DRIVER_IRQL_NOT_LESS_OR_EQUAL

  • Thread starter Thread starter Grinder
  • Start date Start date
G

Grinder

Using Windows 2000 (up to date,) I'm getting a
DRIVER_IRQL_NOT_LESS_OR_EQUAL blue screen of death every few days. The
install is fairly clean, having been made in the last couple of months.
(I'm fairly conservative in installing software.)

I've determined that this crash comes in the few seconds in which my
PC's IP address has been expired, and is being renewed by the DHCP
server (a Linksys gateway router) on my network. This comes from the
only Event Viewer messages that report any sort of problem, and from a
half a dozen realtime observations.

I've replaced the NIC card, but this has had no effect on the problem.

Any suggestions?
 
Either code was written defectively or the hardware is
changing that code. What would change code? Memory
failures. Once code is changed, then that code is trying to
access illegal memory locations. NIC would have been
completely irrelevant to your error message.
 
w_tom said:
Either code was written defectively or the hardware is
changing that code. What would change code? Memory
failures. Once code is changed, then that code is trying to
access illegal memory locations. NIC would have been
completely irrelevant to your error message.
Click to expand...

By code, do you mean the driver (or system) files?
 
Grinder said:
Using Windows 2000 (up to date,) I'm getting a
DRIVER_IRQL_NOT_LESS_OR_EQUAL blue screen of death every few days. The
install is fairly clean, having been made in the last couple of months.
(I'm fairly conservative in installing software.)

I've determined that this crash comes in the few seconds in which my PC's
IP address has been expired, and is being renewed by the DHCP server (a
Linksys gateway router) on my network. This comes from the only Event
Viewer messages that report any sort of problem, and from a half a dozen
realtime observations.

I've replaced the NIC card, but this has had no effect on the problem.

Any suggestions?
Click to expand...

This error message can be an indication of 2 devices sharing IRQs and that
being a problem - graphics and sound card for example - Ive also seen it
caused by using USB devices that the motherboard had problems with.
Reinstalling the OS with ACPI disabled fixed it.
 
By code I mean any software. The most important information
in that error message was not posted - the numbers. Therefore
it could be any code related to the few devices and software
functions that can crash an NT based OS.
 
w_tom said:
By code I mean any software. The most important information
in that error message was not posted - the numbers. Therefore
it could be any code related to the few devices and software
functions that can crash an NT based OS.
Click to expand...

I'll elaborate next time the BSOD comes around.
 
With error numbers, then go to places such as Microsoft
Technical Database for details. I remember something about
when second number is a two, then further information if
provided.

Meanwhile, move on to isolating the problem. If computer
manufacturer is responsible, he provides comprehensive
diagnostics - for free. Otherwise diagnostics must be
obtained from each component manufacturer or third party.
Since memory is a likely suspect, diagnostics such as Memtst86
or DocMem should be obtained.

Hardware intermittents tend to become hard failures when air
temperature increases. A room at 100 degrees F is pig's
heaven to semiconductors. If in doubt, then get numbers from
datasheets. A memory test conducted when heated by hairdryer
on high will more likely find intermittent failures. IOW
semiconductor heated to be uncomfortable to touch but does not
leave skin is perfectly normal temperatures - and ideal for
testing. If memory is intermittent, this is the best way to
find that defect.

Why are some so quick to solve problems with more fans?
Heat is a diagnostic tool. Instead they cure symptoms with
more fans.

Also on a short list of suspects is the power supply DC
voltages. That means a 3.5 digit multimeter especially on
red, orange, and yellow wires (relative to black wire). No, I
did not say motherboard monitor. And no, I did not say swap
power supply. Neither is sufficient. Voltages of less than
3.22, 4.87, and 11.7 can be symptoms of failure created by
power supply.
 
Some additional information:

w_tom said:
With error numbers, then go to places such as Microsoft
Technical Database for details. I remember something about
when second number is a two, then further information if
provided.

Meanwhile, move on to isolating the problem. If computer
manufacturer is responsible, he provides comprehensive
diagnostics - for free. Otherwise diagnostics must be
obtained from each component manufacturer or third party.
Since memory is a likely suspect, diagnostics such as Memtst86
or DocMem should be obtained.
Click to expand...

I have run Memtest86+ on my PC for multiple hours (overnight,) and it
has failed to find any errors.
Hardware intermittents tend to become hard failures when air
temperature increases. A room at 100 degrees F is pig's
heaven to semiconductors. If in doubt, then get numbers from
datasheets. A memory test conducted when heated by hairdryer
on high will more likely find intermittent failures. IOW
semiconductor heated to be uncomfortable to touch but does not
leave skin is perfectly normal temperatures - and ideal for
testing. If memory is intermittent, this is the best way to
find that defect.
Click to expand...

