BSOD from IRQL not less or equal 1

[bobsession]

Hi there guys

Sorry to bring this one up as I know it's such a common problem. I just can't work out all of where the problem is. Ok - BSOD occurs randomly but not at bootup, sometimes in idle mode, sometimes when actively doing things. Stop code parameters being (00000008, 00000004, 0000009, 0000008) and (00000004, 00000002, 00000008, and 00000004)

However the Pstat file either doesn't reference any devices that go down that low, or I can't read it properly! Nearest I can figure the device failing is ntlkrnlpa at 804D7000 but ntdll is 7C...... and I believe the hex codes reference 10+...so any thoughts? I can't find out how to attach a file that's not a URL but please know if I can.

Thanks in advance

 

[Turkbear]

Hi,
Anything useful in the event logs?





To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[bobsession]

Event logs show errors on DCOM as of today: (the server {B2B3C70A-B20F-40B7-90C5-EA7E946C16E0} did not register with DCOM within the required timeout) - 4 of those.

Other than that I've only got warnings for i8042prt (Could not set the keyboard typematic rate and delay) but that's a regular occurence and is Not triggering freezing.

Other than that the Save Dump info shows 00000008 as the 3rd quartile of the Stop error codes consistently (all 9 times recorded). 4, 3, 9 and 1a7 are the 4th quartiles from those 9 - if that's useful.

 

[Freestone]

Try running a memory test to rule out faulty memory.

http://www.memtest.org/

http://oca.microsoft.com/en/windiag.asp

 

[BadBigBen]

another possibility, is that the pagefile.sys is corrupt, or on a portion of the drive that may have a damaged cluster...

recreate the pagefile on another drive/partition and delete the pagefile on the C drive... reboot and test...

PS: attaching a file that resides on your PC will not be accessible on the forum... better would be to either paste the file in the thread or to upload the txt file to one of the numerous uploading sites, e.g. rapidshare or badongo...

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

or on a portion of the drive that may have a damaged cluster."

Which is why a hard drive test from the manufacturer would rule this in or out. Rather than moving the page file, this is the more direct approach to test the hard drive's fitness.

Deleting the page file and having it get recreated is not a bad idea, but it doesn't answer "for sure" whether the had drive is ok.

 

[BadBigBen]

but it doesn't answer "for sure" whether the had drive is ok.

never said it was, and of course the drive should be tested with the manufacturers tools first, but that the BSOD could also stem from a corrupted PAGEFILE.SYS...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[bobsession]

Hi peeps - thanks so much for your advice. Currently I'm in limbo seeing what happens. Memtest 86, generic advanced drive test from Seagate and Hitachi advanced drive fail test all proved error-free!

I'm currently in clean-boot mode as well and waiting to see if the damned machine freezes again... I'm kinda thinking it will so ... any other thoughts?

 

[bobsession]

Also pagefile was moved to D: and back to C:.....

 

[bobsession]

Hi people - been a while since I posted back here and sorry about that. I'm still having the same problems but on a more regular basis (about 2 - 3 times per day now).

Have done all the above options but they aren't helping and the stop codes run pretty much consistently as 0x000000002, ...4, ...8, ...2. Anyway - I don't have a clue what to do anymore except maybe reinstall windows or upgrade even to 7.

Please advise

 

[satrow]

Look for old drivers listed in the minidumps by using BlueScreenview. Update the old ones from the hardware makers site in preference to using MS Update.

If the STOP errors really are 0x2, 0x4, 0x8, that's pretty unusual, I think.

 

[bobsession]

Ok - sorry to sound dense but BlueScreenView is highlighting 5 drivers in pink - are they the old drivers I need to upgrade?

If so the drivers listed are: IPNAT.sys, NDIS.sys, NTOSKRNL.sys, and PSCHED.sys (and my old wireless card currently not in use). would they all need to have the same version to run properly because I can't find them on the microsoft website (listed maker) although I have been able to locate them on various free driver sites but they aren't all the same version.

The minidumps available on BSV are showing some variation on stop code parameter 1 but mostly 0x4; param 2 and 3 are always 0x2 and 0x8 respectively, and param 4 is a duplicate of param 1 - is that usual?

Please advise - thank you

 

[satrow]

The highlighted drivers are those listed in the dump as being likely contenders for the cause but if the drivers highlighted are standard Windows files, it's highly unlikely that they're actually to blame, more likely something else had triggered the problem a little earlier.

To look for old drivers in BSV, > Options > Lower pane mode > All drivers. Then move to the lower pane and click on the Time string column to list by age. To check the drivers listed,

http://www.carrona.org/dvrref.html

is very useful but may not be complete or fully updated.

Standard Windows files will be grouped together in several time slots:
SP3 - Final - 6 May 2008
SP3 - RTM - 21 April 2008
SP2 - 6 August 2004
SP1a - 3 February 2003
SP1 - 9 September 2002
SP0 - 25 October 2001
Other Windows files will be from Windows/Microsoft Updates and patches. If you're on a fully-patched XP SP3, spend your time getting the 3rd party drivers updated.

For a higher chance of finding the suspect, you can go to Windows > Minidump and copy the *.dmp files to the Desktop, zip then upload them to a free hosting service, if you put the link to the uploaded file here, I (or hopefully someone with more knowledge than me) will try to debug them further.