BSOD IRQL_NOT_LESS_OR_EQUAL when waking from Hibernate

This is odd as it only happens waking from Hibernate. I don't get it on wake from startup or sleep.

I have tried:

memory diagnostics - all fine
updating all drivers
restore from points created by me (failed, even without Kaspersky running)
sfc /scannow
Keeping wireless off and Kaspersky off on hibernating and wake up
Checking out HP website and support etc.

I think it started after windows 10 Creative update, along with icons disappearing/re-arranging themselves.

Computer name: HP-HENRY
Windows version: Windows 10 , 10.0, build: 15063
Windows dir: C:\WINDOWS
Hardware: HP Pro x2 612 G1 Tablet, Hewlett-Packard, 221B
CPU: GenuineIntel Intel(R) Core(TM) i5-4202Y CPU @ 1.60GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 8465244160 bytes total

---

Crash Dump Analysis

---

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Sun 23/07/2017 18:06:01 your computer crashed
crash dump file: C:\WINDOWS\Minidump\072317-9781-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16C4C0)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF802C0504BF8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



I attach zipfile and would be grateful for help as ntoskrnl is not informative of what is causing it.

Code:

2: kd> lmvm SDDisk2K
Browse full module list
start             end                 module name
fffff800`b96d0000 fffff800`b9753000   SDDisk2K T (no symbols)           
    Loaded symbol image file: SDDisk2K.sys
    Image path: \SystemRoot\system32\DRIVERS\SDDisk2K.sys
    Image name: SDDisk2K.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Dec 05 22:14:01 2014 (54822E29)
    CheckSum:         00040545
    ImageSize:        00083000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I'm not sure what the above driver is related to? The results I can find are related to SecureDoc? The driver appears to start at boot too.

The issue does appear to lie with a power-related IRP and its subsequent page fault.

Code:

2: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffa201`bf57db98 fffff801`b6a088a9 nt!KeBugCheckEx
01 ffffa201`bf57dba0 fffff801`b6a06e7d nt!KiBugCheckDispatch+0x69
02 ffffa201`bf57dce0 fffff801`b68fcbf8 nt!KiPageFault+0x23d << Causes Bugcheck
03 ffffa201`bf57de70 fffff801`b68c63fd nt!IopCompleteRequest+0xb98 << Completion of IRP
04 ffffa201`bf57df60 fffff801`b68c7d75 nt!KiDeliverApc+0x13d
05 ffffa201`bf57dff0 fffff801`b68f443f nt!KiCheckForKernelApcDelivery+0x25
06 ffffa201`bf57e020 fffff801`b694ee4c nt!KiLeaveGuardedRegionUnsafe+0x2f
07 ffffa201`bf57e050 fffff801`b68d568f nt!MmWaitForCacheManagerPrefetch+0x68
08 ffffa201`bf57e080 fffff801`b6d1a419 nt!CcFetchDataForRead+0xff
09 ffffa201`bf57e0e0 fffff801`b68d53cb nt!CcMapAndCopyFromCache+0xd9
0a ffffa201`bf57e180 fffff800`bca319b9 nt!CcCopyReadEx+0x12b
0b ffffa201`bf57e210 fffff800`bc9f5b5c fastfat!FatCommonRead+0x8ad
0c ffffa201`bf57e380 fffff800`b812563d fastfat!FatFsdRead+0x18c
0d ffffa201`bf57e410 fffff800`b81234d6 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d
0e ffffa201`bf57e480 fffff801`b6d276ef FLTMGR!FltpDispatch+0xb6
0f ffffa201`bf57e4e0 fffff801`b6d26457 nt!IopSynchronousServiceTail+0x1af
10 ffffa201`bf57e5a0 fffff801`b6a08413 nt!NtReadFile+0x697
11 ffffa201`bf57e6a0 fffff801`b6a006a0 nt!KiSystemServiceCopyEnd+0x13
12 ffffa201`bf57e8a8 fffff801`b68b556c nt!KiServiceLinkage
13 ffffa201`bf57e8b0 fffff801`b6cf9da1 nt!CmpFileReadEx+0xc0
14 ffffa201`bf57e960 fffff801`b6dc7913 nt!CmpFileRead+0x31
15 ffffa201`bf57e9a0 fffff801`b6dc6c4a nt!HvpGetHiveHeader+0x77
16 ffffa201`bf57e9e0 fffff801`b6dc6427 nt!HvLoadHive+0x5a
17 ffffa201`bf57eaf0 fffff801`b6dc5de5 nt!HvInitializeHive+0x2a3
18 ffffa201`bf57eb70 fffff801`b6cfbbdf nt!CmpInitializeHive+0x521
19 ffffa201`bf57ed50 fffff801`b6cfb7a7 nt!CmpInitHiveFromFile+0x3d7
1a ffffa201`bf57ef70 fffff801`b6ceabb8 nt!CmpCmdHiveOpen+0xc3
1b ffffa201`bf57f000 fffff801`b6cfa7c2 nt!CmLoadKey+0x1c8
1c ffffa201`bf57f340 fffff801`b6e12029 nt!CmLoadDifferencingKey+0x94a
1d ffffa201`bf57f640 fffff801`b6a08413 nt!NtLoadKey2+0x39
1e ffffa201`bf57f6b0 fffff801`b6a006a0 nt!KiSystemServiceCopyEnd+0x13
1f ffffa201`bf57f848 fffff801`b6e091d4 nt!KiServiceLinkage
20 ffffa201`bf57f850 fffff801`b6e0590b nt!BiLoadHive+0x138
21 ffffa201`bf57f950 fffff801`b6e055cb nt!BiAddStoreFromFile+0x6b
22 ffffa201`bf57fa00 fffff801`b6e06748 nt!BiLoadSystemStore+0xa7
23 ffffa201`bf57fa60 fffff801`b6e05af5 nt!BiOpenSystemStore+0xf8
24 ffffa201`bf57fad0 fffff801`b6dfe16f nt!BcdOpenStore+0x3d
25 ffffa201`bf57fb10 fffff801`b6c98e0c nt!PopFreeHiberContext+0x2b
26 ffffa201`bf57fb50 fffff801`b68ceca8 nt!PopUnlockAfterSleepWorker+0x4c
27 ffffa201`bf57fb80 fffff801`b696dac7 nt!ExpWorkerThread+0xd8
28 ffffa201`bf57fc10 fffff801`b6a02946 nt!PspSystemThreadStartup+0x47
29 ffffa201`bf57fc60 00000000`00000000 nt!KiStartSystemThread+0x16

