Solved BSOD when waking from sleep mode 0x80041003

[lokizone]

I've been trying to catch the various error codes at the blue screen, but haven't been quick enough. In the event viewer I see ID 10 event codes, but from what I read online they are not indicative of a serious problem. The BSODs seem to be associated with windows 7 waking from sleep. I have been researching that all morning, and I believe my system is set up correctly. I use S3 mode as far as I can tell. This is a brand new computer build, and my first time, so I wouldn't be surprised if I'm missing something. I really like the trouble shooting, and especially utilizing the brain power online, so I appreciate any help that can be offered.

I finally captured a stop message.
STOP: 0x000000F4 (0x000000000000003, 0xFFFFFA800B938B30, 0xFFFFFA800B938E10, 0xFFFFF80002F80460)

 

[koolkat77]

Welcome and thank you for choosing SevenForums.

A number of your .dmp files come with bug check code F4, often relates to hard drive issues.

I note you have a SSD.

Model INTEL SSDSC2CT240A3

Please do the following:

If you have an SSD, make sure the following are up to date:

• SSD firmware
• BIOS Version
• Chipset Drivers
• Hard disk controller drivers/SATA drivers
• If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Norton tends to cause BSOD-s. I would recommend uninstalling it with the Norton Removal Tool and replace with Microsoft Security Essentials To Test.

• Norton Removal Tool

You may install it back if it is not the cause of your BSOD-s.

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

• Microsoft Security Essentials - Free Antivirus for Windows
  • Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
    • http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

:ar: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Get the latest version for Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver) installed.
Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to "Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver)" and reboot the system. Delete remnants of its drivers/older drivers using Driver Sweeper.

:ar: http://www.sevenforums.com/tutorial...over-files-after-uninstalling.html#post726559

Link & description: http://www.carrona.org/drivers/driver.php?id=MBfilt64.sys


Perform a System File Check:

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Disk Check on your hard drive for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Reduce items at start-up. Nothing except anti-virus is required:

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

:ar: BSOD Report

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {40, 2, 1, fffff80002ce2468}
*** WARNING: Unable to verify timestamp for MBfilt64.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt64.sys
Probably caused by : MBfilt64.sys ( MBfilt64+1817 )
Followup: MachineOwner
---------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, fffffa8009ea0520, fffffa8009ea0800, fffff80002fd2460}
----- ETW minidump data unavailable-----
Probably caused by : wininit.exe
Followup: MachineOwner
---------

Hope this helps.

 

[lokizone]

Thank you so much. I will hopefully get a chance to work on this tonight after work. I actually got another BSOD this morning after turning it on from a complete shut down. Some differences, but mostly F4 again.
STOP: 0x000000F4 (0x000000000000003, 0xFFFFFA800BCF4B30, 0xFFFFFA800BCF4E10, 0xFFFFF800031D4460)

 

[koolkat77]

Look forward to your results.

 

[lokizone]

Ok, so I performed most of your suggestions last night.

SSD firmware is latest, BIOS is back one as suggested due to boot up issues in Windows 7. The new BIOS is optimized for Windows 8, and apparently causes a slow boot up. Chipset and hard disk drivers are latest according to Intel; no Marvell devices.
Norton was removed and Windows Security essentials was installed. I opted not to do the Malwarebytes at this time as my computer is so new and has barely anything on it.
Startup folder is empty.
Disk check, SFC and Memory test all found nothing.

I unplugged all of the other SATA devices while I was doing most of this, so I was only dealing with the SSD. I pulled one of the memory sticks as well. For a while, I was thinking that the removal of Norton was helping. I was able to recover from sleep mode three times throughout the night. When I woke the computer from sleep mode this morning, it worked for about 5 minutes, then when my back was turned it got another BSOD and restarted quickly, displaying the screen about windows not starting properly and asking me if I want to start in safe state or normally. I need to disable the quick reboot after BSOD.
I found a critical event for the kernel, and a bugcheck code. I will upload my dump files.

I don't have a ton of time to debug this as I have a new baby and wife who wanted me to buy another Dell. I did a lot of research yesterday at work and was convinced that the model of SSD I have, Intel 330, was the cause. Many complaints online about Sanforce controlled SSDs in general. I didn't need the SSD, but I splurged. I will feel really bad if that is the issue, but it may come down to me getting a newer HDD, or a more reputable SSD (which means more money).

