# irql_not_less_or_equal bsod?



## mheaney14 (Feb 25, 2014)

Hey, I've been having an issue with my laptop which has windows 8 installed. It has been crashin frequently to a bsod where it gives me the error irql_not_less_or_equal. It seems to pretty much happen randomly so it is hard to find a direct cause for the issue. Sometimes after it crashes I can start the computer normally but other times when I try to start I am greeted by a variety of error messages. I tried to do a system restore but got an error stating that I didnt have the proper permission to change some of the files. Does anyone know a way to fix this?


----------



## Macboatmaster (Jan 15, 2010)

1. Welcome to Tech Support Guy


2. Can you send a dump file
open windows 
open MiniDumps
on the latest dump right click and click send to compressed file - desktop
then on reply go advanced and attach to reply


3. Most likely cause is a driver and the most likely ones are the wireless driver or the graphics
If you know how
Go device manager right click those and click update driver


4. What Anti-virus please as that if not windows defender is the next likely cause


----------



## Macboatmaster (Jan 15, 2010)

I am signing off in 15 minutes it is 0018 in uk
If the suggestions re the drivers do not work
post the dumps please and I will look when I return but that will not be until 1800hrs


----------



## mheaney14 (Feb 25, 2014)

Macboatmaster said:


> I am signing off in 15 minutes it is 0018 in uk
> If the suggestions re the drivers do not work
> post the dumps please and I will look when I return but that will not be until 1800hrs


1) Thanks.

2) Alright, I compressed the most recent dump and attached it.

3) Okay, I updated all of my wireless and graphics drivers that needed updating.

4) Currently I am using Kapersky Pure 3.0 13.0.2.558 as well as AVG anti-virus free edition 2014.

Thanks for your help!


----------



## Macboatmaster (Jan 15, 2010)

YOU CANNOT USE BOTH those anti virus programs
uninstall ONE
which do you want to keep
I suggest you uninstall the AVG free
Use Control Panel Programs and features
then run the AVG uninstaller
http://www.avg.com/gb-en/utilities

It is too late for me to look at the dumps now but this may well be the cause of the problem

By running the two together you have actually ended up with less protection rather than more as they conflict with each other

If that proves NOT to be the cause, post and I will look at the dump when I return. It is not a few minutes of a job otherwise I would do it now for you


----------



## Macboatmaster (Jan 15, 2010)

I have GONE - goodnight
Will reply as soon as I come back online if you still need it with analysis of dump


----------



## mheaney14 (Feb 25, 2014)

Alright, I uninstalled AVG. The computer actually crashed during the un-installation but when it looks like it was still removed properly. When I first tried to start the computer it wouldn't start and gave me an error: "The operating system couldn't be loaded because a critical system driver is missing or contains errors.
File: \windows\System32\drivers\evbda.sys
Error Code: 0xc0000221
You'll need to use recovery tools on your installation media. If you don't have any installation media (like a disc or USB device), contact your system administrator or PC manufacturer"
Upon seeing this message I shut down the computer and then turned it back on a few minutes later and it started like normal.


----------



## Macboatmaster (Jan 15, 2010)

I think it is Broadcom extreme gigabyte Ethernet controller
See how you go with it now


and I will look when I return
I HAVE NOW gone - goodnight


----------



## mheaney14 (Feb 25, 2014)

Hey, I know you're not going to see this until later but I figured I would post it now. So, essentially what happened is my computer crashed again with the same error but this time would not start and instead give me an error no matter how much I waited or how many times I tried. So, in order to get my computer to start I performed a system refresh. After the refresh finished the computer started successfully. I have not encountered the same error at all but the computer did crash once with the error: "Page Fault in Non Paged Area". I'm not sure what caused that error but the computer seems to be running fine otherwise.


