locked
BSOD Vista x64 After Waking from Sleep RRS feed

  • Question

  • Hi. I recently re-installed my OS after purchasing a new MB (ASUS P8277-M LGA 1155). I in stalled a fresh (/mbr format) copy of WIN Vista x64. After my computer awakens from sleep mode a BSOD occurs. I've tried troubleshooting the issue with winDBg; however, I cannot resolve the issue. The output from my dump file is below. Please let me know the next steps I should take to resolve this issue.

    Thanks,
    Chris

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\Mini021214-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 6002.18881.amd64fre.vistasp2_gdr.130707-1535
    Machine Name:
    Kernel base = 0xfffff800`01c15000 PsLoadedModuleList = 0xfffff800`01dd9e30
    Debug session time: Wed Feb 12 19:04:50.893 2014 (UTC - 6:00)
    System Uptime: 0 days 10:27:05.946
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...............
    Loading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck F4, {3, fffffa800c74a710, fffffa800c74a948, fffff80001ea5870}

    Probably caused by : csrss.exe

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    CRITICAL_OBJECT_TERMINATION (f4)
    A process or thread crucial to system operation has unexpectedly exited or been
    terminated.
    Several processes and threads are necessary for the operation of the
    system; when they are terminated (for any reason), the system can no
    longer function.
    Arguments:
    Arg1: 0000000000000003, Process
    Arg2: fffffa800c74a710, Terminating object
    Arg3: fffffa800c74a948, Process image file name
    Arg4: fffff80001ea5870, Explanatory message (ascii)

    Debugging Details:
    ------------------


    PROCESS_OBJECT: fffffa800c74a710

    IMAGE_NAME:  csrss.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    MODULE_NAME: csrss

    FAULTING_MODULE: 0000000000000000 

    PROCESS_NAME:  csrss.exe

    EXCEPTION_CODE: (NTSTATUS) 0x114adbb0 - <Unable to get error code text>

    BUGCHECK_STR:  0xF4_114ADBB0

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    CURRENT_IRQL:  0

    STACK_TEXT:  
    fffffa60`023421a8 fffff800`01f6cb63 : 00000000`000000f4 00000000`00000003 fffffa80`0c74a710 fffffa80`0c74a948 : nt!KeBugCheckEx
    fffffa60`023421b0 fffff800`01f1c380 : fffffa80`114adbb0 fffffa80`114adbb0 fffffa60`02342c20 fffffa60`02342a40 : nt!PspCatchCriticalBreak+0x93
    fffffa60`023421f0 fffff800`01ec2a98 : fffffa80`114adbb0 00000000`00000008 fffffa60`02342c20 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x103a6
    fffffa60`02342240 fffff800`01c6bbf3 : fffffa80`0c74a710 fffffa80`114adbb0 fffffa60`02342320 fffffa60`02342c20 : nt!NtTerminateProcess+0xd8
    fffffa60`023422a0 fffff800`01c6c100 : fffff800`01cce59d fffffa60`02342b78 fffffa60`02342ca0 fffffa60`02342c20 : nt!KiSystemServiceCopyEnd+0x13
    fffffa60`02342438 fffff800`01cce59d : fffffa60`02342b78 fffffa60`02342ca0 fffffa60`02342c20 00000000`014915a0 : nt!KiServiceLinkage
    fffffa60`02342440 fffff800`01c6bfa9 : fffffa60`02342b78 00000000`00005d2c fffffa60`02342c20 00000000`01491ba8 : nt! ?? ::FNODOBFM::`string'+0x2942c
    fffffa60`02342a40 fffff800`01c6ada5 : 00000000`00000000 fffffa60`02342ca0 00000000`00000001 00000000`00005d2c : nt!KiExceptionDispatch+0xa9
    fffffa60`02342c20 00000000`7767320e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x1e5
    00000000`014914c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7767320e


    STACK_COMMAND:  kb

    FOLLOWUP_NAME:  MachineOwner

    FAILURE_BUCKET_ID:  X64_0xF4_114ADBB0_IMAGE_csrss.exe

    BUCKET_ID:  X64_0xF4_114ADBB0_IMAGE_csrss.exe

    Followup: MachineOwner
    ---------

    Thursday, February 13, 2014 4:36 AM

Answers

  • cperry11

    9 of 11 were related to memory corruption.  Please run these 2 tests

    *

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these tests to verify your memory and find which driver is causing the problem.  

