Windows 10: BSOD IRQL_NOT_LESS_OR_EQUAL when waking from Hibernate

This is odd as it only happens waking from Hibernate. I don't get it on wake from startup or sleep.

I have tried:

memory diagnostics - all fine
updating all drivers
restore from points created by me (failed, even without Kaspersky running)
sfc /scannow
Keeping wireless off and Kaspersky off on hibernating and wake up
Checking out HP website and support etc.

I think it started after windows 10 Creative update, along with icons disappearing/re-arranging themselves.

Computer name: HP-HENRY
Windows version: Windows 10 , 10.0, build: 15063
Windows dir: C:\WINDOWS
Hardware: HP Pro x2 612 G1 Tablet, Hewlett-Packard, 221B
CPU: GenuineIntel Intel(R) Core(TM) i5-4202Y CPU @ 1.60GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 8465244160 bytes total



Crash Dump Analysis
Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Sun 23/07/2017 18:06:01 your computer crashed
crash dump file: C:\WINDOWS\Minidump\072317-9781-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16C4C0)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF802C0504BF8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



I attach zipfile and would be grateful for help as ntoskrnl is not informative of what is causing it.

:)

 

Laptop BSOD when waking up from Hibernate mode

Hello Eddie,

We've noticed that the thread you've generated become idle for a few days already. We are here to check if you would still need help in this regard. We would also love to know about the result after you tried the third suggestion of our MVP. Were you able to
get any response from the engineers over the Feedback Hub? Tell us if you think we can help.

Feel free to keep us updated and best regards.

 

Laptop BSOD when waking up from Hibernate mode

apparently the fix was to format my PC entirely,

Quite a dissapointment

 

Code: 2: kd> lmvm SDDisk2K Browse full module list start end module name fffff800`b96d0000 fffff800`b9753000 SDDisk2K T (no symbols) Loaded symbol image file: SDDisk2K.sys Image path: \SystemRoot\system32\DRIVERS\SDDisk2K.sys Image name: SDDisk2K.sys Browse all global symbols functions data Timestamp: Fri Dec 05 22:14:01 2014 (54822E29) CheckSum: 00040545 ImageSize: 00083000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4[/quote] I'm not sure what the above driver is related to? The results I can find are related to SecureDoc? The driver appears to start at boot too.

The issue does appear to lie with a power-related IRP and its subsequent page fault.

