BSOD after resuming from sleep

[auutumn]

For months I had Win7 installed and running without any incidents; I was using Microsoft Security Essentials. The other day I installed Win8, decided I hated it, and reformatted/installed Win7. This time I tried Avast 7 Free and things looked good for a while until I woke up my PC from Sleep mode then it crashed.

I appreciate the help.

 

[Vir Gnarus]

Hi auutumn,

Is this a recurring incident? I did notice it only happened on time in the syslog. Sometimes solitary flukes can occur that can "correct" themselves. Have you been able to confirm that this is a repeated incident when you wake the system from sleep?

As for the crashdump, it reported that the process wininit.exe terminated unexpectedly. Wininit is a temporarily used process that exists to initiate some other processes (primarily the desktop sessions) before it lets others do the rest of the work for the duration of Windows. Typically if something bad happens to it, it's during startup of a desktop session (each user logged on is a desktop session).

The error that caused Wininit to cave in was an I/O error (c0000006), which means something ugly happened between your RAM and your disk (primarily the paging file on your disk). What exactly caused the issue I'm not sure, but it may very well be a hardware problem.

I personally would recommend doing hardware tests, starting with Seatools running all basic tests on the Windows drive, and then at least 7+ passes on your memory with Memtest. Links to the two applications are below.

| Seagate

www.memtest.org

 

[writhziden]

Problem Devices:

Marvell 91xx Config ATA Device	IDE\PROCESSORMARVELL_91XX_CONFIG_____________________1.01____\6&1B887581&0&1.1.0	The drivers for this device are not installed.

Antivirus Software:

avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	1524	8	200	1380	3/2/2012 10:44 AM	7.0.1407.0	43.72 KB (44,768 bytes)	3/2/2012 8:22 AM
avastui.exe	c:\program files\avast software\avast\avastui.exe	2952	8	200	1380	3/2/2012 10:44 AM	7.0.1407.0	3.84 MB (4,031,368 bytes)	3/2/2012 8:22 AM
msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	576	8	200	1380	3/2/2012 10:44 AM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 6:21 PM

Having two security programs that accomplish the same task can cause instability on the system.


Possible outdated drivers:

wdcsam64	fffff880`0624d000	fffff880`06250880	Wed Apr 16 02:39:08 2008 (4805bb2c)	0000d887		wdcsam64.sys
Rt64win7	fffff880`0ffc6000	fffff880`0fff8000	Thu Feb 26 02:04:13 2009 (49a65b0d)	0002eb30		Rt64win7.sys

wdcsam64.sys
Rt64win7.sys
Update both of the above drivers...

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\auutumn\Windows_NT6_BSOD_jcgriff2\030212-8268-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03051000 PsLoadedModuleList = 0xfffff800`03296670
Debug session time: Fri Mar  2 08:43:16.446 2012 (UTC - 7:00)
System Uptime: 0 days 0:21:39.446
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8007801b30, fffffa8007801e10, fffff800033d18b0}

Probably caused by : wininit.exe

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8007801b30, Terminating object
Arg3: fffffa8007801e10, Process image file name
Arg4: fffff800033d18b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa8007801b30

IMAGE_NAME:  wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  wininit.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

