IRQL_NOT_LESS_OR_EQUAL on ntoskrnl.exe.

Discussion in 'Windows 7 Blue Screen of Death (BSOD)' started by CelticWhisper, Jul 22, 2014.

  1. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    I've been running into this error when running a VM on my second monitor (with laptop in docking station) and also today when running a VNC connection to another PC in the office.

    Hoping someone can help solve this. Reinstalling isn't a viable option right now as it's a company PC, we don't have an imaging solution set up yet, and Office 2013 is a royal PITA when it comes to extracting license keys for a reinstall. I need to at least try to fix this one in-place.

    Many thanks!
     

    Attached Files:

  2. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {fffffa80caf9b290, 2, 0, fffff800030994f9}
    
    Probably caused by : ntkrnlmp.exe ( nt!KiTimerExpiration+d9 )
    
    Followup: MachineOwner
    
    Hi,
    Bugcheck A appears when invalid memory is accessed which can be caused by the installation of faulty system software, drivers or bios.

    Laptops drivers are obtained from the manufacturer and looking though I see you have several updates pending including a bios update too. I'd also check the firmware section too in fact apply anything that seems relevant:
    http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdHome/?sp4ts.oid=5212913&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3DswEnvOID%253D4061%257CswLang%253D%257Caction%253DlistDriver&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

    If you have any more dump files then please send them as the more we can debug gives us a better idea on the actual issue.
     
  3. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Just got another BSOD after updating drivers & BIOS. Posting W7F diags. Thanks in advance for the help.

    EDIT: Also switched to "kernel memory dump" from "small memory dump" in sysdm.cpl. Not sure if that'll help for next time or not.
     

    Attached Files:

    #3 CelticWhisper, Jul 25, 2014
    Last edited: Jul 25, 2014
  4. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {fffffa8817201128, 2, 0, fffff8000309c861}
    
    Probably caused by : ntkrnlmp.exe ( nt!KiTimerWaitTest+171 )
    
    Followup: MachineOwner
    
    Hi,
    Your drivers are looking much better date wise as is the Bios but I see a lot of third party software some of which may be the cause of this issue.
    Some drivers which drew attention are:

    MfeEpeOpal.sys Wed Mar 27 12:04:38 2013: McAFEE Encryption? Please uninstall to test.

    savonaccess.sys Mon Jun 10 09:39:25 2013: Sophos Anti-Virus On-Access Driver please uninstall to test.

    A very stable anti virus app we always suggest is MSE:
    http://www.microsoft.com/en-gb/security/pc-security/mse.aspx
     
  5. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Sophos is our corporate AV, so I can't uninstall that. I mean...I technically can, as IT Manager, but I want to keep company equipment in line with company software loadouts as best I can. If you recommend against Sophos overall I'm open to suggestions for when our license subscription is up, but for now we gotta stick with it.

    I'll DEFINITELY look into the McAfee encryption software/driver though. McAfee anything has no place on our equipment. Kill Crush Destroy.
     
  6. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
    Hi Celtic,
    let me know how the uninstall goes and if it helps some. If you get any further dump files I'd sure love to see them as the more available the easier it becomes to spot trends and possible issues.
     
  7. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Got another one for you. I set the McAfee Endpoint Encryption Agent service to "Disabled" and stopped it. This BSOD happened during the same session.
     

    Attached Files:

  8. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {de5f270, 2, 0, fffff8800573cda4}
    
    *** WARNING: Unable to verify timestamp for dne64x.sys
    *** ERROR: Module load completed but symbols could not be loaded for dne64x.sys
    Probably caused by : dne64x.sys ( dne64x+4da4 )
    
    Followup: MachineOwner
    
    Hi,
    this bugcheck means pretty much the same as the one above and is again produced by drivers accessing invalid memory. Looking through your driver stack again I see there are a number of drivers which still need updating:

    dne64x.sys Tue Nov 11 01:01:24 2008: As mentioned in the above dump file this is Citrix Deterministic Network Enhancer Miniport or Cisco Systems VPN Client and needs updating:
    http://www.cisco.com/

    igdkmd64.sys Wed Sep 26 20:49:04 2012: Intel Graphics driver please update to later version on support webpage:
    http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdHome/?javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken&javax.portlet.prp_bd9b6997fbc7fc515f4cf4626f5c8d01=wsrp-navigationalState=swEnvOID%3D4061%7CswLang%3D%7Caction%3DlistDriver&javax.portlet.tpst=bd9b6997fbc7fc515f4cf4626f5c8d01&sp4ts.oid=5212913&ac.admitted=1406563495174.876444892.199480143#Driver - Graphics

    LGBusEnum.sys Tue Nov 24 01:36:48 2009: Are you also using a Logitech keyboard and mouse? If so please update to the latest drivers:
    http://www.logitech.com/en-us/support-downloads/downloads

    snp2uvc.sys Tue Nov 20 03:01:44 2012: HP webcam driver, later version on website

    stwrt64.sys Tue May 08 03:04:09 2012: HP Audio driver, 2013 version on website

    teamviewervpn.sys Thu Dec 13 09:22:09 2007: TeamViewerVPN Network Adapter please update or remove:
    http://www.teamviewer.com/en/download/windows.aspx

    tap0901.sys Thu Nov 24 18:50:27 2011: TAP-Win32 Adapter V9 or OpenVPN driver or COMODO security please advise if possible.

    Please check through the support page for any further system updates:
    http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdHome/?javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken&javax.portlet.prp_bd9b6997fbc7fc515f4cf4626f5c8d01=wsrp-navigationalState=swEnvOID%3D4061%7CswLang%3D%7Caction%3DlistDriver&javax.portlet.tpst=bd9b6997fbc7fc515f4cf4626f5c8d01&sp4ts.oid=5212913&ac.admitted=1406563495174.876444892.199480143#Driver - Audio
     
  9. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Awesome, thanks for that. One question: The Cisco VPN client requires an account to download. Do you know of a way to get the latest client without the login BS or should I contact our consulting company to find out our corporate Cisco account info?
     
