Solved BSOD when resume from sleep (+1 hour)

[LiquidBlack NL]

Hello,

I have the problem with my new setup that it gives me a bluescreen when i wake it up from Sleep mode that's approximately +1 hour long sleep mode. When i set the pc to sleep and almost immediately wake it up by keyboard I get no bluescreen.

I can't get it fixed. Mayby someone can get this clear?

I tried the following already:
Memtest - 13 cycles, 28 hours (http://i60.tinypic.com/24m9o9d.jpg)
CPU test Intel
CPU stress test
GPU stress test
SSD check Samsung Magician
Bios update to newest version
WhoCrashed logs
Install Windows 7 & 8.1 on another SSD (M4 Crucial 128 GB )


Setup:
MB: Gigabyte Z97X Gaming 3
CPU: Intel Core i7 4790
CPU koeler: Scythe Mugen 4 PCGH Edition
RAM: Crucial Ballistix Sport 16GB DDR3-1600 CL9 kit
GPU: MSI GeForce GTX 970 Gaming 4GB
HDD: Samsung 850 Evo 500GB
PSU: Corsair RM650
On this moment installed Windows 7 x64 - Build 7601 SP1 (+all updates)

I have included the zip file in this post.

 

[Arc]

The versatility of the crash dumps are strongly indicating something going extremely odd there. The first notion goes to the RAM, which you nullified, the camera snap does the job.

Then we have to dig the deep for the root of the issue. At first I would like to ask you one thing. What is the purpose of this program in your system?

Start Menu\Programs\KMSpico
​

Let us know.

 

[LiquidBlack NL]

Thank you for your reply! I really appreciate your help .

I don't know, I don't use the KMSPico for doing things.

I have googled the KMSPico and found it is been used in installation iso's. I've tried windows 7 & 8.1 as mentioned above. They are both a all-in-one with the most recent updates to June 2015 and then I use my own keys to activate them. They both use the same "loader" in the installation wizard when installing a fresh Windows version (both the Windows 8 loader). Maybe that's why KMSPico is present on my system?

I have downloaded a new Windows 7 iso from my school Dreamspark and at the moment i'm installing it on the Samsung Evo 500GB. It's a clean and orginal one, so I eliminate the problem with the custom crap.

Are they any other kind of programs that can cause the BSOD everytime? I use the following programs everytime when I do a fresh install:
VLC
XNView
Google Chrome
Teracopy
PowerISO
7zip
Quickpar
CDBurnerXP
Filezilla
Adobe Reader
Java
Google Drive
Dropbox
Notepad++
Teamspeak 2 Client
Teamviewer
PDFCreator
Office 2013 incl Viso & Project (Dutch)

I use them also on my notebook without any problems.

 

[Arc]

KMSPico is used for counterfeit activation of windows. So it alters the system codes with some heavy moderated codes. In such a situation, all sort of issues are possible, and troubleshooting is worthless by virtue of this program.

If you opt for a genuine software, it will help you to get the reliable error data at least, with which troubleshooting will be possible.

 

[LiquidBlack NL]

Ok, that's clear. Maybe the problem was in the "custom" iso indeed.

I'm installing my drivers at the moment on the fresh original Windows 7 iso from Dreamspark. That's a good version right?

I'm gonna test the sleep function again and use it overnight. I'll post an update if something occurs.

 

[Arc]

Till you get a legit OS installed and activate it using a legit key, there will not be a scope of troubleshooting.

 

[LiquidBlack NL]

I'm using the Dreamspark Windows 7 iso and my buyed key now.
I mentioned if I use the sleep now and wake it up a few seconds later it goes MUCH faster dan before with the other installation. Almost instant.

I'm installing all the windows updates now, then I let my pc sleep overnight and wake it up in the morning. I hope it give me no Bsod. I'll let you know!

Thanks so far!

 

[Arc]

OK, let us wet and see.

 

[LiquidBlack NL]

When I wake up my pc this morning it starts, but gives me no screen activity. But I didn't hear it reset either.
So i quickly disconnect my 2 external harddrives out of the USB 3.0 ports and hit the reset button.

It resets, give me on the screen: "Resuming Windows" and it starts in the same state I left it the night before, without BSOD .