BUGCHECK_STR:  0xF4_IOERR

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`068f30e8 fffff800`034585e2 : 00000000`000000f4 00000000`00000003 fffffa80`07801b30 fffffa80`07801e10 : nt!KeBugCheckEx
fffff880`068f30f0 fffff800`0340599b : ffffffff`ffffffff fffffa80`07ca2b60 fffffa80`07801b30 fffffa80`07801b30 : nt!PspCatchCriticalBreak+0x92
fffff880`068f3130 fffff800`03385448 : ffffffff`ffffffff 00000000`00000001 fffffa80`07801b30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`068f3180 fffff800`030cced3 : fffffa80`07801b30 fffff800`c0000006 fffffa80`07ca2b60 00000000`009f0df0 : nt!NtTerminateProcess+0xf4
fffff880`068f3200 fffff800`030c9470 : fffff800`0311967f fffff880`068f3b78 fffff880`068f38d0 fffff880`068f3c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`068f3398 fffff800`0311967f : fffff880`068f3b78 fffff880`068f38d0 fffff880`068f3c20 00000000`ffe8b4d8 : nt!KiServiceLinkage
fffff880`068f33a0 fffff800`030cd2c2 : fffff880`068f3b78 00000000`00a70000 fffff880`068f3c20 00000000`ffe8fb88 : nt! ?? ::FNODOBFM::`string'+0x49874
fffff880`068f3a40 fffff800`030cbe3a : 00000000`00000000 00000000`ffe83900 00000000`00a4b001 00000000`00a70000 : nt!KiExceptionDispatch+0xc2
fffff880`068f3c20 00000000`77b18f55 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`009f13b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b18f55


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_IOERR_IMAGE_wininit.exe

BUCKET_ID:  X64_0xF4_IOERR_IMAGE_wininit.exe

Followup: MachineOwner
---------

A windows system process was terminated unexpectedly. Possible causes are hard disk errors... System file corruption... Viruses... Lack of Windows updates... Drivers...


To supplement the excellent advice given by Vir Gnarus:

• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
• Use HD Diagnostic to find your hard disk manufacturer and also to find the diagnostic tools provided by that manufacturer. Run all tests through those diagnostic tools to determine whether the hard disk is faulty.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

 

[vinitwins]

i was facing similar issues with my system (bugcheck/bsod on wake from sleep). took me a couple of days trying to pin down the error - ran memtest, seatools, chkdsk and other diagnostic tools but in the end managed to trace down the error to a faulty driver: microsoft's MSAHCI.SYS (6.1.7601.17514) - this driver has a known bug with large sata drives and wake from sleep bsods (cross-verified by installing windows on my trusty 2.5" 80gb sata hdd - which worked flawlessly with the stock msahci.sys driver!)

solution:
installed intel RST (rapid storage tech) drivers and the problem was resolved.

fyi my system specs:
1. i3-2100
2. intel bh67bl (h67 chipset rev b3)
3. 4gb corsair 1600mhz certified ram running @ default speed of 1333mhz
4. seagate 1tb 7200rpm hdd (ST1000DM003)

i hope this post helps anyone running high capacity sata drives in ahci mode (a bios setting) with windows 7 and experiencing wake from sleep bsods...

best,
vinit

 

[ArchaicWarrior]

Thanks Viniitwins, I'm having a similar problem and your findings will hopefully put me on the right track.

mobo Gigabyte P67A-UD5-B3.
240G SSD
2 x 1TB HDD in RAID

ive undated BIOS from F3 to F8 but haven't updated the drivers yet. I've gone to the Gigabyte site to download the drivers but am unsure which ones!?? i've got the latest sound drivers but there's 2 ? drivers for Chipset, not sure which to get plus there's 3 options for SATA drivers - Rapid, Marvel and something else. I know in the BIOS marvel is setup for the RAID so I think it's that one ????? confusing

Thanks again for typing out your findings, people do read them!

AW.

 

[Vir Gnarus]

Hi, if you wish to be assisted properly, it's probably best to start your own thread and link to this as reference. Please post your information as instructed here.

Your situation may be similar to what vinitwins explained, but every case should be treated independently as there's a vast number of variables involved that can alter the cause and behavior of the symptoms. I can admit, however, that SSDs are particularly tricky to deal with and still are relatively buggy when compared to using HDDs. I recommend starting off by not only going to the Gigabyte website to download drivers for your drive controller, but also to go to the website for your SSD drive manufacturer and download any related drivers and especially firmware for it, since often times I've found initial firmware for SSD drives tend to be quite buggy.

Also, just to clarify, your Marvell controller is for RAID and other extra drive features support when plugging in external drives via the eSATA/USB ports. It only pertains to externally-connected drives. The Intel is for internal drives.