Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD when waking from sleep mode 0x80041003

13 Jan 2013   #1
lokizone

Windows 7 Home Premium 64bit
 
 
BSOD when waking from sleep mode 0x80041003

I've been trying to catch the various error codes at the blue screen, but haven't been quick enough. In the event viewer I see ID 10 event codes, but from what I read online they are not indicative of a serious problem. The BSODs seem to be associated with windows 7 waking from sleep. I have been researching that all morning, and I believe my system is set up correctly. I use S3 mode as far as I can tell. This is a brand new computer build, and my first time, so I wouldn't be surprised if I'm missing something. I really like the trouble shooting, and especially utilizing the brain power online, so I appreciate any help that can be offered.

I finally captured a stop message.
STOP: 0x000000F4 (0x000000000000003, 0xFFFFFA800B938B30, 0xFFFFFA800B938E10, 0xFFFFF80002F80460)


My System SpecsSystem Spec
.
14 Jan 2013   #2
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

Welcome and thank you for choosing SevenForums.

A number of your .dmp files come with bug check code F4, often relates to hard drive issues.

I note you have a SSD.
Code:
Model INTEL SSDSC2CT240A3
Please do the following:
Quote   Quote: Originally Posted by writhziden View Post

If you have an SSD, make sure the following are up to date:
  • SSD firmware
  • BIOS Version
  • Chipset Drivers
  • Hard disk controller drivers/SATA drivers
  • If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.
Norton tends to cause BSOD-s. I would recommend uninstalling it with the Norton Removal Tool and replace with Microsoft Security Essentials To Test.
You may install it back if it is not the cause of your BSOD-s.

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-
warning   Warning
Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Get the latest version for Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver) installed.
Click on the Start ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to "Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver)" and reboot the system. Delete remnants of its drivers/older drivers using Driver Sweeper.

Drivers - Clean Left over Files after Uninstalling

Link & description: http://www.carrona.org/drivers/driver.php?id=MBfilt64.sys


Perform a System File Check:
  1. Click on the start
  2. Type CMD on Search
  3. Left click and Run as Administrator
  4. Type SFC /scannow
Full tutorial here:Disk Check on your hard drive for file system errors and bad sectors on it:Reduce items at start-up. Nothing except anti-virus is required: BSOD Report
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {40, 2, 1, fffff80002ce2468}
*** WARNING: Unable to verify timestamp for MBfilt64.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt64.sys
Probably caused by : MBfilt64.sys ( MBfilt64+1817 )
Followup: MachineOwner
---------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, fffffa8009ea0520, fffffa8009ea0800, fffff80002fd2460}
----- ETW minidump data unavailable-----
Probably caused by : wininit.exe
Followup: MachineOwner
---------
Hope this helps.
My System SpecsSystem Spec
14 Jan 2013   #3
lokizone

Windows 7 Home Premium 64bit
 
 

Thank you so much. I will hopefully get a chance to work on this tonight after work. I actually got another BSOD this morning after turning it on from a complete shut down. Some differences, but mostly F4 again.
STOP: 0x000000F4 (0x000000000000003, 0xFFFFFA800BCF4B30, 0xFFFFFA800BCF4E10, 0xFFFFF800031D4460)
My System SpecsSystem Spec
.

14 Jan 2013   #4
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

Look forward to your results.
My System SpecsSystem Spec
15 Jan 2013   #5
lokizone

Windows 7 Home Premium 64bit
 
 

Ok, so I performed most of your suggestions last night.

SSD firmware is latest, BIOS is back one as suggested due to boot up issues in Windows 7. The new BIOS is optimized for Windows 8, and apparently causes a slow boot up. Chipset and hard disk drivers are latest according to Intel; no Marvell devices.
Norton was removed and Windows Security essentials was installed. I opted not to do the Malwarebytes at this time as my computer is so new and has barely anything on it.
Startup folder is empty.
Disk check, SFC and Memory test all found nothing.

I unplugged all of the other SATA devices while I was doing most of this, so I was only dealing with the SSD. I pulled one of the memory sticks as well. For a while, I was thinking that the removal of Norton was helping. I was able to recover from sleep mode three times throughout the night. When I woke the computer from sleep mode this morning, it worked for about 5 minutes, then when my back was turned it got another BSOD and restarted quickly, displaying the screen about windows not starting properly and asking me if I want to start in safe state or normally. I need to disable the quick reboot after BSOD.
I found a critical event for the kernel, and a bugcheck code. I will upload my dump files.

