Reading the stop code and the file it names
IRQL stands for Interrupt Request Level, a numbering of priorities the kernel uses to decide what code may run when. Some memory pages are allowed to be parked on disk, and touching them is legal only at low IRQLs. A driver that breaks this rule crashes Windows instantly and deliberately: 0x0000000A is the kernel refusing to continue with its own bookkeeping corrupted.
The file name printed at the bottom of the blue screen — and repeated in the minidump — is the single most useful piece of evidence the crash gives you. It points to the driver, and the driver points to the fix. When the screen shows no name at all, the memory itself becomes the prime suspect.
- nvlddmkm.sys — NVIDIA graphics driver; update it, or remove the old copy cleanly with DDU and install fresh
- rt640x64.sys, e1d*.sys — Realtek and Intel network drivers, frequent flyers on laptops
- tcpip.sys, netio.sys — the network stack, usually provoked by VPN clients and antivirus filters
- iaStorA.sys — Intel Rapid Storage driver, common on preinstalled OEM Windows 10 systems
- No file name at all — raise the suspicion of RAM running unstable at its XMP/EXPO profile
Fixing the driver side first
Start in Device Manager (Win + X → Device Manager) with the devices matching the named file: graphics under Display adapters, network under Network adapters. Open Properties → Driver and try Roll Back Driver if the crashes began after an update; otherwise let Update driver search automatically, then check the manufacturer's site for a newer package. Windows Update → Advanced options → Optional updates also carries driver updates, in a section of their own.
Third-party kernel filters deserve the same suspicion as hardware drivers. Antivirus suites, VPN clients and old virtualization tools hook the network and storage stacks, and each has triggered 0x0000000A in the field. Uninstall the newest of them — or switch the antivirus to a different product temporarily — and watch whether the stop code returns. If the crash loops before the desktop, enter Safe Mode from WinRE (Troubleshoot → Advanced options → Startup Settings → Restart → press 4) and remove the software there.
Testing RAM and confirming the culprit
Memory is the other half of the statistics. Launch the Windows Memory Diagnostic with mdsched.exe, restart when prompted and let the standard pass run; the result lands in Event Viewer under Windows Logs → System, from the source MemoryDiagnostics-Results. For a verdict you can act on, run MemTest86 from a USB stick for at least four full passes — the intermittent errors that mdsched misses surface there.
If the machine is overclocked or the RAM runs an XMP/EXPO profile, turn the profile off in BIOS and run at the board's default speeds for a week. A machine that stops crashing at stock speeds has just told you the memory was the problem. Test sticks one at a time to find the bad one, and keep the minidumps from C:\Windows\Minidump — WinDbg with the !analyze -v command reads the failing address out of them.
Questions and Answers
Is IRQL_NOT_LESS_OR_EQUAL caused by a virus?
Almost never. Genuine malware rarely triggers this specific stop code; it is overwhelmingly a driver or memory problem. An antivirus filter driver, ironically, is the more likely culprit.
What does stop code 0x0000000A mean?
A kernel-mode driver tried to reach pageable memory at an interrupt request level where that is not allowed. In plain terms: a driver broke the kernel's memory rules.
Can bad RAM cause IRQL_NOT_LESS_OR_EQUAL?
Yes — it is one of the two leading causes. Test with mdsched.exe first and MemTest86 for confirmation, and try disabling XMP/EXPO.
Know what is included before you buy.
The one-time 30-minute trial covers core tools. PRO-labelled features stay locked until a paid license is activated.
Read next
Write to us: [email protected]