Windows 10: BSOD IRQL_NOT_LESS_OR_EQUAL when waking from Hibernate

There were 3 bsod mini dump files debugged and there was 1 misbehaving driver identified.
It was a repeat misbehaving driver: MBAMChameleon.sys

1) open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /restorehealth
4) chkdsk /scan
When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread


4) msconfig (in the pop up system configuration > move the dot from normal startup to selective startup > uncheck load startup items > click service tab > in left lower corner check hide all Microsoft services > in the lower right side click disable all > click apply or ok > do not reboot)


5) taskmgr (in the pop up task manager > click on the start up tab > click on status so that the column sorts with enable rising to the top > right click on each row with enable and change to disable)


https://support.microsoft.com/en-us/...oot-in-windows


How to perform a Clean Boot in Windows 10 - TechNet Articles - United States (English) - TechNet Wiki

6) shutdown /r (you will reboot the computer so that it is in clean boot)


These next steps are an attempt to remove Malwarebytes. The drivers list is not displaying the misbehaving driver,
Please use everything search to confirm that it is still present and the report what you see in the post with an image of the results.

voidtools

Search for each:
malware
mbam

7) uninstall Kaspersky software
8) use the Kaspersky uninstall tool: Removal tool for Kaspersky Lab products (kavremover)
9) turn on windows defender
10) install Malwarebytes
11) uninstall Malwarebytes
12) recheck everything search for each
malware
mbam
13) report the results into the thread with images.








Code: ffffc380`15394048 fffff803`be422a1fUnable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x2a1f[/quote] mbamchameleon.sys Malwarebytes Chameleon Protection Driver Chameleon - Free Malware Removal Tool If using this

 

I have not yet heard from Malwarebytes. However, this is the information I sent them.