The odd thing is that even though it is intermittent, it is so regular
-- always occurring when my IP lease is being renewed.
Why are some so quick to solve problems with more fans?
Heat is a diagnostic tool. Instead they cure symptoms with
more fans.

Also on a short list of suspects is the power supply DC
voltages. That means a 3.5 digit multimeter especially on
red, orange, and yellow wires (relative to black wire). No, I
did not say motherboard monitor. And no, I did not say swap
power supply. Neither is sufficient. Voltages of less than
3.22, 4.87, and 11.7 can be symptoms of failure created by
power supply.
Click to expand...

I have tested the voltages on the power supply (a relatively new Antec
430W) and it has supplied the rated values +/- 5%.
 
Numbers provided in that post are specific for reasons
beyond the technical nature of this discussion. Ignore that
+/-5% figure because I did not say nor provide +/- 5% - for
very good and technical reasons.. Provided in the last post
were numbers to use. Also post exact numbers here since
numbers also contain information that you might not realize.

Running Memtst without heat does not always find failures.
You cannot select what from my post you will and will not do.
My post already eliminated all unnecessary options. To
perform minimal diagnosis, you must do everything. That means
hairdryer heating as described. That means posting the exact
numbers read from multimeter - best when multiple peripherals
are being accessed simultaneously. Numbers best find voltage
problems only when loaded by operating computer peripherals
such as disk drive access while DVD is writing, etc. That
also means using a multimeter and not using numbers for
motherboard voltage monitor.

However, it appears that that hardware is OK. Once the
tests have been performed with everything - heat being
essential to memory testing - then you are ready to move on to
other suspects. Point is that power supply and memory must be
tested sufficiently to no longer ever be suspect. That means
doing everything I had posted since what I had posted was the
'least' necessary to confirm those are not problematic.

Meanwhile, what did Event (system) logs and Device Manager
report? Event logs really made the BSOD less significant.
 
w_tom said:
By code I mean any software. The most important information
in that error message was not posted - the numbers. Therefore
it could be any code related to the few devices and software
functions that can crash an NT based OS.
Click to expand...

Here is the text of the BSOD:

*** STOP: 0x000000D1 (0x00000014,0x00000002,0x00000000,0xB1A69E9D)
DRIVER_IRQL_NOT_LESS_OR_EQUAL

*** Address B1A69E9D, DateStamp 42832efa - tcpip.sys

Beginning dump of physical memory
Physical memory dump complete. Contact your system administrator or
technical support group.
 
As I said, you now have numbers. So now details are
obtained from the Microsoft database. Some information and
solutions are:
The parameter values may be different on your computer, but a
memory analysis in a dump file indicates that the error
messages are based in either the Qafilter.sys or
Qsfilter.sys files.
Click to expand...
and
http://support.microsoft.com/kb/244617/EN-US/

Meanwhile, errors message is quite specific. It complains
of the driver tcpip.sys. Has something changed this file?
IOW before changing anything, first get date time information
on this file - especially date time of last write or last
creation. File may be defective or memory location where this
file resides may be intermittent - which is why the memory
test running all night will not report what memory test when
heated reports in minutes.

We are slowly isolating the problem. Eventually, you may
need to unload Windows networking (a Windows component
unloaded using Control Panel) and then reload networking.
Then upgrade windows (and the reloaded network files) using
WindowsUpdate.com from Microsoft web site.

BTW, your disk drives are using NTFS filesystem - not FAT.
Correct?

At least we now have suspects. Error message does not
necessarily say tcpip.sys is defective. But it does say
tcpip.sys is involved or may be defective. Record all numbers
(such as file last access and file last written numbers)
before making any changes.

There are a number of Driver_IRQL_Not... messages. The
number D1 reported an error message completely different from
the Driver_IRQL_Not.. message I was previously familiar with.
Again, notice how important every tiny number can be. Two
digits made error message different.
 
w_tom said:
Meanwhile, what did Event (system) logs and Device Manager
report? Event logs really made the BSOD less significant.
Click to expand...

There will be several instances of this warning in the 3-4 hours before
the crash:

Your computer was not able to renew its address from the network (from
the DHCP Server) for the Network Card with network address xxxxxxxxxxxx.
The following error occured:
The semaphore timeout period has expired. . Your computer will continue
to try and obtain an address on its own from the network address (DHCP)
server.

Then, right before the crash, a single instance of this error:

Your computer has lost the lease to its IP address 192.168.1.102 on the
Network Card with network address xxxxxxxxxxxx.

....where xxxxxxxxxxxx is the hexadecimal representation of the MAC
address for my network card. The ip address also corresponds to the pc
in question.
 
w_tom said:
As I said, you now have numbers. So now details are
obtained from the Microsoft database. Some information and
solutions are:


and
http://support.microsoft.com/kb/244617/EN-US/

Meanwhile, errors message is quite specific. It complains
of the driver tcpip.sys. Has something changed this file?
Click to expand...

