BSOD upon waking from sleep

r33tpoopet · Mar 20, 2015

Hi everyone,

I've had the current computer I am running for a about a year now and have been getting BSODs inconsistently when waking the computer from sleep. As in sometimes it will wake fine, other times it crashes with various BSOD messages (isn't always the same). I built the computer myself and can usually fix most problems I face with PCs but the process of analysis .dmp files is foreign to me.

I've included the dump files of my computer and let me know if any other information is needed.

Cheers,

Sam

blueelvis · Mar 23, 2015

Hi Sam & Welcome to the forums ^_^,

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would have overwritten the function's return address and jumped back to an arbitrary address when the function returned. This is the classic "buffer overrun" hacking attack and the system has been brought down to prevent a malicious user from gaining complete control of it. Do a kb to get a stack backtrace -- the last routine on the stack before the buffer overrun handlers and bugcheck call is the one that overran its local variable(s).

Code:

Arguments:
Arg1: [COLOR=#FF0000][B]00000b0a53fb2f86[/B][/COLOR], Actual security check cookie from the stack
Arg2: [COLOR=#0000FF][B]00000b0a53fb2f86,[/B][/COLOR] Expected security check cookie
Arg3: ffffd466d2205dcd, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

So, if we compare the actual and expected security cookies, you would see that the security cookies are the same. That is strange. Let's do the KB to get the stack backtrace -

Code:

0: kd> knL
 # Child-SP          RetAddr           Call Site
00 ffffd000`211d9058 fffff801`c4feb426 nt!KeBugCheckEx
01 ffffd000`211d9060 00000000`000000f7 nvlddmkm+0x18f426
02 ffffd000`211d9068 00000b0a`53fb2f86 0xf7
03 ffffd000`211d9070 00000b0a`53fb2f86 0x00000b0a`53fb2f86
04 ffffd000`211d9078 ffffd466`d2205dcd 0x00000b0a`53fb2f86
05 ffffd000`211d9080 00000000`00000000 0xffffd466`d2205dcd

So, according to the stack and the other dump file (I have not posted here since with that dump file, I was having some symbol problems

), it seems that the NVIDIA driver is causing this problem.
Below is a list of 3rd party drivers present on your system -

Code:

**************************Fri Mar 20 11:47:41.118 2015 (UTC + 5:30)**************************
[B][U]LGBusEnum.sys               Tue Nov 24 07:06:48 2009 (4B0B38B0)
[COLOR=#FF0000]3xHybr64.sys                Wed Oct 13 09:38:20 2010 (4CB530B4)
[/COLOR][/U][/B]LGSHidFilt.Sys              Thu May 30 20:46:33 2013 (51A76D51)
mvxxmm.sys                  Tue Jul 30 12:21:32 2013 (51F76274)
mvs91xx.sys                 Tue Jul 30 12:22:22 2013 (51F762A6)
intelppm.sys                Thu Aug 22 14:16:35 2013 (5215CFEB)
RTKVHD64.sys                Fri Mar 14 16:33:23 2014 (5322E1FB)
xusb22.sys                  Tue Mar 18 13:48:41 2014 (53280161)
LHidEqd.Sys                 Wed Mar 19 05:50:53 2014 (5328E2E5)
LEqdUsb.Sys                 Wed Mar 19 05:50:55 2014 (5328E2E7)
LHidFilt.Sys                Wed Mar 19 05:51:03 2014 (5328E2EF)
iwdbus.sys                  Wed Jun 18 03:24:22 2014 (53A0B90E)
A6210.sys                   Thu Aug 14 17:51:57 2014 (53ECA9E5)
IntcDAud.sys                Tue Sep  9 18:06:30 2014 (540EF44E)
igdkmd64.sys                Mon Sep 29 23:21:21 2014 (54299C19)
nvlddmkm.sys                Thu Nov 13 02:21:31 2014 (5463C853)
nvvad64v.sys                Thu Nov 20 21:03:54 2014 (546E09E2)
NvStreamKms.sys             Mon Jan 12 23:26:42 2015 (54B40ADA)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sun Mar  8 06:14:57.858 2015 (UTC + 5:30)**************************
gdrv.sys                    Fri Mar 13 08:52:29 2009 (49B9D175)
etdrv.sys                   Fri Mar 20 08:29:06 2009 (49C3067A)
etocdrv.sys                 Tue Apr 16 13:50:56 2013 (516D09E8)

Please update your WinFast DTV1000 Analog Capture driver from this **LINK**. The driver is quite outdated and I won't be surprised if this is the culprit. Also, if there are no available updates, please physically disconnect the device from the system and then test the system for stability.
If the above step does not solve the problem, kindly remove your NVIDIA driver using the Display Driver Uninstaller from this **LINK**. Once you have removed the NVIDIA driver, install the latest driver from NVIDIA's site and then check the system for stability.

Let me know how it goes ^_^

-Pranav

BSOD upon waking from sleep

r33tpoopet

New Member

My Computer

System One

blueelvis

OMG Debugger!

My Computer

System One