Solved BSOD IRQL_NOT_LESS_OR_EQUAL Recent McAfee install and sytem restore

[rbaker882]

Hello - My computer will no longer start normally and gets the BSOD with an error showing IRQL_NOT_LESS_OR_EQUAL. On the day of the first crash 10/29/12, I had installed McAfee Anti Virus software. During the installation, a warning appeared that Ad-Aware must be uninstalled before installing McAfee. I uninstalled Ad-Aware and continued the McAfee install. When it was done my PC started running very slow. I am not sure if it was before or after the first crash that I did a system restore to 10/27/12. McAfee was gone and Ad-Aware was back. Using Safe Mode, I then uninstalled Ad-Aware since some google searches indicated the error might be due to an Anti-Virus software problem. But it did not fix the issue...still get BSOD whenever I try to start the PC normally.

There is no file listed on the BSOD that I can see to give a clue what the problem is. I am able to start the computer in Safe mode. I've looked at the Event viewer but don't really know what I am looking at - nothing stands out though.

I hope this info along with the attached file is enough information for someone to see what is going on here! Thanks very much in advance for any help you can provide.
Rachael

 

[koolkat77]

Welcome to SevenForums

Can you tell us what antivirus is currently installed on your PC?

__________________

1. Click on User CP on the top right of this page
2. Click on Edit System Spec
3. Fill in your computer specs
   • http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

__________________

 

[rbaker882]

No antivirus software is currently installed that I know of. I did not actually uninstall McAfee, just did a system restore to a prior date and don't see it anymore. Spybot (is that considered antivirus?) is still installed.
Thank you!

Update: McAfee is not available in the Control Panal as a program to Remove. But files still exist on the computer in Program Files\McAfee.

 

[koolkat77]

Some info on your bugchecks:---

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL  
Usual causes:  Kernel mode driver, System Service, BIOS, Windows, [COLOR="blue"]Virus scanner[/COLOR], 
Backup tool, compatibility
BugCheck A, {dc, 2, 1, fffff80002e9aef5}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
---------------------------
STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL  
Usual causes:  Kernel mode driver, System Service, BIOS, Windows, [COLOR="Blue"]Virus scanner[/COLOR], 
Backup tool, compatibility
BugCheck A, {1, 2, 0, fffff80002e7863f}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+10f )

Well the problem is McAfee itself, as far as I can say(for some reason). It very often causes BSOD-s on the system. You consider uninstalling it with the McAfee Removal Tool and replace with Microsoft Security Essentials at least to test.

(Please uninstall Ad-Aware - if you have it and spybot S&D slows down the system, please uninstall it as well). Uninstall using the free version of Revo Uninstaller [Advanced Mode]

• Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems
• How to uninstall | Spybot ©
• Removing Spybot - Safer-Networking Forums

• McAfee Removal Tool - McAfee Uninstaller

Recommended antivirus program for Windows 7 based on stability compared to others:-

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes - The Free version
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.
-------
From one of your older .dmps, and your .nfo file, your video card drivers need to be updated.

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; ATI REBOOT then delete remnants of its drivers/older drivers using Driver Fusion/Sweeper.
Update to newer driver version by going into Device Manager from rb: > Search and expand the list under Display Adapters.

• http://www.sevenforums.com/tutorials/97061-driver-install-device-manager.html

Once drivers have been installed reboot.

OR

Get the latest drivers from the filehippo link below:

• Download AMD Catalyst Drivers 12.10 Vista 64 - FileHippo.com

STOP 0x0000009F: DRIVER_POWER_STATE_FAILURE    
Usual causes:  Device driver
0: kd> !irp fffffa800817d910
Irp is active with 3 stacks 2 is current (= 0xfffffa800817da28)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [ 16, 0]   0  0 fffffa80075daa20 00000000 fffff88004e36c68-fffff880096a6bc0    
	       \Driver\pci	dxgkrnl!DpiFdoDevicePowerCompletionRoutine
			Args: 00000000 00000000 00000000 00000002
>[ 16, 2]   0 e1 fffffa800883e040 00000000 00000000-00000000    pending
	      Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
 \Driver\atikmdag
			Args: 00051100 00000001 00000001 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa800d50de40    

