Windows 10: BSOD PAGE_FAULT_IN_NONPAGED_AREA After Resume From Sleep

Hey everyone, bought a new Acer Swift 3 laptop and recently I have been having this issue where I would have some sort of BSOD pointing to bad RAM after I resumed from sleep. If Windows successfully resumes from sleep, I could also trigger it from trying to restart after sleep.

A lot of the time it has been PAGE_FAULT_IN_NONPAGED_AREA, sometimes MEMORY_MANAGEMENT or IRQL_NOT_LESS_OR_EQUAL, and recently FAULTY_HARDWARE_CORRUPTED_PAGE.

Because this all points to bad ram, I've run a few tests such Windows Memory Diagnostic and Memtest86. All of it passes and says the RAM is all fine.

I've been searching for a solution for hours but have not been successful so I'm hoping you guys could help me analyse my dump files. Thanks.

ERIK-WINDOWS-07_29_17__12141_18.zip - Google Drive

:)

 

BSOD IRQL_NOT_LESS_OR_EQUAL after resuming from sleep

The forum asked me to give an update.

Haven't had the crash again, but since occurence is kinda random and related to how often I resume my computer from sleep I only consider it solved when the crashing has stopped for a couple of weeks.

 

BSOD IRQL_NOT_LESS_OR_EQUAL after resuming from sleep

Since a couple of months I regularly get a BSOD after resuming my computer from sleep mode. It happens once or twice a week or once every 5-10 resumes. It's usually IRQL_NOT_LESS_OR_EQUAL. Sleeping time doesn't matter. The last time I had the BSOD the computer
was only in sleep mode for a couple of seconds.

When the system is up, it's stable.m I've tested the memory with windows memtest and memtest86 and found no problems. I don't do any overclocking except enabling 'XMP' in memory. I've also done a windows 'reset' to set all drivers to factory defaults, but
the problem came back.

These are the dump files and msinfo file. They are the most recent 2. I lost the older ones during the reset.

minidumps.zip

running windbg it points to the mt7612us.sys driver with failure_bucket_id AV_mt7612US+38b08

This is my xbox one controller dongle, but I need that stick for connecting my xbox one controller. I bought it 3 months ago, the BSOD's started after that date so it may be related. The driver itself is up to date.

 

When you ran MemTest86+, did you follow the instructions illustrated in this thread - MemTest86+ - Test RAM Windows 10 BSOD Tutorials

 

When I ran it I only ran 4 passes, I will start another test again right now and run 12 passes. I read somewhere that 12 passes is necessary.

 

Ran 10 passes, not a single error

 

There were 18 bsod noted in the zip but only 5 mini dump files.
One misbehaving driver was identified and should be uninstalled.
Please uninstall Avira antivirus and turn on Windows defender.
This is a link from Avira on how to uninstall the antivirus: How do I uninstall my Avira Antivirus product?


In the event logs there are a lot of event 1026.
Do you have a TPM owner password?
If so you can fix the event report with a reset: Error: The TPM is defending against dictionary attacks and is in a time-out period.
How do I fix ?

Open administrative command prompt and type or copy and paste:
1) sfc /scannow
2) dism /online /cleanup-image /restorehealth
3) chkdsk /scan
4) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread




Code: ffff9180`afd4f248 fffff80b`3908c7f0Unable to load image \SystemRoot\system32\DRIVERS\avipbb.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for avipbb.sys*** ERROR: Module load completed but symbols could not be loaded for avipbb.sys avipbb+0xc7f0[/quote] avipbb.sys Avira AntiVir Free Downloads of Avira Antivirus Software & Utilities
Code: avipbb avipbb avipbb Kernel System Running OK TRUE FALSE 4,096 102,400 0 5/03/17 4:25:48 AM C:\Windows\system32\DRIVERS\avipbb.sys 4,096[/quote] Code: Event[4232]: Log Name: System Source: Microsoft-Windows-TPM-WMI Date: 2017-07-24T00:11:11.066 Event ID: 1026 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: ERIK-WINDOWS Description: The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically. To set up the TPM interactively use the TPM management console (Start->tpm.msc) and use the action to make the TPM ready.Error: The TPM is defending against dictionary attacks and is in a time-out period.Additional Information: 0x0[/quote] Code: Event[4235]: Log Name: System Source: Microsoft-Windows-TPM-WMI Date: 2017-07-24T00:11:16.913 Event ID: 1026 Task: N/A Level: Information Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: ERIK-WINDOWS Description: The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically. To set up the TPM interactively use the TPM management console (Start->tpm.msc) and use the action to make the TPM ready.Error: The TPM is defending against dictionary attacks and is in a time-out period.Additional Information: 0x0[/quote]

 

Hey first off thanks for your help. Really appreciate it. I uninstalled Avira antivirus and the probem seems to have gone away. As for the 18 blue screens but 5 minidumps, Windows seems to have deleted the oldest one after each new BSOD.

Im not too sure what a TPM owner password is so I am assuming that I dont have one?