2017-08-06 00:14:40.673 mb-clean:3.1.0.1014 @ Malwarebytes. All rights reserved.
2017-08-06 00:14:44.415 Find Malwarebytes 3 installation location from C:\Program Files\Malwarebytes\Anti-Malware\.
2017-08-06 00:14:45.945 Malwarebytes self-protection module is not installed.
2017-08-06 00:14:45.957 Launching process:C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /log="C:\Users\pamelap\AppData\Local\Temp\Mbam3x.log"
2017-08-06 00:14:45.958 Failed to launch C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /log="C:\Users\pamelap\AppData\Local\Temp\Mbam3x.log", reason*SadThe system cannot find the file specified.(error=2))
2017-08-06 00:14:45.959 >>>>>> Starting 2nd phase cleanup for Malwarebytes version 3.0.5.1299 <<<<<<
2017-08-06 00:14:45.960 HKLM\SYSTEM\CurrentControlSet\Services\ESProtectionDriver does not exist.
2017-08-06 00:14:45.961 HKLM\SYSTEM\CurrentControlSet\Services\MBAMChameleon does not exist.
2017-08-06 00:14:45.961 HKLM\SYSTEM\CurrentControlSet\Services\MBAMFarflt does not exist.
2017-08-06 00:14:45.962 HKLM\SYSTEM\CurrentControlSet\Services\MBAMProtection does not exist.
2017-08-06 00:14:45.962 HKLM\SYSTEM\CurrentControlSet\Services\MBAMService does not exist.
2017-08-06 00:14:45.963 HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy does not exist.
2017-08-06 00:14:45.963 HKLM\SYSTEM\CurrentControlSet\Services\MBAMWebProtection does not exist.
2017-08-06 00:14:49.266 Trying to delete path C:\ProgramData\Malwarebytes\
2017-08-06 00:14:49.267 Cannot delete path C:\ProgramData\Malwarebytes\, reason*SadThe system cannot find the path specified.(error=3))
2017-08-06 00:14:49.269 Trying to delete path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\
2017-08-06 00:14:49.270 Cannot delete path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\, reason*SadThe system cannot find the path specified.(error=3))
2017-08-06 00:14:49.270 Trying to delete path C:\Program Files\Malwarebytes\Anti-Malware\
2017-08-06 00:14:49.271 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
2017-08-06 00:14:49.273 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
2017-08-06 00:14:49.274 Failed to delete C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll, reason*SadAccess is denied.(error=5))
2017-08-06 00:14:49.274 Trying to delete file or folder C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll on reboot
2017-08-06 00:14:49.275 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\msvcp120.dll
2017-08-06 00:14:49.276 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\msvcr120.dll
2017-08-06 00:14:49.277 Trying to delete path C:\Program Files\Malwarebytes\Anti-Malware\platforms\
2017-08-06 00:14:49.278 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\platforms\qwindows.dll
2017-08-06 00:14:49.279 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\platforms\
2017-08-06 00:14:49.280 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
2017-08-06 00:14:49.282 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Gui.dll
2017-08-06 00:14:49.284 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Network.dll
2017-08-06 00:14:49.285 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll
2017-08-06 00:14:49.287 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Quick.dll
2017-08-06 00:14:49.289 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Widgets.dll
2017-08-06 00:14:49.291 Trying to delete file or folder: C:\Program Files\Malwarebytes\Anti-Malware\
2017-08-06 00:14:49.292 Failed to delete C:\Program Files\Malwarebytes\Anti-Malware\, reason*SadThe directory is not empty.(error=145))
2017-08-06 00:14:49.292 Trying to delete file or folder C:\Program Files\Malwarebytes\Anti-Malware\ on reboot
2017-08-06 02:09:41.423 --------END OF LOG FILE ----------
2017-08-06 02:10:50.560 >>>>>Starting post reboot phase cleanup for Malwarebytes version 3.0.5.1299 <<<<<<<<.
2017-08-06 02:10:50.825 HKLM\SYSTEM\CurrentControlSet\Services\ESProtectionDriver does not exist.
2017-08-06 02:10:50.825 HKLM\SYSTEM\CurrentControlSet\Services\MBAMChameleon does not exist.
2017-08-06 02:10:50.825 HKLM\SYSTEM\CurrentControlSet\Services\MBAMFarflt does not exist.
2017-08-06 02:10:50.857 HKLM\SYSTEM\CurrentControlSet\Services\MBAMProtection does not exist.
2017-08-06 02:10:50.857 HKLM\SYSTEM\CurrentControlSet\Services\MBAMService does not exist.
2017-08-06 02:10:50.888 HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy does not exist.
2017-08-06 02:10:50.888 HKLM\SYSTEM\CurrentControlSet\Services\MBAMWebProtection does not exist.
2017-08-06 02:10:54.091 Trying to delete path C:\ProgramData\Malwarebytes\
2017-08-06 02:10:54.122 Cannot delete path C:\ProgramData\Malwarebytes\, reason*SadThe system cannot find the path specified.(error=3))
2017-08-06 02:10:54.122 Trying to delete path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\
2017-08-06 02:10:54.154 Cannot delete path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\, reason*SadThe system cannot find the path specified.(error=3))
2017-08-06 02:10:54.154 Trying to delete path C:\Program Files\Malwarebytes\Anti-Malware\
2017-08-06 02:10:54.154 Cannot delete path C:\Program Files\Malwarebytes\Anti-Malware\, reason*SadThe system cannot find the path specified.(error=3))
2017-08-06 02:13:05.218 !!!!!!Failed to open Postreboot file C:\Users\pamelap\AppData\Local\Temp\postreboot.txt
2017-08-06 02:19:41.115 --------END OF LOG FILE ----------

REGISTRY ITEMS FOR MALWAREBYTES STILL SHOWING
=================================================
Computer\HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.ApplicationCompany REG_SZ Malwarebytes
Computer\HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.FriendlyAppName REG_SZ Malwarebytes

Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.ApplicationCompany REG_SZ Malwarebytes
Computer\HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.FriendlyAppName REG_SZ Malwarebytes

Computer\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\5c2e6c83_0 (default) REG_SZ {2.}\\?\hdaudio#func_01..............HarddiskVolume4\Program Files\Malwarebytes\Anti-M..............
Computer\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d6b30b3e_0 (default) REG_SZ {2.}\\?\hdaudio#func_01..............HarddiskVolume4\Program Files(86)\Malwarebytes\Anti-M..............

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit Lastkey REG_SZ Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\mbamser vice.exe

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC 109 REG_MULTI_SZ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\Malwarebytes.lnk C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe REG_BINARY .............
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UFH\SHC 72 REG_MULTI_SZ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\Malwarebytes.lnk C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe REG_BINARY ............

