PC crashed when going into hibernation

Steve06 · May 13, 2013

Hello,
recently I set the PC to hibernation mode before going to bed. I stayed by the machine for a moment to check that it effectively powers off and noticed that it seemed to take an unusual amount of time (the power LED of my PC case was still on while it neither reacted to keyboard or mouse input nor did the screen show anything). I didn't wait until the end and went to sleep. The next day when I turned the PC on I noticed that it went through a full restart without restoring the open apps and also that Windows had created a memory dump and asked for permission to send it to Microsoft.

I have not been able to reproduce the issue, that is hibernation works normally, but it happened for the second time since I did clean install of Windows 8 one week ago.

I have attached a memory dump and other useful information and would be thankful if someone could help me to narrow down which app or hardware causes the issue.

Thanks,
Steve

Mookalookabutu · May 13, 2013

Make-a check on MBfilt64 MBfilt64.sys Thu Jul 30 23:40:32 2009

Make-a update or disable to see result.

If no happy time, look at VPN.

Steve06 · May 13, 2013

Mookalookabutu said:
Make-a check on MBfilt64 MBfilt64.sys Thu Jul 30 23:40:32 2009

Make-a update or disable to see result.

If no happy time, look at VPN.

I'm not sure I got you. How should I upload that file and where do I find it?

usasma · May 14, 2013

MBfilt64.sys is a driver that belongs to your Realtek HD Audio. As it dates from 2009, it's not likely to be compatible with Win8.
More info on the driver here: Driver Reference Table - MBfilt64.sys
Download the latest Win8 compatible version of the Audio driver from the Realtek site and use it to update your Realtek HD Audio.

Only 56 Windows Updates installed. Most systems have 66 or more. Please visit Windows Update and get ALL available updates (it may take several trips to get them all).

SSD's were temperamental when they first came out, but their reliability has improved greatly over the last year or two. There are 2 things that MUST be checked on systems with BSOD's and SSD's:

1) That the SSD firmware is the latest available for the SSD
2) That the storage controller drivers on the motherboard are the most recent. They must date from late 2012 or later. This is ALL controllers, not just the one that the SSD is attached to.

These devices appear disabled. Is this deliberate? If so, why?

Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64 ROOT\NET\0000 Das Gerät wurde deaktiviert.

Intel(R) Centrino(R) Advanced-N 6235 PCI\VEN_8086&DEV_088E&SUBSYS_40608086&REV_24\4&2B8260C3&0&00E4 Das Gerät wurde deaktiviert.

Bluetooth-Gerät (PAN) BTH\MS_BTHPAN\7&2B9B9E67&0&2 Das Gerät wurde deaktiviert.

Please re-enable them and update their drivers. If you wish, feel free to disable them after this is done.

The memory dump blames networking issues - but previous memory dumps (listed in the WER section of MSINFO32) blame k57nd60a.sys - a driver component of your Broadcom NetLink Gigabit Ethernet device.
For starters, please do this:
- download the latest Win8 drivers for the Broadcom NetLink Gigabit Ethernet device from here: Ethernet NIC NetLink Driver Downloads | Broadcom
- uninstall the current Broadcom NetLink Gigabit Ethernet drivers from your system
- install the freshly downloaded drivers
- monitor for further BSOD's

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Sun May 12 23:11:45.572 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\051313-10515-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16551.amd64fre.win8_gdr.130306-1502
System Uptime:[B]1 days 6:01:12.976[/B]
*** ERROR: Module load completed but symbols could not be loaded for mslldp.sys
Probably caused by :[B]ntkrnlmp[/B]
BugCheck [B]9F, {4, 12c, fffffa8013ba0b00, fffff880030ce810}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000009F]DRIVER_POWER_STATE_FAILURE (9f)[/url]
Arguments: 
Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp
    subsystem.
Arg2: 000000000000012c, Timeout in seconds.
Arg3: fffffa8013ba0b00, The thread currently holding on to the Pnp lock.
Arg4: fffff880030ce810, nt!TRIAGE_9F_PNP on Win7
BUGCHECK_STR:  0x9F
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]0x9F_4_IMAGE_ntkrnlmp[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Sun May 12 23:11:45.572 2013 (UTC - 4:00)**************************
[COLOR=RED][B]MBfilt64.sys                Thu Jul 30 23:40:32 2009 (4A7267B0)[/B][/COLOR]
irstrtdv.sys                Thu Jul 12 19:58:02 2012 (4FFF648A)
RTKVHD64.sys                Tue Aug  7 06:49:39 2012 (5020F2C3)
asmtxhci.sys                Mon Aug 20 08:28:15 2012 (50322D5F)
asmthub3.sys                Mon Aug 20 08:28:29 2012 (50322D6D)
k57nd60a.sys                Sun Aug 26 00:58:34 2012 (5039ACFA)
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
acsock64.sys                Tue Nov  6 21:27:25 2012 (5099C70D)
iaStorA.sys                 Mon Nov 19 15:09:40 2012 (50AA9204)
dump_iaStorA.sys            Mon Nov 19 15:09:40 2012 (50AA9204)
HECIx64.sys                 Mon Dec 17 14:32:21 2012 (50CF7345)
IntcDAud.sys                Fri Jan 11 08:55:16 2013 (50F019C4)
igdkmd64.sys                Wed Mar 20 00:25:41 2013 (51493A45)
pmouself.sys                Mon Mar 25 19:40:16 2013 (5150E060)
phidmice.sys                Mon Mar 25 19:46:51 2013 (5150E1EB)
[/font]