And for your last request, here you go:

Microsoft Windows [Version 10.0.15063](c) 2017 Microsoft Corporation. All rights reserved.C:\Windows\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection did not find any integrity violations.C:\Windows\system32>dism /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0[==========================100.0%==========================] The restore operation completed successfully.The operation completed successfully.C:\Windows\system32>chkdsk /scanThe type of the file system is NTFS.Stage 1: Examining basic file system structure ... 291840 file records processed.File verification completed. 5922 large file records processed. 0 bad file records processed.Stage 2: Examining file name linkage ... 406678 index entries processed.Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found.Stage 3: Examining security descriptors ...Security descriptor verification completed. 57420 data files processed.CHKDSK is verifying Usn Journal... 41417928 USN bytes processed.Usn Journal verification completed.Windows has scanned the file system and found no problems.No further action is required. 165004287 KB total disk space. 52132196 KB in 134681 files. 94736 KB in 57421 indexes. 0 KB in bad sectors. 406143 KB in use by the system. 65536 KB occupied by the log file. 112371212 KB available on disk. 4096 bytes in each allocation unit. 41251071 total allocation units on disk. 28092803 allocation units available on disk.C:\Windows\system32>

 

Pretty sure my post requires moderator approval because of the length, but the Avira antivirus uninstall seems to have solved it. Post with full details and those cmd requests coming soon.

 

Update: another BSOD with PAGE_FAULT_IN_NONPAGED_AREA error code happened right now. Posting the .dmp file if any of you guys can check it out.

New Dump File.zip - Google Drive

 

Code: BugCheck 50, {ffffa8e088361a3c, 2, fffff8037708331a, 2}Could not read faulting driver nameProbably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+2fa )[/quote]
1) make an image of your drive using Macrium
Macrium Software | Your image is everything
2) make sure the image is on a drive other than the drive with the windows operating system
3) create a brand new restore point

Windows driver verifier is a tool that is used to find misbehaving drivers.
It will repetitively produce bsod until all misbehaving drivers are fixed or until it is turned off.
Each time a bsod is produced there is a stop code typically driver verifier detected violation. There may or may not be a malfunctioning driver displayed in the form *.sys. If you see a driver displayed please record it and post it into the thread.

Before using Windows driver verifier you must know how to turn it off so that you can return to the desktop and process the bsod mini dump files. Then uninstall, update, or roll back the misbehaving driver. The process can continue until all misbehaving drivers are uninstalled or a replacement driver can be re-installed immediately after each un-installation. The result should be the same. The method is personal preference whether to uninstall all until there are no more bsod or to reinstall immediately after each uninstall.

To turn off windows driver verifer you will need to open the windows recovery or advanced troubleshooting menu. Then you will navigate to startup options (not startup repair) and when in startup options select #6 safe mode with command prompt. You will type the command: verifier /reset
In case verifier /reset fails to turn off windows driver verifier you will navigate within the windows advanced troubleshooting menu to command prompt. It will open Administrator X: \Windows\system32\cmd.exe
Then you will type: verifier /bootmode resetonbootfail
And in case the second method fails to turn off windows driver verifier you will navigate within the windows advanced recovery to restore. A restore unfortunately leads to loss of the bsod minidump file and little if any progress is made in the troubleshooting.

This is a link to learn about windows driver verifer. It has the method to turn it on and the custom settings used for the tests.

https://answers.microsoft.com/en-us/...3-c48669e4c983

In order to have time to view the bsod window please make sure these settings are in place or updated:
The system settings need to be modified to not automatically restart so that you have ample time to view the bsod window. Follow the settings in this link:
BSOD Finding and fixing them - Microsoft Community

Keyboard: win + r keys simultaneously > type or copy and paste: sysdm.cpl > click advanced tab > under startup and recover click settings > under system failure uncheck automatically restart

See this link: BSOD Finding and fixing them - Microsoft Community:
https://answers.microsoft.com/en-us/...d-e95ee5d8669d


Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials


To practice using the Windows recovery or advanced troubleshooting menu open administrative command prompt and type or copy and paste: shutdown /r /o /f /t 00
When the computer reboots it will open to the windows recovery or windows advanced troubleshooting menu.

Download and install both Bluescreenview and Whocrashed to process the bsod minidump files. You will use these software applications each time you return to the desktop.

Resplendence Software - WhoCrashed, automatic crash dump analyzer


Blue screen of death (STOP error) information in dump files.

For every bsod please post a new zip file:
BSOD - Posting Instructions - Windows 10 Forums


When you have time to work on the misbehaving drivers and you are comfortable with the windows advanced troubleshooting menu to turn off windows driver verifier and you have created a brand new restore point you can turn on windows driver verifier.
In most cases it will immediately bsod. And again it is designed to repetitively produce bsod until all of the misbehaving drivers are fixed or it is turned off.
Once there are no longer any bsod you will run windows driver verifier for 36 hours under typical computer use. If there are no longer any bsod the troubleshooting will be completed.

 

Hey zbook, I ran the driver verifier and right off the bat it pointed towards Malwarebytes? I'll disable Malwarebytes from startup and run the driver verifier again. After this I'll post back with updates.