----------



## Macboatmaster (Jan 15, 2010)

1. The minidump you sent me on post 4 is here

2. It is not really a lot of use the crash it appears was due to AVG
I say appears as that was what was running when the crash occurred
However that does not actually mean that AVG was the cause of the crash

3. I see the computer is an Hewlett-Packard 
HP ENVY 15 Notebook PC

4.* On the crash dump I see NO MENTION of Kapersky Pure 3.0 13.0.2.558 was this only recently installed *

5*. DUMP*
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.16452.amd64fre.winblue_gdr.131030-1505
Machine Name:
Kernel base = 0xfffff800`d240b000 PsLoadedModuleList = 0xfffff800`d26cf990
Debug session time: Tue Feb 25 17:14:51.476 2014 (UTC - 5:00)
System Uptime: 0 days 1:03:28.233
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff800d22b63a7, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff800d22b63a7, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: fffff800d26bd340: Unable to get special pool info
fffff800d26bd340: Unable to get special pool info
GetUlongFromAddress: unable to read from fffff800d2758208
fffff800d22b63a7

CURRENT_IRQL: 2

FAULTING_IP: 
+0
fffff800`d22b63a7 ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: avgnsa.exe

TRAP_FRAME: ffffd00020562770 -- (.trap 0xffffd00020562770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000001
rdx=ffffe000058fdc28 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800d22b63a7 rsp=ffffd00020562900 rbp=0000000000000001
r8=0000000000000001 r9=0000000000000000 r10=0000000fffffffff
r11=0000098000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
fffff800`d22b63a7 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800d25647e9 to fffff800d2558ca0

FAILED_INSTRUCTION_ADDRESS: 
+0
fffff800`d22b63a7 ?? ???

STACK_TEXT: 
ffffd000`20562628 fffff800`d25647e9 : 00000000`0000000a fffff800`d22b63a7 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
ffffd000`20562630 fffff800`d256303a : 00000000`00000008 00000000`00000000 00000000`00000900 ffffd000`20562770 : nt!KiBugCheckDispatch+0x69
ffffd000`20562770 fffff800`d22b63a7 : ffffe000`06ae9980 ffffe000`00ab5800 ffffe000`06ae9980 fffff6e8`00156080 : nt!KiPageFault+0x23a
ffffd000`20562900 ffffe000`06ae9980 : ffffe000`00ab5800 ffffe000`06ae9980 fffff6e8`00156080 00000000`00000000 : 0xfffff800`d22b63a7
ffffd000`20562908 ffffe000`00ab5800 : ffffe000`06ae9980 fffff6e8`00156080 00000000`00000000 ffffe000`06ae99d8 : 0xffffe000`06ae9980
ffffd000`20562910 ffffe000`06ae9980 : fffff6e8`00156080 00000000`00000000 ffffe000`06ae99d8 ffffe000`058fdc28 : 0xffffe000`00ab5800
ffffd000`20562918 fffff6e8`00156080 : 00000000`00000000 ffffe000`06ae99d8 ffffe000`058fdc28 00000000`00000001 : 0xffffe000`06ae9980
ffffd000`20562920 00000000`00000000 : ffffe000`06ae99d8 ffffe000`058fdc28 00000000`00000001 ffffe000`04a7d900 : 0xfffff6e8`00156080

STACK_COMMAND: kb

FOLLOWUP_IP: 
nt!KiPageFault+23a
fffff800`d256303a 440f20c0 mov rax,cr8

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiPageFault+23a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 52718d9c

FAILURE_BUCKET_ID: X64_AV_CODE_AV_BAD_IP_nt!KiPageFault+23a

BUCKET_ID: X64_AV_CODE_AV_BAD_IP_nt!KiPageFault+23a

Followup: MachineOwner

6. avgnsa.exe
Is the AVG Network scanner - part of the AVG product you have. It has been known to cause all manner of problems on Windows 8.

7. When you uninstalled AVG using Programs and Features did you run the uninstall tool


> Use Control Panel Programs and features
> then run the AVG uninstaller
> http://www.avg.com/gb-en/utilities


8. So please answer 4 and 7 and if you did not run the AVG uninstaller you must do to remove the remnants of AVG which can still cause problems


----------



## TerryNet (Mar 23, 2005)

> 3. Most likely cause is a driver and the most likely ones are the wireless driver or the graphics
> If you know how
> *Go device manager right click those and click update driver*


Sorry, but I have to disagree with Macboatmaster on the part I bolded. I agree that the wireless driver is a prime suspect, but you need to get the latest driver from the PC manufacturer's web site (assuming it is an integrated adapter).

This is my preferred order for finding drivers:

1. PC manufacturer's web site,
2. Motherboard manufacturer's web site,
3. Device manufacturer's web site,
4. A "drivers" site, such as DriverGuide,
5. Anywhere you can find one that might work,
6. Let Device Manager try to find one.
7. Use Windows Update.