    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you dont know what it is you probably are not overclocking.

    1-Memtest. (You can read more about running memtest here)
    Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Get it here
    Boot from the CD, and leave it running for at least 5 or 6 passes.
    Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.
    Test the sticks individually, and if you find a good one, test it in all slots.

    If a known good stick fails in one motherboard slot but not another it is probably the slot.


    2-Driver verifier (for complete directions see our wiki here)

    Using Driver Verifier is an iffy proposition.
    Most times it will crash and it will tell you what the driver is, but sometimes it will crash and won't tell you the driver.
    Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

    I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise.
    Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

    Here is the procedure:

    Go to Start and type in "verifier" (without the quotes) and press Enter
    Select "Create custom settings (for code developers)" and click "Next
    Select "Select individual settings from a full list" and click "Next"
    Select everything EXCEPT FOR "Low Resource Simulation" 
    For Win 8 dont check Concurrency stress test, and DDI compliance checking click "Next"
    Select "Select driver names from a list" and click "Next"
    Then select all drivers NOT provided by Microsoft and click "Next"
    Select "Finish" on the next page.

    Reboot the system and wait for it to crash to the Blue Screen.

    Continue to use your system normally, and if you know what causes the crash, do that repeatedly. 
    The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. 
    If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

    If you can't get into Windows because it crashes too soon, try it in Safe Mode.
    If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
    Co-Authored by  JMH3143


    Wanikiya and Dyami--Team Zigzag

    Saturday, February 15, 2014 9:50 PM
    Moderator

All replies

  • We DO need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  
    We prefer at least 2 DMP files to spot trends and confirm the cause.

    Please follow our instructions for finding and uploading the files we need to help you fix your computer.

    They can be found here

    If you have any questions about the procedure please ask

    Advice offered in good faith. It is your decision to implement same. Wanikiya and Dyami - Team ZigZag

    Thursday, February 13, 2014 4:48 AM
  • Thanks for replying back. I really appreciate it.

    I've uploaded dumps (10), system, and hardware info to http://1drv.ms/1btYAae

    Please let me know if you need anything else.

    Thanks again,
    Chris

    Friday, February 14, 2014 5:20 AM
  • Chris,

    1. Please run a system file check (SFC)
    All instructions are in our Wiki article below...
    Should you have any questions please ask us.
    System file check (SFC) Scan and Repair System Files *

    *

    2. Next download the free version of Malwarebytes.
    Update it immediately.
    Do a full system scan
    Let us know the results at the end.
    http://www.malwarebytes.org/products


    Advice offered in good faith. It is your decision to implement same. Wanikiya and Dyami - Team ZigZag


    Friday, February 14, 2014 6:57 AM
  • Thanks for the reply. I've run  sfc /scannow in the past; however, I didn't save the information. I will run the utility three times and provide you with the output from each run. Additionally, I'll provide output from the malware scan.

    I'll provide the information after 9p CST. Does your team troubleshoot and respond on weekends? Also, what is the early analysis of the dmp files?

    Thanks,
    Chris

    Friday, February 14, 2014 3:11 PM
  • I'll provide the information after 9p CST. Does your team troubleshoot and respond on weekends?

    Also, what is the early analysis of the dmp files?


    Hello Chris again,

    *

    1.People seeking help can rest assured that this Forum is active on a daily basis.

    But please appreciate that most of us are volunteers who donate our time helping people such as yourself. We too have real lives, families & work that must be attended to.

    *

    2.Your BSOD analysis indicates BugCheck F4,                                                                               & probably caused by : csrss.exe                                                     
    This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.



