Page 1 of 6 123 ... LastLast
  1.    23 Jul 2017 #1
    Join Date : Jul 2017
    Posts : 26
    Windows 10 Pro x64

    BSOD IRQL_NOT_LESS_OR_EQUAL when waking from Hibernate


    This is odd as it only happens waking from Hibernate. I don't get it on wake from startup or sleep.

    I have tried:

    memory diagnostics - all fine
    updating all drivers
    restore from points created by me (failed, even without Kaspersky running)
    sfc /scannow
    Keeping wireless off and Kaspersky off on hibernating and wake up
    Checking out HP website and support etc.

    I think it started after windows 10 Creative update, along with icons disappearing/re-arranging themselves.

    Computer name: HP-HENRY
    Windows version: Windows 10 , 10.0, build: 15063
    Windows dir: C:\WINDOWS
    Hardware: HP Pro x2 612 G1 Tablet, Hewlett-Packard, 221B
    CPU: GenuineIntel Intel(R) Core(TM) i5-4202Y CPU @ 1.60GHz Intel586, level: 6
    4 logical processors, active mask: 15
    RAM: 8465244160 bytes total




    Crash Dump Analysis


    Crash dump directory: C:\WINDOWS\Minidump

    Crash dumps are enabled on your computer.

    On Sun 23/07/2017 18:06:01 your computer crashed
    crash dump file: C:\WINDOWS\Minidump\072317-9781-01.dmp
    This was probably caused by the following module: ntoskrnl.exe (nt+0x16C4C0)
    Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF802C0504BF8)
    Error: IRQL_NOT_LESS_OR_EQUAL
    file path: C:\WINDOWS\system32\ntoskrnl.exe
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT Kernel & System
    Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



    I attach zipfile and would be grateful for help as ntoskrnl is not informative of what is causing it.
    BSOD IRQL_NOT_LESS_OR_EQUAL when waking from Hibernate Attached Files
      My ComputerSystem Spec
  2.    23 Jul 2017 #2
    Join Date : Jul 2017
    Posts : 33
    Windows 10 x64 - Windows 7 SP1 x86

    Code:
    2: kd> lmvm SDDisk2K
    Browse full module list
    start             end                 module name
    fffff800`b96d0000 fffff800`b9753000   SDDisk2K T (no symbols)           
        Loaded symbol image file: SDDisk2K.sys
        Image path: \SystemRoot\system32\DRIVERS\SDDisk2K.sys
        Image name: SDDisk2K.sys
        Browse all global symbols  functions  data
        Timestamp:        Fri Dec 05 22:14:01 2014 (54822E29)
        CheckSum:         00040545
        ImageSize:        00083000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    I'm not sure what the above driver is related to? The results I can find are related to SecureDoc? The driver appears to start at boot too.

    The issue does appear to lie with a power-related IRP and its subsequent page fault.

