Solved Windows 8 crash randomly when entering sleep mode

[demonguy]

Actually, the problem is that my computer can't enter S3 sometimes rather than waking up from S3...
And i've disabled either "power management function" or "selective suspend", or both of them, after these 3 tests, i found only disable "selective suspend" can solve this problem....that's why i reply here after nearly 2 weeks and ask about "USB driver"...

I've submitted to the Ralink about this , but no reply after a week. I don't think they take this problem seriously.

 

[Anshad Edavana]

I don't think they take this problem seriously.

I respect Realtek as they have the best support in my opinion. Some time ago, i Emailed Realtek inquiring about the availability of XP driver for a particular WLAN card (in a Toshiba laptop). Most companies will ignore this but to my surprise they send me a reply with direct download link to the driver.

 

[demonguy]

yeah，realtek replyed me too. But I'm talking about Ralink. Lol

 

[Anshad Edavana]

Realtek , Ralink , Atheroz and Broadcom are only doing OEM business. Legally they are not responsible to provide any support to the end user. It is the device manufacturer who is supposed to provide driver updates and support. It will be better to send a mail to the card manufacturer than Ralink.

 

[demonguy]

I know,but manufacturer of my NIC is so lazy that the driver on their websites is created in 2011 and can't support win8 at all. When I contact to them ,they just said my NIC doesn't support win8, and I finally found the latest driver on ralink's websites.
So even if they don't reply me ,I still hope they can fix it in the next version

 

[Anshad Edavana]

Hi

In my opinion, you don't need to worry about this issue. BSOD F9 is very common with wireless cards (especially USB one) and you are not the only one affected. As long as the power management is disabled, your card will work fine and there is nothing wrong with that. Ralink is not like Realtek. They don't usually updates the drivers frequently. At least you were lucky to find a native "Windows 8" driver.

 

[demonguy]

Yes,you are right. Thanks very much

 

[demonguy]

Hi

In my opinion, you don't need to worry about this issue. BSOD F9 is very common with wireless cards (especially USB one) and you are not the only one affected. As long as the power management is disabled, your card will work fine and there is nothing wrong with that. Ralink is not like Realtek. They don't usually updates the drivers frequently. At least you were lucky to find a native "Windows 8" driver.

Oh my god, it BOSD again(this time i unplugged my wireless NIC), and i analyze it shows pci.sys..... what's wrong with my computer....

 

[Anshad Edavana]

Hi

This time it is the LAN driver which is blamed in the dump.

BugCheck 9F, {3, fffffa8006bfd060, fffff8800348e7f0, fffffa800ea291c0}


Probably caused by : pci.sys


Followup: MachineOwner
---------


2: kd> !irp fffffa800ea291c0
Irp is active with 4 stacks 3 is current (= 0xfffffa800ea29320)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 fffffa800a5d6050 00000000 fffff80019be9da0-fffffa800d1559f0 Success Error Cancel pending
          Unable to load image \SystemRoot\system32\DRIVERS\Rt630x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt630x64.sys
*** ERROR: Module load completed but symbols could not be loaded for [COLOR=#ff0000][B]Rt630x64.sys[/B][/COLOR]
 \Driver\RTL8168    nt!PopSystemIrpCompletion
            Args: 00014400 00000000 00000004 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa800d1559f0    


            Args: 00000000 00000000 00000000 00000000
2: kd> lmvm Rt630x64
start             end                 module name
fffff880`03e73000 fffff880`03f40000   Rt630x64 T (no symbols)           
    Loaded symbol image file: Rt630x64.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt630x64.sys
    Image name: Rt630x64.sys
    Timestamp:        Thu [COLOR=#ff0000][B]Aug 15 11:53:59 2013[/B][/COLOR] (520C73FF)
    CheckSum:         000CE980
    ImageSize:        000CD000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As you can see, LAN driver is already up to dated so my best guess is some other driver is preventing your network interface devices to switch states. Previously it was the WiFi and now it is the Ethernet. There is no way to directly find which driver is interfering with the network adapters so we should do a trial and error approach.

There is two network filter drivers present in your system. They are VMware bridge driver and Kaspersky Lab Intermediate Network Driver.

vmnetbridge.sys Sun Jul 8 13:29:19 2012 (4FF93DD7)
VMware bridge driver
http://www.carrona.org/drivers/driver.php?id=vmnetbridge.sys

klim6.sys Thu Aug 2 16:38:40 2012 (501A5FB8)
Kaspersky Lab Intermediate Network Driver
http://www.carrona.org/drivers/driver.php?id=klim6.sys


Please try the below steps.

1. Uninstall VMware as a test.

You can re-install it (if needed) the latest version once the issue is resolved. For now, leave it uninstalled.

2. Update Kaspersky.

Uninstall Kaspersky but save the licencing information.

Then download and install the latest trial version from the official site.

Free Kaspersky Internet Security 2014 Trial | Kaspersky Lab US

It will be auto activated.