    Advice offered in good faith. It is your decision to implement same. Wanikiya and Dyami - Team ZigZag


    Friday, February 14, 2014 9:35 PM
  • Morning.

    I ran /scannow three times and the result each time was "Windows Resource Protection did not find any integrity violations."

    I also ran a full scan of my HD with Malwarebytes and the application found a few issues. I've uploaded the log to SkyDrive http://1drv.ms/1cII9kT 

    Of major concern to me is the registry issue, which I'm researching now. What are you thoughts on the output?

    And thanks for volunteering!!!

    Chris

    Saturday, February 15, 2014 4:22 PM
  • So I removed a program called "Spigot" then ran Malwarebytes again and it returned 0 infections. I then put the computer in to sleep mode. Upon awaking the PC returned a BSOD. The fie causing the issue this go around was for pci.sys. I've uploaded the new dump file to Skydrive http://1drv.ms/1bU2zr7 
    Saturday, February 15, 2014 6:53 PM
  • cperry11

    9 of 11 were related to memory corruption.  Please run these 2 tests

    *

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these tests to verify your memory and find which driver is causing the problem.  

    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you dont know what it is you probably are not overclocking.

    1-Memtest. (You can read more about running memtest here)
    Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Get it here
    Boot from the CD, and leave it running for at least 5 or 6 passes.
    Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.
    Test the sticks individually, and if you find a good one, test it in all slots.

    If a known good stick fails in one motherboard slot but not another it is probably the slot.


    2-Driver verifier (for complete directions see our wiki here)

    Using Driver Verifier is an iffy proposition.
    Most times it will crash and it will tell you what the driver is, but sometimes it will crash and won't tell you the driver.
    Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

    I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise.
    Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

    Here is the procedure:

    Go to Start and type in "verifier" (without the quotes) and press Enter
    Select "Create custom settings (for code developers)" and click "Next
    Select "Select individual settings from a full list" and click "Next"
    Select everything EXCEPT FOR "Low Resource Simulation" 
    For Win 8 dont check Concurrency stress test, and DDI compliance checking click "Next"
    Select "Select driver names from a list" and click "Next"
    Then select all drivers NOT provided by Microsoft and click "Next"
    Select "Finish" on the next page.

    Reboot the system and wait for it to crash to the Blue Screen.

    Continue to use your system normally, and if you know what causes the crash, do that repeatedly. 
    The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. 
    If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

    If you can't get into Windows because it crashes too soon, try it in Safe Mode.
    If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
    Co-Authored by  JMH3143


    Wanikiya and Dyami--Team Zigzag

    Saturday, February 15, 2014 9:50 PM
    Moderator
  • Hi again Chris,

    Based on the analysis of your latest DMP files ZigZag3143 would have recommended the appropriate steps to take.

    {FYI... ZigZag3143 is one of the best & brightest in the BSOD area & certainly is respected as such.}

    It is of course your decision, or not, to follow the advice given.


    Advice offered in good faith. It is your decision to implement same. Wanikiya and Dyami - Team ZigZag


    Sunday, February 16, 2014 7:08 AM
  • There were no memory issues.

    I did the driver verification and have uploaded a new dmp. http://1drv.ms/1bCM0Wh
    The driver verification has been running over 24 hours and no fault injects have occurred

    I can always get the system to BSOD by putting the PC in sleep mode then waking the machine.


    • Edited by cperryiii Monday, February 17, 2014 1:50 AM
    Sunday, February 16, 2014 11:24 PM
  • Cperryiii

    Driver verifier does not appear to be enabled in the latest dmp.  YOU can verify it by typing verifier /query.  If enabled there will be a list of drivers.  If there is not it is not enabled/