Steve06 · May 14, 2013

Dear usasma

,
thanks for your detailed analysis.

1) I will download the latest driver from the Realtek homepage. The only thing I find confusing is that when I look up the driver date of the currently installed driver in device manager, it is from 2012 - but maybe this does not apply to this specific .sys file. Still, I will run the update and try to see if the version of the .sys file changes.

2) Thanks for pointing out the Windows Updates. I run them twice (after the first run no more were found) and 7 more updates were installed, so that I should now be at 63.

3) The SSD has never had new firmware released (checked with Intel SSD Toolbox), so it is up to date. By storage controller I assume you mean the "Intel 7 Series/C216 Chipset Family SATA AHCI Controller" in my device manager. Driver date is 2012 and Windows Update does propose a more recent one, but will try to look myself on Intel's page.

4) Regarding the deactivated network devices, I indeed deliberately deactivated the Wifi and Bluetooth as I do not use them at the moment (PC is connected via LAN). The Cisco is a VPN connection device that gets switched on and off automatically by the Cisco client software when I connect to my company's network.

5) The Broadcom LAN driver was updated by me right after the installation of Windows 8 using the latest driver posted on Broadcom's website. Maybe it is this new version that is flawed and I should have sticked to the version installed by Windows or the one by my motherboard manufacturer (Asrock)?

I'll keep you posted on how these improvements work out. Let me know please if anybody as another idea.

Many thanks,
Steve

Steve06 · May 14, 2013

Update:
- Installed latest Realtek driver from Realtike site but unfortunately the date of the MBfilt64.sys file is still quite old, 18th Nov 2009, but still a bit newer than previously.

- I installed and ran https://downloadcenter.intel.com/De...hipset+Software+Installation+Utility&lang=eng and hope that took care of installing the latest chipset/SATA driver.

- I activated the Intel Wifi device and installed the newest driver version. Then I ran Intel's driver detection utiltity (Intel® Driver Update Utility) and everything from Intel seems up to date.

Mookalookabutu · May 14, 2013

Very smart and dedicated Usasma and I hopefully have made problem disappear, along with effort of you!

If no, we-make-a-more help. Please tell us result when it make problem again or if some good time of no problem.

usasma · May 14, 2013

You can try the other Broadcom drivers - but I tend to trust those from the device manufacturer over those from the motherboard manufacturer or from Windows.

Otherwise, now we wait. Hopefully the BSOD's will stop and we'll have a happy ending here!

Steve06 · May 15, 2013

Thanks for your efforts, today there was a new, slightly different crash.
Suddenly the LAN connection stopped working and then I wanted to start Windows own problem resolution routines there was a BSOD stating system_thread_exception_not_handled and k57nd60a.sys .

I googled up the latter and it seems related to the Broadcom Ethernet driver which, according to the device manager, is the same version as the one on Broadcom's website. Should I go back to Asrock's version? Or should I uninstall the driver completely (is clicking uninstall enough for that or is some deeper clean up necessary?) and just reinstall the current one?

I have attached the new dump etc.

usasma · May 15, 2013

As you've found, this one also points to the Broadcom driver.
But, it also points out some other networking issues - namely an outdated (2009) Juniper Networks Network Connect VPN software.
So, don't change the Broadcom driver just yet.

I'd suggest removing the Juniper program entirely
Then monitor for further BSOD's
Should the BSOD's continue, then run Driver Verifier according to these instructions: Driver Verifier Settings

Please also update your Realtek HD Audio drivers - as they date from 2009 also.
If there are no updated drivers at the system/mobo site, download them from Realtek

Analysis:
The following is for informational purposes only.