I don't have a ton of time to debug this as I have a new baby and wife who wanted me to buy another Dell. I did a lot of research yesterday at work and was convinced that the model of SSD I have, Intel 330, was the cause. Many complaints online about Sanforce controlled SSDs in general. I didn't need the SSD, but I splurged. I will feel really bad if that is the issue, but it may come down to me getting a newer HDD, or a more reputable SSD (which means more money).
My System SpecsSystem Spec
15 Jan 2013   #6
Vir Gnarus

Microsoft Community Contributor Award Recipient

Windows 7 64-bit
 
 

I'm afraid, my friend, that this is the case. Sandforce controllers - even on Intel brand SSDs (Intel is pretty solid brand) are unstable messes that cause a lot of trouble for many here at SF. Yours is no exception, as evident from the crashdumps, which all of them one way or another reported an issue dealing with disk I/O. One particularly interesting one was that it was reporting that the system was still trying to work on a file when a surprise removal occurred on the SSD. That means that the SSD suddenly just completely out and about stopped doing anything, and the system thought someone pulled it out! Of course, this could also mean that there's an issue with the cable. Reattach both ends for both data and power cables for your SSD to make sure they're sitting pretty. If you have a spare data cable, try that as well to make sure the cable itself just ain't bad. If none of that seems to work, then it's time to write this SSD as bad.

Don't let this experience sour your perspective on SSDs. There are a good number of reliable SSD brands and models out there, some of which are even sitting in enterprise environments on pure SSD-driven file servers! From my experience both on personal and enterprise level, Samsung has been the most reliable, with Intel and Crucial being close behind. OCZ and Rosewill are by far the worst contenders, and often you'll have to run through 3-5 of them before you get one that'll last you over a year. Of course, stay away from all Sandforce controller SSDs, and be aware that failure rate on even the best models still exists, albeit small (akin to a good model RAM stick or HDD). You don't really need the extra umph pushed out of Sandforce controllers or what OCZ has to offer; SSDs by design are already super fast enough, so risking an extra little speed for a large reduction in stability is not worth it.

Analysts:

As mentioned before, pretty much all crashdumps have stacks in the offending threads riddled with NTSTATUS error codes associated with file and disk-to-RAM I/O operations. The most curious one is the surprise removal one, shown here:

Code:
Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc50070450, ffffffffc0000056, c50c880, fffff8a00e08a000}

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36bea )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc50070450, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000056, error status (normally i/o status code)
Arg3: 000000000c50c880, current process (virtual address for lock type 3, or PTE)
Arg4: fffff8a00e08a000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

ERROR_CODE: (NTSTATUS) 0xc0000056 - A non close operation has been requested of a file object with a delete pending.

