The attached DMP file is of the IRQL_NOT_LESS_OR_EQUAL (a)
bugcheck.A kernel-mode driver or process attempted to access a protected memory location it does not have permission for, or a kernel interrupt request level (IRQL) attempted to access a memory address that is too high.
This bugcheck usually occurs when a driver uses an incorrect memory address. Other possible causes of this error include: bug in a device driver, system service, the BIOS, an old Anti-virus program or backup tool, or possibly memory issues.
Not much info from the dump itself, we can just see that via the call stack we had a page fault which later turned into the bugcheck:
2: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffff880`2853a2d8 fffff800`8e4e2769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`2853a2e0 fffff800`8e4e0fe0 : 00000000`00000000 00000000`00000010 00000000`00000000 fffff880`2853a420 : nt!KiBugCheckDispatch+0x69
fffff880`2853a420 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
If we run a .trap on the address which referenced memory (4th parameter), we can see that the rip register is the same:
2: kd> .trap 0xfffff8802853a420
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8802853a6b8 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff8a003ee9dc8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8008e54474f rsp=fffff8802853a5b0 rbp=fffff8802853a671
r8=0000000000000000 r9=fffff8802853ab00 r10=0000000000000000
r11=fffff8802853a690 r12=0000000000000000 r13=0000000000000000
From what I am seeing here, it's 50/50 in regards to possibly being a driver issue or hardware (likely if at that point, the hard drive or memory itself).
Judging from the module list this seems to be a fairly clean install of Windows 8, but I'd like you to enable Driver Verifier just so we're sure there are no driver conflicts:Driver Verifier:What is Driver Verifier?
Driver Verifier is included in Windows 8, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.
Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.Before enabling Driver Verifier, it is recommended to create a System Restore Point:
Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.htmlHow to enable Driver Verifier:
Start > type "verifier" without the quotes > Select the following options -
1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7)
- Concurrentcy Stress Test (Windows 8)
- DDI compliance checking (Windows 8)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT
provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.Important information regarding Driver Verifier:
- If Driver Verifier finds a violation, the system will BSOD.
- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will flag it, and as stated above, that will cause / force a BSOD.
If this happens, do not panic, do the following:
- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.
- Once in Safe Mode - Start > type "system restore" without the quotes.
- Choose the restore point you created earlier.If you did not set up a restore point, do not worry, you can still disable Driver Verifier to get back into normal Windows:
- Start > Search > type "cmd" without the quotes.
- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
・ Restart and boot into normal Windows.How long should I keep Driver Verifier enabled for?
It varies, many experts and analysts have different recommendations. Personally, I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier.My system BSOD'd, where can I find the crash dumps?
They will be located in %systemroot%Minidump
Any other questions can most likely be answered by this article:
http://support.microsoft.com/kb/244617If verifier doesn't manage to catch a culprit driver within ~24 hours, let's move onto memory diagnostics:
If Memtest manages to go ~8 passes without displaying errors, move onto hard disk diagnostics:
Download Memtest86+ here:
http://www.memtest.org/Which should I download?
You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).How Memtest works:
Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.
The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.
Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.
Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.
This information, if available to the program, can be displayed via a menu option.
Any other questions, they can most likely be answered by reading this great guide here:
start>search bar>type cmd right click and select run as admin
Elevated CMD should now be opened, type the following:
chkdsk x: /r
x implies your drive letter, so if your hard drive in question is letter c, it would be:
chkdsk c: /r
Restart system and let chkdsk run.
If chkdsk turns out okay, run Seatools - http://www.seagate.com/support/downloads/seatools/
Run all tests EXCEPT - Fix All, Long Generic, and any advanced.