BSOD ntoskml.exe+70740 IRQL_NOT_LESS_OR_EQUAL

[Tatia]

Hi All, I am newbie submitting to forums - however sometimes read them and now really hope someone can help promptly!?!

I am supporting this E4200 laptop for our CEO and the last 3 months he has had 10 BSOD. I see these via BlueScreenView - however I must admit I do not understand what I can best do from here....

Attached a .doc with various printscreens from BlueScreenView.

Any detailed comments would be greatly appreciated! Many thanks in advance.

Best wishes

Tatia

 

[Lomai]

Hello Tatia

Welcome to Seven Forums
Please have a look at his thread as to how to upload your dump files - BSOD - Posting Instructions
The BSOD Squad will require the dump files for analysis.

TIA and regards

 

[Tatia]

Thanks Lomai

I get as far as:

"Windows Explorer will open to your Documents folder" - twice having run the .exe and it said it was nearly finished....

However there is no Windows_NT6_BSOD_jcgriff2 folder in the Documents folder??? I have refreshed and searched for this - but to no avail?

Yours puzzled...

Tatia

 

[Tews]

Hi Tatia...

Navigate to c:/windows/minidump and zip up the .dmp files and attach them to your next post!

 

[Tatia]

Many thanks Tews,

I tried the software for the 3rd time and got to: "Almost finished..." and the same happened ( no new folder seen ).

Anyhow - here is some more info as requested earlier:

Windows 7 Pro
x64
Original installed
OEM
Never reinstalled OS
MS Office 2007, Norton NIS 2011, Vodafone inbuilt SIM
Laptop is 5 months old – fully updated with the latest updates, SPs etc. Strictly business – user runs as a Standard User daily and then I install all updates as the Administrator as per Secunia’s guidance

Attached 2 x attachment: 10xminidump.zip and system_health_report.zip

I REALLY appreciate your prompt help – however please note that from this afternoon ( am already running late!!! ) I am roaming for a few days so I will not easily have access to this forum and his laptop – so please bear with me and understand that I may not be able to report back to you prompt/before early next week - at the very latest.

Many thanks for your co-operation.

I look forward to hearing from you – thanks and best wishes

Tatia

 

[Tews]

Ok... this may take a few, so be patient..

 

[Tews]

Calling in some help... dont give up the ship!

 

[Jonathan_King]

Start by updating your Dell wireless drivers: Drivers and Downloads

Next, remove Norton with this tool: ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

Replace it with MSE: http://www.microsoft.com/security_essentials

Update LogMeIn:

 lmimirr.sys  Tue Apr 10 18:32:45 2007

Install these chipset drivers: Drivers and Downloads

Install these graphics drivers: Drivers & Downloads

Did you place the .exe file in your Documents folder?

...Summary of the Dumps:

[font=lucida console]
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Thu Sep  9 16:10:00.792 2010 (GMT-4)
System Uptime: 1 days 22:49:40.055
BugCheck A, {41, 2, 1, fffff80002c85cd8}
*** WARNING: Unable to verify timestamp for d557bus.sys
*** ERROR: Module load completed but symbols could not be loaded for d557bus.sys
Probably caused by : d557bus.sys ( d557bus+1c009 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Tue Sep  7 01:52:41.952 2010 (GMT-4)
System Uptime: 2 days 12:44:52.214
BugCheck D4, {fffff880042fe7d8, 2, 0, fffff80002cc99eb}
Probably caused by : ntkrnlmp.exe ( nt!ExpScanGeneralLookasideList+a0 )
BUGCHECK_STR:  0xD4
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Wed Sep  1 02:55:01.547 2010 (GMT-4)
System Uptime: 1 days 23:12:21.810
BugCheck D4, {fffff880040747d8, 2, 0, fffff80002c7a9eb}
Probably caused by : ntkrnlmp.exe ( nt!ExpScanGeneralLookasideList+a0 )
BUGCHECK_STR:  0xD4
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep 13 07:10:02.784 2010 (GMT-4)
System Uptime: 0 days 14:31:27.047
BugCheck A, {41, 2, 1, fffff80002cd2cd8}
*** WARNING: Unable to verify timestamp for d557bus.sys
*** ERROR: Module load completed but symbols could not be loaded for d557bus.sys
Probably caused by : d557bus.sys ( d557bus+1c009 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨[/font]

 

[zigzag3143]

I wonder if we havent missed something. In at least 4 of the 10 a driver (used by Toshiba) WwanUSBmp64.sys was installed and blamed. It also may be responsible for the memory corruption in the other BugChecks.

I will bet that the conflict between the dell driver and the toshiba driver is what caused the crashes. It absolutely must be removed.

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Minidump\060510-21933-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a4d000 PsLoadedModuleList = 0xfffff800`02c8ae50
Debug session time: Sat Jun  5 11:52:42.718 2010 (GMT-4)
System Uptime: 3 days 3:23:01.981
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa800f44c000, 2, 0, fffff88002248d41}

[COLOR=Red][B]Unable to load image \SystemRoot\system32\DRIVERS\WwanUsbMp64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for WwanUsbMp64.sys
*** ERROR: Module load completed but symbols could not be loaded for WwanUsbMp64.sys
Probably caused by : WwanUsbMp64.sys[/B][/COLOR] ( WwanUsbMp64+17d41 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa800f44c000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88002248d41, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf50e0
 fffffa800f44c000 

CURRENT_IRQL:  2

[I]FAULTING_IP: 
WwanUsbMp64+17d41
fffff880`02248d41 803900          cmp     byte ptr [rcx],0
[/I] 
CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  Dell.ControlPo