Code: 2: kd> knL # Child-SP RetAddr Call Site 00 ffffa201`bf57db98 fffff801`b6a088a9 nt!KeBugCheckEx 01 ffffa201`bf57dba0 fffff801`b6a06e7d nt!KiBugCheckDispatch+0x69 02 ffffa201`bf57dce0 fffff801`b68fcbf8 nt!KiPageFault+0x23d << Causes Bugcheck 03 ffffa201`bf57de70 fffff801`b68c63fd nt!IopCompleteRequest+0xb98 << Completion of IRP 04 ffffa201`bf57df60 fffff801`b68c7d75 nt!KiDeliverApc+0x13d 05 ffffa201`bf57dff0 fffff801`b68f443f nt!KiCheckForKernelApcDelivery+0x25 06 ffffa201`bf57e020 fffff801`b694ee4c nt!KiLeaveGuardedRegionUnsafe+0x2f 07 ffffa201`bf57e050 fffff801`b68d568f nt!MmWaitForCacheManagerPrefetch+0x68 08 ffffa201`bf57e080 fffff801`b6d1a419 nt!CcFetchDataForRead+0xff 09 ffffa201`bf57e0e0 fffff801`b68d53cb nt!CcMapAndCopyFromCache+0xd9 0a ffffa201`bf57e180 fffff800`bca319b9 nt!CcCopyReadEx+0x12b 0b ffffa201`bf57e210 fffff800`bc9f5b5c fastfat!FatCommonRead+0x8ad 0c ffffa201`bf57e380 fffff800`b812563d fastfat!FatFsdRead+0x18c 0d ffffa201`bf57e410 fffff800`b81234d6 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d 0e ffffa201`bf57e480 fffff801`b6d276ef FLTMGR!FltpDispatch+0xb6 0f ffffa201`bf57e4e0 fffff801`b6d26457 nt!IopSynchronousServiceTail+0x1af 10 ffffa201`bf57e5a0 fffff801`b6a08413 nt!NtReadFile+0x697 11 ffffa201`bf57e6a0 fffff801`b6a006a0 nt!KiSystemServiceCopyEnd+0x13 12 ffffa201`bf57e8a8 fffff801`b68b556c nt!KiServiceLinkage 13 ffffa201`bf57e8b0 fffff801`b6cf9da1 nt!CmpFileReadEx+0xc0 14 ffffa201`bf57e960 fffff801`b6dc7913 nt!CmpFileRead+0x31 15 ffffa201`bf57e9a0 fffff801`b6dc6c4a nt!HvpGetHiveHeader+0x77 16 ffffa201`bf57e9e0 fffff801`b6dc6427 nt!HvLoadHive+0x5a 17 ffffa201`bf57eaf0 fffff801`b6dc5de5 nt!HvInitializeHive+0x2a3 18 ffffa201`bf57eb70 fffff801`b6cfbbdf nt!CmpInitializeHive+0x521 19 ffffa201`bf57ed50 fffff801`b6cfb7a7 nt!CmpInitHiveFromFile+0x3d7 1a ffffa201`bf57ef70 fffff801`b6ceabb8 nt!CmpCmdHiveOpen+0xc3 1b ffffa201`bf57f000 fffff801`b6cfa7c2 nt!CmLoadKey+0x1c8 1c ffffa201`bf57f340 fffff801`b6e12029 nt!CmLoadDifferencingKey+0x94a 1d ffffa201`bf57f640 fffff801`b6a08413 nt!NtLoadKey2+0x39 1e ffffa201`bf57f6b0 fffff801`b6a006a0 nt!KiSystemServiceCopyEnd+0x13 1f ffffa201`bf57f848 fffff801`b6e091d4 nt!KiServiceLinkage 20 ffffa201`bf57f850 fffff801`b6e0590b nt!BiLoadHive+0x138 21 ffffa201`bf57f950 fffff801`b6e055cb nt!BiAddStoreFromFile+0x6b 22 ffffa201`bf57fa00 fffff801`b6e06748 nt!BiLoadSystemStore+0xa7 23 ffffa201`bf57fa60 fffff801`b6e05af5 nt!BiOpenSystemStore+0xf8 24 ffffa201`bf57fad0 fffff801`b6dfe16f nt!BcdOpenStore+0x3d 25 ffffa201`bf57fb10 fffff801`b6c98e0c nt!PopFreeHiberContext+0x2b 26 ffffa201`bf57fb50 fffff801`b68ceca8 nt!PopUnlockAfterSleepWorker+0x4c 27 ffffa201`bf57fb80 fffff801`b696dac7 nt!ExpWorkerThread+0xd8 28 ffffa201`bf57fc10 fffff801`b6a02946 nt!PspSystemThreadStartup+0x47 29 ffffa201`bf57fc60 00000000`00000000 nt!KiStartSystemThread+0x16[/quote] I would suggest removing the program associated with the driver if possible, or running Driver Verifier for at least 24 hours using the following instructions - Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

 

Consider uninstalling Malwarebytes and turning hibernation off.
Are you using any Winmagic software programs such as disk encryption?
Are you using any HP drive encryption software?

 

Thanks for replies.

I'm not sure what the above driver is related to? The results I can find are related to SecureDoc? The driver appears to start at boot too.[/quote] What is SecureDoc? I don't know about the driver SDDISK2K.sys either.

 

IRP = I/O Request Package, used to perform I/O operations.

 

Open control panel
Use the Microsoft snipping tool
Post an image into the thread.
Uninstall Malwarebytes.

Before starting windows driver verifier make sure:
1) create a brand new restore point
2) use Macrium to create a backup image: Macrium Software | Your image is everything
3) backup any important files
4) know 2 methods to turn off windows driver verifier using windows recovery or advanced troubleshooting options:
a) startup options > requires a restart > safe mode with command prompt > type: verifier /reset
b) command prompt or AdminitratorX: \Windows\system32\cmd.exe type: verifier /bootmode resetonbootfail
5) if the two methods fail to turn off windows driver verifier you will then choose restore and use the restore point that you just created. Unfortunately the minidump file typically disappear so little progress is made in the debugging
6) The system settings need to be modified to not automatically restart so that you have ample time to view the bsod window.
Follow the settings in this link: BSOD Finding and fixing them - Microsoft Community

Keyboard: win + r keys simultaneously > type or copy and paste: sysdm.cpl > click advanced tab > under startup and recover click settings > under system failure uncheck automatically restart

For each BSOD you will see a stop code typically driver verifier detected violation. The misbehaving driver may be displayed in the form *.sys If you see the driver displayed please record it for later use.

