Solved BSOD after waking from sleep

[qwazzerman]

Hi, I don't know what the problem is, but I've had two BSODs in the past week, which worries me a little. Both occurred within a minute or so of resuming from sleep mode. They have different error codes (one is IQRL_NOT_LESS_EQUAL and the other is ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY), so maybe they're unrelated, but I want to make sure they're not symptomatic of a larger hidden issue.
I'm not very familiar with the error codes and all that to fully understand, but it looks like one of them had something to do with the USB ports. I do take this computer home with me at the end of the day, which means putting it to sleep (by closing the lid), unplugging the external mouse, monitor, and ethernet cable. I eject any external hard drives or flash drives before putting it to sleep.

I did try the verify tool, but it found no unsigned drivers.
Additional info: Asus N56VZ laptop, purchased around June 2012. Windows 7 Pro (64 bit), OEM install, no recent hardware changes. Haven't reinstalled the OS since I got it. I fully restart the system about every other week or so.

Thank you!

 

[koolkat77]

Welcome.

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSSI\Downloads\Compressed\MERCURY-Tue_03_24_2015_140723_63\032415-31418-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18741.amd64fre.win7sp1_gdr.150202-1526
Machine Name:
Kernel base = 0xfffff800`03455000 PsLoadedModuleList = 0xfffff800`03699890
Debug session time: Wed Mar 25 02:19:36.233 2015 (UTC + 6:00)
System Uptime: 6 days 2:39:21.092
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..............................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffffe766d703a03c, 2, 1, fffff80003646e80}

Probably caused by : hardware ( nt!KiInitialPCR+180 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffe766d703a03c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80003646e80, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003703100
GetUlongFromAddress: unable to read from fffff800037031c0
 ffffe766d703a03c Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInitialPCR+180
fffff800`03646e80 801f00          sbb     byte ptr [rdi],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

DPC_STACK_BASE:  FFFFF80003C0DFB0

TRAP_FRAME:  fffff80003c072e0 -- (.trap 0xfffff80003c072e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff80003c07400
rdx=fffffa800a36a050 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003646e80 rsp=fffff80003c07478 rbp=fffffa8007719060
 r8=00000000d90818d4  r9=0000000001d0666f r10=fffff80003455000
r11=fffff80003c07470 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!KiInitialPCR+0x180:
fffff800`03646e80 801f00          sbb     byte ptr [rdi],0 ds:00000000`00000000=??
Resetting default scope

MISALIGNED_IP: 
nt!KiInitialPCR+180
fffff800`03646e80 801f00          sbb     byte ptr [rdi],0

LAST_CONTROL_TRANSFER:  from fffff800034c9469 to fffff800034c9ec0

STACK_TEXT:  
fffff800`03c07198 fffff800`034c9469 : 00000000`0000000a ffffe766`d703a03c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`03c071a0 fffff800`034c80e0 : fffffa80`0fda8f00 fffff880`051003a8 fffffa80`0aa5c2b0 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff800`03c072e0 fffff800`03646e80 : 00000000`00000001 fffffa80`07719060 00000000`00000002 fffff800`03c074e0 : nt!KiPageFault+0x260
fffff800`03c07478 00000000`00000001 : fffffa80`07719060 00000000`00000002 fffff800`03c074e0 fffff800`034d5b96 : nt!KiInitialPCR+0x180
fffff800`03c07480 fffffa80`07719060 : 00000000`00000002 fffff800`03c074e0 fffff800`034d5b96 fffffa80`07719168 : 0x1
fffff800`03c07488 00000000`00000002 : fffff800`03c074e0 fffff800`034d5b96 fffffa80`07719168 fffffa80`07719168 : 0xfffffa80`07719060
fffff800`03c07490 fffff800`03c074e0 : fffff800`034d5b96 fffffa80`07719168 fffffa80`07719168 00000000`00000000 : 0x2
fffff800`03c07498 fffff800`034d5b96 : fffffa80`07719168 fffffa80`07719168 00000000`00000000 00000000`00000000 : 0xfffff800`03c074e0
fffff800`03c074a0 fffff800`034d5a7e : 000004cd`415563ba fffff800`03c07b18 00000000`020468f2 fffff800`0364b0c8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`03c07af0 fffff800`034d5867 : 00000113`67c5b5c2 00000113`020468f2 00000113`67c5b5c7 00000000`000000f2 : nt!KiTimerExpiration+0x1be
fffff800`03c07b90 fffff800`034c1bca : fffff800`03646e80 fffff800`03654cc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`03c07c40 00000000`00000000 : fffff800`03c08000 fffff800`03c02000 fffff800`03c07c00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiInitialPCR+180
fffff800`03646e80 801f00          sbb     byte ptr [rdi],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiInitialPCR+180

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

IMAGE_VERSION:  6.1.7601.18741

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_ip_misaligned

FAILURE_ID_HASH:  {45769616-fd06-8c70-4b8b-74a01eddc0cd}

Followup: MachineOwner
---------

 Clean boot

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

• How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Temp Monitoring

Check for heating issues using Speccy or HWMonitor.

• Speccy - System Information - Free Download
• HWMonitor CPUID - System & hardware benchmark, monitoring, reporting

Upload a screen shot with either of the tools: http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Run Disk Check on your Hard Drive for file system errors and bad sectors on it.