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe REG_BINARY ..........
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files (x86)\Malwarebytes Anti-Malware\mbampt.exe REG_BINARY ..........


Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files\Malwarebytes Anti-Malware\assistant.exe REG_BINARY ..........
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files\Malwarebytes Anti-Malware\malwarebytes_assistant.exe REG_BINARY ..........

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files\Malwarebytes Anti-Malware\mbam.exe REG_BINARY ..........
Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files\Malwarebytes Anti-Malware\unins000.exe REG_BINARY ..........

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\ProgramData\Malwarebytes\MBAMService\instlrupdate\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\mbamser vice.exe

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION mbam.exe REG_DWORD ....

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WARN_ON_SEC_CERT_REV_FAILED mbam.exe REG_DWORD ....

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\mbamchameleon EventMessageFile REG_SZ C:\Windows\system32\drivers\mbamchameleon.sys

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\mbamchameleon EventMessageFile REG_SZ C:\Windows\system32\drivers\mbamchameleon.sys

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.ApplicationCompany REG_SZ Malwarebytes
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.FriendlyAppName REG_SZ Malwarebytes

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\5c2e6c83_0 (default) REG_SZ {2}.\\?\hdaudio#func_01&ven_10ec&dev_0280&subsys_103c221b&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbam.exe%b{00000000-0000-0000-0000-000000000000}
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d6b30b3e_0 (default) REG_SZ {2}.\\?\hdaudio#func_01&ven_10ec&dev_0280&subsys_103c221b&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbam.exe%b{00000000-0000-0000-0000-000000000000}

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit LastKey REG_SZ Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\mbamser vice.exe

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows\CurrentVersion\UFH\SHC 109 REG_MULTI_SZ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\Malwarebytes.lnk C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe REG_BINARY .............
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows\CurrentVersion\UFH\SHC 72 REG_MULTI_SZ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes\Malwarebytes.lnk C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe REG_BINARY ............

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files(86)\Malwarebytes Anti-Malware\mbam.exe REG_BINARY ..........
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files(86)\Malwarebytes Anti-Malware\mbampt.exe REG_BINARY ..........

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files\Malwarebytes Anti-Malware\mbam.exe REG_BINARY ..........
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\Program Files\Malwarebytes Anti-Malware\mbampt.exe REG_BINARY ..........
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store C:\ProgramData\Malwarebytes\MBAMService\instlrupdate\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe REG_BINARY ............

Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.ApplicationCompany REG_SZ Malwarebytes
Computer\HKEY_USERS\S-1-5-21-339604962-2008541192-2779379361-1002_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe.FriendlyAppName REG_SZ Malwarebytes


CODE showing faults
_______________________



ffffe181`4338d0a8 fffff801`b970fbd0Unable to load image \??\C:\WINDOWS\system32\drivers\farflt.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for farflt.sys*** ERROR: Module load completed but symbols could not be loaded for farflt.sys farflt+0xfbd0

ffffe181`4338d048 fffff80b`c8922a1fUnable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x2a1f

Event[797]: Log Name: System Source: Service Control Manager Date: 2017-07-18T15:06:23.140 Event ID: 7045 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: HP-Henry Description: A service was installed in the system.Service Name: MBAMChameleonService File Name: C:\WINDOWS\system32\drivers\MBAMChameleon.sysService Type: kernel mode driverService Start Type: boot startService Account:

____________________________________________________________________________________________________ ____________________________________________________________________________________________________ ____________________________________________________________________________________________________ ____________________________________________________________________________________________________ ________________________________________________________________________________


MBAMchameleon.sys does not exist in drivers directory (presume uninstalled) although there are entries for it in the registry.

I will redo steps 1-4 of your post, although I have done them before.

I'd rather wait to hear from Malwarebytes as they may have the answer; the msconfig change you specify tends to be hard afterwards to get back to the original so it's last resort for me.

 

In case it is needed see this video: 3 Ways to Uninstall Malwarebytes' Anti Malware - wikiHow

 

Could you please provide a Kernel Memory Dump if possible? The directory path is the following:

Code: %systemroot%\MEMORY.DMP[/quote] The file will need to be zipped and then uploaded to a file sharing site such as Dropbox or OneDrive.