			Args: 00000000 00000000 00000000 00000000
0: kd> lmvm atikmdag
start             end                 module name
fffff880`04816000 fffff880`04e2d000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Thu Jul 02 23:45:07 2009 (4A4CF223)
    CheckSum:         005C2509
    ImageSize:        00617000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Simple stuff:
Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Free up the start-up, nothing except the antivirus is usually needed.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

-------
Install all windows updates, including Service Pack 1

• Learn how to install Windows 7 Service Pack 1 (SP1)

Look for a newer version on the BIOS:

BIOS Version/Date	American Megatrends Inc. P01-A4, [COLOR="Red"]9/15/2009[/COLOR]

Let us know how it goes.

 

[rbaker882]

Thank you for all the information! I have completed most of these tasks and the original error listed on the BSOD is gone but new ones have replaced it...Windows still won't start normally. Here are the things I did:

1. Uninstalled McAfee using the McAfee Uninstall Tool
2. Installed the Revo Uninstaller tool
3. Uninstalled Spybot using the Revo Uninstaller
4. Rebooted in Normal mode - At this point the BSOD appears with new error code 0x0000001E
5. Ran SFC /Scannow command - this completed and a message displayed that WRP did not find any violations
6. Rebooted in Normal mode - the BSOD appeared with new error 0x0000024 and had a file ntfs.sys listed
7. Ran chkdsk /f. This completed in less than 10 seconds so not sure if it really worked but it did display a list of things checked and a message stating no problems found. Also a message that it failed to transfer to event log Status 50
8. Rebooted again and the BSOD 0x000000E1 was back
9. Uninstalled one program that referenced ATI and rebooted. The Driver Fusion/Sweeper did not have a driver listed for anything 'ATI'. Went to the Device Manager and selected the Display Adapter...it said it has the most current driver.

I could not install the Microsoft Security Essentials in Safe Mode so that is not done yet. Also the Windows Update option in my start menu does not function so I couldn't download the new SP1.

Hopefully I did everything correctly and didn't make things worse! Can you please review the updated system info file I am attaching and let me know what you think?

 

[koolkat77]

I'm taking a look at the files and will report in a short while.

Run this tool and delete anything it finds:

• Anti-rootkit utility TDSSKiller

ESET online scanner:

• Free Online Virus Scanner | ESET

 

[rbaker882]

Koolkat77 you are a genius! My computer is back up and running AND it's running better than it has since I got it. Using your instructions, here is what I did and the results:

--Ran TDSSKiller - this found and fixed something called Rootkit.Boot.Pirah.C
--Rebooted - chkdsk ran automatically and (1) found error in Index $SII for File 9 and (2) found and repaired a 'security file record segmant'.
--Ran ESET online virus checker - this found and repaired 17 problems with names such as InstallCore.A, Olmarik.AK, InstallQ, JS/Agent.NEY, Kryptic and Weelsof.B. I am attaching a file of the errors if you are interested.
--Rebooted NORMALLY...Yeah!!!!
--Installed Microsoft Security Essentials and ran scan, no problems found.

So it looks like I had McAfee problems AND some viruses??? Thanks for your time and all the information...this was way over my head and I could never have fixed it without your help.
Rachael

 

[koolkat77]

Good to hear about the progress.

Now complete the last two steps:
1. Reduce the start-up prgms.
2. Install all updates & Service Pack 1.​

Let us know the results

 

[koolkat77]

How is the system running now? Did you complete the last steps?

 

[rbaker882]

Yes I removed all start up stuff except Microsoft Security Client, and installed all the Windows Updates. It's been a week now and the system is running better than ever!

Conicidentally, my two year old laptop crashed last week for the first time ever with a BSOD too. I was able to use all the troubleshooting tools you showed me for this and the laptop is fine now too. Thank you very much for your help and for all the info that's posted on this web site!!!

 

[koolkat77]

Thanks for the update. Nice to hear your laptop is running stable now.

You may mark the thread as solved for now. If there are any problems, create a new thread and refer this thread on the new one.

Good luck