Windows 10 BSOD SYSTEM_SERVICE_EXCEPTION and IRQL_NOT_LESS_OR_EQUAL

[Harib0x]

Hi, since a few weeks, I keep having some BSOD with either Error: SYSTEM_SERVICE_EXCEPTION or Error: IRQL_NOT_LESS_OR_EQUAL.

Here are the descriptions from "Who Crashed":

On Thu 29/10/2015 12:37:17 GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\102915-35031-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E2E0)
Bugcheck code: 0x3B (0xC000001D, 0xFFFFF8013152BB45, 0xFFFFD001CCA277E0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Thu 29/10/2015 12:37:17 GMT your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x3B (0xC000001D, 0xFFFFF8013152BB45, 0xFFFFD001CCA277E0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sun 25/10/2015 13:31:01 GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\102515-62015-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E2E0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF801F6AFBBA8, 0xFFFFD00020621590, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

On Sun 25/10/2015 11:39:35 GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\102515-40437-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x14E2E0)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF8009B65A9C3)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


I'm also attaching the dump files of the BSOD.

Thank you for any help you could provide.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff8013152bb45, ffffd001cca277e0, 0}

Probably caused by : hardware ( nt!SepNormalAccessCheck+4c5 )

Followup: MachineOwner

Hi,
all your dump files were similar to the above apart from one which blamed memory corruption. The above Bugcheck can be caused by out of date drivers as well as faulty system service and can be memory related in some instances.
When you upgraded to windows 10 did you check your system was compatible? The reason I ask is because your issue is possible down to either faulty memory or a compatibility issue.
You also have some extremely old drivers:

ADIHdAud.sys Thu May 21 09:21:06 2009: SoundMAX Digital HD Audio Driver Please update:
SoundMAX HD Audio Driver 6.10.02.6585
(It was difficult to find an update although this 2013 version will help for now)

hssdrv6.sys Mon Mar 24 20:09:36 2014: Hotspot Shield Routing Driver can be a possible BSOD cause please remove to test. (possibly belongs to something called 'Anchorfree')

nvoclk64.sys Wed Sep 05 03:26:33 2007: nVidia System Utility Driver please either update or remove:
Drivers - Download NVIDIA Drivers

SSPORT.sys Fri Aug 12 00:07:32 2005: Samsung printer driver please update (if no longer used remove):
Download Center: Download Software, Firmware, Drivers & Manuals | Samsung

If the bsod continues after updating the above then you'll need to test your RAM. Windows does have a memory testing app but it can miss errors and the best app for the job is Memtest86.
If you open the link below you'll see you can run Memtest86 in two ways. You can either burn it to disk or install it onto a USB drive it's entirely up to you. You'll then need to enter the bios to change the boot order so you can boot from either the Disk or USB stick you have Memtest86 on.
You must test for at least 12 hours unless it becomes obvious there is a problem straight away (you'll see errors outlined in red.
Memtest86+ - Advanced Memory Diagnostic Tool

If you find no errors then it could be that your system isn't compatible with Windows 10. You may have to roll back to your previous os. Have you had windows 10 installed over 30 days?

Post any new dump files.

 

[Harib0x]

My system is compatible for Windows 10, so it might come from a faulty memory.
I'll try to update all these drivers.
Also, I already had these BSOD from time to time before I upgraded to Windows 10 so I really don't think that it is a compatible issue...

Thanks for your help and I'll let you know if I keep having some BSOD.

 

[kemical]

Also, I already had these BSOD from time to time before I upgraded to Windows 10 so I really don't think that it is a compatible issue

Ah I see. Thank you for that info. I would try the Memtest86 memory scan then and see what shows up.