In the logs I found the following entry 5 times:
An error was detected on device \Device\Harddisk2\DR2

I have both SSD's plugged in (harddisk0 & harddisk1) en the external harddrivers connected via USB 3.0. I think they cause the boot failure when I resume from sleep?

Edit:
I use: Intel Usb3.0 version 3.0.4.65 (from the Gigabyte website)

On the Intel website the newest version is: 3.0.5.69 (https://downloadcenter.intel.com/do...Intel-8-9-Series-and-C220-C610-Chipset-Family)

Maybe an driver update will fix the issue?

 

[LiquidBlack NL]

Yesterday I installed the new USB 3.0 driver and set my pc to sleep in the evening.
In the morning I resume it from sleep without a problem but after a couple of minutes I get the following BSOD:

I also use the DM collector again and added the zip as a Attachment.

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\070115-5397-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`03253000 PsLoadedModuleList = 0xfffff800`0349a730
Debug session time: Wed Jul  1 09:30:02.583 2015 (UTC + 2:00)
System Uptime: 0 days 10:05:10.363
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800498ae30, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+338a4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa800498ae30
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80003337810 to fffff800032c78c0

STACK_TEXT:  
fffff880`0add56e8 fffff800`03337810 : 00000000`0000001a 00000000`00041790 fffffa80`0498ae30 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0add56f0 fffff800`032fb1b9 : 00000000`00000000 000007fe`f355cfff fffffa80`00000000 fffff880`00960000 : nt! ?? ::FNODOBFM::`string'+0x338a4
fffff880`0add58b0 fffff800`035dfb71 : fffffa80`10d8ce20 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0add59d0 fffff800`035dff7f : 0000007f`00000000 000007fe`f3240000 fffffa80`00000001 fffffa80`1034ddc0 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0add5a90 fffff800`032c6b53 : 00000000`00000000 000007fe`f354800c fffffa80`105d3b10 000007fe`f3240000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0add5ae0 00000000`7713de5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0028a448 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7713de5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+338a4
fffff800`03337810 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+338a4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  556356e8

IMAGE_VERSION:  6.1.7601.18869

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+338a4

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+338a4

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1a_41790_nt!_??_::fnodobfm::_string_+338a4

FAILURE_ID_HASH:  {b7b6e799-20a2-a8ed-3529-d30731685de0}

Followup: MachineOwner
---------

 

[cluberti]

It's eminently possible that something you've installed into both systems is causing an issue, but this dump points to a page table page being corrupt so it could really be anything, software or hardware. It does have a 3rd param of ffff, so it's an underflow of some kind triggering the corruption. It could be a bad driver, or potentially some sort of hardware issue that triggers this (bad hardware, firmware bugs, etc) flipping of at least one (or more) PTEs in the page table page to a non-zero value (this very particular scenario is what triggers the bugcheck you've posted here).

If you truly believe that the RAM is good in this machine, you can try to reproduce these errors on a Windows 8.1 system, which will attempt to go about preserving the corrupted PTE value before issuing a bugcheck if this happens again, thus making it (hopefully) easier to analyze in that configuration. A trial version of Windows 8.1 would be sufficient, you wouldn't need to go out and purchase a license at all.

 

[LiquidBlack NL]

Thanks for your extensively answer! It clear things up for me .

On the moment i've got a ticket on hold at Gigabyte (Motherboard manufacturer) maybe they can give me more informatie or maybe it is a know problem with this type mb.

Yes Windows 8 trail is a very good idea, i'm gonna try that and post an update soon! I don't know what to do else .

I also checked my ram with HCIMemtest because i read on the forums that it can provide with an error that memtest can't give you, but i came clean:

 

[LiquidBlack NL]

Hello,

Back from vacation so I can go further with fixing my BSOD problems.
Today I replaced the ram with 4x1 GB I loan from a colleague.

Today I've already got 4 BSOD's. I see there are "new" and have to do with the Creative Audio Driver. I've used the one on the Gigabyte's website:

Realtek HD Audio Driver R3.94 216.93 MB 2014/07/01
Creative SB X-Fi driver 1.00.03 70.19 MB 2014/05/02

The problem with sleeping overnight and resume in the morning I'm gonna test tonight.

