none
BSOD - IRQL_GT_ZERO_AT_SYSTEM_SERVICE - Windows 7 RRS feed

  • Question

  • Hi, from few days ago i was dealing with this error

    Crash dump directories:
    C:\Windows
    C:\Windows\Minidump

    On Mon 24/06/2019 8:43:32 your computer crashed or a problem was reported
    crash dump file: C:\Windows\Minidump\062419-22620-01.dmp
    This was probably caused by the following module: ntoskrnl.exe (nt+0x75BC0)
    Bugcheck code: 0x4A (0x779F132A, 0x2, 0x0, 0xFFFFF88008956B60)
    Error: IRQL_GT_ZERO_AT_SYSTEM_SERVICE
    file path: C:\Windows\system32\ntoskrnl.exe
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT Kernel & System
    Bug check description: This indicates that a thread is returning to user mode from a system call when its IRQL is still above PASSIVE_LEVEL.
    This bug check belongs to the crash dump test that you have performed with WhoCrashed or other software. It means that a crash dump file was properly written out.
    The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 

    I dont want to format my pc, because it takes a lot of time.

    Here are the minidump files: http://www.mediafire.com/file/aax33ejt13n20l8/Minidump.zip/file

    Thanks in advance

    Update: I already passed 7 times memtest during 6 hours and no errors found
    • Edited by Samuel Marfer Monday, June 24, 2019 2:36 PM Update info
    Monday, June 24, 2019 2:26 PM

All replies

  • To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command.

    Make sure the default language is English so that the logs can be scanned and read.

    Choose the applicable link for the operating system:
    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html
    https://www.eightforums.com/threads/language-add-or-remove-in-windows-8.5849/
    https://www.sevenforums.com/tutorials/87317-display-language-change.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use 7zip to organize the files and one drive, drop box, or google drive to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There are two files for you to find manually:

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter the above to find results.

    b) dxdiag:  

    In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    For share links please use one drive, drop box, or google drive.

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .

    Monday, June 24, 2019 3:09 PM
  • Hi Samuel.

    The .DMP files have recorded a 0x4a (IRQL_GT_ZERO_AT_SYSTEM_SERVICE) bug check, which has been caused by the ekrn.exe (component of ESET Smart Security by ESET NOD32) and epfwwfp.sys (component of the ESET Personal Firewall) modules, as you can see from the below information

    FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_ekrn.exe_nt!KiSystemServiceExit+245
    BUCKET_ID:  X64_RAISED_IRQL_FAULT_ekrn.exe_nt!KiSystemServiceExit+245
    PRIMARY_PROBLEM_CLASS:  X64_RAISED_IRQL_FAULT_ekrn.exe_nt!KiSystemServiceExit+245

    Try disabling or removing that software and check if the problem still occurs; you can uninstall it using its removal tool available at https://support.eset.com/kb2289/?locale=en_US&viewlocale=en_US.


    Luigi Bruno
    MCP, MOS, MTA, MCTS, MCSA, MCSE

    Monday, June 24, 2019 3:14 PM
  • 1) Please uninstall ESET using the applicable uninstall tool:

    https://support.eset.com/kb2289/?locale=en_US&viewlocale=en_US

    2) Download and install:  https://www.microsoft.com/en-us/download/details.aspx?id=5201

    3) If there are no BSOD in 3 to 4 days then uninstall Microsoft Security Essentials and reinstall ESET

    4) Post the results of the administrative command prompt command for more comprehensive troubleshooting

    .

    .

    .

    epfwwfp.sys Thu Jan 10 22:19:30 2019 (5C383572)

    .

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .



    Monday, June 24, 2019 3:32 PM
  • Hi,

     

    As Luigi said, uninstall ESET to see if the issue remains.

     

    If you have any questions, please feel free to contact us.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, June 25, 2019 3:26 AM
  • Hi,

     

    Was your issue solved?

     

    If the reply helped you, please remember to mark it as an answer.

     

    If no, please reply and tell us the current situation in order to provide further help.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, June 27, 2019 6:54 AM