    Code:
    2: kd> knL
     # Child-SP          RetAddr           Call Site
    00 ffffa201`bf57db98 fffff801`b6a088a9 nt!KeBugCheckEx
    01 ffffa201`bf57dba0 fffff801`b6a06e7d nt!KiBugCheckDispatch+0x69
    02 ffffa201`bf57dce0 fffff801`b68fcbf8 nt!KiPageFault+0x23d << Causes Bugcheck
    03 ffffa201`bf57de70 fffff801`b68c63fd nt!IopCompleteRequest+0xb98 << Completion of IRP
    04 ffffa201`bf57df60 fffff801`b68c7d75 nt!KiDeliverApc+0x13d
    05 ffffa201`bf57dff0 fffff801`b68f443f nt!KiCheckForKernelApcDelivery+0x25
    06 ffffa201`bf57e020 fffff801`b694ee4c nt!KiLeaveGuardedRegionUnsafe+0x2f
    07 ffffa201`bf57e050 fffff801`b68d568f nt!MmWaitForCacheManagerPrefetch+0x68
    08 ffffa201`bf57e080 fffff801`b6d1a419 nt!CcFetchDataForRead+0xff
    09 ffffa201`bf57e0e0 fffff801`b68d53cb nt!CcMapAndCopyFromCache+0xd9
    0a ffffa201`bf57e180 fffff800`bca319b9 nt!CcCopyReadEx+0x12b
    0b ffffa201`bf57e210 fffff800`bc9f5b5c fastfat!FatCommonRead+0x8ad
    0c ffffa201`bf57e380 fffff800`b812563d fastfat!FatFsdRead+0x18c
    0d ffffa201`bf57e410 fffff800`b81234d6 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d
    0e ffffa201`bf57e480 fffff801`b6d276ef FLTMGR!FltpDispatch+0xb6
    0f ffffa201`bf57e4e0 fffff801`b6d26457 nt!IopSynchronousServiceTail+0x1af
    10 ffffa201`bf57e5a0 fffff801`b6a08413 nt!NtReadFile+0x697
    11 ffffa201`bf57e6a0 fffff801`b6a006a0 nt!KiSystemServiceCopyEnd+0x13
    12 ffffa201`bf57e8a8 fffff801`b68b556c nt!KiServiceLinkage
    13 ffffa201`bf57e8b0 fffff801`b6cf9da1 nt!CmpFileReadEx+0xc0
    14 ffffa201`bf57e960 fffff801`b6dc7913 nt!CmpFileRead+0x31
    15 ffffa201`bf57e9a0 fffff801`b6dc6c4a nt!HvpGetHiveHeader+0x77
    16 ffffa201`bf57e9e0 fffff801`b6dc6427 nt!HvLoadHive+0x5a
    17 ffffa201`bf57eaf0 fffff801`b6dc5de5 nt!HvInitializeHive+0x2a3
    18 ffffa201`bf57eb70 fffff801`b6cfbbdf nt!CmpInitializeHive+0x521
    19 ffffa201`bf57ed50 fffff801`b6cfb7a7 nt!CmpInitHiveFromFile+0x3d7
    1a ffffa201`bf57ef70 fffff801`b6ceabb8 nt!CmpCmdHiveOpen+0xc3
    1b ffffa201`bf57f000 fffff801`b6cfa7c2 nt!CmLoadKey+0x1c8
    1c ffffa201`bf57f340 fffff801`b6e12029 nt!CmLoadDifferencingKey+0x94a
    1d ffffa201`bf57f640 fffff801`b6a08413 nt!NtLoadKey2+0x39
    1e ffffa201`bf57f6b0 fffff801`b6a006a0 nt!KiSystemServiceCopyEnd+0x13
    1f ffffa201`bf57f848 fffff801`b6e091d4 nt!KiServiceLinkage
    20 ffffa201`bf57f850 fffff801`b6e0590b nt!BiLoadHive+0x138
    21 ffffa201`bf57f950 fffff801`b6e055cb nt!BiAddStoreFromFile+0x6b
    22 ffffa201`bf57fa00 fffff801`b6e06748 nt!BiLoadSystemStore+0xa7
    23 ffffa201`bf57fa60 fffff801`b6e05af5 nt!BiOpenSystemStore+0xf8
    24 ffffa201`bf57fad0 fffff801`b6dfe16f nt!BcdOpenStore+0x3d
    25 ffffa201`bf57fb10 fffff801`b6c98e0c nt!PopFreeHiberContext+0x2b
    26 ffffa201`bf57fb50 fffff801`b68ceca8 nt!PopUnlockAfterSleepWorker+0x4c
    27 ffffa201`bf57fb80 fffff801`b696dac7 nt!ExpWorkerThread+0xd8
    28 ffffa201`bf57fc10 fffff801`b6a02946 nt!PspSystemThreadStartup+0x47
    29 ffffa201`bf57fc60 00000000`00000000 nt!KiStartSystemThread+0x16
    I would suggest removing the program associated with the driver if possible, or running Driver Verifier for at least 24 hours using the following instructions - Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials
      My ComputerSystem Spec
  3.    23 Jul 2017 #3
    Join Date : Apr 2017
    Posts : 8,761
    windows 10 professional version 1607 build 14393.969 64 bit

    Consider uninstalling Malwarebytes and turning hibernation off.
    Are you using any Winmagic software programs such as disk encryption?
    Are you using any HP drive encryption software?
      My ComputerSystem Spec
  4.    26 Jul 2017 #4
    Join Date : Jul 2017
    Posts : 26
    Windows 10 Pro x64
    Thread Starter

    Thanks for replies.

    Quote Originally Posted by Abaculus View Post
    Code:
    2: kd> lmvm SDDisk2K
    Browse full module list
    start             end                 module name
    fffff800`b96d0000 fffff800`b9753000   SDDisk2K T (no symbols)           
        Loaded symbol image file: SDDisk2K.sys
        Image path: \SystemRoot\system32\DRIVERS\SDDisk2K.sys
        Image name: SDDisk2K.sys
        Browse all global symbols  functions  data
        Timestamp:        Fri Dec 05 22:14:01 2014 (54822E29)
        CheckSum:         00040545
        ImageSize:        00083000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    I'm not sure what the above driver is related to? The results I can find are related to SecureDoc? The driver appears to start at boot too.
    What is SecureDoc? I don't know about the driver SDDISK2K.sys either.

