BSOD PAGE_FAULT_IN_NONPAGED_AREA After Resume From Sleep

Hey everyone, bought a new Acer Swift 3 laptop and recently I have been having this issue where I would have some sort of BSOD pointing to bad RAM after I resumed from sleep. If Windows successfully resumes from sleep, I could also trigger it from trying to restart after sleep.

A lot of the time it has been PAGE_FAULT_IN_NONPAGED_AREA, sometimes MEMORY_MANAGEMENT or IRQL_NOT_LESS_OR_EQUAL, and recently FAULTY_HARDWARE_CORRUPTED_PAGE.

Because this all points to bad ram, I've run a few tests such Windows Memory Diagnostic and Memtest86. All of it passes and says the RAM is all fine.

I've been searching for a solution for hours but have not been successful so I'm hoping you guys could help me analyse my dump files. Thanks.

ERIK-WINDOWS-07_29_17__12141_18.zip - Google Drive

When you ran MemTest86+, did you follow the instructions illustrated in this thread - MemTest86+ - Test RAM Windows 10 BSOD Tutorials

When I ran it I only ran 4 passes, I will start another test again right now and run 12 passes. I read somewhere that 12 passes is necessary.

Ran 10 passes, not a single error

There were 18 bsod noted in the zip but only 5 mini dump files.
One misbehaving driver was identified and should be uninstalled.
Please uninstall Avira antivirus and turn on Windows defender.
This is a link from Avira on how to uninstall the antivirus: How do I uninstall my Avira Antivirus product?


In the event logs there are a lot of event 1026.
Do you have a TPM owner password?
If so you can fix the event report with a reset: Error: The TPM is defending against dictionary attacks and is in a time-out period.
How do I fix ?

Open administrative command prompt and type or copy and paste:
1) sfc /scannow
2) dism /online /cleanup-image /restorehealth
3) chkdsk /scan
4) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

Code:

ffff9180`afd4f248  fffff80b`3908c7f0Unable to load image \SystemRoot\system32\DRIVERS\avipbb.sys, Win32 error 0n2*** WARNING: Unable to verify timestamp for avipbb.sys*** ERROR: Module load completed but symbols could not be loaded for avipbb.sys avipbb+0xc7f0

avipbb.sys

Avira AntiVir

http://www.free-av.com/en/download/index.html

Code:

avipbb       avipbb                 avipbb                 Kernel        System     Running    OK         TRUE        FALSE        4,096             102,400     0          5/03/17 4:25:48 AM     C:\Windows\system32\DRIVERS\avipbb.sys           4,096

Code:

Event[4232]:  Log Name: System  Source: Microsoft-Windows-TPM-WMI  Date: 2017-07-24T00:11:11.066  Event ID: 1026  Task: N/A  Level: Information  Opcode: Info  Keyword: N/A  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: ERIK-WINDOWS  Description: The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically.  To set up the TPM interactively use the TPM management console (Start->tpm.msc) and use the action to make the TPM ready.Error: The TPM is defending against dictionary attacks and is in a time-out period.Additional Information: 0x0

Code:

Event[4235]:  Log Name: System  Source: Microsoft-Windows-TPM-WMI  Date: 2017-07-24T00:11:16.913  Event ID: 1026  Task: N/A  Level: Information  Opcode: Info  Keyword: N/A  User: S-1-5-18  User Name: NT AUTHORITY\SYSTEM  Computer: ERIK-WINDOWS  Description: The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically.  To set up the TPM interactively use the TPM management console (Start->tpm.msc) and use the action to make the TPM ready.Error: The TPM is defending against dictionary attacks and is in a time-out period.Additional Information: 0x0

Hey first off thanks for your help. Really appreciate it. I uninstalled Avira antivirus and the probem seems to have gone away. As for the 18 blue screens but 5 minidumps, Windows seems to have deleted the oldest one after each new BSOD.

Im not too sure what a TPM owner password is so I am assuming that I dont have one?

And for your last request, here you go:

Microsoft Windows [Version 10.0.15063](c) 2017 Microsoft Corporation. All rights reserved.C:\Windows\system32>sfc /scannowBeginning system scan. This process will take some time.Beginning verification phase of system scan.Verification 100% complete.Windows Resource Protection did not find any integrity violations.C:\Windows\system32>dism /online /cleanup-image /restorehealthDeployment Image Servicing and Management toolVersion: 10.0.15063.0Image Version: 10.0.15063.0[==========================100.0%==========================] The restore operation completed successfully.The operation completed successfully.C:\Windows\system32>chkdsk /scanThe type of the file system is NTFS.Stage 1: Examining basic file system structure ... 291840 file records processed.File verification completed. 5922 large file records processed. 0 bad file records processed.Stage 2: Examining file name linkage ... 406678 index entries processed.Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered to lost and found.Stage 3: Examining security descriptors ...Security descriptor verification completed. 57420 data files processed.CHKDSK is verifying Usn Journal... 41417928 USN bytes processed.Usn Journal verification completed.Windows has scanned the file system and found no problems.No further action is required. 165004287 KB total disk space. 52132196 KB in 134681 files. 94736 KB in 57421 indexes. 0 KB in bad sectors. 406143 KB in use by the system. 65536 KB occupied by the log file. 112371212 KB available on disk. 4096 bytes in each allocation unit. 41251071 total allocation units on disk. 28092803 allocation units available on disk.C:\Windows\system32>

