wouldn't have needed to because they never existed.

It is a complete set of snipped bollox, if you get my drift.

Very cunningly marketed via various sites, but scare-ware nonetheless. ;)

Unlike un-snipped bollox which are very productive - and you get them for FREE! :^0

by sheerluck.holmes

Actually CDR is a software release from Bosch Industries (auto manufacturers) called Crash Data Retrieval
No malware contained therein however I'll run through the steps outlined in your reply anyway...who knows what's lurking in the depths ?!

by sheerluck.holmes

Yes I did have the most recent version of the software. The 'btport.sys'file was actually part of Lenovo's bluetooth connectivity suite packaged with the T61 laptops. It was reserving COM5, which the CDR software looked to, and subsequently caused the conflict (i think). Either way, I uninstalled CDR, renamed btport.sys to btport_old.sys, then went to device manager and deleted the bluetooth COM5 assignment.
Re-boot then reinstalled CDR software...ta da!

Thanks again for all your input ! Stellar !
...and if you're ever in Toronto, Canada....

This discussion is closed to new replies.