Windows 7 blue screen after Sleep

Hi,

 

Its worth having a look at this page on resuming from hibernation issues.

And these articles maybe of some help :

http://support.microsoft.com/kb/977186 - Error message when you try to resume a Windows 7-based or a Windows Server 2008 R2-based computer from hibernation: "Stop 0x0000009F"

http://support.microsoft.com/kb/977178 - You receive various Stop error messages in Windows 7 or in Windows Server 2008 R2 when you try to resume a computer that has a large SATA hard disk

 

good luck

 

Also, can you zip up any minidump file(s) in the C:\Windows\Minidump folder and make available (provide link) via Windows Live SkyDrive or similar site?

The following link has information on using Windows Live SkyDrive:

http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65

If you have problems zipping the minidump files copy the minidump files to another location such as a folder on the Desktop

Also, you do not necessarily have to zip up the minidump files, you can upload them one at a time.

Hi,

Here is a starting point for analyzing the minidumps,

http://mikemstech.blogspot.com/2011/11/windows-crash-dump-analysis.html

Alternatively, please upload to skydrive and post a link,

http://mikemstech.blogspot.com/2010/08/skydrive-uploading-files-for-community.html

Hi,

I have uploaded the minidump from a few days ago here as well as some photos from my phone of the latest BSOD's

The minidump is from prior to the BSOD photos.  I notice there is a difference between the two BSOD photos and both are saying physical memory dump failed, hence no minidumps I imagine.

Minidump

The error from the minidump indicates that there is a possible hardware issue. To help rule out a hardware issue, can you test the RAM, then examine the statistics on the hard drive,

http://mikemstech.blogspot.com/2011/11/troubleshooting-memory-errors.html

http://mikemstech.blogspot.com/2011/12/how-to-detect-failing-hard-drive.html

Looking at the error message on the blue screens, this definitely looks like a hardware issue,

# for hex 0xc000009c / decimal -1073741668 :
  STATUS_DEVICE_DATA_ERROR                                      ntstatus.h
# 1 matches found for "c000009c"


0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fb400000f0, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000056, error status (normally i/o status code)
Arg3: 0000000013690884, current process (virtual address for lock type 3, or PTE)
Arg4: fffff6800001e000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000056 - A non close operation has been requested of a file object with a delete pending.

BUGCHECK_STR:  0x7a_c0000056

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b38b52 to fffff80002ac7c40

STACK_TEXT: 
fffff880`0a147688 fffff800`02b38b52 : 00000000`0000007a fffff6fb`400000f0 ffffffff`c0000056 00000000`13690884 : nt!KeBugCheckEx
fffff880`0a147690 fffff800`02aef6cf : fffffa80`05cb98d0 fffff880`0a147800 fffffa80`03bada98 fffffa80`05cb98d0 : nt! ?? ::FNODOBFM::`string'+0x37bba
fffff880`0a147770 fffff800`02ad602a : 00000000`00000000 00000000`00000008 ffffffff`ffffffff fffffa80`0838bb60 : nt!MiIssueHardFault+0x28b
fffff880`0a147840 fffff800`02aaa90a : 00000000`00000000 fffff680`0001e000 00000000`00000000 fffffa80`0838bb60 : nt!MmAccessFault+0x146a
fffff880`0a1479a0 fffff800`02b24d0c : fffff6fb`400000f0 00000000`00000000 fffffa80`03ab8340 ffffffff`00000420 : nt!MiMakeSystemAddressValid+0xea
fffff880`0a147a00 fffff800`02a934ca : fffffa80`03ab8340 fffffa80`03bad700 fffffa80`03bad700 00000000`03c00000 : nt! ?? ::FNODOBFM::`string'+0x14e01
fffff880`0a147a50 fffff800`02da2724 : fffff880`00000002 00000000`03c01000 fffffa80`03ab8340 00000000`00000000 : nt!MiQueryAddressSpan+0xaa
fffff880`0a147ac0 fffff800`02ac6ed3 : 00000000`00000160 fffffa80`0838bb60 fffff880`0a147bc8 00000000`000cada8 : nt!NtQueryVirtualMemory+0x382
fffff880`0a147bb0 00000000`7700154a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000cad88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7700154a


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+37bba
fffff800`02b38b52 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+37bba

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x7a_c0000056_nt!_??_::FNODOBFM::_string_+37bba

BUCKET_ID:  X64_0x7a_c0000056_nt!_??_::FNODOBFM::_string_+37bba

Followup: MachineOwner
---------

Also, the photos showed a reference to the ks.sys, a Windows driver.

It is possible the problem is software related.

There are some potentially problematic driver loaded on the system.

What i would suggest is to uninstall Daemon Tools and then uninstall the sptd.sys which may be from an older version of Daemon Tools or from Alcohol 120%.

To uninstall the sptd.sys see "How can I remove SPTD driver on 64-bit OS?" in the following link:

http://www.duplexsecure.com/en/faq

Also, there appears to be an older version of McAfee installed.

Update to the latest version of McAfee or uninstall McAfee and go with other security software such as Microsoft Security Essentials.

Then see if the error resolves.

 

KERNEL_DATA_INPAGE_ERROR (7a)

Did you look at the links i provided ? One of them refers to various stop messages. If you follow the link one of the "various" stop messages refers to is 7a. Its a hotfix. So did you follow it and how did you get on?

 

I can only provide the information its your choice whether you read it and follow it.

Hi, I just tried the hotfix from http://support.microsoft.com/kb/977178

When I went to install it It stated 'this update is not applicable to your computer'.

I will continue with the other suggestions.

Hi,

• Ran Windows Memory diagnostic tests overnight, no errors found.
• HDD smart checks all OK
• When I look at help > about for D-tools it says SPTD version: Not installed

Also, after the bluescreen and reboot, Windows comes back with my applications still open like it is resuming.

The BSOD does seem to change, the last one referenced afd.sys.  No new minidumps created.

I will still try uninstalling D-tools to tick it off the list.  I would like to only uninstall McAfee as a last resort.

I have uninstalled D-Tools and McAfee and am still getting blue screens on each resume from sleep.  Latest error stated afd.sys.  Dumps are still failing.