  10. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
  11. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    According to the page, that's for version 5.0.07. Checked my installed version and it's 5.0.07.0440. Not sure what version post-5.0.07 the WSU download is, but the Cisco link points to my version so I'm wondering what component is outdated.

    I've updated the Intel gfx driver, and also updated my 3 Logitech drivers (Unifying Software, Gaming Software for the G110, and SetPoint).

    TAP-Win32 is for an installation of the PIA VPN client. Client was not running at the time of the BSOD, and no updates are available as of this writing, but I can uninstall if need be.

    Received 2 BSODs within an hour or so of each other. They happened prior to updating Logitech software, but after updating Intel driver.

    Also, I was curious about what software you're using to find out driver versions and check for updates so quickly.
     

    Attached Files:

  12. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Webcam and audio drivers have been updated, TeamViewer has been temporarily uninstalled.
     
  13. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {a0, 2, 0, fffff88001966dc9}
    
    Probably caused by : NETIO.SYS ( NETIO!FsbAllocate+49 )
    
    Followup: MachineOwner
    
    Hi,
    although all dump files were slightly different they were mostly network related. Cisko was also mentioned once again as a probable cause and looking at those updates again it doesn't seem that a later update to 2011 is available.
    Unfortunately my experience does not cover setting up VPN clients and the like especially in a professional setting. I feel I'm doing you a disservice by not trying to get you better qualified eyes to look over your issue. Let me contact a friend who is more versed in such things..
    By the way how come your tech support isn't on hand or are you kinda filling in right now?
     
  14. Trouble

    Trouble Noob Whisperer

    Joined:
    Nov 30, 2009
    Messages:
    13,845
    Likes Received:
    833
    It would seem that a couple drivers relating to your two installations of separate VPN Client software is messing with your network stack and causing these Blue Screens.
    Why not try renaming the two problem drivers.
    Do a search of your computer for
    CVPNDRVA.sys
    and
    dne64x.sys
    and rename them by changing the file extension to .OLD
    so CVPNDRVA.sys becomes CVPNDRVA.OLD
    and dne64x.sys becomes dne64x.OLD
    likely both will be found in C:\Windows\System32\Drivers
    but they may be elsewhere as well.
    Make sure you're not hiding file extensions of known types.
    Easily reversed if blue screens persist after renaming. Just go back and change them to .sys from .OLD
    At least we'll be able to refine the trouble shooting equation a bit.
     
    kemical likes this.
  15. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    I've renamed CVPNDRVA, but I have 3 copies of dne64x.sys. One is in C:\windows\system32\drivers, one is in C:\Program Files\Common Files\Deterministic Networks\DNE, and one is in C:\windows\system32\DriverStore\FileRepository\dne2000.inf_amd64_neutral_13093c410ec6ad15

    Which of these should be renamed?
     
  16. Trouble

    Trouble Noob Whisperer

    Joined:
    Nov 30, 2009
    Messages:
    13,845
    Likes Received:
    833
    First of all, if you reboot your machine after having renamed the one and the blue screens stop then there would be no need to mess about with the other, so give that a try first.
    Then (regarding the other driver) I would first rename the one that is in C:\windows\system32\drivers
    But depending on how the app that uses that driver actually operates it may notice that the driver is missing and pull the driver from one of the other two places, most likely C:\windows\system32\DriverStore\FileRepository\dne2000.inf_amd64_neutral_13093c410ec6ad15
    So you may have to rename all three drivers in all three locations in order to successfully defeat it from loading.
     
    kemical likes this.
  17. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Well, renaming CVPNDRVA definitely did hose my ability to connect to the company VPN, so at least I know what that corresponds to. I'm going to rename it back and try renaming dne64x instead, in hopes that that'll fix the problem equally well. I'll keep you posted. Thanks for the help so far.
     
    kemical likes this.
  18. Trouble

    Trouble Noob Whisperer

    Joined:
    Nov 30, 2009
    Messages:
    13,845
    Likes Received:
    833
    Thanks for the update.... I think we were pretty sure that renaming the driver was going to break something so no surprises there.
    The object of this exercise is to determine which (if either or both) is causing the blue screens. At which point you can take steps to update to a more recent and hopefully more compatible driver.
    Keep us posted.
     
    kemical likes this.
  19. CelticWhisper

    CelticWhisper New Member

    Joined:
    Jul 22, 2014
    Messages:
    16
    Likes Received:
    2
    Finally got one with the Cisco driver renamed to .old. Uploading the diags file.
     

    Attached Files:

  20. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,797
    Likes Received:
    1,563
    Code:
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {fffff8080325ddd8, 2, 8, fffff8080325ddd8}
    
    Probably caused by : volsnap.sys ( volsnap!VspWriteVolumePhase35+60 )
    
    Followup: MachineOwner
    
    Hi,
    the above dump file was caused by a driver accessing an invalid address and it might be worth trying the driver verifier to see if we can track down which driver is causing the bsod.
    This guide will give you the basics:
    http://www.reviversoft.com/blog/2013/09/using-driver-verifier-to-fix-a-blue-screen-of-death/

    Post the dump files as soon as you have them and we'll have a look see.. :)

    Edit:
    Just as a thought try running the system file checker to make sure we aren't dealing with any system corruption and also ensure the machine is fully updated via Windows update too.
    To run the file checker, open an admin command prompt and type:
    sfc /scannow
    Press enter and await results.
     

Share This Page

Loading...