 

[Vir Gnarus]

I'm afraid, my friend, that this is the case. Sandforce controllers - even on Intel brand SSDs (Intel is pretty solid brand) are unstable messes that cause a lot of trouble for many here at SF. Yours is no exception, as evident from the crashdumps, which all of them one way or another reported an issue dealing with disk I/O. One particularly interesting one was that it was reporting that the system was still trying to work on a file when a surprise removal occurred on the SSD. That means that the SSD suddenly just completely out and about stopped doing anything, and the system thought someone pulled it out! Of course, this could also mean that there's an issue with the cable. Reattach both ends for both data and power cables for your SSD to make sure they're sitting pretty. If you have a spare data cable, try that as well to make sure the cable itself just ain't bad. If none of that seems to work, then it's time to write this SSD as bad.

Don't let this experience sour your perspective on SSDs. There are a good number of reliable SSD brands and models out there, some of which are even sitting in enterprise environments on pure SSD-driven file servers! From my experience both on personal and enterprise level, Samsung has been the most reliable, with Intel and Crucial being close behind. OCZ and Rosewill are by far the worst contenders, and often you'll have to run through 3-5 of them before you get one that'll last you over a year. Of course, stay away from all Sandforce controller SSDs, and be aware that failure rate on even the best models still exists, albeit small (akin to a good model RAM stick or HDD). You don't really need the extra umph pushed out of Sandforce controllers or what OCZ has to offer; SSDs by design are already super fast enough, so risking an extra little speed for a large reduction in stability is not worth it.

Analysts:

As mentioned before, pretty much all crashdumps have stacks in the offending threads riddled with NTSTATUS error codes associated with file and disk-to-RAM I/O operations. The most curious one is the surprise removal one, shown here:

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc50070450, ffffffffc0000056, c50c880, fffff8a00e08a000}

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36bea )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc50070450, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffff[COLOR=Red]c0000056[/COLOR], error status (normally i/o status code)
Arg3: 000000000c50c880, current process (virtual address for lock type 3, or PTE)
Arg4: fffff8a00e08a000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

[COLOR=Red]ERROR_CODE: (NTSTATUS) 0xc0000056 - A non close operation has been requested of a file object with a delete pending.[/COLOR]