 

I have deleted all traces of Malwarebytes from the registry as per last item on your link, and done a full shutdown and then started the machine up again. It started fine no problems. I then did Hybernate and on waking up from that got the usual error. I attach the .zip file.

Abaculus, there is no file called MEMORY.DMP. - I think you will find the .dmp files are in the attached .zip file. If not, I don't know where it is.

Attachment 147995

 

There was 1 new mini dump and there was no definitive misbehaving driver.

Intel wireless was identified as a faulting application and a problem signature.

1) Please temporarily connect the computer via a wired or ethernet cat5e cable or download the replacement driver to the desktop using wifi. Use the HP website with the computer's serial or product number and operating to find the latest wifi drivers.
If there is a mechanical button please turn off wireless before installing the replacement driver.
2) Uninstall and reinstall any wireless driver offered on the HP website for your computer's configuration.
3) report into the thread which driver(s) were updated.
4) Open administrative command prompt and type: powercfg.exe /hibernate off
5) The event log has entries: The TPM is defending against dictionary attacks and is in a time-out period.
View this link for a possible fix: How do I fix ?
6) Tomorrow once all of the above have been completed plan to restart windows driver verifier. If there are any new bsod post a new zip: BSOD - Posting Instructions - Windows 10 Forums



Code: NETwNb64 Intel(R) Wireless Adap Intel(R) Wireless Adap Kernel Manual Running OK TRUE FALSE 741,376 2,134,016 0 05/04/2017 18:04:27 C:\WINDOWS\system32\drivers\Netwbw02.sys 4,096[/quote] Code: Name [00000003] Intel(R) Dual Band Wireless-N 7260Adapter Type Ethernet 802.3Product Type Intel(R) Dual Band Wireless-N 7260Installed YesPNP Device ID PCI\VEN_8086&DEV_08B1&SUBSYS_C0608086&REV_6B\A4C494FFFF0DFA6B00Last Reset 09/08/2017 16:20Index 3Service Name NETwNb64IP Address 192.168.1.75, fe80::d545:fae8:32f5:c196IP Subnet 255.255.255.0, 64Default IP Gateway 192.168.1.254DHCP Enabled YesDHCP Server 192.168.1.254DHCP Lease Expires 10/08/2017 16:21DHCP Lease Obtained 09/08/2017 16:21MAC Address ‪A4:C4:94:0D:FA:6B‬Memory Address 0xC05FE000-0xC05FFFFFIRQ Channel IRQ 4294967285Driver c:\windows\system32\drivers\netwbw02.sys (18.33.7.2, 3.36 MB (3,526,392 bytes), 20/10/2016 04:26)[/quote] Code: BugCheck A, {0, 2, 0, fffff8004e6edbf8}*** WARNING: Unable to verify timestamp for win32k.sys*** ERROR: Module load completed but symbols could not be loaded for win32k.sysProbably caused by : memory_corruption[/quote] Code: 21/07/2017 20:45 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x1048 Faulting application start time: 0x01d3026210fb7555 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: f8be37c5-ca9e-4c16-ab1c-1ad18c2d34b5 Faulting package full name: Faulting package-relative application ID:21/07/2017 20:39 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x106c Faulting application start time: 0x01d302601e8d2730 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 0da462a1-5562-4505-a4f3-2cf4c5ba6db0 Faulting package full name: Faulting package-relative application ID:09/08/2017 15:16 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x113c Faulting application start time: 0x01d30ebf6f8f8f1d Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 245f1da3-4890-4620-93a4-9c36641bfa17 Faulting package full name: Faulting package-relative application ID:04/08/2017 17:10 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x1288 Faulting application start time: 0x01d30d3f72269e01 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 3709e4c1-03e3-418e-871b-1e9c2570db88 Faulting package full name: Faulting package-relative application ID:05/08/2017 22:57 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x12c8 Faulting application start time: 0x01d30e2574fc59ef Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 