Urgent help needed on dump - IRQL_NOT_LESS_OR_EQUAL

Hi

I am used to application stacks and dumps but not kernel.
I am in Sydney and my collegue is trying to get some sleep in europe (11:30am here as i type)
trying to resolve crashes on a customer system that is Blue Screening.
We managed to get a full dump and a summary follows (using windbg) :

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000c, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80416b67, address which referenced memory

Stack

STACK_TEXT:
ed42fcd0 80416b67 00000003 8046b60a 818a5570 nt!KiTrap0E+0x27c
ed42fd44 804a517c 00000000 00000001 800695c0 nt!ExAcquireResourceExclusiveLite+0xd
ed42fd64 8044f8be 81459be8 80483a90 8046dc20 nt!ObpRemoveObjectRoutine+0x47
ed42fd78 804191b5 00000000 00000000 00000000 nt!ObpProcessRemoveObjectQueue+0x34
ed42fda8 80455a16 00000000 00000000 00000000 nt!ExpWorkerThread+0xae
ed42fddc 80469bb2 804190f0 00000000 00000000 nt!PspSystemThreadStartup+0x69
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FAULTING_IP:
nt!ExAcquireResourceExclusiveLite+d
80416b67 6683790c00 cmp word ptr [ecx+0xc],0x0

on Windows 2000 SP4

>> I am hoping to get some answers back to him.

>> Is there some way for me to establish for which process/thread the OS was doing this request for ? The processes and threads option just brings up ntoskrnl.exe

I can see that ECX is the problem as its value is zero !!!

Now this issue happened after hours of operation so it can't be as simple as h/w with the wrong settings as its all been exercised 1000s or millions of time before the crash.

>> So i am after hints, things to do to try to resolve who is at fault

Thanks heaps and i wish really good karma on you for helping !!

 

Hi,

If it is full memory dump, issue line command !thread or !process 0 and it displays the current thread and process name. Issue the command lmtn and it displays the load module list. Paste the output the load module here.


IRQL ff is usually related to faulty ram, device driver error or improper software installation. I have 15 confirmed case of IRQL ff. 8 are resolved by re-installation of windows, 2 is RAM, 2 is CPU, 1 is M/B, 1 is Hide Folder and 1 is ATI display card driver.

 

Thanks for the quick reponse,
it is a full dump. the pc has matrox g400 graphics card
and some other specialised cards to talk to industrial hardware.

The !process 0 list is enormous the thread is below

The owning process is 818a89e0 so if this is a memory space address it
is not a user application.

I can't seem to see a process name anywhere ?

Thanks again

THREAD 818a71c0 Cid 8.18 Teb: 00000000 Win32Thread: 00000000 RUNNING
Not impersonating
Owning Process 818a89e0
Wait Start TickCount 1244620 Elapsed Ticks: 0
Context Switch Count 20462
UserTime 0:00:00.0000
KernelTime 0:00:00.0076
Start Address nt!ExpWorkerThread (0x804190f0)
Stack Init ed430000 Current ed42fd34 Base ed430000 Limit ed42d000 Call 0
Priority 13 BasePriority 13 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
ed42fcd0 80416b67 00000003 8046b60a 818a5570 nt!KiTrap0E+0x27c
ed42fd44 804a517c 00000000 00000001 800695c0 nt!ExAcquireResourceExclusiveLite+0xd
ed42fd64 8044f8be 81459be8 80483a90 8046dc20 nt!ObpRemoveObjectRoutine+0x47
ed42fd78 804191b5 00000000 00000000 00000000 nt!ObpProcessRemoveObjectQueue+0x34
ed42fda8 80455a16 00000000 00000000 00000000 nt!ExpWorkerThread+0xae
ed42fddc 80469bb2 804190f0 00000000 00000000 nt!PspSystemThreadStartup+0x69
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16



