Solved BSOD sometime during sleep, Ntoskrnl seems to be at fault

[kevdlandrig]

I already checked the other threads for my specific problem, and I couldn't find it although I spent several hours looking for the problem on the interwebz.

I've been putting my computer to sleep, go to bed, and when I wake up, I often find that the computer has BSOD'd sometime during the night. I have never actually seen the BSOD happen. From what I have seen of other people's problems with this, people typically have a bad hard drive or memory issues. This is not the case for me. I have already run several hard disk checks with WD's software, and I ran memtest overnight. neither returned a single error. I thought there might be an issue with the computer switching from sleep mode to hibernate, so I changed the delay between going to sleep and switching to hibernate to about three days. The issue persists. At this point I seem to have exhausted the knowledge of the forums so I am attaching my SF diagnostic.

If you need any more information I would be happy to oblige.

 

[Dsprague]

It looks like your problem is being caused by your wireless driver:

Unable to load image \SystemRoot\system32\DRIVERS\NETwNs64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for NETwNs64.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys
 \Driver\NETwNs64

Please update the driver from here: https://downloadcenter.intel.com/Default.aspx

 

[kevdlandrig]

Alrighty, I've installed the driver, and I will advise you on the situation in a few weeks(or sooner if the problem reoccurs). Just wondering though, why was bluescreenview pointing to ntoskrnl if the problem was really somewhere else? Did I miss something?

 

[Dsprague]

In all likely hood yes, ntoskrnl is the core of the operating system, and often times what happens is a driver (in this case your wireless driver) will do something it shouldn't and the core (ntoskrnl) will detect this and force a crash (bluescreen) to save its self and other very important files from possible corruption by the bad data. you have to understand too that debugging a BSOD is something that requires a good understanding of various components of the opreating system, how they work, and a properly configured copy of the windbg debugging program if you want more information see these threads, they are very helpful: Crash and lockup debug 'How To' - Windows 7 Help Forums

 

[kevdlandrig]

The bluescreen happened again last night. I looked at bluescreenview, which pointed to ntoskrnl again, so I think that it is safe to assume that the cause is some residual of the old wireless drivers. I am going to attempt to completely uninstall the wireless driver and any parts of it I can find tomorrow morning if no one stops me. Any advice on the process? I'm also attaching the new dump for analysis in case that is not the issue.

 

[Dsprague]

It does appear that it is your wireless drivers once again,though the driver, at least according to the dump files, is up to date. let me see if I can get some one else to take a look at this.

 

[x BlueRobot]

0: kd> [COLOR="SeaGreen"]lmvm b57nd60a[/COLOR]
start             end                 module name
fffff880`04732000 fffff880`04799000   b57nd60a T (no symbols)           
    Loaded symbol image file: b57nd60a.sys
    Image path: \SystemRoot\system32\DRIVERS\b57nd60a.sys
    Image name: b57nd60a.sys
    Timestamp:        [COLOR="Red"]Tue Feb 15 03:58:31 2011[/COLOR] (4D59F9E7)
    CheckSum:         00072A2A
    ImageSize:        00067000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Broadcom NetXtreme Gigabit Ethernet driver seems to be causing problems, please update the driver from here - Ethernet NIC Driver Downloads | Broadcom

 

[kevdlandrig]

I updated the Broadcom adapter, and then had an unrelated breakthrough. If I press the power button to sleep the computer, and then immediately close the lid, the computer has the screen off, but will react (as in beep or something) when I press the WiFi switch or plug in the power. The computer will otherwise act like it is frozen. About fifteen minutes later, the computer will bluescreen. (I finally saw it last night because I opened the lid again when I saw it was acting funny)

One other thing. I noticed that my computer came with a Bluetooth module, but I can't seem to detect it on the hardware level. Could this be somehow related? Im attaching yet another dump of the most recent two bluescreens as well.

EDIT/UPDATE My computer is now bluescreening on every sleep, so I decided to run verifier.exe I selected 'create standard settings' and 'automatically select all drivers installed on this computer'. I promptly got a bluescreen upon restarting. Here is the newest grab all.

 

[x BlueRobot]

Scan for any missing, modified or corrupted protected Windows files with:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Follow these instructions, enabling Driver Verifier on all drivers will cause unreliable crashes, also please enable the Special Pool option:

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[kevdlandrig]

Ive been running the verifier for a few days now, but I haven't bluescreened because of it. The verifier is currently set to not check the microsoft stuff. should I be looking at that two?

