# [SOLVED] random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0



## tremlin (Oct 12, 2014)

hello IT pros,

unfortunately, i get a BSOD from time to time on my laptop.

the error(s) turn up randomly. sometimes, when i'm not even around or just browsing the web.
i have this problem since i installed windows 7, so there is no other,older working restore point.
harddrive seems fine, chkdsk gave no errors.
also i tried different drivers, no luck so far. also there is no newer BIOS.

· OS - Windows 7
· x86 (32-bit) or x64: x64
· What was the original installed OS on sthe ystem?: Windows 8
· Is the OS an OEM version: i purchased it from retailer
· Approximate age of system: less than 1 year old laptop
· os installed 6 months ago
· Have you re-installed the OS? yes

· CPU: Intel i5-3230M 
· Video Card: Intel HD 4000
· MotherBoard: Acer Aspire E1-771

· System Manufacturer: Acer 
· Exact model number: Aspire E1-771

SysnativeBSODCollectionApp.exe stops working here, after "Autoruns. . . D O N E" it's coming up with "Waiting for SystemInfo" every 5 secs, forever. i tried twice with the same result.
So i zipped manually what was done so far.

any help is highly appreciated.

thanks in advance
thomas


----------



## Patrick (Apr 15, 2012)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

Hi,

*IRQL_NOT_LESS_OR_EQUAL (a)*

_This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above._


```
1: kd> .trap 0xfffff880089cd8c0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffff88002f00180
rdx=fffffa800b072fe0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032dbe52 rsp=fffff880089cda50 rbp=0000000000000000
 r8=0000000000000000  r9=fffffa8009d9bc40 r10=fffffa8009d9bc40
r11=fffff880089cdae0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KiSignalSynchronizationObject+0x42:
fffff800`032dbe52 488b3f          [COLOR=Red]mov[/COLOR]     [COLOR=Blue]rdi[/COLOR],qword ptr [[COLOR=Green]rdi[/COLOR]] ds:00000000`00000000=????????????????
```
Failure moving the contents of the rdi register into rdi, this makes no sense of course.

*1. *In your loaded drivers list, dtsoftbus01.sys is listed which is the Daemon Tools driver. Daemon Tools is a very popular cause of BSOD's in 7/8 based systems. Please uninstall Daemon Tools. Alternative imaging programs are: MagicISO, Power ISO, etc.

*2. *Uninstall KProcessHacker as it's likely conflicting with TrueCrypt.

*3. *


```
1: kd> lmvm auuzplzn
start             end                 module name
fffff880`085ad000 fffff880`085fe000   auuzplzn   (deferred)             
    Image path: auuzplzn.SYS
    Image name: auuzplzn.SYS
    Timestamp:        Tue Sep 10 09:56:12 2013
```
No idea what this driver is, and there's no documentation regarding it. Run a Malwarebytes free scan:

https://www.malwarebytes.org/

Regards,

Patrick


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

thanks a lot for your hints!

i will try your suggestions.  i bought daemon tools, but honestly i don't need all those features anymore really, so any mounting tool will do.
interesting though i never had any troubles using the same daemon tools on my old laptop, there was no BSOD for years.

ProcessHacker is something i really like, but there are other tools doing about the same, too.
but one thing i don't get: ProcessHacker isn't running all the time (of course...), doesn't the driver kprocesshacker.sys get unloaded if i close ProcessHacker?

as for auuzplzn.SYS... hm. weird, i really need to check this!


thanks again!
thomas


----------



## Patrick (Apr 15, 2012)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*



> doesn't the driver kprocesshacker.sys get unloaded if i close ProcessHacker?


Nope.

Keep me updated.

Regards,

Patrick


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*



Patrick said:


> Nope.


thanks.



Patrick said:


> Keep me updated.


sure. but as you can see, sometimes it takes weeks to get a BSOD, and i have no idea how to force it.
but even if it happens only once a month, it's annoying.


----------



## Patrick (Apr 15, 2012)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

That's fine, I'm not going anywhere. If you'd like, we can enable Driver Verifier to try and reproduce it:

*Driver Verifier:*

*What is Driver Verifier?*

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior. 