kd> lmtn
start end module name
80062000 800794e0 hal hal.dll Thu Jan 16 06:41:57 2003 (3E25B985)
80400000 805a3a00 nt ntoskrnl.exe Wed Jun 11 15:37:06 2003 (3EE6C002)
a0000000 a01a35a0 win32k win32k.sys Fri May 02 13:47:08 2003 (3EB1EA3C)
ba3ba000 ba3c9a20 ipsec ipsec.sys Wed Apr 30 09:04:59 2003 (3EAF051B)
ba5a6000 ba5e1bc0 srv srv.sys Wed Apr 30 09:05:07 2003 (3EAF0523)
ba61a000 ba628fe0 Cdfs Cdfs.SYS Wed Apr 16 13:58:53 2003 (3E9CD4FD)
ba6aa000 ba6bca00 SENTINEL SENTINEL.SYS Thu Sep 26 15:47:32 2002 (3D929F74)
ba7ad000 ba7ca4a0 afd afd.sys Wed Apr 30 18:45:29 2003 (3EAF8D29)
bb8e3000 bbb35000 G400DHD G400DHD.dll unavailable (FFFFFFFE)
bdb35000 bdb4a180 dump_atapi dump_atapi.sys Wed Apr 02 05:08:25 2003 (3E89D599)
bdb4b000 bdb6d3c0 Fastfat Fastfat.SYS Thu Jan 16 06:48:39 2003 (3E25BB17)
bdb96000 bdbfc240 mrxsmb mrxsmb.sys Fri May 23 08:46:57 2003 (3ECD5361)
bdc0f000 bdc399c0 rdbss rdbss.sys Fri May 23 08:47:05 2003 (3ECD5369)
bdc62000 bdc8b1a0 netbt netbt.sys Thu May 22 11:51:10 2003 (3ECC2D0E)
bdc8c000 bdcdd060 tcpip tcpip.sys Wed Apr 30 09:05:31 2003 (3EAF053B)
bdcf0000 bdd243e0 UdfReadr UdfReadr.SYS Thu Oct 25 06:59:45 2001 (3BD72BC1)
bdd37000 bdd71440 cdudf cdudf.SYS Thu Oct 25 06:48:17 2001 (3BD72911)
bfdba000 bfde43a0 update update.sys Wed Apr 16 14:22:01 2003 (3E9CDA69)
bfde5000 bfe00b40 ks ks.sys Wed Apr 16 14:02:11 2003 (3E9CD5C3)
bfe01000 bfe15380 pwd_2K pwd_2K.SYS Thu Dec 27 10:59:10 2001 (3C2A644E)
bfe16000 bfe2cba0 ndiswan ndiswan.sys Wed Apr 30 09:05:01 2003 (3EAF051D)
bfe2d000 bfe7a400 g400dhm g400dhm.sys Fri Feb 15 06:44:23 2002 (3C6C1397)
bfe9b000 bfeb0640 Mup Mup.sys Thu Jan 16 06:54:01 2003 (3E25BC59)
bfeb1000 bfedaaa0 NDIS NDIS.sys Wed Apr 30 09:05:01 2003 (3EAF051D)
bfedb000 bff5d5a0 Ntfs Ntfs.sys Sat May 10 05:46:45 2003 (3EBC05A5)
bff5e000 bff6f7c0 KSecDD KSecDD.sys Thu Mar 27 08:37:44 2003 (3E821DA8)
bff70000 bff820c0 SCSIPORT SCSIPORT.SYS Sat May 17 11:11:02 2003 (3EC58C26)
bff83000 bff98180 atapi atapi.sys Wed Apr 02 05:08:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Thu Jan 16 06:47:04 2003 (3E25BAB8)
bffbb000 bffd7220 ftdisk ftdisk.sys Tue Apr 01 09:21:58 2003 (3E88BF86)
bffd8000 bffffc20 ACPI ACPI.sys Thu Jan 16 06:44:22 2003 (3E25BA16)
ed000000 ed00e6a0 pci pci.sys Thu Jan 16 06:44:07 2003 (3E25BA07)
ed010000 ed01b680 isapnp isapnp.sys Thu Jan 16 06:43:47 2003 (3E25B9F3)
ed020000 ed028100 ultra66 ultra66.sys Sun Sep 26 05:11:46 1999 (37ED1E72)
ed030000 ed038700 CLASSPNP CLASSPNP.SYS Thu Jan 16 06:42:51 2003 (3E25B9BB)
ed060000 ed06c4c0 VIDEOPRT VIDEOPRT.SYS Thu Jan 16 06:47:20 2003 (3E25BAC8)
ed070000 ed07ca80 rasl2tp rasl2tp.sys Wed Apr 30 09:05:06 2003 (3EAF0522)
ed080000 ed08bc40 raspptp raspptp.sys Thu May 15 09:47:00 2003 (3EC2D574)
ed090000 ed09ea20 parallel parallel.sys Thu Jan 16 06:47:14 2003 (3E25BAC2)
ed0a0000 ed0af000 el90xbc5 el90xbc5.sys Wed Oct 20 03:09:18 1999 (380CA5BE)
ed0b0000 ed0bd6e0 Cdr4_2K Cdr4_2K.SYS Sat Oct 13 04:15:17 2001 (3BC73335)
ed0c0000 ed0cb680 i8042prt i8042prt.sys Wed Apr 16 14:00:59 2003 (3E9CD57B)