ERIK-WINDOWS-08_01_17_111320_45.zip - Google Drive

 

Two more BSODs but only one minidump, same thing happened with the MBAM driver.

ERIK-WINDOWS-08_01_17_112854_89.zip - Google Drive

 

Again two more BSODs, very similar looking to my previous post. Caused by VerifierExt.sys and ntoskrnl.exe again. I dont think running verifier further will fix it as the same blue screen just keeps repeating. Heres the new files.

ERIK-WINDOWS-08_01_17_113911_64.zip - Google Drive

 

There were two misbehaving drivers identified.
One was in the bsod min dump debugging: MBAMSwissArmy.sys
And one was identified using Windows error reporting: 8/01/17 6:30 PM Windows Error Reporting Qcamain10x64.sys
Qualcomm Atheros Extensible wireless LAN

1) Uninstall Malwarebytes using control panel
Use file explorer and search for MBAMSwissArmy.sys to confirm that it has been uninstalled
2) Open device manager > expand network adapters > find Qualcom Atheros wireless LAN > right click > properties > driver > driver details > confirm Qcamain10x64.sys > OK > left click update driver
If the above method fails to update the Qualcom wireless LAN driver > open Acer website > enter computer's serial or product number > download the latest Acer approved driver
If there are no drivers on the Acer website then use the Killer networking website to find the latest Qualcom driver.
Home
3) continue running windows driver verifier for 36 hours when there are no longer any bsod.

Code: BugCheck C4, {2000, fffff802dbe48e23, 0, 41724765}*** WARNING: Unable to verify timestamp for MBAMSwissArmy.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMSwissArmy.sysProbably caused by : MBAMSwissArmy.sys ( MBAMSwissArmy+18e23 )[/quote] mbamswissarmy.sys Malwarebytes Anti-malware http://www.malwarebytes.org/mbam.php
Code: 8/01/17 6:20 PM Application Error Faulting application name: mbam.exe, version: 3.0.0.1068, time stamp: 0x59125ef2 Faulting module name: Qt5Core.dll, version: 5.6.2.0, time stamp: 0x58ed4d4f Exception code: 0xc0000005 Fault offset: 0x0018da93 Faulting process id: 0x734 Faulting application start time: 0x01d30af2c90976fb Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll Report Id: 079481e1-10ed-4c60-8967-51989eafedd9 Faulting package full name: Faulting package-relative application ID:[/quote]
Code: 8/01/17 6:10 PM Windows Error Reporting Fault bucket 0xc4_2000_VRF_MBAMSwissArmy!unknown_function, type 0 Event Name: BlueScreen Response: Not available Cab Id: 93aaa2c2-ac3e-42a9-9eb1-61cd52be47aa Problem signature: P1: c4 P2: 2000 P3: fffff802dbe48e23 P4: 0 P5: 41724765 P6: 10_0_15063 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\Windows\Minidump\080117-2828-01.dmp \\?\C:\Windows\Temp\WER-4406-0.sysdata.xml \\?\C:\Windows\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C03.tmp.WERInternalMetadata.xml \\?\C:\Windows\Temp\WER12B.tmp.WERDataCollectionStatus.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c4_5c7cf8e911c788f4e34ae9403129e5f99c69852d_00000000_cab_02d01c03 Analysis symbol: Rechecking for solution: 0 Report Id: 306f2818-366b-4276-bd0d-6a5aa361bc4c Report Status: 16388 Hashed bucket:[/quote]
Code: 8/01/17 6:30 PM Windows Error Reporting Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0 Event Name: BlueScreen Response: Not available Cab Id: 71b9e104-984a-4b08-b95d-3bf4dea5ec53 Problem signature: P1: c4 P2: 9200f P3: fffff808fa678470 P4: ffff990e5faabeb0 P5: ffff990e5faabfb8 P6: 10_0_15063 P7: 0_0 P8: 768_1 P9: P10: Attached files: \\?\C:\Windows\Minidump\080117-2828-02.dmp \\?\C:\Windows\Temp\WER-3578-0.sysdata.xml \\?\C:\Windows\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1760.tmp.WERInternalMetadata.xml \\?\C:\Windows\Temp\WER11F4.tmp.WERDataCollectionStatus.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c4_79d8a1da16665488c5a5907a28742ecbf8a82fe_00000000_cab_02d01760 Analysis symbol: Rechecking for solution: 0 Report Id: 5fc2ce08-c835-4fc8-b2c9-cf32f6e19705 Report Status: 16388 Hashed bucket:[/quote] Qcamain10x64.sys Qualcomm Atheros Extensible Wireless LAN device driver Download - http://www.killernetworking.com/supp...iver-downloads
Support - Contact Killer Network | Ethernet Killer | Killernetworking




Code: Qcamain10x64 Qualcomm Atheros Exten Qualcomm Atheros Exten Kernel Manual Running OK TRUE FALSE 4,096 1,703,936 0 8/23/16 3:50:43 AM C:\Windows\system32\drivers\Qcamain10x64.sys 8,192[/quote]