I would suggest removing the program associated with the driver if possible, or running Driver Verifier for at least 24 hours using the following instructions - Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

Consider uninstalling Malwarebytes and turning hibernation off.
Are you using any Winmagic software programs such as disk encryption?
Are you using any HP drive encryption software?

Thanks for replies.

Abaculus said:

Code:

2: kd> lmvm SDDisk2K
Browse full module list
start             end                 module name
fffff800`b96d0000 fffff800`b9753000   SDDisk2K T (no symbols)           
    Loaded symbol image file: SDDisk2K.sys
    Image path: \SystemRoot\system32\DRIVERS\SDDisk2K.sys
    Image name: SDDisk2K.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Dec 05 22:14:01 2014 (54822E29)
    CheckSum:         00040545
    ImageSize:        00083000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

I'm not sure what the above driver is related to? The results I can find are related to SecureDoc? The driver appears to start at boot too.

What is SecureDoc? I don't know about the driver SDDISK2K.sys either.

Abaculus said:

[code]2: kd> lmvm SDDisk2K
The issue does appear to lie with a power-related IRP and its subsequent page fault.

What is IRP?

Abaculus said:

[code]2: kd> lmvm SDDisk2K
I would suggest removing the program associated with the driver if possible, or running Driver Verifier for at least 24 hours using the following instructions - Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

I'll give it a go.

zbook said:

Consider uninstalling Malwarebytes and turning hibernation off.
Are you using any Winmagic software programs such as disk encryption?
Are you using any HP drive encryption software?

I've been running Malwarebytes for a couple of years with no problem.

I do have password file/directory/usb protection running which is fairly recent change. Can't remember if it was installed before windows update or afterwards. I'll try switching it off.

Open control panel
Use the Microsoft snipping tool
Post an image into the thread.
Uninstall Malwarebytes.