TRAP_FRAME:  fffff80000ba2150 -- (.trap 0xfffff80000ba2150)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000200 rbx=0000000000000000 rcx=fffffa800f44c000
rdx=fffffa800f44be00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88002248d41 rsp=fffff80000ba22e0 rbp=fffff8800225e510
 r8=0000000000000000  r9=0000000000000000 r10=3a444155432b0a0d
r11=fffffa800f44be00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
WwanUsbMp64+0x17d41:
fffff880`02248d41 803900          cmp     byte ptr [rcx],0 ds:c1b0:fffffa80`0f44c000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002abcb69 to fffff80002abd600

STACK_TEXT:  
fffff800`00ba2008 fffff800`02abcb69 : 00000000`0000000a fffffa80`0f44c000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00ba2010 fffff800`02abb7e0 : 00000000`00000009 00000000`00000004 fffff880`022ca2c0 fffffa80`080b61a0 : nt!KiBugCheckDispatch+0x69
fffff800`00ba2150 fffff880`02248d41 : fffffa80`00000000 fffffa80`65525441 fffff800`02c4cbc0 fffff800`02c37e80 : nt!KiPageFault+0x260
fffff800`00ba22e0 fffffa80`00000000 : fffffa80`65525441 fffff800`02c4cbc0 fffff800`02c37e80 00000000`00000000 : WwanUsbMp64+0x17d41
fffff800`00ba22e8 fffffa80`65525441 : fffff800`02c4cbc0 fffff800`02c37e80 00000000`00000000 fffff880`0223e58c : 0xfffffa80`00000000
fffff800`00ba22f0 fffff800`02c4cbc0 : fffff800`02c37e80 00000000`00000000 fffff880`0223e58c fffffa80`08e3aec0 : 0xfffffa80`65525441
fffff800`00ba22f8 fffff800`02c37e80 : 00000000`00000000 fffff880`0223e58c fffffa80`08e3aec0 00000000`00000200 : nt!NonPagedPoolDescriptor+0x340
fffff800`00ba2300 00000000`00000000 : fffff880`0223e58c fffffa80`08e3aec0 00000000`00000200 fffffa80`08d5a000 : nt!KiInitialPCR+0x180


STACK_COMMAND:  kb

FOLLOWUP_IP: 
WwanUsbMp64+17d41
fffff880`02248d41 803900          cmp     byte ptr [rcx],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  WwanUsbMp64+17d41

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: WwanUsbMp64

IMAGE_NAME:  WwanUsbMp64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a892046

FAILURE_BUCKET_ID:  X64_0xD1_WwanUsbMp64+17d41

BUCKET_ID:  X64_0xD1_WwanUsbMp64+17d41

Followup: MachineOwner
---------

 

[Jonathan_King]

Ken, that WwanUSBmp64.sys is a WWAN Wireless Module Device Driver, used by Lenovo, Toshiba, and of course Dell systems.

It's related to that Dell driver I linked to.

 

[zigzag3143]

Jonathan

Thanks for the clarification. Everyone makes mistakes or doesn't make that 110% effort on every post as you well know. When I was training you it was one of the most important things I tried to impart. In this case it was my turn. That is what teamwork is all about. When we all work together we catch each others mistakes, get other views, and generally gain from the experience. We have all found flaws in others work and worked quietly in the background to correct them. It is only when we dont, that we (and the op) lose out.

 

[JMH]

To err is human.........

We all make mistakes...the important thing is that we learn & help each other...

 

[Jonathan_King]

Thanks Ken, that's the beauty of a forum, because we all cover each other.

No one sees everything.

 

[Tatia]

Many thanks to you all - I am just back - however I will take a closer look at all your recommendations over the weekend! It's too late here now Zzzzzz Your assistance is very much appreciated!!!! Thanks and best wishes Tatia

 

[JMH]

Many thanks to you all - I am just back - however I will take a closer look at all your recommendations over the weekend! It's too late here now Zzzzzz Your assistance is very much appreciated!!!! Thanks and best wishes Tatia

Tatia,

Before you zzzzzzzz

Good luck & let us know how you go please.

 

[Tatia]

Hi All,

Many thanks for all your help so far and for your patience whilst I have been away/offline this week.

Jonathan_King: I have now been able to take a closer look at your recommendations and as soon I get my hands on the Dell E4200 laptop again I will get these updates installed. I am pleased to report there has been no BSOD the last 6 days.

I do have a question ref Norton 2011 – was Norton actually reported to cause some of these troubles??? In general I have only ever had success with NIS 2009/2010 on about 20-odd systems. However the Norton 2011 is my first install – this was installed on this E4200 12 days ago ( 07/09/2010 ) after I used the Norton uninstall to remove Norton 2010. I understand/feel that NIS in general offer overall better protection + features – no?

I was very surprised to see the outdated:
lmimirr.sys Tue Apr 10 18:32:45 2007
-as I only installed LogMeIn Free in May 2010 direct from their website?!

I had this back from LogMeIn support:

From the Toolkit

1. On the host computer, click on the LogMeIn icon in the System Tray.
2. Click on Open LogMeIn.
3. Click on the About tab.
4. Click on Check for Updates.

From the MSI package

If the Toolkit method fails, you can always download and update via the LogMeIn MSI package.

1. Download and save the MSI package from www.logmein.com/logmein.msi.
2. Run the file once the download completes.
3. Choose the Upgrade option from within the installer wizard.

Follow the steps and complete the upgrade install.


I usually DO run the LogMeIn updates?! However will double-check this when I next have LogMeIn access to the Dell E4200 laptop.

On another note… I am getting a new laptop for myself next week ( Lenovo, SSD, Win 7 / MS Office 2010 64bit ) and no doubt will have one or two questions – so what is the netiquette of this Forum – should I just Edit the System Spec to my new details if/when I need to submit a post based on my new laptop?

Thanks and best wishes
Tatia