Code:

[FONT=lucida console]**************************Wed May 15 08:01:32.427 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\051513-9953-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16551.amd64fre.win8_gdr.130306-1502
System Uptime:[B]0 days 14:57:03.741[/B]
*** WARNING: Unable to verify timestamp for k57nd60a.sys
*** ERROR: Module load completed but symbols could not be loaded for k57nd60a.sys
Probably caused by :[B]k57nd60a.sys ( k57nd60a+652da )[/B]
BugCheck [B]1000007E, {ffffffffc0000005, fffff8800486b2da, fffff880178f3168, fffff880178f29a0}[/B]
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x1000007E"]SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)[/URL]
Arguments: 
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800486b2da, The address that the exception occurred at
Arg3: fffff880178f3168, Exception Record Address
Arg4: fffff880178f29a0, Context Record Address
PROCESS_NAME:  System
BUGCHECK_STR:  AV
FAILURE_BUCKET_ID: [B]AV_k57nd60a+652da[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/FONT]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[FONT=lucida console]**************************Wed May 15 08:01:32.427 2013 (UTC - 4:00)**************************
[COLOR=RED][B]dsNcAdpt.sys                Mon Mar 30 22:33:33 2009 (49D180FD)[/B][/COLOR]
[COLOR=RED][B]MBfilt64.sys                Thu Jul 30 23:40:32 2009 (4A7267B0)[/B][/COLOR]
irstrtdv.sys                Thu Jul 12 19:58:02 2012 (4FFF648A)
asmtxhci.sys                Mon Aug 20 08:28:15 2012 (50322D5F)
asmthub3.sys                Mon Aug 20 08:28:29 2012 (50322D6D)
k57nd60a.sys                Sun Aug 26 00:58:34 2012 (5039ACFA)
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
dump_iaStorA.sys            Mon Nov 19 15:09:40 2012 (50AA9204)
iaStorA.sys                 Mon Nov 19 15:09:40 2012 (50AA9204)
HECIx64.sys                 Mon Dec 17 14:32:21 2012 (50CF7345)
IntcDAud.sys                Fri Jan 11 08:55:16 2013 (50F019C4)
igdkmd64.sys                Wed Mar 20 00:25:41 2013 (51493A45)
pmouself.sys                Mon Mar 25 19:40:16 2013 (5150E060)
phidmice.sys                Mon Mar 25 19:46:51 2013 (5150E1EB)
RTKVHD64.sys                Fri Mar 29 09:40:06 2013 (515599B6)
[/FONT]

Steve06 · May 15, 2013

The problem is that I need the Juniper VPN client sometimes to remote desktop to my workplace's PC. I can ask them if they can make an updated driver version available as I do not think I can download it myself.

Regarding the Broadcom device, I made an interesting discovery:
The driver date on Broadcom's site, which is currently installed, is more recent (01/26/13) than on Asrock's (11/1/2012), however the version number at Broadcom is inferior (15.4.0.9) compared to Asrock (15.4.4.1).
Websites: ASRock > Z77E-ITX , Ethernet NIC NetLink Driver Downloads | Broadcom

I don't understand how it can be that Asrock has a higher version number, but at this point I should probably give it a try?

The other odd thing is that the Realtek driver on Asrock's site has a different numbering ("Realtek high definition audio driver ver:6699") than on Realtek's (2.71). Currently the newest driver from Realtek is installed and this does not seem to have updated the MBfilt64.sys as per your analysis.

The final oddity is that the date for MBfilt64.sys given in the dump is older than the date I get when I track down the file in Windows Explorer (18th Nov 2009).

I'm not sure what to make of all this.

usasma · May 15, 2013

Temporarily remove the Juniper stuff to see if it's the cause - you can always reinstall it later on. Ask the IT folks for help with the version that they've given you. Mention that you're using a 2009 driver on Win8 - which was released on Oct 26, 2012. We did see issues with Juniper back in the testing days of Win8 - but haven't seen anything recently.

Don't worry about the audio stuff right now. We'll deal with it if the networking stuff turns out to be a dead end.
Driver versioning is up to the people that write the driver. While it's possible that Realtek may have written a driver just for AsRock - why wouldn't they mention it/upload it to their webiste? It's also possible that AsRock has modified the driver using their own driver developers. Also, files have at least 3 dates - Created, Modified, and Last Accessed

Mookalookabutu · May 15, 2013

I concur. Very likely Juniper VPN as shown.

Steve06 · May 17, 2013

PC crashed again when switching it on after hibernation. While it was off, I had turned off the power from the socket as I usually did when going to bed and the PC was hibernating and therefore turned off. Previously, it never caused any problem to switch off the power from the socket to which the PC power cable was plugged in.

I should say that I had NOT uninstalled Juniper yet but installed Broadcom driver from Asrock's website.

Have contacted my admin though who said they will soon buy new VPN appliances. Will uninstall Juniper and repeat what I did before.

