SOLVED DRIVER_IRQL_NOT_LESS_OR_EQUAL since last week

[jlauret7]

I keep getting frequent crashes (when connected to the wire / did not notice it yet from the wireless) like the below

[FONT=Segoe UI, Arial]On Mon 2/11/2013 17:27:18 GMT your computer crashed
crash dump file: C:\Windows\Minidump\021113-31418-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x7EFC0)
Bugcheck code: 0xD1 (0x0, 0x2, 0x0, 0xFFFFF88003E2CABF)
Error: [FONT=Segoe UI, Arial]DRIVER_IRQL_NOT_LESS_OR_EQUAL[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

[/FONT]
[FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]On Mon 2/11/2013 17:27:18 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]l1c62x64.sys[/FONT] (L1C62x64+0x6ABF)
Bugcheck code: 0xD1 (0x0, 0x2, 0x0, 0xFFFFF88003E2CABF)
Error: [FONT=Segoe UI, Arial]DRIVER_IRQL_NOT_LESS_OR_EQUAL[/FONT]
file path: C:\Windows\system32\drivers\l1c62x64.sys
product: [FONT=Segoe UI, Arial]Qualcomm Atheros Ar81xx series PCI-E Gigabit Ethernet Controller[/FONT]
company: [FONT=Segoe UI, Arial]Qualcomm Atheros Co., Ltd.[/FONT]
description: Qualcomm Atheros Ar81xx series PCI-E Gigabit Ethernet Controller
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: l1c62x64.sys (Qualcomm Atheros Ar81xx series PCI-E Gigabit Ethernet Controller, Qualcomm Atheros Co., Ltd.).



The two extracts above are from a small utility called WhoCrashed.

Here is what I have done since:

- First, when it happened on Thursday, I decided to follow the advice so right
clicked on "Computer" -> Manage -> Device Manager; located "Network Adapters"
and "Atheros AR8131 .." and asked for updating. It found a newer version and
now at version 2.1.0.12 (driver date 9/21/2012)

- Friday, next crash - usually, it happens when I download something. So, I decided
to check errors on the disk were the file I was trying to download was supposed to
be saved (I had experienced random crahs before if the drive has errors). After
waiting for most of my Saturday (a few index relocation fixed at best) ...
suffered more crashes again.
Typically, here are a few things that would cause the BSOD:
* download a file (today, it crashed while I was trying to download
GRMWDK_EN_7600_1.ISO from the MS site ... It finally completed
after two tries and two crashes [and now, I can provide the dump
from WinDbg now if requested but also attach the minidump])
* streaming a video (via flash or similar)
* viewing any embedded video (YouTube or similar)
It has not happened yet when I view a a Web page.
[/FONT][/FONT]
[FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]- I also tried to clean the computer (CCleaner and equivalent) to be sure there
were no special bits and pieces causing browser problems since most crashes
happened via Browser interaction ... new crash on Sunday (same diagnostic)

- tested downloads using Free Download Manager (to exclude the possibility of
a browser issue) - same crash (the larger the file, more likely the crash)

[/FONT][/FONT][/FONT][/FONT]- None of the steps above resolving anything and disk errors checking finding
nothing, I run a rootkit scan (in case) - nothing found. Needless to say I also run
a full system scan for virus etc ... nothing came up. I used Avira Free.

+ Note that the driver in question (at least until the first crash) had not been
updated for a while. Hard to explain why things crash only now

I am out of ideas of what can go wrong but now work in a mode where I fear
to even click on any links. I upload the dump in a desperate hope for help (while
scanning once more for virus and problems with Malwarebytes just to be sure
but seems like a desperate random action even to me :-( ).

I would appreciate guidance.


Addition:
- My computer specs are updated in my profile - I do have Service Pack 1 (Windows 7 Professional, System
type is 64 Bit Operating System)
- I have Outpost Firewall Pro installed (version 8.0) - from to time, it detects a port scan on this
Internet connection (this makes me suspicious as well - could a packet injection cause those
crash?)

 

[TrainableMan]

I'm not a BSOD expert but from what I see ...

You need to actually go to the website >>HERE<< and download the latest Network driver(s) for your computer.

Also update the Intel driver "igdkmd64.sys".

(When you hit "update driver" it just goes to see if Microsoft has been supplied an update, it doesn't mean that is the absolute latest available from the appropriate company - that's why you should always go to the component companies websites directly)

I also suggest a safe mode virus scan as explained HERE.

 

[jlauret7]

;;I'm not a BSOD expert but from what I see ...
;;
;;You need to actually go to the website >>HERE<< and download the
;;latest Network ;;driver(s) for your computer.

