Windows 7 IRQL_NOT_LESS_OR_EQUAL on ntoskrnl.exe.

[CelticWhisper]

I've been running into this error when running a VM on my second monitor (with laptop in docking station) and also today when running a VNC connection to another PC in the office.

Hoping someone can help solve this. Reinstalling isn't a viable option right now as it's a company PC, we don't have an imaging solution set up yet, and Office 2013 is a royal PITA when it comes to extracting license keys for a reinstall. I need to at least try to fix this one in-place.

Many thanks!

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa80caf9b290, 2, 0, fffff800030994f9}

Probably caused by : ntkrnlmp.exe ( nt!KiTimerExpiration+d9 )

Followup: MachineOwner

Hi,
Bugcheck A appears when invalid memory is accessed which can be caused by the installation of faulty system software, drivers or bios.

Laptops drivers are obtained from the manufacturer and looking though I see you have several updates pending including a bios update too. I'd also check the firmware section too in fact apply anything that seems relevant:
Link Removed

If you have any more dump files then please send them as the more we can debug gives us a better idea on the actual issue.

 

[CelticWhisper]

Just got another BSOD after updating drivers & BIOS. Posting W7F diags. Thanks in advance for the help.

EDIT: Also switched to "kernel memory dump" from "small memory dump" in sysdm.cpl. Not sure if that'll help for next time or not.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8817201128, 2, 0, fffff8000309c861}

Probably caused by : ntkrnlmp.exe ( nt!KiTimerWaitTest+171 )

Followup: MachineOwner

Hi,
Your drivers are looking much better date wise as is the Bios but I see a lot of third party software some of which may be the cause of this issue.
Some drivers which drew attention are:

MfeEpeOpal.sys Wed Mar 27 12:04:38 2013: McAFEE Encryption? Please uninstall to test.

savonaccess.sys Mon Jun 10 09:39:25 2013: Sophos Anti-Virus On-Access Driver please uninstall to test.

A very stable anti virus app we always suggest is MSE:
Link Removed

 

[CelticWhisper]

Sophos is our corporate AV, so I can't uninstall that. I mean...I technically can, as IT Manager, but I want to keep company equipment in line with company software loadouts as best I can. If you recommend against Sophos overall I'm open to suggestions for when our license subscription is up, but for now we gotta stick with it.

I'll DEFINITELY look into the McAfee encryption software/driver though. McAfee anything has no place on our equipment. Kill Crush Destroy.

 

[kemical]

Hi Celtic,
let me know how the uninstall goes and if it helps some. If you get any further dump files I'd sure love to see them as the more available the easier it becomes to spot trends and possible issues.

 

[CelticWhisper]

Got another one for you. I set the McAfee Endpoint Encryption Agent service to "Disabled" and stopped it. This BSOD happened during the same session.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {de5f270, 2, 0, fffff8800573cda4}

*** WARNING: Unable to verify timestamp for dne64x.sys
*** ERROR: Module load completed but symbols could not be loaded for dne64x.sys
Probably caused by : dne64x.sys ( dne64x+4da4 )

Followup: MachineOwner

Hi,
this bugcheck means pretty much the same as the one above and is again produced by drivers accessing invalid memory. Looking through your driver stack again I see there are a number of drivers which still need updating:

dne64x.sys Tue Nov 11 01:01:24 2008: As mentioned in the above dump file this is Citrix Deterministic Network Enhancer Miniport or Cisco Systems VPN Client and needs updating:
http://www.cisco.com/

igdkmd64.sys Wed Sep 26 20:49:04 2012: Intel Graphics driver please update to later version on support webpage:
http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdHome/?javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken&javax.portlet.prp_bd9b6997fbc7fc515f4cf4626f5c8d01=wsrp-navigationalState=swEnvOID%3D4061%7CswLang%3D%7Caction%3DlistDriver&javax.portlet.tpst=bd9b6997fbc7fc515f4cf4626f5c8d01&sp4ts.oid=5212913&ac.admitted=1406563495174.876444892.199480143#Driver - Graphics

LGBusEnum.sys Tue Nov 24 01:36:48 2009: Are you also using a Logitech keyboard and mouse? If so please update to the latest drivers:
Link Removed

snp2uvc.sys Tue Nov 20 03:01:44 2012: HP webcam driver, later version on website

stwrt64.sys Tue May 08 03:04:09 2012: HP Audio driver, 2013 version on website

teamviewervpn.sys Thu Dec 13 09:22:09 2007: TeamViewerVPN Network Adapter please update or remove:
http://www.teamviewer.com/en/download/windows.aspx

tap0901.sys Thu Nov 24 18:50:27 2011: TAP-Win32 Adapter V9 or OpenVPN driver or COMODO security please advise if possible.

Please check through the support page for any further system updates:
http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdHome/?javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken&javax.portlet.prp_bd9b6997fbc7fc515f4cf4626f5c8d01=wsrp-navigationalState=swEnvOID%3D4061%7CswLang%3D%7Caction%3DlistDriver&javax.portlet.tpst=bd9b6997fbc7fc515f4cf4626f5c8d01&sp4ts.oid=5212913&ac.admitted=1406563495174.876444892.199480143#Driver - Audio

 

[CelticWhisper]

Awesome, thanks for that. One question: The Cisco VPN client requires an account to download. Do you know of a way to get the latest client without the login BS or should I contact our consulting company to find out our corporate Cisco account info?