Here are the dumps again.

UPDATE: The blue screen mentioned k57nd60a.sys (Broadcom) again and something about "IRQL less or not equal..."

In the meantime, I also contacted Asrock support to enquire about what the best driver is and if for the Broadcom device they have a custom one, but have not received any answer yet.

In case I want to reinstall the Broadcom driver by taking the one from Asrock (again), how do I uninstall the existing driver properly and thoroughly - is clicking uninstall in device manager enough? Just want to make sure there are no remaining bits of a potentially wrong driver causing all this trouble...

Steve06 · May 17, 2013

I have now uninstalled Juniper completely.

However, I still run into trouble when I shut the PC off by clicking on "Hibernate", and then a few seconds after the fans and lights stop running disconnect it from power supply by pressing a button my socket. Afterwards, when I want to resume, it boots up but crashes. The last time the screen remained black after the cyan-colored Windows logo and nothing else happened.

Resuming from hibernation if the power was not shut off is no problem on the other hand.

However, it should work even in the event of a power failure and in case of this exactly same hardware it used to work under Windows 7 before I did clean install of Windows 8. So it must be a software, settings or BIOS issue.

In my BIOS I noticed that "Deep sleep" is enabled for S5 mode (=real shut down), implying that only then the USB ports are powered off. I don't think this should have any bearing.

Any idea?

usasma · May 18, 2013

I was out late last night (driving to pickup stuff for my wife) and am late for work.
I've got a dinner tonight about 2 hours from here, but I'll try to get back on this evening.
Please let us know if there are any BSOD's after removing the Juniper software.

The network driver is still involved - yet you've installed another version. This says to me that it's probably not the network driver (having the same error in 2 different versions of the driver is unlikely IMO)

Juniper remains the prime suspect here. As you've uninstalled it, let's just wait and see if that fixed (stopped) the BSOD's.

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Fri May 17 10:16:50.753 2013 (UTC - 4:00)**************************
Loading Dump File [C:\Users\Owner\SysnativeBSODApps\051713-11953-01.dmp]
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Built by: [B]9200[/B].16581.amd64fre.win8_gdr.130410-1505
System Uptime:[B]1 days 15:22:21.258[/B]
*** WARNING: Unable to verify timestamp for k57nd60a.sys
*** ERROR: Module load completed but symbols could not be loaded for k57nd60a.sys
Probably caused by :[B]k57nd60a.sys ( k57nd60a+f90f )[/B]
BugCheck [B]D1, {fffffb086333c3cc, 2, 0, fffff8800469a90f}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000D1]DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)[/url]
Arguments: 
Arg1: fffffb086333c3cc, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8800469a90f, address which referenced memory
BUGCHECK_STR:  AV
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID: [B]AV_k57nd60a+f90f[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Fri May 17 10:16:50.753 2013 (UTC - 4:00)**************************
[COLOR=RED][B]dsNcAdpt.sys                Mon Mar 30 22:33:33 2009 (49D180FD)[/B][/COLOR]
[COLOR=RED][B]MBfilt64.sys                Thu Jul 30 23:40:32 2009 (4A7267B0)[/B][/COLOR]
irstrtdv.sys                Thu Jul 12 19:58:02 2012 (4FFF648A)
asmtxhci.sys                Mon Aug 20 08:28:15 2012 (50322D5F)
asmthub3.sys                Mon Aug 20 08:28:29 2012 (50322D6D)
k57nd60a.sys                Sun Aug 26 00:58:34 2012 (5039ACFA)
intelppm.sys                Mon Nov  5 22:55:02 2012 (50988A16)
dump_iaStorA.sys            Mon Nov 19 15:09:40 2012 (50AA9204)
iaStorA.sys                 Mon Nov 19 15:09:40 2012 (50AA9204)
hiber_iaStorA.sys           Mon Nov 19 15:09:40 2012 (50AA9204)
HECIx64.sys                 Mon Dec 17 14:32:21 2012 (50CF7345)
IntcDAud.sys                Fri Jan 11 08:55:16 2013 (50F019C4)
igdkmd64.sys                Wed Mar 20 00:25:41 2013 (51493A45)
pmouself.sys                Mon Mar 25 19:40:16 2013 (5150E060)
phidmice.sys                Mon Mar 25 19:46:51 2013 (5150E1EB)
RTKVHD64.sys                Fri Mar 29 09:40:06 2013 (515599B6)
[/font]

PC crashed when going into hibernation

New Member

My Computer

Banned

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

New Member

My Computer

Banned

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer

Banned

My Computer

New Member

My Computer

New Member

My Computer

Mr. Cranky Pants

My Computer