    Quote Originally Posted by Abaculus View Post
    [code]2: kd> lmvm SDDisk2K
    The issue does appear to lie with a power-related IRP and its subsequent page fault.
    What is IRP?

    Quote Originally Posted by Abaculus View Post
    [code]2: kd> lmvm SDDisk2K
    I would suggest removing the program associated with the driver if possible, or running Driver Verifier for at least 24 hours using the following instructions - Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials
    I'll give it a go.

    Quote Originally Posted by zbook View Post
    Consider uninstalling Malwarebytes and turning hibernation off.
    Are you using any Winmagic software programs such as disk encryption?
    Are you using any HP drive encryption software?
    I've been running Malwarebytes for a couple of years with no problem.

    I do have password file/directory/usb protection running which is fairly recent change. Can't remember if it was installed before windows update or afterwards. I'll try switching it off.
      My ComputerSystem Spec
  5.    26 Jul 2017 #5
    Join Date : Jun 2015
    Posts : 12,864
    Windows 10 Pro

    IRP = I/O Request Package, used to perform I/O operations.
      My ComputersSystem Spec
  6.    26 Jul 2017 #6
    Join Date : Apr 2017
    Posts : 8,761
    windows 10 professional version 1607 build 14393.969 64 bit

    Open control panel
    Use the Microsoft snipping tool
    Post an image into the thread.
    Uninstall Malwarebytes.

    Before starting windows driver verifier make sure:
    1) create a brand new restore point
    2) use Macrium to create a backup image: Macrium Software | Your image is everything
    3) backup any important files
    4) know 2 methods to turn off windows driver verifier using windows recovery or advanced troubleshooting options:
    a) startup options > requires a restart > safe mode with command prompt > type: verifier /reset
    b) command prompt or AdminitratorX: \Windows\system32\cmd.exe type: verifier /bootmode resetonbootfail
    5) if the two methods fail to turn off windows driver verifier you will then choose restore and use the restore point that you just created. Unfortunately the minidump file typically disappear so little progress is made in the debugging
    6) The system settings need to be modified to not automatically restart so that you have ample time to view the bsod window.
    Follow the settings in this link: BSOD Finding and fixing them - Microsoft Community

    Keyboard: win + r keys simultaneously > type or copy and paste: sysdm.cpl > click advanced tab > under startup and recover click settings > under system failure uncheck automatically restart

    For each BSOD you will see a stop code typically driver verifier detected violation. The misbehaving driver may be displayed in the form *.sys If you see the driver displayed please record it for later use.

    7) install each Bluescreenview and Whocrashed and view their analysis after each bsod:
    http://www.resplendence.com/whocrashed
    Blue screen of death (STOP error) information in dump files.
    8) Update or post a new zip after the bsod so that we can debug and guide you through the update or uninstall / reinstall of drivers: BSOD - Posting Instructions - Windows 10 Forums

    Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

    Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community
      My ComputerSystem Spec
  7.    03 Aug 2017 #7
    Join Date : Jul 2017
    Posts : 26
    Windows 10 Pro x64
    Thread Starter

    The application using SDDisk2K.sys was HP Drive Encryption. I don't use it and I don't think it is even compatible with Windows 10. Anyway, HP said just uninstall it. Which I have done. I checked the driver had been dropped in device manager and yes, no longer there.
    HP-HENRY-03_08_2017_192523_21.zipHP-HENRY-03_08_2017_192523_21.zip
    However, I am still getting the same STOP Code. IRQL_NOT_LESS_OR_EQUAL.

    On Thu 03/08/2017 19:19:19 your computer crashed
    crash dump file: C:\WINDOWS\Minidump\080317-7921-01.dmp
    This was probably caused by the following module: ntoskrnl.exe (nt+0x16C4C0)
    Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF801B4A73BF8)
    Error: IRQL_NOT_LESS_OR_EQUAL
    file path: C:\WINDOWS\system32\ntoskrnl.exe
    product: Microsoft® Windows® Operating System
    company: Microsoft Corporation
    description: NT Kernel & System
    Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
    This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
    The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

    I attach the latest zip file including the dump and would be grateful for analysis again.