I don't believe so. I'm running a fairly clean version of Windows 2000,
patched to be current. At the time that the problem originally
appeared, I had not recently made any software installations. (I keep a
manual log of software installations.)
IOW before changing anything, first get date time information
on this file - especially date time of last write or last
creation. File may be defective or memory location where this
file resides may be intermittent - which is why the memory
test running all night will not report what memory test when
heated reports in minutes.

We are slowly isolating the problem. Eventually, you may
need to unload Windows networking (a Windows component
unloaded using Control Panel) and then reload networking.
Then upgrade windows (and the reloaded network files) using
WindowsUpdate.com from Microsoft web site.

BTW, your disk drives are using NTFS filesystem - not FAT.
Correct?
Click to expand...

That is correct.
At least we now have suspects. Error message does not
necessarily say tcpip.sys is defective. But it does say
tcpip.sys is involved or may be defective. Record all numbers
(such as file last access and file last written numbers)
before making any changes.
Click to expand...

I'll just record them here, in case you have any interest in those details:

tcpip.sys (The one in c:\winnt\system32\drivers)

Version: 5.0.2195.7049
Created: Thursday, June 19, 2003, 1:05:04 PM
Modified: Thursday, May 12, 2005, 4:25:02 AM
Accessed: Today, December 04, 2005, 11:06:34 PM
 
Problems recently started after May 2005? You did not say
so, but something was changed on 12 May. Coincidence? Maybe.
Suspicious? Yes.

You don't want to reload tcpip.sys only because the reloaded
file may not be compatible with other 'updated' files. Should
you decide that network drivers are the only remaining and
possible problem, then use Windows Add/Remove in Control
Panel to completely remove the Network function. Then reboot,
and completely reload that Windows networking function -
including drivers for the NIC.

It is only enough to speculate. But the BSOD complains
about something that also involves the tcpip.sys driver.
That tcpip.sys file (and probably other related files) were
changed only last May. A reason to be suspicious. One
possibility that might explain your intermittent failures.

Once you have reloaded network drivers and rebooted again,
then visit www.windowsupdate.com for additional updates.
 
w_tom said:
Problems recently started after May 2005? You did not say
so, but something was changed on 12 May. Coincidence? Maybe.
Suspicious? Yes.
Click to expand...

It would be. Unfortunately I cannot say with precision. The timing is
about correct.
You don't want to reload tcpip.sys only because the reloaded
file may not be compatible with other 'updated' files. Should
you decide that network drivers are the only remaining and
possible problem, then use Windows Add/Remove in Control
Panel to completely remove the Network function. Then reboot,
and completely reload that Windows networking function -
including drivers for the NIC.

It is only enough to speculate. But the BSOD complains
about something that also involves the tcpip.sys driver.
That tcpip.sys file (and probably other related files) were
changed only last May. A reason to be suspicious. One
possibility that might explain your intermittent failures.

Once you have reloaded network drivers and rebooted again,
then visit www.windowsupdate.com for additional updates.
Click to expand...

I'll try that, thanks.
 
What virus or spyware software do you have installed.
I had a similar BSOD after installing Aluria Spyware Eliminator
 
My said:
What virus or spyware software do you have installed.
I had a similar BSOD after installing Aluria Spyware Eliminator
Click to expand...

I don't have anything that persistently run. I do spot checks with
AdAware and Spybot Search & Destroy.
 
That's is not a good idea.
Suggest installing a good freeware virus package and running a full scan -
or better still paying for a full internet security package eg pc-cillin or
Norton.
 
I have the same BSOD on servers where I work, but I don't think it i
a virus or a worm or anything - it's simply a Microsoft bug

Here's why I think this

We have 50 Servers in our data center. 25 of them are under th
responsibility of a guy who has an "if it ain't broke don't fix it
approach to patches. Obviously it is protected by a very tigh
firewall. The other 25 servers are run under another guy who has
"keep it patched right up to date" policy.

So, we are evaluating moving from a Checkpoint VPN solution to a Cisc
solution. I set up a Pix 501 in the DMZ and another one outside, an
connected my client machine to the outside 501. I built a VPN to th
inside 501 and got it going.

THEN as soon as I tried to test the new VPN by contacting insid
servers, all hell broke loose. All of the 25 servers with Win2003SP
were fine. All of the other 25 servers with Win2003 only got thi
same BSOD you are talking about - without exception

If I move my test workstation back to the Checkpoint VPN solution,
can contact all of the inside servers without any problems. Once
move it back to the Cisco PIX vpn, I can crash every server withou
SP1 by just browsing it. Same server, same client, different VPN

So, I think this is simply a Microsoft bug that is fixed i
Win2003SP1

My problem. Some of the servers are Windows2000SP4 and they have thi
problem. So it is not fixed with SP4. I hope there is a critica
update post-SP4 that fixes this, or I have to ditch my Cisco VP
solution
 
Back
Top