BUGCHECK_STR:  0x7a_c0000056

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f3a552 to fffff80002eccfc0

STACK_TEXT:  
fffff880`035fbd98 fffff800`02f3a552 : 00000000`0000007a fffff6fc`50070450 ffffffff`c0000056 00000000`0c50c880 : nt!KeBugCheckEx
fffff880`035fbda0 fffff800`02ef3cbf : fffffa80`0d7b4e90 fffff880`035fbed0 fffff800`030ff600 fffffa80`067ad660 : nt! ?? ::FNODOBFM::`string'+0x36bea
fffff880`035fbe80 fffff800`02eda589 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000003 : nt!MiIssueHardFault+0x28b
fffff880`035fbf10 fffff800`02f35a46 : 00000000`00000000 fffff8a0`0e08a000 fffffa80`0d89cd00 00000000`00000000 : nt!MmAccessFault+0x1399
fffff880`035fc070 fffff800`031680cb : fffffa80`0d89cd50 00000000`00000000 00000000`0008c081 fffffa80`0d89cd50 : nt! ?? ::FNODOBFM::`string'+0x2a8d0
fffff880`035fc140 fffff800`02e9a52b : fffffa80`0d89cdd0 00000000`00000000 fffffa80`0d89cdd0 fffffa80`0d89cdd0 : nt!MiSegmentDelete+0x7b
fffff880`035fc180 fffff800`02e9ac52 : 00000000`00000000 00000000`00000011 00000000`00000000 fffff880`01639200 : nt!MmPurgeSection+0x71b
fffff880`035fc270 fffff880`016a5817 : fffffa80`0c64fc88 00000000`00000000 00000000`00000000 fffffa80`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`035fc2e0 fffff880`017a59e2 : fffffa80`07e96730 fffffa80`0d180180 00000000`00000000 fffff880`017a5901 : [COLOR=Red]Ntfs!NtfsFlushVolume[/COLOR]+0x5fb
fffff880`035fc410 fffff880`016fbdcc : fffff980`10290f68 fffffa80`0d180180 fffffa80`0d180180 fffff800`02e4e000 : [COLOR=Red]Ntfs!NtfsPerformSurpriseRemoval[/COLOR]+0x32
fffff880`035fc460 fffff880`016fcaec : fffffa80`07e96730 fffff880`035fc5e8 fffff880`035fc5f0 00000000`00000001 : Ntfs!NtfsCommonPnp+0x7eb
fffff880`035fc540 fffff800`0336fc16 : fffff980`10290c10 00000000`00000000 00000000`00000001 fffffa80`07e96730 : Ntfs!NtfsFsdPnp+0x1f0
fffff880`035fc5e0 fffff880`0146cbcf : fffff980`10290fb0 fffff880`035fc680 fffffa80`0c3a6350 fffffa80`0cd1f0e0 : nt!IovCallDriver+0x566
fffff880`035fc640 fffff880`0146b6df : fffffa80`0d88f1e0 fffffa80`0d88f1e0 fffffa80`0d88f100 fffff980`10290c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`035fc6d0 fffff800`0336fc16 : fffff980`10290c10 00000000`00000002 00000000`c00000bb fffff880`035fc848 : fltmgr!FltpDispatch+0xcf
fffff880`035fc730 fffff800`031338d9 : fffffa80`0d88f1e0 00000000`c00000bb fffff880`035fc848 fffffa80`0e81a820 : nt!IovCallDriver+0x566
fffff880`035fc790 fffff800`032b31e1 : fffffa80`0850a8e0 fffffa80`0d180030 fffffa80`0852b840 fffffa80`0850a8e0 : nt!IopSynchronousCall+0xc5
fffff880`035fc800 fffff800`032adbd8 : 00000000`00000010 fffffa80`0850a8e0 00000000`0000030a 00000000`00000308 : [COLOR=Red]nt!IopRemoveDevice[/COLOR]+0x101
fffff880`035fc8c0 fffff800`032b2d27 : fffffa80`0852b840 00000000`00000000 00000000`00000003 00000000`000007ff : [COLOR=Red]nt!PnpSurpriseRemoveLockedDeviceNode[/COLOR]+0x128
fffff880`035fc900 fffff800`032b2e40 : 00000000`00000000 fffff8a0`12fa1100 fffff8a0`03208760 fffff880`035fca58 : [COLOR=Red]nt!PnpDeleteLockedDeviceNode[/COLOR]+0x37
fffff880`035fc930 fffff800`0334379f : 00000000`00000002 00000000`00000000 fffffa80`0852b840 00000000`00000000 : [COLOR=Red]nt!PnpDeleteLockedDeviceNodes[/COLOR]+0xa0
fffff880`035fc9a0 fffff800`0334435c : fffff880`035fcb78 00000000`00010200 fffff880`035fcb00 00000000`00000000 : [COLOR=Red]nt!PnpProcessQueryRemoveAndEject[/COLOR]+0x6cf
fffff880`035fcae0 fffff800`0322d5ce : 00000000`00000000 fffffa80`0bfe7310 fffff8a0`12fa1120 00000000`00000000 : [COLOR=Red]nt!PnpProcessTargetDeviceEvent[/COLOR]+0x4c
fffff880`035fcb10 fffff800`02ed6641 : fffff800`03132768 fffff8a0`12fa1120 fffff800`0306a2d8 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x5ab9b
fffff880`035fcb70 fffff800`03163e5a : 00000000`00000000 fffffa80`067ad660 00000000`00000080 fffffa80`0678a040 : nt!ExpWorkerThread+0x111
fffff880`035fcc00 fffff800`02ebdd26 : fffff880`033d7180 fffffa80`067ad660 fffff880`033e1fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`035fcc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36bea
fffff800`02f3a552 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36bea

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x7a_c0000056_VRF_nt!_??_::FNODOBFM::_string_+36bea

BUCKET_ID:  X64_0x7a_c0000056_VRF_nt!_??_::FNODOBFM::_string_+36bea

Followup: MachineOwner

Evidently, what was going on was that a surprise removal occurred (a device unexpectedly disconnected) and the system is trying to complete the I/O typically responsible for cleaning up after an ejected device. However, during that, a c0000056 error occurred, meaning that during a file deletion (most likely deleting the device object representing the physical drive) the system tried to perform something on the same object that wasn't deletion-related. I can't dive further in the minidump to figure it out, but I speculate what happened is the drive both 'ejected' and returned in such quick succession - most likely a spontaneous connection loss - that the system was trying to work with the device object that was still pending deletion from supposed ejection! Again, minidump can't tell further, but that's what I figure.

 

[lokizone]

I will try a couple of other SATA cables I have, and recheck the power. The nice thing about the SSD is the size, and how it sits in the HDD tray; all of the cables are easy to tuck out of the way, but I will definitely check. During my original parts researching, I was building around the Samsung 830. The only reason I got the Intel was a cyber monday deal, and it was twice the size. I didn't get a chance to do my homework as I had with the samsung. I will work on this, possibly even installing the OS on one of the 500gb HDDs in my system, but I fear the Intel SSD is the issue. The Samsung 830 is hard to find these days, and the non pro version of the 840 doesn't seem to be up to par, so that means the 840 pro is probably what I will get. What about the Plextor m5 pro? I've read good things about the Marvell controlled SSD.