      My ComputerSystem Spec
  8.    03 Aug 2017 #8
    Join Date : Apr 2017
    Posts : 8,761
    windows 10 professional version 1607 build 14393.969 64 bit

    In post #3 you were supposed to uninstall Malwarebytes.
    Somehow it was never uninstalled or reinstalled on the computer?
    The Malwarebytes is again producing bsod.

    1) Uninstall all Malwarebytes software.


    Code:
    ffffe181`4338d0a8  fffff801`b970fbd0Unable to load image \??\C:\WINDOWS\system32\drivers\farflt.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for farflt.sys*** ERROR: Module load completed but symbols could not be loaded for farflt.sys farflt+0xfbd0
    Code:
    ffffe181`4338d048  fffff80b`c8922a1fUnable to load image \SystemRoot\system32\drivers\MBAMChameleon.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for MBAMChameleon.sys*** ERROR: Module load completed but symbols could not be loaded for MBAMChameleon.sys MBAMChameleon+0x2a1f

    Code:
    Event[797]:  Log Name: System  Source: Service Control Manager  Date: 2017-07-18T15:06:23.140  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: HP-Henry  Description: A service was installed in the system.Service Name:  MBAMChameleonService File Name:  C:\WINDOWS\system32\drivers\MBAMChameleon.sysService Type:  kernel mode driverService Start Type:  boot startService Account:
    mbamchameleon.sys Malwarebytes Chameleon Protection Driver https://www.malwarebytes.org/chameleon/ If using this


    farflt.sys Malwarebytes Anti-Ransomware Protection Downloads: https://www.malwarebytes.org/downloads/
    Support: https://www.malwarebytes.org/support/


    Code:
    Event[12708]:  Log Name: System  Source: Service Control Manager  Date: 2017-08-03T19:20:11.144  Event ID: 7045  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: HP-Henry  Description: A service was installed in the system.Service Name:  MBAMFarfltService File Name:  C:\WINDOWS\system32\drivers\farflt.sys
    Code:
    MBAMChameleo MBAMChameleon          MBAMChameleon          File System   Boot       Running    OK         TRUE        FALSE        12,288            139,264     0          27/06/2017 19:22:06    C:\WINDOWS\system32\drivers\MBAMChameleon.sys    8,192
      My ComputerSystem Spec
  9.    04 Aug 2017 #9
    Join Date : Jul 2017
    Posts : 26
    Windows 10 Pro x64
    Thread Starter

    It wasn't Malwarebytes. Uninstalling made no difference.

    It turned out to probably be Folder Lock, a security program, which I had uninstalled a while ago. The uninstall left a complete mess behind. Still entries in the registry, in startup, in drivers, etc. newsoftwares.net - at least it went away when I cleaned it all up, the only other thing I did was download WDK but not used it, and I doubt the issue was fixed by downloading and installing that.

    So running ok at present. Hope it doesn't come back.
      My ComputerSystem Spec
  10.    04 Aug 2017 #10
    Join Date : Apr 2017
    Posts : 8,761
    windows 10 professional version 1607 build 14393.969 64 bit

    See if you can run windows driver verifier for 36 hours without a bsod.
      My ComputerSystem Spec

 
Page 1 of 6 123 ... LastLast


Similar Threads
Thread Forum
BSOD immediately after sleep/hibernate V2
This is just a continuation of a previous thread which was marked as too old. See https://www.tenforums.com/bsod-crashes-debugging/63396-bsod-immediately-after-sleep-hibernate.html Had another BSOD immediately after returning from hibernate. I...
BSOD Crashes and Debugging
BSOD immediately after sleep/hibernate
I sometimes get a failure from either Corrupt Page or Memory Management after returning from either sleep mode or hibernate. Always caused by ntoskrnl.exe+142940. I wonder if it might be caused by my trying to log in too soon and the different...
BSOD Crashes and Debugging
Strange behavior after waking from hibernate
Lately my computer has been doing strange things after waking from hibernate. The first time 2 days ago after waking from hibernate my monitor did not wake up and just remained a black screen, yet after i restarted the computer it acted as if i had...
General Support
BSOD waking from sleep or hibernate
Hello! I have BSODs after waking my computer up. Windows 10 upgraded from Windows 8.1. Waking from hibernate generates Kernel_Security_Check_Failure. Waking from sleep generates mostly IRQ NOT EQUAL. Could you please help? Thanks!
BSOD Crashes and Debugging
BSOD resuming from Hibernate
This also happened with Windows 8.x but it persisted after I upgraded to Windows 10. It's an older machine with limited support, but I'd like to try and use it if I can. It's a tank of a laptop. 40024 Thanks
BSOD Crashes and Debugging
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 10:02.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums