BSOD PAGE_FAULT_IN_NONPAGED_AREA After Resume From Sleep

zbook · 02 Aug 2017

The logs are displaying that the misbehaving drivers have not been uninstalled (time zone may be an issue)
They were supposed to be removed yesterday and are displaying present on 8/2/2017
Windows defender antivirus has appeared as a problem signature. It has not yet appeared as a problem related to bsod. (It's only a windows update failure at this time)

Are your files backed up?
Have you made an image using Macrium?
Have you made a brand new restore point?
If you needed to perform a clean install (delete partitions, format drive) would you be able to?
If you clean the drive are you comfortable reinstalling Ubuntu as a dual partition?

If Windows defender continue to appear as a problem signature it may be necessary to perform an in place upgrade repair.
Please create a bootable windows 10 iso: Download Windows 10

Code:

8/02/17 6:52 AM    Application Error    Faulting application name: mbamservice.exe, version: 3.1.0.479, time stamp: 0x58f6af02
Faulting module name: mbamservice.exe, version: 3.1.0.479, time stamp: 0x58f6af02
Exception code: 0xc0000005
Fault offset: 0x0000000000065d25
Faulting process id: 0xfa4
Faulting application start time: 0x01d30b5bf0cb5f85
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Report Id: e9120fc4-e80f-452f-96d3-a7d89fe23004
Faulting package full name: 
Faulting package-relative application ID:8/01/17 6:20 PM    Application Error    Faulting application name: mbam.exe, version: 3.0.0.1068, time stamp: 0x59125ef2
Faulting module name: Qt5Core.dll, version: 5.6.2.0, time stamp: 0x58ed4d4f
Exception code: 0xc0000005
Fault offset: 0x0018da93
Faulting process id: 0x734
Faulting application start time: 0x01d30af2c90976fb
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\Qt5Core.dll
Report Id: 079481e1-10ed-4c60-8967-51989eafedd9
Faulting package full name: 
Faulting package-relative application ID:

Code:

8/02/17 7:21 AM    Windows Error Reporting    Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: d154e24f-b046-4f6f-8a6a-c9854d9a13c2

Problem signature:
P1: c4
P2: 9200f
P3: fffff8035f8f8470
P4: ffffcd835b44beb0
P5: ffffcd835b44bfb8
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\080217-2828-01.dmp
\\?\C:\Windows\Temp\WER-3859-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1983.tmp.WERInternalMetadata.xml
\\?\C:\Windows\Temp\WER17DF.tmp.WERDataCollectionStatus.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c4_ad390fc7da81e21cb95ce9241229eb30f650c3_00000000_cab_02d01983

Analysis symbol: 
Rechecking for solution: 0
Report Id: 7e4cb1be-a634-443e-8a50-0d106ea7357a
Report Status: 16388
Hashed bucket:

Code:

+++ WER5 +++:Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: d154e24f-b046-4f6f-8a6a-c9854d9a13c2


Problem signature:
P1: c4
P2: 9200f
P3: fffff8035f8f8470
P4: ffffcd835b44beb0
P5: ffffcd835b44bfb8
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10:

Code:

+++ WER1 +++:Fault bucket , type 0
Event Name: WindowsUpdateFailure3
Response: Not available
Cab Id: 0


Problem signature:
P1: 10.0.15063.483
P2: 80240438
P3: 00000000-0000-0000-0000-000000000000
P4: Scan
P5: 0
P6: 0
P7: 0
P8: Windows Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24)
P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}
P10: 0




+++ WER2 +++:
Fault bucket , type 0
Event Name: WindowsUpdateFailure3
Response: Not available
Cab Id: 0


Problem signature:
P1: 10.0.15063.483
P2: 80240438
P3: 00000000-0000-0000-0000-000000000000
P4: Scan
P5: 0
P6: 0
P7: 0
P8: Windows Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24)
P9: {9482F4B4-E343-43B6-B170-9A65BC822C77}
P10: 0




+++ WER3 +++:
Fault bucket , type 0
Event Name: WindowsUpdateFailure3
Response: Not available
Cab Id: 0


Problem signature:
P1: 10.0.15063.483
P2: 80240438
P3: 00000000-0000-0000-0000-000000000000
P4: Scan
P5: 0
P6: 0
P7: 0
P8: Windows Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24)
P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}
P10: 0




+++ WER4 +++:
Fault bucket , type 0
Event Name: WindowsUpdateFailure3
Response: Not available
Cab Id: 0


Problem signature:
P1: 10.0.15063.483
P2: 80240438
P3: 00000000-0000-0000-0000-000000000000
P4: Scan
P5: 0
P6: 0
P7: 0
P8: Windows Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24)
P9: {9482F4B4-E343-43B6-B170-9A65BC822C77}
P10: 0

Dulk · 02 Aug 2017

Malwarebytes was installed about 2 or 4 BSODs ago, dont know which. But I can assure you that the most recent BSODs have not been caused by Malwarebytes because the directory that the code is referring to does not exist currently.

I did try to update my Intel Integrated Graphics, but Device Manager said that it was the most recent version, it was not available for download from Acer's website, and the version off Intel's website was not allowed to install as Acer has their own special version of Intel Integrated Graphics Drivers?

Anyways after this, I checked for Windows update and there was one available. I updated Windows and ran verifier again but again got two more BSODs (One failed to make a .dmp file).

ERIK-WINDOWS-08_02_17__11409_09.zip - Google Drive

My files are not backed up and don't need to be backed up, this is a brand new laptop bought two weeks ago and just wanted to figure out what the hell is causing these blue screens. Because of this, I did not feel the need to make a Macrium image or create a restore point.