ed0d0000 ed0d9ce0 NDProxy NDProxy.SYS Fri Oct 01 09:25:35 1999 (37F3F16F)
ed0f0000 ed0f8fa0 Npfs Npfs.SYS Sun Oct 10 09:58:07 1999 (37FFD68F)
ed100000 ed108680 msgpc msgpc.sys Thu Jan 16 06:54:25 2003 (3E25BC71)
ed110000 ed1181a0 netbios netbios.sys Wed Oct 13 05:34:19 1999 (38038D3B)
ed1d0000 ed1d8240 Fips Fips.SYS Wed May 10 01:28:29 2000 (39182E9D)
ed280000 ed285520 PCIIDEX PCIIDEX.SYS Wed Feb 26 05:31:08 2003 (3E5BB66C)
ed288000 ed28f140 MountMgr MountMgr.sys Wed Feb 05 07:15:15 2003 (3E401F53)
ed290000 ed297720 disk disk.sys Thu Jan 16 06:43:05 2003 (3E25B9C9)
ed298000 ed29d100 agp440 agp440.sys Thu Jan 16 06:47:07 2003 (3E25BABB)
ed2c0000 ed2c4400 ptilink ptilink.sys Thu Jan 16 06:47:15 2003 (3E25BAC3)
ed2d0000 ed2d40e0 raspti raspti.sys Sat Oct 09 06:45:10 1999 (37FE57D6)
ed2f8000 ed2fec40 cdrom cdrom.sys Thu Jan 16 06:43:04 2003 (3E25B9C8)
ed308000 ed30d600 Cdralw2k Cdralw2k.SYS Tue Oct 16 06:50:05 2001 (3BCB4BFD)
ed320000 ed325ec0 kbdclass kbdclass.sys Fri Feb 21 03:37:30 2003 (3E55044A)
ed330000 ed336100 parport parport.sys Thu Jan 16 06:47:13 2003 (3E25BAC1)
ed340000 ed346580 fdc fdc.sys Thu Jan 16 06:42:51 2003 (3E25B9BB)
ed350000 ed355400 mouclass mouclass.sys Fri Feb 21 03:37:45 2003 (3E550459)
ed360000 ed366a20 EFS EFS.SYS Thu Jan 16 06:46:55 2003 (3E25BAAF)
ed370000 ed374a60 flpydisk flpydisk.sys Thu Jan 16 06:42:52 2003 (3E25B9BC)
ed390000 ed395240 Msfs Msfs.SYS Wed Oct 27 09:21:32 1999 (3816377C)
ed3c0000 ed3c7d00 wanarp wanarp.sys Fri Aug 16 22:25:01 2002 (3D5CEF1D)
ed410000 ed412a20 BOOTVID BOOTVID.DLL Thu Nov 04 12:24:33 1999 (3820E051)
ed414000 ed416d00 PartMgr PartMgr.sys Thu Jan 16 06:43:07 2003 (3E25B9CB)
ed474000 ed4762e0 ndistapi ndistapi.sys Thu Jan 16 06:54:15 2003 (3E25BC67)
ed484000 ed487e60 TDI TDI.SYS Thu Jan 16 06:56:26 2003 (3E25BCEA)
ed4b8000 ed4bb580 vga vga.sys Sun Sep 26 04:37:40 1999 (37ED1674)
ed500000 ed501100 intelide intelide.sys Thu Feb 20 04:19:09 2003 (3E53BC8D)
ed502000 ed503d20 Diskperf Diskperf.sys Thu Feb 13 08:34:38 2003 (3E4ABDEE)
ed504000 ed505b80 dmload dmload.sys Thu Jan 16 06:47:06 2003 (3E25BABA)
ed50a000 ed50bca0 Fs_Rec Fs_Rec.SYS Thu Jan 16 06:53:30 2003 (3E25BC3A)
ed512000 ed513e40 rasacd rasacd.sys Sun Sep 26 04:41:23 1999 (37ED1753)
ed568000 ed5692a0 Npci_io2 Npci_io2.SYS Fri Jul 13 16:29:52 2001 (3B4E9560)
ed56c000 ed56d860 ParVdm ParVdm.SYS Tue Sep 28 13:28:16 1999 (37F035D0)
ed5c8000 ed5c8f80 WMILIB WMILIB.SYS Sun Sep 26 04:36:47 1999 (37ED163F)
ed5c9000 ed5c9b00 pciide pciide.sys Thu Jan 16 06:43:03 2003 (3E25B9C7)
ed5cb000 ed5cba40 audstub audstub.sys Sun Sep 26 04:35:33 1999 (37ED15F5)
ed5cc000 ed5ccd80 swenum swenum.sys Sun Sep 26 04:36:31 1999 (37ED162F)
ed5cf000 ed5cf9e0 Null Null.SYS Sun Sep 26 04:34:58 1999 (37ED15D2)
ed5d0000 ed5d0ee0 Beep Beep.SYS Thu Oct 21 08:18:59 1999 (380E3FD3)
ed5d1000 ed5d1f80 mnmdd mnmdd.SYS Sun Sep 26 04:37:40 1999 (37ED1674)
ed5d2000 ed5d2f80 dump_WMILIB dump_WMILIB.SYS Sun Sep 26 04:36:47 1999 (37ED163F)