7dee3aef-d3a9-42eb-a5bb-2d8a9ae3cb81 Faulting package full name: Faulting package-relative application ID:04/08/2017 15:33 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x1314 Faulting application start time: 0x01d30d315477cd91 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 796571d8-07d0-45cf-84b0-4d212e3c161b Faulting package full name: Faulting package-relative application ID:04/08/2017 14:50 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x1344 Faulting application start time: 0x01d30c85218e600a Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 55e86b51-fa5c-4bdb-8f35-7e2988ef1b24 Faulting package full name: Faulting package-relative application ID:21/07/2017 21:30 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x1364 Faulting application start time: 0x01d302651e4dbf69 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 1060afb1-9265-4e4b-9b1d-a10d4e6863d1 Faulting package full name: Faulting package-relative application ID:03/08/2017 17:30 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x136c Faulting application start time: 0x01d3080a22a49594 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 60133062-c34e-479c-b729-d5abc6680d41 Faulting package full name: Faulting package-relative application ID:21/07/2017 20:23 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x137c Faulting application start time: 0x01d30254dbf1da51 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 82caa6e8-d86f-4db3-bc9d-536d38b00a21 Faulting package full name: Faulting package-relative application ID:21/07/2017 21:57 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x13bc Faulting application start time: 0x01d302695f64e208 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: b3a6f3d6-079d-44db-8a32-b713cc634332 Faulting package full name: Faulting package-relative application ID:26/07/2017 18:09 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x13c8 Faulting application start time: 0x01d3062cac5483bc Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: ac78929a-cf95-45c0-b098-93a57a5e54d3 Faulting package full name: Faulting package-relative application ID:06/08/2017 01:09 Application Error Faulting application name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Faulting module name: ZeroConfigService.exe, version: 19.60.0.0, time stamp: 0x58d16fa6 Exception code: 0xc0000409 Fault offset: 0x000000000022af80 Faulting process ID: 0x13e0 Faulting application start time: 0x01d30e3ef9c96c56 Faulting application path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Faulting module path: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe Report ID: 7fa81eab-be0f-48ad-ad76-cf52e6a0bd00 Faulting package full name: Faulting package-relative application ID:[/quote]
Code: Event[20893]: Log Name: System Source: Microsoft-Windows-Kernel-Boot Date: 2017-08-09T16:20:57.801 Event ID: 16 Task: N/A Level: Error Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: HP-Henry Description: Windows failed to resume from hibernate with error status 0xC0000001.[/quote] Code: Event[20881]: Log Name: System Source: Microsoft-Windows-TPM-WMI Date: 2017-08-09T16:17:39.004 Event ID: 1026 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: HP-Henry Description: The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically. To set up the TPM interactively use the TPM management console (Start->tpm.msc) and use the action to make the TPM ready. Error: The TPM is defending against dictionary attacks and is in a time-out period. Additional Information: 0x100000 Event[20882]: Log Name: System Source: Microsoft-Windows-TPM-WMI Date: 2017-08-09T16:17:41.134 Event ID: 1026 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: HP-Henry Description: The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically. To set up the TPM interactively use the TPM management console (Start->tpm.msc) and use the action to make the TPM ready. Error: The TPM is defending against dictionary attacks and is in a time-out period. Additional Information: 0x100000[/quote]

 

Malwarebytes has an uninstall tool: How-To: Use the Malwarebytes Clean Uninstall Tool | Malwarebytes Support

 

1) Malwarebytes has been completely removed for the last two days.

2) I connected by cable - still get error on hibernate.

3) I have run HP Softpaq Download Manager which tells me what needs updating. I have installed the update to HP Client Security Manager, and Intel Wireless Display Software. Rebooted. Problem: it tells me Intel Wireless Software still needs updating. Going round in circles with this. Intel site says not supporting it anymore.

4) Running HP Softpaq Download Manager tells me I need to (critical) update Intel Full Management Engine (ME) Firmware Component however it fails to install it. Instead it tells me to download and install. I started this but got a warning lots of stuff would need to be set up again. It did not say what. I have no idea if I would be able to do this. So I stopped and haven't installed it.

5) I now have an extra problem. I had to set up my wireless connection as it did not exist after all this. However in the system tray display it does not display my connection nor any other networks in the building (block of flats, I used to see all their networks), despite display them being ticked.

6) I am very concerned all these things I am trying are actually making more errors as at 5) above.

7) I have very limited time to spend on this as I am chronically ill and struggling.

8) Anyway, here is the latest zip file and also the state of the TPM.

HP-HENRY-10_08_2017_203636_99.zip

 

Nice work on Malwarebytes. The bsod needs to be identified and fixed. The mini dump with updated logs were not present in the zip as it was empty.
With the updated zip it should have some information on hibernation.
The HP softpaq download manager like HP support assistant often has updates that may not be applicable to the computer.
For the wireless go directly to the hp web site support and drivers: HP Software and Driver Downloads for HP Printers, Laptops, Desktops and More | HP® Customer Support

Enter the computer's serial or product number and the operating system to view all available drivers.
Then click on a specific driver and view the revision history. Choose the most up to date version that is applicable to your computer's configuration.
What is the availability of a wired connection until the wireless gets fixed? Ethernet or cat5e cable?
The manual download using the computer's serial or product number should display the proper driver for the configuration and operating system.
For the Intel full management engine that needs to be installed from the HP website using the computer's serial or product number with operating system. Expand firmware > identify Intel full management engine > click download

 

Already done. Some of the drivers there are wrong, eg. Broadcom when I have Intel and the Intel is up to date. So I prefer the Softpaq which seems to give the right drivers. Some are just not applicable. I think the drivers are for the "series" not the specific machine. I also used the HP update drivers tool which displayed wireless up to date because I already updated them. As far as I am aware all drivers up to date and did this before but still got the BSOD.

This is really difficult - I am in bed almost all the time and router/modem in another room with nowhere to work. Anyway I still get the BSOD when using Ethernet (eg cable). See item 2) in my previous post.

See 4) above. What do I do if I have to set stuff up again? What stuff? It doesn't say. Maybe I can do it, maybe it is stuff I know nothing about.

I am concerned not to make the problems even worse.

 

HP products I have used for many years and the products I am currently using came with 3 year warranties. It's a whole lot different in the business support than the consumer support. So I had a situation with softpaq recommending downloads for items that were not applicable to this computers configuration. They can be ignored or removed from the list. HP provided support on softpaq Intel and indicated that that had to be done directly from the HP website.

Where are you now with the capability to connect or not connect using wireless?
If you can send an updated zip I'll look though the files for any problems that can be troubleshooted.:
BSOD - Posting Instructions - Windows 10 Forums

 

I ran the Tensforum program to collect everything in the zip file. It looked fine as it ran. Everything was "done". Afterwards, I checked the zip file, and it is empty like the last one.

Help!

 

To check the DM log collector I just ran it and it produced a log with information.
It's unclear why it is not working for your computer at this time.
The first few steps will be to check the operating system and the file structure on the drive.
The next few steps will place the computer in clean boot to see if there are any conflicting non-Microsoft services.
Open administrative command prompt and type or copy and paste:
1) sfc /scannow
2) dism /online /cleanup-image /restorehealth
3) chkdsk /scan
When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread


4) msconfig (in the pop up system configuration > move the dot from normal startup to selective startup > uncheck load startup items > click service tab > in left lower corner check hide all Microsoft services > in the lower right side click disable all > click apply or ok > do not reboot)


5) taskmgr (in the pop up task manager > click on the start up tab > click on status so that the column sorts with enable rising to the top > right click on each row with enable and change to disable)


https://support.microsoft.com/en-us/...oot-in-windows


How to perform a Clean Boot in Windows 10 - TechNet Articles - United States (English) - TechNet Wiki





6) shutdown /r (you will reboot the computer so that it is in clean boot)



7) Perform dm collection and see if it works:
BSOD - Posting Instructions - Windows 10 Forums

 

I've followed all your instructions. Unfortunately I lost the copy of the command prompt actions and results before posting them. All went well - there weren't any errors.

After the reboot I ran the BSOD dm and again there was nothing in the zip file although it appeared to run successfully.

I put the machine into Hiberate and on wake up got the usual BSOD.

Ran BSOD dm again: seemed to run through all the collection processes ok, no errors, ending:


The file collector has finished.

All files have now been collected and are in a zipped folder on your desktop
ready for you to upload to the forum.


Press any key to continue . . .

But the zip file is still empty.

 

The DM collector was working on the computer and sent multiple zips with contents.
Somehow it is no longer putting together the files into the zip.
This will be trial and error to see what can be done to get the files.
Before the DM Log collector prompt closes, there is a folder on the desktop called TFdebugFiles.
Please upload this file as a zip.