Anyways, if you can't seem to figure out whats going on, fresh install of Windows would be fine by me. Just really wanted to figure out what was causing this. However this works out, I want to thank you for all your time, help, and effort put into this.

Posted the last .dmp file above, give it a shot, and let me know if I should pull the trigger on the wipe.

Dulk · 02 Aug 2017

Also just a thought, would these BSODs being caused by driver verifier just not happen in normal use of Windows? I mean I could just wait and see but maybe one of these solutions already fixed the issue, and driver verifier is just unnecessarily overstressing the drivers past unrealistic use and it would be just fine in day to day. Just wanted to know what you thought of this.

zbook · 02 Aug 2017

Driver verifier should be able to be used 36 hours without any bsod.
See the links that were posted earlier.
The use of Windows driver verifier is to find misbehaving drivers now and a some preventative maintenance for the future.

Dulk · 02 Aug 2017

Oh ok that makes sense

Dulk · 02 Aug 2017

Literally was doing nothing on my laptop and got a UNEXPECTED_STORE_EXCEPTION BSOD.

ERIK-WINDOWS-08_02_17__15552_57.zip - Google Drive

zbook · 02 Aug 2017

The debugging on the latest bsod mini dump is below.
There was no definitive misbehaving driver displayed.
Later today I'll catch up with you. Please continue updating the zip with the bsod.
Do you have the option to connect this computer to the internet using ethernet (wired with cat5e) instead of wireless?

Code:

BugCheck C4, {9200f, fffff80abd328470, ffffdf8ec5492eb0, ffffdf8ec5492fb8}
Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+fb )

Code:

Qcamain10x64.sys

Code:

+++ WER2 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: c8991ae0-37f7-4a37-b26c-0051294acbcc


Problem signature:
P1: c4
P2: 9200f
P3: fffff8051d2d8470
P4: ffffdf8fdd49ede0
P5: ffffdf8fdd49eee8
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER3 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 8ae98e40-a335-4e35-bf3b-186e42b3fe63


Problem signature:
P1: c4
P2: 9200f
P3: fffff806fbfc8470
P4: ffffc58d437c0eb0
P5: ffffc58d437c0fb8
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER4 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 6b9f8395-2d92-4c3d-8303-6128157d10b6


Problem signature:
P1: c4
P2: 9200f
P3: fffff80abd328470
P4: ffffdf8ec5492eb0
P5: ffffdf8ec5492fb8
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER5 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 23d8ff79-fcf0-41f9-b597-5c02595a3603


Problem signature:
P1: c4
P2: 9200f
P3: fffff8035f8f8470
P4: ffffcd835b44beb0
P5: ffffcd835b44bfb8
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER6 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 7c2f4829-8da6-475a-99f2-7f45e2ada2dc


Problem signature:
P1: c4
P2: 9200f
P3: fffff80576d38470
P4: ffffb30ddb7f9e10
P5: ffffb30ddb7f9f18
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER7 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: b11692d5-9918-48c7-8f63-bae7983ec382


Problem signature:
P1: c4
P2: 9200f
P3: fffff80553cd8470
P4: ffffc6898da5ca60
P5: ffffc6898da5cb68
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER8 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: bedde8c5-bb00-4a2f-a2e1-0c2978da62a0


Problem signature:
P1: c4
P2: 9200f
P3: fffff80f3adc8470
P4: ffff95835c045230
P5: ffff95835c045338
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10: 




+++ WER9 +++:
Fault bucket 0xc4_NdisTimedDataHang_XDV_VRF_IMAGE_Qcamain10x64.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: a1008b30-d45f-4e4b-8b57-2412f35c3467


Problem signature:
P1: c4
P2: 9200f
P3: fffff8060cc78470
P4: ffffa90b52a40730
P5: ffffa90b52a40838
P6: 10_0_15063
P7: 0_0
P8: 768_1
P9: 
P10:

Dulk · 02 Aug 2017

Yes I do

zbook · 02 Aug 2017

Okay.
Please connect to ethernet.
Then disable windows updates of non-Microsoft drivers:
Enable or Disable Driver Updates in Windows Update in Windows 10 Windows 10 Windows Update Activation Tutorials
Please use the hardware setting on the computer if there is one to turn off wireless.
Then uninstall the wireless driver: Qcamain10x64.sys
Please use device manager to uninstall it (not disable it)
Then open file explorer > this PC > local C: > enter Qcamain10x64.sys in search to see if it is completely uninstalled.
Then continue using windows driver verifier to generate bsod mini dump files.

So you will have completely eliminated 3 misbehaving drivers:
1) Malwarebytes
2) Qualcom wireless driver
3) Avira antivirus

And updated 1 misbehaving driver:
4) Intel graphics

When we have more misbehaving drivers and there are no more bsod we will find a replacement driver so that you can use wireless at a later time. For the time being it will make troubleshooting easier with ethernet and no likelihood or recurrent problems with the wireless driver.

Dulk · 02 Aug 2017

Do I need to connect to the Ethernet? Laptop doesn't have an Ethernet port so I would have to get an adapter. If the only point of ethernet cable is to post updates, I can post updates from my desktop.

I removed automatic windows updating for non windows drivers and uninstalled Qualcomm WIFI driver but files were still left in Windows. Restarted and the drivers were reinstalled. Uninstalled the driver again but Windows did not allow me to delete files in System32 even if I was the owner of the file so I just deleted it from Ubuntu.

Currently been running driver verifier for over an hour and not a single blue screen. Before it would have bluescreened within 10 seconds of logging in.

I think uninstalling the wifi driver was the solution, but now I don't have wifi.