BUGCHECK_STR:  0x7a_c0000056

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f3a552 to fffff80002eccfc0

STACK_TEXT:  
fffff880`035fbd98 fffff800`02f3a552 : 00000000`0000007a fffff6fc`50070450 ffffffff`c0000056 00000000`0c50c880 : nt!KeBugCheckEx
fffff880`035fbda0 fffff800`02ef3cbf : fffffa80`0d7b4e90 fffff880`035fbed0 fffff800`030ff600 fffffa80`067ad660 : nt! ?? ::FNODOBFM::`string'+0x36bea
fffff880`035fbe80 fffff800`02eda589 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000003 : nt!MiIssueHardFault+0x28b
fffff880`035fbf10 fffff800`02f35a46 : 00000000`00000000 fffff8a0`0e08a000 fffffa80`0d89cd00 00000000`00000000 : nt!MmAccessFault+0x1399
fffff880`035fc070 fffff800`031680cb : fffffa80`0d89cd50 00000000`00000000 00000000`0008c081 fffffa80`0d89cd50 : nt! ?? ::FNODOBFM::`string'+0x2a8d0
fffff880`035fc140 fffff800`02e9a52b : fffffa80`0d89cdd0 00000000`00000000 fffffa80`0d89cdd0 fffffa80`0d89cdd0 : nt!MiSegmentDelete+0x7b
fffff880`035fc180 fffff800`02e9ac52 : 00000000`00000000 00000000`00000011 00000000`00000000 fffff880`01639200 : nt!MmPurgeSection+0x71b
fffff880`035fc270 fffff880`016a5817 : fffffa80`0c64fc88 00000000`00000000 00000000`00000000 fffffa80`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`035fc2e0 fffff880`017a59e2 : fffffa80`07e96730 fffffa80`0d180180 00000000`00000000 fffff880`017a5901 : Ntfs!NtfsFlushVolume+0x5fb
fffff880`035fc410 fffff880`016fbdcc : fffff980`10290f68 fffffa80`0d180180 fffffa80`0d180180 fffff800`02e4e000 : Ntfs!NtfsPerformSurpriseRemoval+0x32
fffff880`035fc460 fffff880`016fcaec : fffffa80`07e96730 fffff880`035fc5e8 fffff880`035fc5f0 00000000`00000001 : Ntfs!NtfsCommonPnp+0x7eb
fffff880`035fc540 fffff800`0336fc16 : fffff980`10290c10 00000000`00000000 00000000`00000001 fffffa80`07e96730 : Ntfs!NtfsFsdPnp+0x1f0
fffff880`035fc5e0 fffff880`0146cbcf : fffff980`10290fb0 fffff880`035fc680 fffffa80`0c3a6350 fffffa80`0cd1f0e0 : nt!IovCallDriver+0x566
fffff880`035fc640 fffff880`0146b6df : fffffa80`0d88f1e0 fffffa80`0d88f1e0 fffffa80`0d88f100 fffff980`10290c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`035fc6d0 fffff800`0336fc16 : fffff980`10290c10 00000000`00000002 00000000`c00000bb fffff880`035fc848 : fltmgr!FltpDispatch+0xcf
fffff880`035fc730 fffff800`031338d9 : fffffa80`0d88f1e0 00000000`c00000bb fffff880`035fc848 fffffa80`0e81a820 : nt!IovCallDriver+0x566
fffff880`035fc790 fffff800`032b31e1 : fffffa80`0850a8e0 fffffa80`0d180030 fffffa80`0852b840 fffffa80`0850a8e0 : nt!IopSynchronousCall+0xc5
fffff880`035fc800 fffff800`032adbd8 : 00000000`00000010 fffffa80`0850a8e0 00000000`0000030a 00000000`00000308 : nt!IopRemoveDevice+0x101
fffff880`035fc8c0 fffff800`032b2d27 : fffffa80`0852b840 00000000`00000000 00000000`00000003 00000000`000007ff : nt!PnpSurpriseRemoveLockedDeviceNode+0x128
fffff880`035fc900 fffff800`032b2e40 : 00000000`00000000 fffff8a0`12fa1100 fffff8a0`03208760 fffff880`035fca58 : nt!PnpDeleteLockedDeviceNode+0x37
fffff880`035fc930 fffff800`0334379f : 00000000`00000002 00000000`00000000 fffffa80`0852b840 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0xa0
fffff880`035fc9a0 fffff800`0334435c : fffff880`035fcb78 00000000`00010200 fffff880`035fcb00 00000000`00000000 : nt!PnpProcessQueryRemoveAndEject+0x6cf
fffff880`035fcae0 fffff800`0322d5ce : 00000000`00000000 fffffa80`0bfe7310 fffff8a0`12fa1120 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0x4c
fffff880`035fcb10 fffff800`02ed6641 : fffff800`03132768 fffff8a0`12fa1120 fffff800`0306a2d8 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x5ab9b
fffff880`035fcb70 fffff800`03163e5a : 00000000`00000000 fffffa80`067ad660 00000000`00000080 fffffa80`0678a040 : nt!ExpWorkerThread+0x111
fffff880`035fcc00 fffff800`02ebdd26 : fffff880`033d7180 fffffa80`067ad660 fffff880`033e1fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`035fcc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36bea
fffff800`02f3a552 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36bea

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x7a_c0000056_VRF_nt!_??_::FNODOBFM::_string_+36bea

BUCKET_ID:  X64_0x7a_c0000056_VRF_nt!_??_::FNODOBFM::_string_+36bea

Followup: MachineOwner

Evidently, what was going on was that a surprise removal occurred (a device unexpectedly disconnected) and the system is trying to complete the I/O typically responsible for cleaning up after an ejected device. However, during that, a c0000056 error occurred, meaning that during a file deletion (most likely deleting the device object representing the physical drive) the system tried to perform something on the same object that wasn't deletion-related. I can't dive further in the minidump to figure it out, but I speculate what happened is the drive both 'ejected' and returned in such quick succession - most likely a spontaneous connection loss - that the system was trying to work with the device object that was still pending deletion from supposed ejection! Again, minidump can't tell further, but that's what I figure.
My System SpecsSystem Spec
15 Jan 2013   #7
lokizone

Windows 7 Home Premium 64bit
 
 