7) install each Bluescreenview and Whocrashed and view their analysis after each bsod:
Resplendence Software - WhoCrashed, automatic crash dump analyzer
Blue screen of death (STOP error) information in dump files.
8) Update or post a new zip after the bsod so that we can debug and guide you through the update or uninstall / reinstall of drivers: BSOD - Posting Instructions - Windows 10 Forums

Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community

 

The application using SDDisk2K.sys was HP Drive Encryption. I don't use it and I don't think it is even compatible with Windows 10. Anyway, HP said just uninstall it. Which I have done. I checked the driver had been dropped in device manager and yes, no longer there.
HP-HENRY-03_08_2017_192523_21.zipHP-HENRY-03_08_2017_192523_21.zip
However, I am still getting the same STOP Code. IRQL_NOT_LESS_OR_EQUAL.

On Thu 03/08/2017 19:19:19 your computer crashed
crash dump file: C:\WINDOWS\Minidump\080317-7921-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16C4C0)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF801B4A73BF8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

I attach the latest zip file including the dump and would be grateful for analysis again.

 

In post #3 you were supposed to uninstall Malwarebytes.
Somehow it was never uninstalled or reinstalled on the computer?
The Malwarebytes is again producing bsod.

1) Uninstall all Malwarebytes software.


Code: ffffe181`4338d0a8 fffff801`b970fbd0Unable to load image \??\C:\WINDOWS\system32\drivers\farflt.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for farflt.sys*** ERROR: Module load completed but symbols could not be loaded for farflt.sys farflt+0xfbd0[/quote] Code: ffffe181`4338d048 fffff80b`c8922a1fUnable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x2a1f[/quote]
Code: Event[797]: Log Name: System Source: Service Control Manager Date: 2017-07-18T15:06:23.140 Event ID: 7045 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: HP-Henry Description: A service was installed in the system.Service Name: MBAMChameleonService File Name: C:\WINDOWS\system32\drivers\MBAMChameleon.sysService Type: kernel mode driverService Start Type: boot startService Account:[/quote] mbamchameleon.sys Malwarebytes Chameleon Protection Driver Chameleon - Free Malware Removal Tool If using this

farflt.sys Malwarebytes Anti-Ransomware Protection Downloads: Free Cyber Security & Anti-Malware Software
Support: Customer Support & Help Center

Code: Event[12708]: Log Name: System Source: Service Control Manager Date: 2017-08-03T19:20:11.144 Event ID: 7045 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: HP-Henry Description: A service was installed in the system.Service Name: MBAMFarfltService File Name: C:\WINDOWS\system32\drivers\farflt.sys[/quote] Code: MBAMChameleo MBAMChameleon MBAMChameleon File System Boot Running OK TRUE FALSE 12,288 139,264 0 27/06/2017 19:22:06 C:\WINDOWS\system32\drivers\MBAMChameleon.sys 8,192[/quote]

 

It wasn't Malwarebytes. Uninstalling made no difference.

It turned out to probably be Folder Lock, a security program, which I had uninstalled a while ago. The uninstall left a complete mess behind. Still entries in the registry, in startup, in drivers, etc. newsoftwares.net - at least it went away when I cleaned it all up, the only other thing I did was download WDK but not used it, and I doubt the issue was fixed by downloading and installing that.

So running ok at present. Hope it doesn't come back.

 

See if you can run windows driver verifier for 36 hours without a bsod.

 

Thanks. The BSOD has happened again. So, although I've cleaned up the Folder Lock mess, it has not solved it.

I did uninstall Malwarebytes, so I don't understand the messages - it is still uninstalled now - I can't find either of the two .sys files you mention. I have done a full search for them, and checked in "Services" to see if they were startup enabled/disabled, but they do not exist.

I will run the Windows Driver Verifier as you suggest.

 

Please post the bsod mini dump as they occur for debugging:
BSOD - Posting Instructions - Windows 10 Forums

 

I have contacted Malwarebytes as it has not uninstalled completely despite using their clean up uninstall - given they have a cleanup utility, they are obviously aware of some errors in uninstall - the registry has Malwarebytes scattered all over the place and I have sent them copies of all the Malwarebyte entries.

Here is the latest BSOD from Hibernate wake up.

HP-HENRY-07_08_2017_170915_28.zip