BSOD IRQL_NOT_LESS_THAN_OR_EQUAL issue

Hi
I have been having some issues with BSODs randomly happening. I have gone through some malware removal processes........

http://forums.majorgeeks.com/showthread.php?p=1832315&posted=1#post1832315

... and I think I still have issues.

Much of the info is in that thread but highlights are:

BSOD is generally headed IRQL_ as per thread title and I've had one say DRIVER_IRQL etc. Havent captured one properly yet

As I ran one of the malware tools tonight it threw one up but it didnt have a title, just some ox0 numbers towards the bottom of the page.

I tried to run the sfc /scannow but instantly got message relating to files required by windows replaced with unrecognised versions, install xp prof sp3 cd - which i dont have and never have had. I also got a message saying missing DLL files need copying to the cache

Any suggestions where I go from here?

 

Zip up the memory dumps and attach them to your next post. They're located in C:\Windows\Minidump, copy them to your Desktop and right click on them, select "Send to", then select "Compressed (zipped) folder"

 

Thanks.

Hoping i've done this right, should be attached

 

Also meant to say there are quite a number of yellow warning triangles and red errors in the event viewer but I have no idea what they mean

 

Can you run MSInfo32 - allow a few minutes for it to complete loading the data then Save as - Msinfo32.nfo, zip that file and attach it here, it'll have further info on errors and drivers, etc.

 

At first glance, I'd guess that Rapport could be involved, uninstall it.

For the Device Manager warnings, uninstall them, after a reboot, Windows will try to reinstall them. They should be listed in MSInfo32, too.

 

OK, so, just looked on c drive for Msinfo32, looks like there is a folder named that but nothing in there - will see what i can do about that

Will uninstall Rapport now, supposedly a security thing recommended by HSBC bank!!

The event viewer errors, have attached a quick snapshot, in applications seem to mention missing DLLs a lot and registrations - not sure if they are normal but I can expand on some if they are of interest/use?

 

OK, figured out Msinfo32, ran it and as the file was saving it threw the attached blue screen

 

zipped msinfo32.nfo attached having had to reboot after blue screen

 

Is there a new minidump you can attach?

If you only ever see 1x minidump, change the settings so that it doesn't overwrite:

If the "overwrite ..." checkbox is still populated and greyed out, you may need to mess with the settings so you can uncheck it before setting the rest as above.

 

There was only one minidump in that file but now there is 2, maybe all the malware stuff cleared them out? Have attached latest one

Note Rapport uninstalled AFTER this instance of blue screen

 

The overwrite box seems greyed out and I cant change it, the rest of the settings were as per your instruction other than restart on failure which was checked so have taken that out

 

The only device I see in MSInfo as having a problem is a keyboard.

I see standard drivers loaded even when they are labelled as 'Disabled' (these particular drivers should NEVER be disabled anyway - some 'bad' tweaking?).

I don't see, or I may have missed it, any signs of a 3rd party firewall loaded - on XP especially, I feel this is a necessity.

I do see 4x Symantec modules as running, yet I don't see any Symantec/Norton product listed; if there is no Symantec/Norton product installed, please use the removal tool.

Overall, it feels like this could be a case of wipe/reinstall, see how it behaves after removing Symantec's traces; upload any further crash dumps when/if you get another BSOD and note down the codes(0x00000???) of any further BSODs before restarting in case the next BSOD happens before you get a chance to upload the last; any info is better than none.


EDIT: after removing Symantec and rebooting (again), please attach a fresh MSInfo file - allow it to run for ~ 10 minutes before saving it, it looked quite limited in places last time.

 

To uncheck the overwrite any existing file, in the drop-down for Write debugging information for the type of minidump, temporarily select either Kernel Memory Dump or Complete Memory Dump and then uncheck. Switch back to Small Memory Dump and click OK twice as before. (see attached)

 

I havent disabled anything as im not clued up enough to know that would do. I did have bullguard until recently but now use Microsoft essentials. The keyboard I use is just a cheap wireless one, maybe I try another?

 

Where would i enable these disabled drivers? Is that in device manager and then run through everything with properties to ensure each device is enabled? Or is it drivers not devices that are disabled?

Do you think the errors and warning ref DLL files and missing registrations are largely meaningless?

 

Yes, it's in device manager "use this device (enable)". No, the missing dll files and registry entries are not meaningless. satrow will have to help you with those.

 

The last dump still had 4x Rapport drivers loaded, try the methods outlined here: http://landing2.trusteer.com/book/uninstalling-rapport

Check that you have a usable copy of all vital files saved away from the computer.

There are signs of file system problems, possibly a faulty hard drive, run Seatools for DOS to check how bad it is: http://knowledge.seagate.com/articles/en_US/FAQ/201271en

 

Oddly Internet Explorer wont load. The icon for it is there but when I press it I get a screen that looks like its going to open, address bar starts to appear & white screen but then just shuts again.

In all honesty I think its time for a new computer!

 

I came to that conclusion too, based on what I could see early on; from what I can tell, I'd not want to trust my data on that machine without a new hard drive and PSU fitted - at a minimum. Frankly, it's probably not worth it.

 

Spookily just had another blue screen, probably not worth pursuing based on the conclusion but in case if its of any help it was

DRIVER_IRQL_NOT_LESS_THAN_OR_EQUAL

ox000000d1 (0x000888ea, 0x00000002, 0x00000000, 0xafa1c35b)

tcpip.sys - address afa1c35b base at afa0e000 datestamp 485b99ad

 

Boy, I've never seen Windows XP FUBARed the way yours seems to be. If you're going to keep the computer, eBay has Windows XP with COA/Product Key for around $55. The page I linked you to says there's 16,475 results. But you can set different criteria on the left side of the page to narrow things down.

An XP installation CD, or for that matter any Windows OS installation CD is a lot cheaper than a new computer.

 

tcpip.sys = network related, could be those Rapport remnants, maybe file damage ...