Unloaded modules:
ba73d000 ba749000 sysaudio.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba56c000 ba57e000 wdmaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba4fa000 ba51f000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba547000 ba56c000 portcls.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba71d000 ba72a000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba72d000 ba73b000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bbb20000 bbb35000 VGA.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
bb8e3000 bbb35000 G400DHD.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
ed130000 ed139000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed120000 ed130000 serial.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed380000 ed385000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ed4b0000 ed4b3000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

 

Hi,

I check the module list and I don't find any module which has known problem (ie Norton AV, ZoneAlaram, ATI display card driver and etc). From the stack trace, I believe that faulty ram is the culprit. Run memtest to stress test the ram. How often do you get the blue screen?

ChildEBP RetAddr Args to Child
ed42fcd0 80416b67 00000003 8046b60a 818a5570 nt!KiTrap0E+0x27c
ed42fd44 804a517c 00000000 00000001 800695c0 nt!ExAcquireResourceExclusiveLite+0xd <--- crash because of faulty ram ??
ed42fd64 8044f8be 81459be8 80483a90 8046dc20 nt!ObpRemoveObjectRoutine+0x47
ed42fd78 804191b5 00000000 00000000 00000000 nt!ObpProcessRemoveObjectQueue+0x34
ed42fda8 80455a16 00000000 00000000 00000000 nt!ExpWorkerThread+0xae
ed42fddc 80469bb2 804190f0 00000000 00000000 nt!PspSystemThreadStartup+0x69
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

 

Your bloods worth bottling

the time changes but about every 5-6 hours

Thanks

 

NB: FAULTING_IP:
nt!ExAcquireResourceExclusiveLite+d
80416b67 6683790c00 cmp word ptr [ecx+0xc],0x0

ECX was zero when location 0xc was dereferenced

 

system event 1001/1003

Hi,

Can you post all the system event 1001/1003 here? Hardware error occurs randomly. The system event log can identify whether it is hardware error or software error. If there have different bugcheck codes and the failing modules are different. Probably it is hardware error. Software error usually has the same symptom.

 

Thanks

I won't be for another 3 or more hours before i can ask for the event logs on site . I don't know what country you are in so this may have to wait to tomorrow.

Regards Greg

 

Hi Grep,

I am living at the time zone two hours (GMT+8) behind Sydney. I also lived Sydney for 5 years and it is wonderful city.

 

An update, we won't be able to get the event logs until monday europe time

 

Hi All,

Please review here the relevant windows event messages ( only 1001 ):

Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 24-03-2006
Time: 11:11:34
User: N/A
Computer: PC_ECC_CL04
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000c, 0x000000ff, 0x00000000, 0x80416b67). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP.

Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 22-03-2006
Time: 15:53:45
User: N/A
Computer: PC_ECC_CL04
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000e2 (0x00000000, 0x00000000, 0x00000000, 0x00000000). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP.

 

Hi Rein,

Does your event log relate to Greg's problem or is it a new problem?

 

Yes;

Greg posted it in awaitment of my feedback.
This is actually my problem and it is still showing.