 

[Harib0x]

I didn't have the time to run the Memtest yet, but I just got another BSOD this afternoon but this time it seems to come from a driver called ntfs.sys.
Here is the WhoCrashed report as well as the dumpfile:

On Fri 30/10/2015 14:11:39 GMT your computer crashed
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: ntfs.sys (NTFS+0xBED5)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF8005BAFB842, 0xFFFFD0005B2F6940, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\WINDOWS\system32\drivers\ntfs.sys
product: Système d’exploitation Microsoft® Windows®
company: Microsoft Corporation
description: Pilote du système de fichiers NT
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8005bafb842, ffffd0005b2f6940, 0}

Probably caused by : hardware ( nt!MmPurgeSection+422 )

Followup: MachineOwner

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s

This bugcheck can be caused by drivers (which I notice you didn't update), faulty system service as well as being associated with memory issues.
As well as testing the memory try running a chkdsk too:
Link Removed
ADIHdAud.sys Thu May 21 09:21:06 2009: SoundMAX Digital HD Audio Driver Please update:
SoundMAX HD Audio Driver 6.10.02.6585
(It was difficult to find an update although this 2013 version will help for now)

hssdrv6.sys Mon Mar 24 20:09:36 2014: Hotspot Shield Routing Driver can be a possible BSOD cause please remove to test. (possibly belongs to something called 'Anchorfree')

nvoclk64.sys Wed Sep 05 03:26:33 2007: nVidia System Utility Driver please either update or remove:
Drivers - Download NVIDIA Drivers

SSPORT.sys Fri Aug 12 00:07:32 2005: Samsung printer driver please update (if no longer used remove):
Download Center: Download Software, Firmware, Drivers & Manuals | Samsung

Open an admin command prompt. Type:
sfc /scannow
Press enter and await results

In the same command prompt after the above scan has finished. Type (or copy and paste):
dism /online /cleanup-image /restorehealth
Press enter and await results.

Also please turn off your pagefile, reboot and then re-enable as they can sometimes be corrupted too.

Update the above, do the testing and then if a bsod occurs please post the dump file.

 

[Harib0x]

Well that's weird because I downloaded the new driver for SoundMax and Samsung printer, and removed Hotspot Shield Routing and nVidia System Utility but it seems like the old drivers are still here...

And what do you mean by turning off the pagefile ?

 

[kemical]

This blog will show you where the pagefile is. All you need to do is turn it off reboot and turn it back on:
Link Removed

 

[Harib0x]

I tried once again to delete the outdated drivers, I hope that they are really gone now.

For sfc /scannow, it said Windows Ressource Protection found corrupt files and successfully repaired them.
And for dism /online /cleanup-image /restorehealth, it said that it was a success too.
I also turned off the pagefile then re-enabled it after the reboot.

I'll tell you if another BSOD occurs.

 

[kemical]

Thank you for updating. Hope all goes well..

 

[Harib0x]

I just got another BSOD...
I am going to run the Memtest86+, should I also try to do a chkdsk C: /f ?

 

[kemical]

should I also try to do a chkdsk C: /f ?

Yes except it should be:
chkdsk /f /r C:

Please read the guide again. The 'r' is important as it stands for 'Repair'.

Please post the dump file too.

 

[Harib0x]

Here is the dump file:

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff802240aab45, ffffd001a41457e0, 0}

Probably caused by : hardware ( nt!SepNormalAccessCheck+4c5 )

Followup: MachineOwner

Hi,
please run those scans as discussed.

 

[Harib0x]

I'll run the scans tonight because I think it will take quite some time, I'll give you the results tomorrow if I can.

 

[Harib0x]

Also, once I run the Memtest86+, after how many errors does it become a major problem ?

 

[kemical]

after how many errors does it become a major problem

One.
One is all you need I'm afraid but if the RAM is bad usually there will be either a few or many errors. It's just a case of running the test and see.

 

[Harib0x]

During the chkdsk the scan found 4ko of bad sectors.

 

[kemical]

Hmm... that might have been the issue. Did it repair them?

 

[Harib0x]

Well, it said that Windows made some corrections on the files, and that no other actions were required.
So I guess that the files are repaired now.

I am going to run the Memtest now.