(4 through 7 are really tied, and with Windows 7--and maybe 8/8.1-- the Windows Update should be at least 4th. The main message is that the first three are almost always to be preferred.)


----------



## mheaney14 (Feb 25, 2014)

Hey, sorry about the late reply.
4) Kapersky was installed on the computer when I originally got it.
7) No, when I tried to uninstall it, I just used Add/Remove programs in the control panel.
Now that I refreshed my computer, AVG is totally gone and it seems like things are running pretty smoothly.


----------



## Macboatmaster (Jan 15, 2010)

1.


> No, when I tried to uninstall it, I just used Add/Remove programs in the control panel.


I strongly advise you to run the uninstall program I sent you.

2. Re the post from my colleague *TerryNet* post 11 that is good advice.  I have often posted to advise that it is best NOT to accept driver updates from Microsoft.

3. If you go Control Panel Devices and Printers you will see an icon for your computer. Right click that and click device installation settings
You will then see that you can choose NOT to have Windows update include driver updates for your devices.

4. In the case of your computer apart from any external devices that require drivers you should go to the HP site

There are numerous models of HP Envy 15 and you need to choose the right one.

Even then any one model has for instance one of 4 or 5 different wireless adapters
Ralink
Intel
Broadcom
Realtek

5. You need to identify the correct model of Envy and the correct wireless adapter you have installed
Here is an example of the five different sorts that may be used on the Envy15
http://h10025.www1.hp.com/ewfrf/wc/...8&lc=en&cc=us&dlc=en&sw_lang=&product=5387995

6. You get the correct one by going to device manager and opening the device and then click on the driver tab please see my screenshot. You then check the driver version you have installed against the one offered by HP

7. HOWEVER many people do NOT realise that Unless you disable the automatic driver updating as I have described in Control Panel, that there is every chance that the next updates will also change the driver.
The system works by the major manufacturers informing Microsoft of driver updates. Unfortunately the actual device in your computer, especially wireless adapters is not always correctly identified by the update system.

8. In your case, I recommended device manager as a quick and easy method of changing the drivers, then when you informed me that you had the two Anti-virus programs running, I was reasonably certain this was the cause.

9. If all is well I suggest you leave it as is.
If you have problems try the drivers from HP, ensuring that you have disabled the automatic driver updating in Control Panel.

10. On your computers dump I see this
CSVirtualDiskDrv CSVirtualDiskDrv.sys

which is part of Kapersky but I do not see other evidence of Kapersky. You say it was installed when you got the computer, is there any chance it was a 30 day trial or so and it has now expired. Are you sure please that all is in order and you can run the various aspects of Kapersky from the user interface


----------



## mheaney14 (Feb 25, 2014)

Hey, sorry again for the late reply. Okay, so basically what is going on now is that I have refreshed my computer. Part of what that did was completely remove AVG as well as some other programs and revert alot of my settings and files to default settings. Kapersky is no longer on my machine and I am now using Spybot as well as Malwarebytes for malware. For a while things seemed to seemed to be running fine until earliet today. My computrt crashed repeatedly with the error "Page Fault in Non Paged Area". After that the computer ran successfully for a few minutes until it crashed again with a familiar "IRQL Not Less ot Equal" error and then when it restarted it soon after crashed again with an error that was something about a "Pool header" I think. I am posting this on mu phone so I cant upload the minidumps but I will do so as soon as I get a chance.


----------



## Crazy10 (May 12, 2012)

I'm guessing failing RAM or a failing HDD.


----------



## mheaney14 (Feb 25, 2014)

Okay, here's the latest minidump.


----------



## mheaney14 (Feb 25, 2014)

Crazy10 said:


> I'm guessing failing RAM or a failing HDD.


Okay, if it's the case that it is failing RAM or a failing HDD, is that kind of thing usually covered under the manufacturer's warranty? Because my computer is still cover under that.