3. Disable power management of Realtek Ethernet adapter (as per the previous instructions).

 

[demonguy]

Hi

This time it is the LAN driver which is blamed in the dump.

BugCheck 9F, {3, fffffa8006bfd060, fffff8800348e7f0, fffffa800ea291c0}


Probably caused by : pci.sys


Followup: MachineOwner
---------


2: kd> !irp fffffa800ea291c0
Irp is active with 4 stacks 3 is current (= 0xfffffa800ea29320)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    


            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 fffffa800a5d6050 00000000 fffff80019be9da0-fffffa800d1559f0 Success Error Cancel pending
          Unable to load image \SystemRoot\system32\DRIVERS\Rt630x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt630x64.sys
*** ERROR: Module load completed but symbols could not be loaded for [COLOR=#ff0000][B]Rt630x64.sys[/B][/COLOR]
 \Driver\RTL8168    nt!PopSystemIrpCompletion
            Args: 00014400 00000000 00000004 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa800d1559f0    


            Args: 00000000 00000000 00000000 00000000
2: kd> lmvm Rt630x64
start             end                 module name
fffff880`03e73000 fffff880`03f40000   Rt630x64 T (no symbols)           
    Loaded symbol image file: Rt630x64.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt630x64.sys
    Image name: Rt630x64.sys
    Timestamp:        Thu [COLOR=#ff0000][B]Aug 15 11:53:59 2013[/B][/COLOR] (520C73FF)
    CheckSum:         000CE980
    ImageSize:        000CD000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

As you can see, LAN driver is already up to dated so my best guess is some other driver is preventing your network interface devices to switch states. Previously it was the WiFi and now it is the Ethernet. There is no way to directly find which driver is interfering with the network adapters so we should do a trial and error approach.

There is two network filter drivers present in your system. They are VMware bridge driver and Kaspersky Lab Intermediate Network Driver.

vmnetbridge.sys Sun Jul 8 13:29:19 2012 (4FF93DD7)
VMware bridge driver
http://www.carrona.org/drivers/driver.php?id=vmnetbridge.sys

klim6.sys Thu Aug 2 16:38:40 2012 (501A5FB8)
Kaspersky Lab Intermediate Network Driver
http://www.carrona.org/drivers/driver.php?id=klim6.sys


Please try the below steps.

1. Uninstall VMware as a test.

You can re-install it (if needed) the latest version once the issue is resolved. For now, leave it uninstalled.

2. Update Kaspersky.

Uninstall Kaspersky but save the licencing information.

Then download and install the latest trial version from the official site.

Free Kaspersky Internet Security 2014 Trial | Kaspersky Lab US

It will be auto activated.

3. Disable power management of Realtek Ethernet adapter (as per the previous instructions).

Ok, i will try, but this time i can't uncheck the Allow the computer to turn off this device because i need "Wake on LAN" feature. I will uninstall the two program to see if there is problem

 

[demonguy]

After one week's test, now i confirmed that this problem is caused by vmware virtual adapter, it's solved after uninstalling it...
But it's amazing, how could know it's karper adapter or vmware adapter which cause this problem? why can't it be other drivers or applications?
In Windows Internals. i noticed that all drivers share one virtual space which mean drivers can affect each other accidentally, so is it the reason why you know only other drivers can cause this rather than applications?But how could you narrow it down to only two drivers?

 

[Anshad Edavana]

i noticed that all drivers share one virtual space which mean drivers can affect each other accidentally

Yes, a badly programmed driver can affect other drivers. Buffer overflow and pool leaks are some examples. If a driver modifies another driver's stack area, most probably the affected driver will be blamed on the crash dump. That is why we advise to update all outdated drivers regardless of whether they are blamed in the Probably caused line of Windbg.

But how could you narrow it down to only two drivers?

There was a clear pattern in the crashes. First it was the WLAN driver and then it was the LAN driver blamed in the crashes. Those drivers are already updated so we can assume it will be a third driver which is affecting the operation of LAN and WLAN. Since the unknown driver is only causing problem to network interfaces, i guessed the culprit could be a network filter driver and that is why i suggested to remove them one by one as a test.

There are people who can precisely narrow down the faulty driver by examining a full memory dump or Kernel memory dump. Extensive knowledge in Windows internals, programming, assembly language etc are required to do that. I only know the basics of Windbg and i think i didn't even scratched the surface of crash dump analysis.

 

[demonguy]

What is a "Filter driver?"
Here is what i understand, Filter driver is attached to a existed driver so it can call some functions of the existed driver.... So the Vmware virtual driver can use the network resources of my main network driver, so make it looks like the virtual driver can have network connection. but a filter driver must stay in the same stack of the main driver so it's highly probably that the filter driver will wrongly modified the existed driver? Am i right?

 

[Anshad Edavana]

So the Vmware virtual driver can use the network resources of my main network driver, so make it looks like the virtual driver can have network connection. but a filter driver must stay in the same stack of the main driver so it's highly probably that the filter driver will wrongly modified the existed driver? Am i right?

Yes, you understand it correctly.

 

[demonguy]

Thanks