 

[kemical]

I did a little googling and found a similar download here but whether it will work or not you'll have to see:
Link Removed
The above download is the same version as this one on the actual Cisco site:
Link Removed

 

[CelticWhisper]

I did a little googling and found a similar download here but whether it will work or not you'll have to see:
Link Removed
The above download is the same version as this one on the actual Cisco site:
Link Removed

According to the page, that's for version 5.0.07. Checked my installed version and it's 5.0.07.0440. Not sure what version post-5.0.07 the WSU download is, but the Cisco link points to my version so I'm wondering what component is outdated.

I've updated the Intel gfx driver, and also updated my 3 Logitech drivers (Unifying Software, Gaming Software for the G110, and SetPoint).

TAP-Win32 is for an installation of the PIA VPN client. Client was not running at the time of the BSOD, and no updates are available as of this writing, but I can uninstall if need be.

Received 2 BSODs within an hour or so of each other. They happened prior to updating Logitech software, but after updating Intel driver.

Also, I was curious about what software you're using to find out driver versions and check for updates so quickly.

 

[CelticWhisper]

Webcam and audio drivers have been updated, TeamViewer has been temporarily uninstalled.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {a0, 2, 0, fffff88001966dc9}

Probably caused by : NETIO.SYS ( NETIO!FsbAllocate+49 )

Followup: MachineOwner

Hi,
although all dump files were slightly different they were mostly network related. Cisko was also mentioned once again as a probable cause and looking at those updates again it doesn't seem that a later update to 2011 is available.
Unfortunately my experience does not cover setting up VPN clients and the like especially in a professional setting. I feel I'm doing you a disservice by not trying to get you better qualified eyes to look over your issue. Let me contact a friend who is more versed in such things..
By the way how come your tech support isn't on hand or are you kinda filling in right now?

 

[Trouble]

It would seem that a couple drivers relating to your two installations of separate VPN Client software is messing with your network stack and causing these Blue Screens.
Why not try renaming the two problem drivers.
Do a search of your computer for
CVPNDRVA.sys
and
dne64x.sys
and rename them by changing the file extension to .OLD
so CVPNDRVA.sys becomes CVPNDRVA.OLD
and dne64x.sys becomes dne64x.OLD
likely both will be found in C:\Windows\System32\Drivers
but they may be elsewhere as well.
Make sure you're not hiding file extensions of known types.
Easily reversed if blue screens persist after renaming. Just go back and change them to .sys from .OLD
At least we'll be able to refine the trouble shooting equation a bit.

 

[CelticWhisper]

I've renamed CVPNDRVA, but I have 3 copies of dne64x.sys. One is in C:\windows\system32\drivers, one is in C:\Program Files\Common Files\Deterministic Networks\DNE, and one is in C:\windows\system32\DriverStore\FileRepository\dne2000.inf_amd64_neutral_13093c410ec6ad15

Which of these should be renamed?

 

[Trouble]

First of all, if you reboot your machine after having renamed the one and the blue screens stop then there would be no need to mess about with the other, so give that a try first.
Then (regarding the other driver) I would first rename the one that is in C:\windows\system32\drivers
But depending on how the app that uses that driver actually operates it may notice that the driver is missing and pull the driver from one of the other two places, most likely C:\windows\system32\DriverStore\FileRepository\dne2000.inf_amd64_neutral_13093c410ec6ad15
So you may have to rename all three drivers in all three locations in order to successfully defeat it from loading.

 

[CelticWhisper]

Well, renaming CVPNDRVA definitely did hose my ability to connect to the company VPN, so at least I know what that corresponds to. I'm going to rename it back and try renaming dne64x instead, in hopes that that'll fix the problem equally well. I'll keep you posted. Thanks for the help so far.

 

[Trouble]

Thanks for the update.... I think we were pretty sure that renaming the driver was going to break something so no surprises there.
The object of this exercise is to determine which (if either or both) is causing the blue screens. At which point you can take steps to update to a more recent and hopefully more compatible driver.
Keep us posted.

 

[CelticWhisper]

Finally got one with the Cisco driver renamed to .old. Uploading the diags file.

 

[kemical]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff8080325ddd8, 2, 8, fffff8080325ddd8}

Probably caused by : volsnap.sys ( volsnap!VspWriteVolumePhase35+60 )

Followup: MachineOwner

Hi,
the above dump file was caused by a driver accessing an invalid address and it might be worth trying the driver verifier to see if we can track down which driver is causing the bsod.
This guide will give you the basics:
http://www.reviversoft.com/blog/2013/09/using-driver-verifier-to-fix-a-blue-screen-of-death/

Post the dump files as soon as you have them and we'll have a look see..

Edit:
Just as a thought try running the system file checker to make sure we aren't dealing with any system corruption and also ensure the machine is fully updated via Windows update too.
To run the file checker, open an admin command prompt and type:
sfc /scannow
Press enter and await results.