Pretty sure my post requires moderator approval because of the length, but the Avira antivirus uninstall seems to have solved it. Post with full details and those cmd requests coming soon.

Update: another BSOD with PAGE_FAULT_IN_NONPAGED_AREA error code happened right now. Posting the .dmp file if any of you guys can check it out.

New Dump File.zip - Google Drive

Code:

BugCheck 50, {ffffa8e088361a3c, 2, fffff8037708331a, 2}Could not read faulting driver nameProbably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+2fa )

1) make an image of your drive using Macrium
Macrium Software | Your image is everything
2) make sure the image is on a drive other than the drive with the windows operating system
3) create a brand new restore point

Windows driver verifier is a tool that is used to find misbehaving drivers.
It will repetitively produce bsod until all misbehaving drivers are fixed or until it is turned off.
Each time a bsod is produced there is a stop code typically driver verifier detected violation. There may or may not be a malfunctioning driver displayed in the form *.sys. If you see a driver displayed please record it and post it into the thread.

Before using Windows driver verifier you must know how to turn it off so that you can return to the desktop and process the bsod mini dump files. Then uninstall, update, or roll back the misbehaving driver. The process can continue until all misbehaving drivers are uninstalled or a replacement driver can be re-installed immediately after each un-installation. The result should be the same. The method is personal preference whether to uninstall all until there are no more bsod or to reinstall immediately after each uninstall.

To turn off windows driver verifer you will need to open the windows recovery or advanced troubleshooting menu. Then you will navigate to startup options (not startup repair) and when in startup options select #6 safe mode with command prompt. You will type the command: verifier /reset
In case verifier /reset fails to turn off windows driver verifier you will navigate within the windows advanced troubleshooting menu to command prompt. It will open Administrator X: \Windows\system32\cmd.exe
Then you will type: verifier /bootmode resetonbootfail
And in case the second method fails to turn off windows driver verifier you will navigate within the windows advanced recovery to restore. A restore unfortunately leads to loss of the bsod minidump file and little if any progress is made in the troubleshooting.

This is a link to learn about windows driver verifer. It has the method to turn it on and the custom settings used for the tests.

https://answers.microsoft.com/en-us/...3-c48669e4c983

In order to have time to view the bsod window please make sure these settings are in place or updated:
The system settings need to be modified to not automatically restart so that you have ample time to view the bsod window. Follow the settings in this link:
BSOD Finding and fixing them - Microsoft Community

Keyboard: win + r keys simultaneously > type or copy and paste: sysdm.cpl > click advanced tab > under startup and recover click settings > under system failure uncheck automatically restart

See this link: BSOD Finding and fixing them - Microsoft Community:
https://answers.microsoft.com/en-us/...d-e95ee5d8669d


Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials


To practice using the Windows recovery or advanced troubleshooting menu open administrative command prompt and type or copy and paste: shutdown /r /o /f /t 00
When the computer reboots it will open to the windows recovery or windows advanced troubleshooting menu.

Download and install both Bluescreenview and Whocrashed to process the bsod minidump files. You will use these software applications each time you return to the desktop.

http://www.resplendence.com/whocrashed


Blue screen of death (STOP error) information in dump files.

For every bsod please post a new zip file:
BSOD - Posting Instructions - Windows 10 Forums


When you have time to work on the misbehaving drivers and you are comfortable with the windows advanced troubleshooting menu to turn off windows driver verifier and you have created a brand new restore point you can turn on windows driver verifier.
In most cases it will immediately bsod. And again it is designed to repetitively produce bsod until all of the misbehaving drivers are fixed or it is turned off.
Once there are no longer any bsod you will run windows driver verifier for 36 hours under typical computer use. If there are no longer any bsod the troubleshooting will be completed.

Hey zbook, I ran the driver verifier and right off the bat it pointed towards Malwarebytes? I'll disable Malwarebytes from startup and run the driver verifier again. After this I'll post back with updates.

ERIK-WINDOWS-08_01_17_111320_45.zip - Google Drive