    Wanikiya and Dyami--Team Zigzag

    Monday, February 17, 2014 7:01 PM
    Moderator
  • Strange. Because "fault injects" were 0 and all Pool Allocations passed. I will restart verifier then crash the system. 
    Monday, February 17, 2014 9:02 PM
  • I started verifier again....then since I can always recreate the BSOD (by putting the computer to sleep then waking it) I manually caused the BSOD. I've uploaded before and after BSOD screenshots of verifier. Additionally, the new dump file has been uploaded. http://1drv.ms/Mtnrzl 
    • Edited by cperryiii Monday, February 17, 2014 9:43 PM
    Monday, February 17, 2014 9:42 PM
  • Cperryiii

    This one had verifier enabled but it didn't catch the driver I would change the set being examined to "all" as that will give us a bet shot at finding it


    Wanikiya and Dyami--Team Zigzag

    Tuesday, February 18, 2014 4:12 PM
    Moderator
  • Sounds good. I'll give it a try this evening.
    Tuesday, February 18, 2014 4:21 PM
  • As recommended, I turned on all drivers within verifier and have uploaded the dmp file to Skydrive http://1drv.ms/Mxspeh
    Wednesday, February 19, 2014 2:16 AM
  • Any new suggestions?
    Saturday, February 22, 2014 9:36 PM
  • Chris

    While verifier was enabled it didnt "catch" the driver.  I would suggest you change the drivers being verified to "all" drivers.

    Currently (thought not caught) the crash seems to be related to a critical OS process being terminated.  As such I would run a system file check if you haven't already.

    Please run a system file check (SFC)

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.



    Wanikiya and Dyami--Team Zigzag

    Monday, February 24, 2014 12:32 PM
    Moderator
  • Verifier was set to "all" drivers as previously suggested.

    I ran SFC before I posted to the forum. There were no issues.

    Monday, February 24, 2014 2:51 PM
  • Chris

    You may be better off doing a clean reinstall of the OS.  There is something causing the critical process to die and since verifier {all} didnt "catch" it and sfc didnt show anything there is little we can do except to do a clean boot and add drivers back until it crashes.


    Wanikiya and Dyami--Team Zigzag

    Monday, February 24, 2014 5:09 PM
    Moderator
  • Chris,

    I agree with the advice given by Zigzag.

    IMHO by far the quickest & neatest way to have your computer up & running would be to do a clean reinstall.

    Test all is well  BEFORE adding "stuff" you had before.

    This can be less "messy" than trying to correct problems you currently are experiencing.

    Good luck!


    Advice offered in good faith. It is your decision to implement same. Wanikiya and Dyami - Team ZigZag


    Monday, February 24, 2014 10:39 PM
  • I appreciate the advice but I actually did two clean installs prior to posting to the forum
    Monday, February 24, 2014 11:14 PM
  • Chris

    And it started to exhibit this problem before you added anything not in the Windows Vista DVD?  Or did it start after you added malware, a video driver, etc?

    If you cant wake from sleep in a COMPLETELY vanilla installation it is either a driver for a device or hardware.  Often video drivers cause this issue. 


    Wanikiya and Dyami--Team Zigzag

    Tuesday, February 25, 2014 1:50 AM
    Moderator
  • Good question. I cannot recall when it began; however, it was definitely prior to installation of the mal-ware application. From the research I did prior to posting on the forum I suspected the video card drivers or anti-virus software as one of the culprit so I uninstalled the aforementioned programs.......when the video card drivers were not installed my PC no longer had the option to "sleep". So I was never really able to test whether the video card drivers were the issue. Thoughts? 
    Tuesday, February 25, 2014 2:26 AM
  • Chris

    The video driver is very often related to the wake from sleep problem.  You need to try and separate the hardware/software issues.

    If you do a completely vanilla install (with nothing, absolutely nothing) that isn't on the dvd it points to hardware.  DO the clean install, reboot, then sleep>>wake.  Does it Crash?

    Then add the video driver sleep>wake>>crash?  YOu might also want to try a new video card.


    Wanikiya and Dyami--Team Zigzag

    Tuesday, February 25, 2014 3:31 AM
    Moderator
  • I'm thinking a new video card.

    when i do a clean install "sleep" isn't an option until i install the video card

    Tuesday, February 25, 2014 3:52 AM