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

*Before enabling Driver Verifier, it is recommended to create a System Restore Point:*

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point" 
Windows 8/8.1 - Restore Point - Create in Windows 8

*How to enable Driver Verifier:*

Start > type "verifier" without the quotes > Select the following options -

*1.* Select - "Create custom settings (for code developers)"
*2.* Select - "Select individual settings from a full list"
*3.* Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (only on Windows 7 & 8/8.1)
- DDI compliance checking (only on Windows 8/8.1)
- Miscellaneous Checks
*4.* Select - "Select driver names from a list"
*5.* Click on the "Provider" tab. This will sort all of the drivers by the provider.
*6.* Check EVERY box that is *NOT *provided by Microsoft / Microsoft Corporation.
*7.* Click on Finish.
*8.* Restart.

*Important information regarding Driver Verifier:*

- Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is *not! *a solution, but instead a diagnostic utility. It will tell us if a driver is causing your issues, but again it will not outright solve your issues. 

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring _*all *_3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

*If this happens, do not panic, do the following:*

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

- Restart and boot into normal Windows.

*If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode: *

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

*How long should I keep Driver Verifier enabled for?*

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

*My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?*

- If you have the system set to generate Small Memory Dumps, they will be located in *%systemroot%\Minidump*.

- If you have the system set to generate Kernel Memory Dumps, _*it *_will be located in *%systemroot% and labeled MEMORY.DMP*.

*Any other questions can most likely be answered by this article:*

http://support.microsoft.com/kb/244617

*-- Disable it if you don't crash for 48 or so hours.*

Regards,

Patrick


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

hm... i remember Driver Verifier from a friends computer, it wasn't all that easy to get rid of it again. but as a last resort... why not. btw, malwarebytes found nothing, except for some password tools and game trainers.


----------



## Patrick (Apr 15, 2012)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*



> it wasn't all that easy to get rid of it again


??

It's as easy as disabling it via the GUI or by typing *verifier /reset *in CMD.

Regards,

Patrick


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*



Patrick said:


> ??
> 
> It's as easy as disabling it via the GUI or by typing *verifier /reset *in CMD.
> 
> ...


it wasn't like that.

after getting more BSODs i dared to try driver verifier again, and again i wasn't able to boot the machine, i got instantly a BSOD.
after that, i wasn't able to do a normal boot, also there was no safe boot, only a "starthilfe", i don't know what that exactly would be in english? starting help, whatever...
and the "starthilfe" didn't really help, it just told me: there are corrupt system files.

so i had to use the win7 dvd to repair the installation and then a system restore.

now it's booting again, and i got a new minidump, at least.
i disabled raddrvv3.sys (radmin server) now. lets see what happens...


maybe it's just bad RAM?


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

still getting those BSOD's.  also without the RAM disk. i'm running out of ideas what else to do.


----------



## Patrick (Apr 15, 2012)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

I'll need a verifier enabled kernel dump, please. Let the system crash with verifier enabled and find the kernel dump at C:\Windows named MEMORY.DMP.

Upload it 3rd party and then paste the link here.

Regards,

Patrick


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

i might do this. but for now, i haven't had a BSOD since the 31. of october, after disabling some more drivers. soi'm waiting for the next BSOD first... or not.


----------



## tremlin (Oct 12, 2014)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

still no BSOD since after the 31. of october....


----------



## Patrick (Apr 15, 2012)

*Re: random BSOD IRQL_NOT_LESS_OR_EQUAL 0x0000000a ntoskrnl.exe+75bc0*

Marked as solved.

Regards,

Patrick


----------



## tremlin (Oct 12, 2014)

ok, thanks *much *for your help so far. 

i'm still not sure if it's really solved, this system was running once even more than a month before a BSOD, sometimes it took only 1 or 2 days to BSOD. kinda weird.


----------



## tremlin (Oct 12, 2014)

i'm back. :smile:

i enabled most (one after one with some weeks between) drivers again, except bluetooth and primo ramdisk, and haven't had a single BSOD since almost 8 months. 
so most likely one of the 2 is the culprit, but i'm not trying any further, as i don't need bluetooth, and for the ramdisk i switched to imdisk, which is free and works even better here, primo never released all memory in dynamic mode.


----------

