Solved BSOD after waking from sleep

[bcd127]

Good day everyone. The BSOD keeps coming up when I wake my laptop from sleep. I'm not sure why. It has just recently started. I'm not sure, but it may only be when its on battery. I've done tons of research and i dont know what to do now. I ran sfc /scannow several times. All times it found corrupt files, but could not repair them. I would love to post the Cbs.log, but for some reason it won't let me. Please, if there is any help you can give, it would be of great value. Let me know if there is anything else i need to tell you. Thanks in advance.

 

[bcd127]

Found it

 

[YoYo155]

Hello welcome to SF .
Please run another instance of the SFDT and upload a new .zip as some files are missing from
the one you have uploaded.

 

[bcd127]

Hopefully this will do it. Sorry about that!

 

[YoYo155]

That will do .


The bugcheck you're experiencing are due to an anti-virus driver:

IRQL_NOT_LESS_OR_EQUAL (a)

Arguments:
Arg1: [COLOR=Blue][U][B]0000000000000088[/B][/U][/COLOR], memory referenced
Arg2: 000000000000000[COLOR=Red][U][B]2[/B][/U][/COLOR], IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003061626, address which referenced memory

• An attempt was made to access a pageable (or completely invalid) address at an
  interrupt request level (IRQL) that is too high. This is usually
  caused by drivers using improper addresses.

By calling the RAW stack we can see the culprit:

fffff880`08bb9128  fffff880`0130e6b2 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xc6b2
fffff880`08bb9498  fffff880`0130886f [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0x686f
fffff880`08bb9598  fffff880`0130ea91 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xca91
fffff880`08bb9620  fffff880`0130e6a0 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xc6a0
fffff880`08bb9648  fffff880`0130ef40 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xcf40
fffff880`08bb96d0  fffff880`0130ad30 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0x8d30
fffff880`08bb96f8  fffff880`0130f102 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xd102
fffff880`08bb9798  fffff880`0130f241 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xd241
fffff880`08bb97d8  fffff880`0131060b [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xe60b
fffff880`08bb9808  fffff880`0130ada1 [COLOR=Red][B][U]WRkrn[/U][/B][/COLOR]+0x8da1
fffff880`08bb9848  fffff880`01310c85 [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xec85
fffff880`08bb9898  fffff880`01310d5c [COLOR=Red][U][B]WRkrn[/B][/U][/COLOR]+0xed5c

• Driver Reference Table - WRkrn.sys

This driver belongs to Webroot SecureAnywhere Anti-virus.

\Programs\Webroot SecureAnywhere

Remove the program using Revo Uninstaller:

   Information

• :info: Download and install Revo Uninstaller free from here: Download Revo Uninstaller Freeware

• Uninstall the software using the Advanced Mode option and when prompted delete the leftover registry keys.

Download and install Microsoft Security Essentials as an alternative.

​

Post back with the results .

 

[bcd127]

Seems to be great right now! I will know for sure tomorrow and will update you then.

 

[YoYo155]

Good
Leave this thread open for a couple of days, if all goes well mark it as solved.

 

[bcd127]

No luck. Still doing the same thing

 

[YoYo155]

Run the SFDT again and upload the newly generated .zip .

 

[bcd127]

Here is the file. I defragged the computer and removed the program and it was working great last night. Not so much now.

 

[YoYo155]

Did you uninstall the software as suggested?

Use !analyze -v to get detailed debugging information.

BugCheck A, {88, 2, 1, fffff8000306e626}

*** WARNING: Unable to verify timestamp for WRkrn.sys
*** ERROR: Module load completed but symbols could not be loaded for [COLOR=Red][U][B]WRkrn.sys[/B][/U][/COLOR]
Probably caused by : tdx.sys ( tdx!TdxTdiDispatchInternalDeviceControl+36d )

Use !analyze -v to get detailed debugging information.

BugCheck A, {88, 2, 1, fffff800030a1626}

*** WARNING: Unable to verify timestamp for WRkrn.sys
*** ERROR: Module load completed but symbols could not be loaded for [COLOR=Red][U][B]WRkrn.sys[/B][/U][/COLOR]
Probably caused by : tdx.sys ( tdx!TdxTdiDispatchInternalDeviceControl+36d )

Runing Tasks:

wrsa.exe    c:\program files\webroot\wrsa.exe 
wrsa.exe    c:\program files\webroot\wrsa.exe

 

[bcd127]

Hmm. Now that i think about it. I did a reinstall of the webroot software instead of removing it. I figured it was just corrupt. But. I've noticed, it only happens while I am at school. And at school, I have to use the "guest" wifi. (long story short, the student one doesnt work) I thought maybe that it was a battery issue, but at home, there is no problem at all. But on the first start up at school, BSOD! Also, I have realized the first time it happen was actually during the first day of school. Is there any possible way the BSOD is caused by a reaction my antivirus is having with the school wifi? I will continue to do testing and post back with results. And by the way, Thank you very much for the help you have given me. It has been a huge help! and i will certainly uninstall it this time.

 

[YoYo155]

Hmm. Now that i think about it. I did a reinstall of the webroot software instead of removing it. I figured it was just corrupt. But. I've noticed, it only happens while I am at school. And at school, I have to use the "guest" wifi. (long story short, the student one doesnt work) I thought maybe that it was a battery issue, but at home, there is no problem at all. But on the first start up at school, BSOD! Also, I have realized the first time it happen was actually during the first day of school. Is there any possible way the BSOD is caused by a reaction my antivirus is having with the school wifi? I will continue to do testing and post back with results. And by the way, Thank you very much for the help you have given me. It has been a huge help! and i will certainly uninstall it this time.

Yes the software is probably bugging out when it detects its connected to an insecure
network and initiates a protocol which in turn calls a buggy driver which leads to the bugcheck.
I still recommend removing it entirely as of now it is more trouble than good.
Do post back with results .

 

[bcd127]

I was finally able to confirm that the BSOD was caused by webroot reacting to the school's internet. Thank you so much for all the help you gave me. Not once have I received such great help anywhere other than here. Again, thank you. This will now be marked as solved!

 

[YoYo155]

You're welcome, it's my pleasure .
Thank you for updating with a confirmation.