 

[kevdlandrig]

I ended up switching the verifier to check all installed drivers, and I promptly was given a pair of bluescreens. I went back into verifier and set it to only look at the microsoft drivers then, and after a few minutes I got another three bluescreens pointing to the NTFS driver. Im uploading my dump.

 

[x BlueRobot]

Have you used this command as suggested earlier?

sfc /scannow

[COLOR=Red]BugCheck D5[/COLOR], {fffff980b93aef80, 0, fffff88001a19c51, 0}

*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys

Could not read faulting driver name
Probably caused by : luafv.sys ( luafv!LuafvGenerateFileName+6d )

Usual causes:  Device driver

This bugcheck indicates that a driver has referenced a freed memory address.

fffff8800b3f7730 -- ([COLOR=SeaGreen].trap 0xfffff8800b3f7730[/COLOR])
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
[COLOR=Red]rax=000000000000004a[/COLOR] rbx=0000000000000000 [COLOR=Red]rcx=fffff980899ecf04[/COLOR]
rdx=000000002f9c207c rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001a19c51 rsp=fffff8800b3f78c8 rbp=0000000000000002
 r8=000000000000004a  r9=0000000000000000 r10=fffff8800b3f7af0
r11=fffff980899ecf04 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
[COLOR=Red]Ntfs!memcpy[/COLOR]+0x41:
fffff880`01a19c51 8b040a          mov     eax,dword ptr [COLOR=Red][rdx+rcx][/COLOR] ds:fffff980`b93aef80=????????

1: kd> [COLOR=SeaGreen]lmvm klif[/COLOR]
start             end                 module name
fffff880`0440b000 fffff880`044b0000   klif     T (no symbols)           
    Loaded symbol image file: klif.sys
    Image path: \SystemRoot\system32\DRIVERS\klif.sys
    Image name: klif.sys
    Timestamp:        [COLOR=Red]Tue Mar 26 15:07:33 2013[/COLOR] (5151B9B5)
    CheckSum:         000A60C2
    ImageSize:        000A5000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Kaspersky seems to be causing problems, please remove the program completely with the Kaspersky Removal Tool, and then install and run full scans with these free and proven alternatives, which work best with the operating system due to their compatibility and lightweight nature on system resources.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

 

[kevdlandrig]

I did run all the sfc /scannow command. It returned no errors and took about half an hour to run.

I'm not really a fan of removing kaspersky and switching to these free antivirus programs, although I know it will improve my boot times rather significantly. I will remove it, but I just don't like it.

 

[x BlueRobot]

Malwarebytes is designed by Kaspersky, but uses different drivers.

 

[kevdlandrig]

Im gonna run verifier again to see if I can find any more problems.

I mentioned earlier that there is a bluetooth module that came with my computer. However, I have no way of using the module because the computer doesn't seem to recognize it's existence. I'm currently thinking that the computer may have misrecognized the hardware when it was initialized, and is now potentially causing some bluescreens. I know that the bluetooth module is an Atheros AR5BBU22, which seems to be pretty rare. Is there any way to test for incorrect drivers?

 

[x BlueRobot]

Have you removed the driver for the Bluetooth device, and then checked your motherboard support page or the hardware vendor? There isn't a driver available on the Atheros website.

 

[kevdlandrig]

I went ahead and started a new thread on the bluetooth problem. Its probably unrelated and will require me to be doing stuff on the hardware side in all likelyhood. anyhow, I have a new batch of bluescreens to show you, if they can help. Im still running verifier to see what other problems I can drag out of the computer.

 

[x BlueRobot]

All the dump file are caused by Driver Verifier, but do not reveal much information. The bluetooth device could be a cause.

 

[kevdlandrig]

Is there any way to get more out of the errors on the computer, or have we reached an impass?

Im beginning to notice fewer and fewer times where the computer fails to sleep properly. I haven't really had an issue for the past few days. Its probably too early to tell, but I think that something we did along the way finally fixed the problem, and I get the feeling that it was the antivirus. Malwarebytes did detect three or four different malware on my computer which I took care of, so they may have also contributed to the cause.

 

[x BlueRobot]

I would disable Driver Verifier, and then see if the computer BSODs normally; as in without Driver Verifier enabled.