 Hard Drive Diagnostics

• Double click and open my computer.
• Right click on desired drive and hit properties.
• Click on tools tab and Check now.

Read complete instructions on the tutorial: http://www.sevenforums.com/tutorials/433-disk-check.html

Other Tests:

 

• Upload a screenshot of your hard disk using Crystal Disk Info.
• Make a hard drive test from the hard drive manufacturers website.
• Test your Hard Drive with SeaTools.

 

[qwazzerman]

Thanks for the response.
SFC: No integrity violations found. (Screenshot attached)
HWMonitor: Temperatures seem normal (as far as I can tell), screenshot attached.
Diskchk: Free space marked as allocated in both master file table and volume bitmap, corrected. (Screenshot attached)
SEATools: Passed Long Generic test.
Crystal Disk Info: Screenshot, once again, attached. (The E:/ drive is an external hard drive that's not usually connected.)

Additional:
I ran Memtest86+ for 13 passes, no errors.
Did Verifier driver testing for 24 hours with no crashes. (Sound was a little choppy sometimes, but no BSODs.)

Is it possible that it was caused by the misallocated hard drive space?
And for the crash before the most recent, the dump file indicated hidusb.sys; could that have been the same root cause?

 

[koolkat77]

Run memtest, furmark, prime95 and disc check on E drive.
If the issue persists, go for driver verifier.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Memtest should be done overnight.

Test your Hardware for Stability and Heat Problems:

Prime95. Be sure to keep an eye on your temperatures when running these tests, especially the Large FFTs.

 

[qwazzerman]

Ran memtest for 13 passes, no errors.
FurMark ran for an hour, video card temp stabilized around 84C. (Interestingly, this got the CPU hotter than Prime95, maxing out at 85C.)
Prime95 ran for 2 hours with no errors, max core temp during test was 76C.

Driver Verifier (after 24 hours) produced no BSODs.

E drive is an external; only problem indicated by CrystalDiskInfo was a Current Pending Sector Count of 11. Chkdisk found a bad file, but that didn't change the Pending Sector Count. Also ran WD's Digital LifeGuard Diagnostics long test, no errors found, Current Pending Sector Count didn't change. It's an old drive, so it's possible it's failing, but it wasn't plugged in when I had the BSODs.

 

[essenbe]

qwazzerman, may I suggest you go to the Asus site for your Laptop and update all your drivers, especially the these.

fffff800`03c07528  fffff880`0f6f83bbUnable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0x21a3bb

Which is your Nvidia Graphics driver. This is your current driver

nvlddmkm
start             end                 module name
fffff880`0f4de000 fffff880`101b2000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Sat Sep 13 14:59:50 2014 (5414A236)
    CheckSum:         00C8E3A6
    ImageSize:        00CD4000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

fffff800`03c070e8  fffff880`0520dee0Unable to load image \SystemRoot\system32\DRIVERS\athrx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
 athrx+0x137ee0

athrx
start             end                 module name
fffff880`050d6000 fffff880`0538b000   athrx    T (no symbols)           
    Loaded symbol image file: athrx.sys
    Image path: \SystemRoot\system32\DRIVERS\athrx.sys
    Image name: athrx.sys
    Timestamp:        Wed Mar 21 08:42:59 2012 (4F69DAE3)
    CheckSum:         002B829C
    ImageSize:        002B5000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Which is your Atheros network adapter driver

fffff800`03c07ab8  fffff880`0538aa01Unable to load image \SystemRoot\system32\DRIVERS\L1C62x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for L1C62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for L1C62x64.sys
 L1C62x64+0xaa01

Current version

 L1C62x64
start             end                 module name
fffff880`05380000 fffff880`0539b000   L1C62x64 T (no symbols)           
    Loaded symbol image file: L1C62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
    Image name: L1C62x64.sys
    Timestamp:        Mon Jan 16 01:10:16 2012 (4F13CD58)
    CheckSum:         0001A3E9
    ImageSize:        0001B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Which is your Atheros NIC driver

fffff800`03c075c8  fffff880`04218b45Unable to load image \SystemRoot\system32\DRIVERS\nvkflt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvkflt.sys
*** ERROR: Module load completed but symbols could not be loaded for nvkflt.sys
 nvkflt+0x18b45

Your current version

nvkflt
start             end                 module name
fffff880`04200000 fffff880`0424d000   nvkflt   T (no symbols)           
    Loaded symbol image file: nvkflt.sys
    Image path: \SystemRoot\system32\DRIVERS\nvkflt.sys
    Image name: nvkflt.sys
    Timestamp:        Sat Sep 13 14:52:45 2014 (5414A08D)
    CheckSum:         0004B821
    ImageSize:        0004D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

That is the NVIDIA Graphics filter driver

I can't say that any of those caused the BSOD. They may have been victims rather than causes, but they are old enough to need updating anyway. Try those and see if you get any better results.

 

[qwazzerman]

Unfortunately, as far as the Asus website is concerned, the drivers are all up-to-date. I did find more recent drivers on each device's manufacturer website, and updated the ones you mentioned.

I haven't had any more BSODs, so I'll tentatively consider the two that occurred as flukes and mark this as solved. If they happen again I'll start a new thread.

Thank you for the help!

 

[essenbe]

Good news and good job finding new drivers. I hope your good fortune continues.