I will try a couple of other SATA cables I have, and recheck the power. The nice thing about the SSD is the size, and how it sits in the HDD tray; all of the cables are easy to tuck out of the way, but I will definitely check. During my original parts researching, I was building around the Samsung 830. The only reason I got the Intel was a cyber monday deal, and it was twice the size. I didn't get a chance to do my homework as I had with the samsung. I will work on this, possibly even installing the OS on one of the 500gb HDDs in my system, but I fear the Intel SSD is the issue. The Samsung 830 is hard to find these days, and the non pro version of the 840 doesn't seem to be up to par, so that means the 840 pro is probably what I will get. What about the Plextor m5 pro? I've read good things about the Marvell controlled SSD.

Thanks for taking the time to read and respond to my post. I really appreciate it.
My System SpecsSystem Spec
15 Jan 2013   #8
Vir Gnarus

Microsoft Community Contributor Award Recipient

Windows 7 64-bit
 
 

I've had off and on experiences with Marvell, both dealing with those here at SF and personally. It's nowhere neeeear as bad as Sandforce, but there definitely is a noticeable difference between it and Intel controllers. I wouldn't mind it on a usual personal SSD purchase, but if I've already ran across a bad one that I've been fussing with like what you've already experienced, I wouldn't want to risk it a second time and just go for an Intel controller drive.
My System SpecsSystem Spec
17 Jan 2013   #9
lokizone

Windows 7 Home Premium 64bit
 
 

I ran memtest on my system last night for 12 passes with no issues. I am using a different SATA cable for the SSD, removed a molex to sata adapter I was using to power the SSD and plugged it into a SATA connector from the PSU. I reconfigured the power settings to never power down the SSD. I removed IRST from the computer.
I discoverd the diagnostic tools and ran the system health report only to find an AntiLog32.sys error. From what I can tell it's from the Norton program I installed and later removed, so I went into the registry and deleted all Norton related items I could find. I've been on the computer for about two hours now without any issues. It just seems to have problems with the sleep and start up operations. Still showing F4 bug check, so I will probably try installing the OS on a normal HDD this weekend to see if that works.
My System SpecsSystem Spec
17 Jan 2013   #10
Vir Gnarus

Microsoft Community Contributor Award Recipient

Windows 7 64-bit
 
 

Still caused by more disk errors.

Btw, since this is concerning sleep specifically, have you disabled hibernation? Go into command prompt and type powercfg -h off then restart the system, then see if there's issues regarding sleep still. The SSD may just not like hibernating at all. In fact, it's advised you don't user hibernate for any SSD, given that it will unnecessarily reduce the lifespan of the SSD.
My System SpecsSystem Spec
Reply

 BSOD when waking from sleep mode 0x80041003




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
BSOD Waking UP From Sleep Mode
Hi, as the title says ive been having repeated problems with Sleep Mode, i have set ACPI Standby State to S3 & there are no overclocking settings enabled, it could be related to my hardrive, i have three with one being an SSD (Samsung 840 Pro 128gb) that has the OS, (Samsung HD103SJ) & (Samsung...
BSOD Help and Support
BSOD while waking from sleep mode
After running the log collector program, here is the zip file it produced. Please help me find what caused this.
BSOD Help and Support
Getting BSOD after waking up my notebook from sleep mode
Hi all. Im new here. Today while i left the house i turned my Asus K52F notebook into Sleep mode. After a few hours i came back and wanted to continue my unfinished job but i get the Startup repair screen. I started it in normal mode and i found out what happened. I started googling and i...
BSOD Help and Support
BSOD upon waking up from sleep mode
Hello, I keep getting BSODs when my computer wakes up from sleep mode. It doesn't happen every time, but it does seem to be more likely if the computer has been asleep for a long time, say overnight. This happened a few months ago, and I posted to this forum, which helped me fix it. Everything...
BSOD Help and Support
BSOD after waking from sleep mode
Hello all, I'm having a headache of a time trying to keep my computer from re-booting after sleep mode. My computer wakes but goes directly to BSOD. I used the app Bluescreenview and it points to this file ntoskrnl.exe generating this this bug check string: (IRQL_NOT_LESS_OR_EQUAL, ...
BSOD Help and Support
BSOD waking from sleep mode
I just built a new computer: Since first fired up it blue screens every time it comes out of sleep mode. I've checked all my drivers and all report being up to date. Currently I have sleep mode turned off and the computer is running reliably. I've attached the required files. Thanks...
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 13:32.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App