Thanks for taking the time to read and respond to my post. I really appreciate it.

 

[Vir Gnarus]

I've had off and on experiences with Marvell, both dealing with those here at SF and personally. It's nowhere neeeear as bad as Sandforce, but there definitely is a noticeable difference between it and Intel controllers. I wouldn't mind it on a usual personal SSD purchase, but if I've already ran across a bad one that I've been fussing with like what you've already experienced, I wouldn't want to risk it a second time and just go for an Intel controller drive.

 

[lokizone]

I ran memtest on my system last night for 12 passes with no issues. I am using a different SATA cable for the SSD, removed a molex to sata adapter I was using to power the SSD and plugged it into a SATA connector from the PSU. I reconfigured the power settings to never power down the SSD. I removed IRST from the computer.
I discoverd the diagnostic tools and ran the system health report only to find an AntiLog32.sys error. From what I can tell it's from the Norton program I installed and later removed, so I went into the registry and deleted all Norton related items I could find. I've been on the computer for about two hours now without any issues. It just seems to have problems with the sleep and start up operations. Still showing F4 bug check, so I will probably try installing the OS on a normal HDD this weekend to see if that works.

 

[Vir Gnarus]

Still caused by more disk errors.

Btw, since this is concerning sleep specifically, have you disabled hibernation? Go into command prompt and type powercfg -h off then restart the system, then see if there's issues regarding sleep still. The SSD may just not like hibernating at all. In fact, it's advised you don't user hibernate for any SSD, given that it will unnecessarily reduce the lifespan of the SSD.

 

[lokizone]

I changed the power settings so the SSD never shuts down, and hibernate is already disabled. I usually just shut it down since we don't use the computer that often, and I would think that would be ok. HDD OS install seems to be my last straw, unless I want to go through trying to install or perform a repair install back on the SSD. Thanks for taking a look.

 

[lokizone]

I was a little reluctant to mark it as solved, but the computer seems to be working well at this point. I will try to summarize what I have done in the past week, in no particular order as I can't quite remember at this time.

-Unhooked and reattached all cables leading to the SSD, swapped out the SATA cable for another, and plugged it into the second SATA 3 port on my board: I don't think any of this really helped, but it helped eliminate low hanging fruit.
-Removed Norton Antivirus that I had installed from my ISP. Had to wrestle with a few of the drivers, but it's gone. Installed MSE and the two antivirus programs listed above.
-Updated all of the drivers, and went to Realtek for the LAN and audio drivers as apposed to using the ones from ASRock. I did not upgrade the BIOS on my board as I read the newest version, which is optimized for Win 8, causes slow boots for Win 7. It was recommended by ASRock tech support, so I suppose I can do it and revert back if necessary.
-Disabled hibernate, which I wasn't using anyway.
-stopped the verify drivers function as it didn't seem to help.
-Ran memtest for 12 passes with both sticks of memory. I was wondering if I shouldn't do one at a time in case one good stick was masking one bad stick, but I didn't get any errors. No drives were hooked up during test.
-Ensured the SSD firmware was up to date.
-Scoured the internet for info from Intel boards, to Microsoft, Sevenforums and google in general.
I still might perform the prime95 stress test, but it appears I will not need to test this issue by installing the OS on an HDD.

As my issue first showed up when waking the computer from sleep, I changed the power settings for the SSD to never power down when the computer sleeps. I wonder if this will also apply to the two HDDs that I am going to reconnect, or if you can set them all individually. Anyway, I think this was the cure. Last night I discovered a page full of tips for SSD users with Windows 7 on Tomshardware, and that was listed as one of the things to change, as well as disabling hibernate. If you think about it, it makes complete sense. SSDs help your system start up so fast that it makes it less of an issue to shut down the computer at night, or whenever you will be leaving it for long periods of time, so why do you need it to sleep in the first place? On the other hand, it should be able to function with your system regardless of your power settings, and it seems that sleep would be important in a laptop???? Anyway, it seems to be stable at this point (knock on wood), and I like the drive a little more now. I hope this can help others out there, and I really appreciate the two experts that took the time to read my post and offer suggestions. I never would have arrived at the solution I did. Even though it cost me a lot of time, I'm glad it didn't cost me a new SSD as I was ready to write this one off.