Scary, this site only has driver version 1.0.0.36 while my computer states it has
[FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]version 2.1.0.12 (driver date 9/21/2012) and this is what Windows "found".
Qualcomm does not have a 8131 driver. I had driver 2.0.9.9 before Windows
updates it (I could recover this info from a driver backup).

I still have a running Malwarebytes scan running [so many files, it is taking
forever] but should I already conclude I have a bogus driver installed? And
if so, how did Windows "update driver" actually located that version [/FONT][/FONT][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]2.1.0.12?
Doesn't it look for a safe repository?

I could also back step to the Sony support site Driver version (upon searching,
found it to be the "Marvell® Atheros® AR8131". Now, I am totally confused of
the variance (though the alternative may have come to my laptops via some
driver updater program). Wouldn't this one a better alternative?

[/FONT][/FONT][/FONT][/FONT]

 

[jlauret7]

;; Also update the Intel driver "igdkmd64.sys".

Went there and it directed me to the "Intel Driver Update Utility" which only found
the "Intel® PROSet/Wireless WiFi Connection Utility" and the"Intel® Wireless Display Software" to be old. While I will update for good measure, seems unrelated
to my wired Internet Qualcomm versus Marvell versus god knows what driver issue.
Comments welcomed.

I have downloaded RKill and TDSSkiller (so I am ready to apply your
recommendations but would benefit from precisions on what is best: seems like
the Sony provided driver is the way to go).

 

[TrainableMan]

I don't have the experience reading DMPs to say you HAVE a virus, that is why I always suggest people run RKill & TDSSKiller plus a virus scan from Safe mode; I merely want them to rule it out as a possibility.

All I know from the DMP is that two files are highlighted as the probable cause (3 really but the problem is not the Windows kernal):
L1C62x64.sys dated 9/21/2012 1:35:28 AM and
igdkmd64.sys dated 7/19/2010 7:10:35 PM

... so if you say L1C62x64.sys is the very latest then find a way to update the other one, the 2010 Intel driver and see if that helps.

The most common causes of BSODs are viruses and bad drivers and of the drivers I have seen the biggest issues are usually with display/video drivers and NIC/Network drivers. Your DMP specifically points to Network so I merely suggest ruling out virus & then updating Network.

As I said, not an expert, so just offering my best effort.

 

[jlauret7]

I don't have the experience reading DMPs to say you HAVE a virus, that is why I always suggest people run RKill & TDSSKiller plus a virus scan from Safe mode; I merely want them to rule it out as a possibility.

All I know from the DMP is that two files are highlighted as the probable cause (3 really but the problem is not the Windows kernal):
L1C62x64.sys dated 9/21/2012 1:35:28 AM and
igdkmd64.sys dated 7/19/2010 7:10:35 PM

... so if you say L1C62x64.sys is the very latest then find a way to update the other one, the 2010 Intel driver and see if that helps.

The most common causes of BSODs are viruses and bad drivers and of the drivers I have seen the biggest issues are usually with display/video drivers and NIC/Network drivers. Your DMP specifically points to Network so I merely suggest ruling out virus & then updating Network.

As I said, not an expert, so just offering my best effort.

So, I did what you suggested. Nothing came up (have to say, in safe mode,
Malwarebytes is much much faster).

I decided to update to whatever Intel suggested + went back to the Sony provided
driver (which seems a few version back but I am confused about the Marvell(R)
versus Qualcomm and have the impression that an over-zealous update may have
changed the driver "branch" unnecessarily). I could not find any updates for
igdkmd64.sys .

Now will be testing for 24 hours with diverse large downloads to see.

 

[jlauret7]

Solution/Resolution:

There was no virus or malware involved in this problem but I recommend anyone to read the procedure to perform a safe virus scan as explained HERE and as suggested by TrainableMan ... very interresting set of tools.

The initial vendor (Sony) supplied "[FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]Marvell® Atheros® AR8131" [/FONT][/FONT][/FONT][/FONT][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]Ver. 2.0.9.9 was replaced by a Qualcomm Atheros AR8131 drive version [/FONT][/FONT][/FONT][/FONT][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]2.1.0.12 [/FONT][/FONT]at some stage (September 2012 dated driver updated in November or so). This change of branch was likely caused by an over-zealous update on my part using a tool named DriverMax, which proposed the Qualcomm Atheros as a newer driver (likely a partial match, ignoring the vendor name change and only considering the version). While the action sounded fine at the time (and the driver worked correctly for a while), it is clear this was the reason for recent BSOD.

Since I went back to the Marvell(R) driver, no further crash occurred and the system is back to its stable state. I hope this will help others.

My own conclusions would include to (a) beware of software proposing to upgrade your drivers (b) an updated driver could cause problems much further down the road than my initial "next day" expectations and (c) remember to make backups of your drivers and keep it around for months (never knows when you will need to step back, perhaps a few versions).
[/FONT][/FONT][/FONT][/FONT]