----------



## Macboatmaster (Jan 15, 2010)

1. We stand little chance of sorting this, while you are making so many changes to the system
In any troubleshooting, of this nature it is vital that the system remains the same with ONLY one change at a time and then testing after each


2. Any other method is doomed to failure as there is no assured way of knowing what is causing the issue, the original cause - as it appeared in your case to antivirus programs running - or other changes


3. Malwarebytes in its free version provides no real time protection and is a scan on demand only
Spybot in its free version is only anti-spyware and has no real malware protection


So which please of these versions do you NOW have installed
When you answer that - it is possible we may be able to make some progress


----------



## mheaney14 (Feb 25, 2014)

Okay, im sorry for making so many changes. I only performed a system refresh because I could not boot ky computer otherwise, even in safe mode. I installed Malwarebytes and Spybot because Kapersky ajd AVG were removed when I performed the refresh and wanted some sort of virus protection. I will try not to make any further changes.


----------



## Macboatmaster (Jan 15, 2010)

OK no need to apologise
I appreciate you had to do the refresh

However please answer the question and then hopefully we can progress



> So which please of these versions do you NOW have installed


----------



## mheaney14 (Feb 25, 2014)

Alright, I have the most recent version s of each. I'm currently posting on my phone so I cant give you the exact version at the moment but as soon as I can I will.


----------



## Macboatmaster (Jan 15, 2010)

I know you say you will post the exact details as soon as possible but all I need to know is 
ARE they both the free version OR have you bought them

As I said
Malwarebytes in its free version provides no real time protection and is a scan on demand only
Spybot in its free version is only anti-spyware and has no real malware protection



I am now offline for evening meal


----------



## mheaney14 (Feb 25, 2014)

They are both the free version. I think Malwarebytes is currently on the trial for the paid version.


----------



## Macboatmaster (Jan 15, 2010)

OK 
That is NO GOOD as after the 14 days trial of the malwarebytes it will revert to the free version and as explained in my post NEITHER the malwarebytes or the Spybot will then provide real time protection and the SPYBOT free version does not do so any way it is only anti spyware

1. UNINSTALL Malwarebytes using Control Panel Programs and features
Reboot the computer

2. See this link
https://helpdesk.malwarebytes.org/entries/25291497-How-do-I-uninstall-Malwarebytes-Anti-Malware-

download and run the malwarebytes uninstall tool - if it reports
*NOTE:* If you get SHGetValue failed with error code 0, that only means that the tool has nothing to perform, continue on with the next step.... 
It will ask to restart your computer, please allow it to do so _*very important*_
_*
*_
3. Uninstall SPYBOT from the Control Panel, Programs and features
REBOOT the computer


4. Check that windows defender is enabled 
Control Panel
Windows Defender
If it has not enabled itself click settings tab and click the check box to turn on and then click save changes.
REBOOT the computer


5. Open Windows defender and run a QUICK SCAN
It will take sometime, the first time it is run but after that it will be quicker


6. Does it find anything please- the scan on Defender


7. POST back with that info please
AND the full model details please of the HP Envy 15 and confirming please you have DONE all in this post
There is a lot more to do.


The latest crash occurred when malwarebytes was being used 
THAT may well be due to other problems which need to be addressed when you have completed the jobs on this post


----------



## mheaney14 (Feb 25, 2014)

Okay, I have completely removed both SPYBOT and MalwareBytes and I have also enabled Windows Defender and ran a quick scan which didn't seem to find anything. What kind of model details do you need me to supply and where would I find them?

Also I should note: when I tried to boot up my computer earlier it went right into a disk check which I decided to let run in case it came up with any useful results. The scan took several hours and when it was finished I got an error stating that the OS could not be loaded and I had to restore to a previous point where it was working. I did restore before I removed SPYBOT and MalwareBytes as well as turn on Windows Defender. I figured I should let you know in case that changes anything.


----------



## Macboatmaster (Jan 15, 2010)

> I did restore before I removed SPYBOT and MalwareBytes as well as turn on Windows Defender. I figured I should let you know in case that changes anything.


I am not sure what you mean

1. Was this disk check before the uninstallation of the software or after

2. Why would you restore before you uninstalled the software all you had to do was to reboot the computer at various points as I indicated

3. Please explain what you mean exactly 
I know what a system restore point is but the expression restore is used as well when it refers to a restore from the recovery partition on the hard drive - restore to factory condition


----------



## mheaney14 (Feb 25, 2014)

1) The disc check was before I uninstalled the software.