Info from WhoCrashed:

(i have also included a new DM Log collector in de attachments from this post)

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Tue 4-8-2015 18:19:55 GMT your computer crashed
crash dump file: C:\Windows\Minidump\080415-11637-01.dmp
uptime: 00:00:12
This was probably caused by the following module: mbfilt64.sys (MBfilt64+0x1817) 
Bugcheck code: 0xA (0x0, 0x2, 0x1, 0xFFFFF800032DB82E)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\mbfilt64.sys
company: Creative Technology Ltd.
description: Creative Audio Driver
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mbfilt64.sys (Creative Audio Driver, Creative Technology Ltd.). 
Google query: Creative Technology Ltd. IRQL_NOT_LESS_OR_EQUAL



On Tue 4-8-2015 18:19:55 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
uptime: 00:00:12
This was probably caused by the following module: mbfilt64.sys (MBfilt64+0x1817) 
Bugcheck code: 0xA (0x0, 0x2, 0x1, 0xFFFFF800032DB82E)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\mbfilt64.sys
company: Creative Technology Ltd.
description: Creative Audio Driver
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mbfilt64.sys (Creative Audio Driver, Creative Technology Ltd.). 
Google query: Creative Technology Ltd. IRQL_NOT_LESS_OR_EQUAL



On Tue 4-8-2015 14:24:30 GMT your computer crashed
crash dump file: C:\Windows\Minidump\080415-3900-01.dmp
uptime: 00:00:10
This was probably caused by the following module: mbfilt64.sys (MBfilt64+0x1817) 
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF8000327CCA5)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\mbfilt64.sys
company: Creative Technology Ltd.
description: Creative Audio Driver
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: mbfilt64.sys (Creative Audio Driver, Creative Technology Ltd.). 
Google query: Creative Technology Ltd. IRQL_NOT_LESS_OR_EQUAL

 

[Arc]

Please upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

How to Create a System Information File in Windows.

Apparently the BSODs are caused by a realtek driver which is a very often BSOD causer, and not important IMHO. Because I have never got that driver installed, and havent lost anything without it.

BugCheck A, {0, 2, 1, fffff800032db82e}

*** WARNING: Unable to verify timestamp for MBfilt64.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt64.sys
[COLOR=Red]Probably caused by : MBfilt64.sys [/COLOR]( MBfilt64+1817 )

Followup: MachineOwner
---------

This page informs it is included in the driver package:

mbfilt64.sys : 6.10.0.8
​

And the removal procedure:

--------------------------
Remove Driver:
--------------------------
Windows Vista, Windows7 :

• Step 1. Go to Start\Settings\Control Panel.
• Step 2. Select [Programs] icon.
• Step 3. Select [Programs and Features] icon.
• Step 4. Select "Realtek High Definition Audio Driver" and press [uninstall] button.
• Step 5. Click on [Yes] to finish the uninstallation.
• Step 6. At the end of the procedure, select to restart the system and press [Finish] to complete the uninstallation.

After removal, download and install it from the source page: Realtek

See how it goes.

 

[LiquidBlack NL]

Thanks for your reply Arc!

Hopefully it's a good sign I don't get the other BSOD's anymore with this RAM.

I've uploaded the MSINFO32 in the attachment of this post.
I've also removed the driver with the described procedure and installed a new one from this link:
Realtek Definition Audio Codecs
I used 64bits version R2.79 from 2015/6/25.

Edit:
A update: my system is getting the same creative BSOD's with the new realtek driver and also without a realtek driver.
I tried reinstall my pc with the original Dreamspark Windows 7 and it freezes itself in the setup. (did not got any problems with the setup when using the original ram)

So i think my conclusion is: with the other RAM I also get a lot of strange errors and BSOD's. I've already tried another SSD disc and already tried to use the onboard VGA instead of the MSI card.

I think I need to send back my motherboard?

 

[Arc]

If you think that all the possible areas are checked, then if the board is within warranty, go for RMA the board.

 

[LiquidBlack NL]

Yeah the setup is just a few weeks old so I got warranty.
Sending back the MB today .

I let you guys know how it goes when i get a new one. Thanks for the help so far!

 

[Laith]

Remember to never use counterfeit activation tools, it will ruin the system really bad.

 

[LiquidBlack NL]

Remember to never use counterfeit activation tools, it will ruin the system really bad.

Noted . Only original DreamSprak editions from now on, no slipstreamed or whatever.

 

[Laith]

Good