Before starting windows driver verifier make sure:
1) create a brand new restore point
2) use Macrium to create a backup image: Macrium Software | Your image is everything
3) backup any important files
4) know 2 methods to turn off windows driver verifier using windows recovery or advanced troubleshooting options:
a) startup options > requires a restart > safe mode with command prompt > type: verifier /reset
b) command prompt or AdminitratorX: \Windows\system32\cmd.exe type: verifier /bootmode resetonbootfail
5) if the two methods fail to turn off windows driver verifier you will then choose restore and use the restore point that you just created. Unfortunately the minidump file typically disappear so little progress is made in the debugging
6) The system settings need to be modified to not automatically restart so that you have ample time to view the bsod window.
Follow the settings in this link: BSOD Finding and fixing them - Microsoft Community

Keyboard: win + r keys simultaneously > type or copy and paste: sysdm.cpl > click advanced tab > under startup and recover click settings > under system failure uncheck automatically restart

For each BSOD you will see a stop code typically driver verifier detected violation. The misbehaving driver may be displayed in the form *.sys If you see the driver displayed please record it for later use.

7) install each Bluescreenview and Whocrashed and view their analysis after each bsod:
http://www.resplendence.com/whocrashed
Blue screen of death (STOP error) information in dump files.
8) Update or post a new zip after the bsod so that we can debug and guide you through the update or uninstall / reinstall of drivers: BSOD - Posting Instructions - Windows 10 Forums

Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community

The application using SDDisk2K.sys was HP Drive Encryption. I don't use it and I don't think it is even compatible with Windows 10. Anyway, HP said just uninstall it. Which I have done. I checked the driver had been dropped in device manager and yes, no longer there.
Attachment 146988Attachment 146988
However, I am still getting the same STOP Code. IRQL_NOT_LESS_OR_EQUAL.

On Thu 03/08/2017 19:19:19 your computer crashed
crash dump file: C:\WINDOWS\Minidump\080317-7921-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16C4C0)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF801B4A73BF8)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

I attach the latest zip file including the dump and would be grateful for analysis again.

In post #3 you were supposed to uninstall Malwarebytes.
Somehow it was never uninstalled or reinstalled on the computer?
The Malwarebytes is again producing bsod.

1) Uninstall all Malwarebytes software.

Code:

ffffe181`4338d0a8  fffff801`b970fbd0Unable to load image \??\C:\WINDOWS\system32\drivers\farflt.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for farflt.sys*** ERROR: Module load completed but symbols could not be loaded for farflt.sys farflt+0xfbd0

Code:

ffffe181`4338d048  fffff80b`c8922a1fUnable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x2a1f

Code:

Event[797]:  Log Name: System  Source: Service Control Manager  Date: 2017-07-18T15:06:23.140  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: HP-Henry  Description: A service was installed in the system.Service Name:  MBAMChameleonService File Name:  C:\WINDOWS\system32\drivers\MBAMChameleon.sysService Type:  kernel mode driverService Start Type:  boot startService Account:

mbamchameleon.sys

Malwarebytes Chameleon Protection Driver

https://www.malwarebytes.org/chameleon/ If using this

farflt.sys

Malwarebytes Anti-Ransomware Protection

Downloads: https://www.malwarebytes.org/downloads/ Support: https://www.malwarebytes.org/support/

Code:

Event[12708]:  Log Name: System  Source: Service Control Manager  Date: 2017-08-03T19:20:11.144  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: HP-Henry  Description: A service was installed in the system.Service Name:  MBAMFarfltService File Name:  C:\WINDOWS\system32\drivers\farflt.sys

Code:

MBAMChameleo MBAMChameleon          MBAMChameleon          File System   Boot       Running    OK         TRUE        FALSE        12,288            139,264     0          27/06/2017 19:22:06    C:\WINDOWS\system32\drivers\MBAMChameleon.sys    8,192

It wasn't Malwarebytes. Uninstalling made no difference.

It turned out to probably be Folder Lock, a security program, which I had uninstalled a while ago. The uninstall left a complete mess behind. Still entries in the registry, in startup, in drivers, etc. newsoftwares.net - at least it went away when I cleaned it all up, the only other thing I did was download WDK but not used it, and I doubt the issue was fixed by downloading and installing that.

So running ok at present. Hope it doesn't come back.

See if you can run windows driver verifier for 36 hours without a bsod.