2) The computer would not boot at all after the disc check if I didnt restore.

3) Sorry, I mean restore to a system restore point not to factory condition


----------



## Macboatmaster (Jan 15, 2010)

OK re the disk check clearly something is wrong and we will look at that shortly

I still cannot understand this


> Sorry, I mean restore to a system restore point


with this



> did restore before I removed SPYBOT and MalwareBytes as well as turn on Windows Defender.


please explain - are you telling me that you uninstalled Spybot and then did a system restore. uninstalled Malwarebytes and then did another system restore etc,. or WHAT please did you do


----------



## mheaney14 (Feb 25, 2014)

Okay I did the system restore, and then uninstalled Malwarebytes, then rebooted, then uninstalled SPYBOT, then rebooted.


----------



## Macboatmaster (Jan 15, 2010)

1. OK re the restore 


2. on the base of the laptop - will be the model details of the envy what please are the full details eg. as an example ONLY


HP ENVY TouchSmart 15-j040us 


3. Open a cmd prompt with admin rights and type
sfc /scannow


cmd prompt with admin rights is from desktop
press windows button
type cmd (I know there is no place to type)
when it appears
right click it and click run as admin
then when the window opens
type the system file check cmd


sfc (space)/scannow (you do not type space)


please post the results of the check it will indicate the result the one we want is that all files are in order and in their correct place


----------



## mheaney14 (Feb 25, 2014)

2) Okay, so if I read this right my computer is a HP ENVY 15 Notebook PC 15-j084ca
3) The scan didn't seem to find any erros


----------



## Macboatmaster (Jan 15, 2010)

> The scan didn't seem to find any erros


Well it either did or it did not
What please was the report when it completed


----------



## mheaney14 (Feb 25, 2014)

"Scan found no registry errors" or somethimg like that is what it said


----------



## Macboatmaster (Jan 15, 2010)

I am perplexed
You say that the computer came with Kapersky
I am NOT doubting what you say but you now appear to have Norton

and indeed according to HP that - Norton is what was installed

Norton Internet Security: Free 60-day subscription helps keep your PC, identity and personal information safe online.

http://h10025.www1.hp.com/ewfrf/wc/document?cc=uk&lc=en&docname=c03805427

NORTON must be removed before you can hope for things to be right with the computer, as you have had other AV`s and are now using Windows Defender

Go Control Panel Programs and Features
Uninstall any listing for Norton - or Symantec and then run this tool
https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us
YOU MUST run the tool it is not sufficient to only uninstall from Control Panel


----------



## mheaney14 (Feb 25, 2014)

Yeah, so when I bought the computer, they installed kapersky on there buy when I performed the system refresh it was removed and Norton was there instead.

Alright. Ill get rid of Norton right away.


----------



## mheaney14 (Feb 25, 2014)

Alright, I uninstalled Norton.


----------



## Macboatmaster (Jan 15, 2010)

Please test it
This was your last dump you sent
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9200.16581.amd64fre.win8_gdr.130410-1505
Machine Name:
Kernel base = 0xfffff800`8181f000 PsLoadedModuleList = 0xfffff800`81aeba20
Debug session time: Sat Mar 1 02:37:43.884 2014 (UTC - 5:00)
System Uptime: 0 days 0:10:27.592
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000050, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880018f04f3, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80081b77168
GetUlongFromAddress: unable to read from fffff80081b771f8
0000000000000050 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP: 
ndis!ndisFOidRequestCompleteInternal+23
fffff880`018f04f3 8b5d50 mov ebx,dword ptr [rbp+50h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: mbamservice.ex


That is Malwarebytes - could be caused by Norton


*If it still crashes post the latest please*


----------



## mheaney14 (Feb 25, 2014)

Alright, here is the latest. It crashed shortly after I uninstalled Norton.


----------



## Macboatmaster (Jan 15, 2010)

Here is the last dump you sent
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9200.16581.amd64fre.win8_gdr.130410-1505
Machine Name:
Kernel base = 0xfffff800`2880b000 PsLoadedModuleList = 0xfffff800`28ad7a20
Debug session time: Tue Mar 4 16:59:27.182 2014 (UTC - 5:00)
System Uptime: 0 days 1:39:02.895

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffdfff, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800288a1e36, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------

Could not read faulting driver name
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80028b63168
GetUlongFromAddress: unable to read from fffff80028b631f8
ffffffffffffdfff

FAULTING_IP: 
nt!KeSetEvent+16
fffff800`288a1e36 f6037f test byte ptr [rbx],7Fh

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff8801f7139f0 -- (.trap 0xfffff8801f7139f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff901010962c0 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800288a1e36 rsp=fffff8801f713b80 rbp=0000000000000000
r8=0000000000000000 r9=00000000ffffffff r10=0000000000000000
r11=fffff8801f713bc0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!KeSetEvent+0x16:
fffff800`288a1e36 f6037f test byte ptr [rbx],7Fh ds:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800289263f1 to fffff80028865440

STACK_TEXT: 
fffff880`1f713808 fffff800`289263f1 : 00000000`00000050 ffffffff`ffffdfff 00000000`00000000 fffff880`1f7139f0 : nt!KeBugCheckEx
fffff880`1f713810 fffff800`2889facb : 00000000`00000000 ffffffff`ffffdfff fffffa80`07178080 fffffff6`00000000 : nt! ?? ::FNODOBFM::`string'+0x33c2b
fffff880`1f7138b0 fffff800`28862eee : 00000000`00000000 ffffffff`ffffdfff 00000000`00000000 fffff880`1f7139f0 : nt!MmAccessFault+0x55b
fffff880`1f7139f0 fffff800`288a1e36 : 00000000`0000000f fffff901`0494fa00 00000000`00000002 ffff01a4`bc430296 : nt!KiPageFault+0x16e
fffff880`1f713b80 fffff960`003196f3 : 00000000`00000001 fffff901`00000001 00000000`005aae69 fffff880`0188a180 : nt!KeSetEvent+0x16
fffff880`1f713bf0 fffff960`000938d6 : fffff901`010e6b90 fffff880`1f713ec0 00000000`00000000 fffff800`288964cc : win32k!zzzWakeInputIdle+0x2854d3
fffff880`1f713c20 fffff960`001fe894 : fffff880`1f713d88 00000000`00000100 fffff880`00000000 00000000`ffffffff : win32k!xxxRealInternalGetMessage+0x8d6
fffff880`1f713d40 fffff800`28864453 : fffffa80`07178080 00000000`03d8f768 fffff880`1f713de8 00000000`03d8f2c8 : win32k!NtUserRealInternalGetMessage+0x74
fffff880`1f713dd0 000007fc`92241b4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03d8f748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fc`92241b4a

STACK_COMMAND: kb

FOLLOWUP_IP: 
win32k!zzzWakeInputIdle+2854d3
fffff960`003196f3 488b4f10 mov rcx,qword ptr [rdi+10h]

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: win32k!zzzWakeInputIdle+2854d3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 527ace4b

FAILURE_BUCKET_ID: X64_AV_win32k!zzzWakeInputIdle+2854d3

BUCKET_ID: X64_AV_win32k!zzzWakeInputIdle+2854d3

Followup: MachineOwner

There is really no definite information.
As you can see it was page fault in non paged area
and basically that means that some process be it a driver for something or a system process, tried to read from memory at the wrong level.

It could be bad ram, but that is rather unlikely - I think

Go to the HP site and using the info on this link
http://h10025.www1.hp.com/ewfrf/wc/...n&lc=en&os=4132&product=5400031&sw_lang=#N598

run the short tests and then if anything is reported as amiss run the extensive test
USE this series of tests
Testing using HP PC Hardware Diagnostics UEFI


----------



## mheaney14 (Feb 25, 2014)

Okay, I ran those tests and they didn't find any errors.


----------



## Macboatmaster (Jan 15, 2010)

Sorry I have no other suggestions to offer
I think I remember you saying it was still under warrantry I suggest you contact HP and explain the problem and all that has been tried


----------



## mheaney14 (Feb 25, 2014)

Alright, well thank you for all your help.


----------



## Macboatmaster (Jan 15, 2010)

Sorry I could not solve it for you


----------



## mheaney14 (Feb 25, 2014)

No worries. You did everything you could.


----------



## Macboatmaster (Jan 15, 2010)

Thanks please do let me know how you go with it.
If the topic has been closed, although it will not be for sometime please send me a PM, as I will be interested to see the result


----------



## mheaney14 (Feb 25, 2014)

Sure thing, I'll keep you posted.


----------



## TerryNet (Mar 23, 2005)

Did you ever install the latest wireless driver from your PC manufacturer's web site? Or, better, install all the latest drivers (beginning with the chipset) from the PC manufacturer's web site?


----------



## Macboatmaster (Jan 15, 2010)

TerryNet

I was convinced at first it was the problem of the two AV programs

The computer originally had Norton on it, as the usual free trial.

The supplier installed Kapersky. He must have uninstalled Norton as there was no trace of it.

However mheaney14 installed AVG as well - so we had Kapersky and AVG

It crashed during the uninstallation of AVG

It later went to autochk and after the chkdsk on boot, it reported that a system restore was necessary
It was restored to an earlier point and then crashed again

That is only a summary, as it then would not boot to Windows and the only apparent solution was to refresh, as it would not even go to a restore point

After the refresh it of course went back to the free trial of Norton and it crashed again when that was uninstalled. However it then transpired that the free trial of Malwarebytes and Spybot were installed after the refresh and it crashed again when those were uninstalled.

Windows Defender was then used.

In summary it may well be a driver, but I have never seen such a sequence of events and such crash dumps from a driver issue.

Finally unless I am missing the obvious here is no chipset driver offered
HP ENVY 15 Notebook PC 15-j084ca
http://h10025.www1.hp.com/ewfrf/wc/...n&cc=us&dlc=en&sw_lang=&product=5400031#N1545

and a search on HP for that computer simply refers you to the Intel, AMD or Nvidia sites but not with mention of 8/8.1

*mheaney14*
I did suggest that you went to the HP site and checked your drivers installed against those offered, but I seem to remember that it crashed at that point and that was when you had to go to a restore point.

My colleagues suggestion is now I reflect on it, certainly worthy of another try.
If however it crashes again and you can only get out of it with a system restore, I would progress the warrantry referral to HP


----------



## mheaney14 (Feb 25, 2014)

Okay, come to think of it I don't think I did try to install the drivers from the website again after the restore. I have re installed the drivers now. So far, it hasn't crashed but that doesn't mean anything yet. I'll let you know if it crashes again after that.


----------



## mheaney14 (Feb 25, 2014)

Alright, it crashed again. This time was kind if weird though. I wasnt able to make out an error message this time though. It looked like it crashed to the normal blue screen but it was all pixelatd and distorted then it rebooted again like normal.


----------



## TerryNet (Mar 23, 2005)

Not having the knowledge or patience to read those dump logs I sometimes learn something on my own systems using BlueScreenView.

And once the following was a pretty big help to me ...

In the Windows 8 Start screen type *reliability*, click _Settings_, and then select _View Reliability History_. In the resulting chart if you click a column you'll see additional detailed text below. Perhaps there will be some useful information here.


----------



## mheaney14 (Feb 25, 2014)

Okay, I used BlueScreenView and it looks like what is causing the problem in almost all cases is the driver ntoskrnl.exe and occasionally netr28x.sys. Apparently netr28x.sys has to do with my wireless adapter driver so i Uninstalled that and re installed the newest one. I am having trouble finding a definitive answer as to what I can do about the ntoskrnl.exe issue though. Do you guys have any suggestions?


----------



## TerryNet (Mar 23, 2005)

See if the laptop manufacturer offers a BIOS (or maybe I should say UEFI) firmware update for your machine.

Test your RAM with several passes of Memtest86+.

And assuming we haven't made any progress I'm now with Macboatmaster and his post # 41.


----------



## mheaney14 (Feb 25, 2014)

Alright, I have already updated the BIOS but I will definitely give Memtest a try. Thanks for all the help.


----------



## Macboatmaster (Jan 15, 2010)

You are right re the netr28 it is I think the Ralink wireless driver
I see there are 5 I think it is wireless drivers for your computer
As previously mentioned you identify which you have from device manager OR use HP scan your computer = I would prefer the device manager route

re the NTOSKRNL
it is NT (windows type) Operating system Kernel

It does not mean that this was the cause of the crash it simply shows part of the route of the crash

There is nothing to be done by you in that direct respect

It would be included for many crashes be it the ram or the wireless driver


----------

