computer blue screens after wake up from sleep mode

[johntitor123]

Recently after waking up my computer from sleep mode it blue screened. It never did this before. It wasn't doing anything special. The night before I was installing games from steam, and watching twitch streams. I remember after the games finished downloading completely from steam I remember getting sleepy myself and left the web browser on the twitch stream and went to bed. When I woke up my self I pressed the keyboard to wake the computer up from sleep mode...that's when it blue screened. I then restarted it manually to get back into windows. When it comes to blue screens i am pretty clueless as what to do. I saw the dump file after i restarted was created and I thought I would post it here. Maybe someone can help me out? Also I looked up how to run Windbg and here are the results. Also here is some background information of my system:
Windows 7 64bit, intel i5, gskill ripjaws 8gb of ram (2x4gb), nvidia gtx 970, z97x-sli motherboard, 1tb wd blue. dump file as follows. please help me out guys i dont know what to do.


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\John Titor\Desktop\030215-13962-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18717.amd64fre.win7sp1_gdr.150113-1808
Machine Name:
Kernel base = 0xfffff800`03057000 PsLoadedModuleList = 0xfffff800`0329b890
Debug session time: Mon Mar 2 11:52:09.940 2015 (UTC - 7:00)
System Uptime: 0 days 14:35:06.126
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa0006df74e0, 2, 0, fffff8000317df1f}

Probably caused by : memory_corruption ( nt!MiIdentifyPfn+23f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa0006df74e0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000317df1f, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003305100
fffffa0006df74e0

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiIdentifyPfn+23f
fffff800`0317df1f 4c8b7500 mov r14,qword ptr [rbp]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: fffff880097943a0 -- (.trap 0xfffff880097943a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0a00000000000020
rdx=000000000004b6c2 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000317df1f rsp=fffff88009794530 rbp=fffffa0006df74e0
r8=000000000004b6c3 r9=0000000000000001 r10=0000000000000042
r11=0000058000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MiIdentifyPfn+0x23f:
fffff800`0317df1f 4c8b7500 mov r14,qword ptr [rbp] ss:0018:fffffa00`06df74e0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800030cb469 to fffff800030cbec0

STACK_TEXT:
fffff880`09794258 fffff800`030cb469 : 00000000`0000000a fffffa00`06df74e0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`09794260 fffff800`030ca0e0 : 00000000`42506650 00000000`00000000 00000000`00000000 02000000`0004af42 : nt!KiBugCheckDispatch+0x69
fffff880`097943a0 fffff800`0317df1f : 00000000`00000000 02000000`0004af42 00000000`42506600 fffff800`033ba187 : nt!KiPageFault+0x260
fffff880`09794530 fffff800`0317ebfb : 00000000`00000000 00000000`00000004 fffffa80`06e60988 fffffa80`06e60000 : nt!MiIdentifyPfn+0x23f
fffff880`097945d0 fffff800`034e2455 : fffffa80`06e60000 fffff880`09794b60 fffff880`097946a8 00000000`00000000 : nt!MmQueryPfnList+0xbb
fffff880`09794610 fffff800`03426418 : 00000000`00000006 00000000`00000000 fffffa80`06e60000 00000000`00000001 : nt!PfpPfnPrioRequest+0x115
fffff880`09794660 fffff800`033d94b3 : 00000000`00000000 00000000`00000000 00000000`64496d4d fffffa80`64496d01 : nt! ?? ::NNGAKEGL::`string'+0x42d2d
fffff880`097946f0 fffff800`033d9d29 : 00000000`02b7b748 fffff800`030ce712 00000000`02b7b7a0 00000000`02b7b768 : nt!ExpQuerySystemInformation+0x1193
fffff880`09794aa0 fffff800`030cb153 : fffffa80`0bfdc670 00000000`03b3aca0 00000000`03b3aca0 00000000`04043780 : nt!NtQuerySystemInformation+0x4d
fffff880`09794ae0 00000000`76d2161a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02b7b678 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d2161a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiIdentifyPfn+23f
fffff800`0317df1f 4c8b7500 mov r14,qword ptr [rbp]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!MiIdentifyPfn+23f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 54b5f6ff

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0xA_nt!MiIdentifyPfn+23f

BUCKET_ID: X64_0xA_nt!MiIdentifyPfn+23f

Followup: MachineOwner
---------

 

[Kadathan]

It looks like it's probably a driver that isn't handling memory addresses very well and either needs to be updated or removed. Without seeing your setup, I can't really take a guess as to what it is.
There's a few ways to approach this sort of problem.

Probably the easiest is to try a program called whocrashed which will sort through the mess that is a crash dump for you, and tell you what is the likely culprit driver. It's not 100% reliable but it gives some things to try and may very well isolate the driver for you.

If you don't want to try that program or if it doesn't give you a productive answer, there is an alternative, manual method.

Note: If you're not really sure what you're doing, follow these instructions carefully! If I specify something, it's not arbitrary. It matters. Follow these instructions at your own risk, if you aren't certain on this stuff it's a good idea to look up a guide on how to do it as well.

You can open msconfig by typing in the start menu, type msconfig , or windows key + r will open a run menu and type msconfig there and hit enter. Click the startup tab and disable all startup items, and click on services and click "Hide all microsoft services", then click disable all. From here you have a mostly clean booting machine, so apply changes and restart. Now try to get your machine to go to sleep and wake it up, see if the crash is still happening. Now hopefully, the machine crashes every time you wake it from sleep, because at least that is easy to troubleshoot(Compared to "It sometimes bluescreens!" kind of intermitent issues) so if you don't crash after the msconfig changes, restart, then sleep/wake test then it probably means something you disabled was causing it, which means it's a short jump from here to fixing the problem.

Assuming the machine doesn't crash after the wake test, go back into msconfig. I'll assume you know nothing about startup items or the programs you have installed to simplify this, if I'm wrong then you probably have an idea how to narrow it down yourself. Select half of all items in the services list, make sure to select them all in one big group, either the top half of the list or the lower half. Apply changes and restart. Check if computer crashes when waking up. If it does, then the problem lies with one of the services you've just enabled, so go deselect half of the ones you just turned on and restart again, wake test again. If the bluescreen is gone, then you deactivated the service causing it, so go back to msconfig and turn off the remaining ones, and turn on the ones you disabled before the last test. One of them is the problem, so split them in half and keep drilling down until you have only one service left that when left on, gives BSOD, and when turned off, sleep/wake works normally.

If you turned on half of the services and didn't get bsod, turn on the other half and try again. If there's still no bsod, then the problem will lie in the Startup list, so go do the same process for those, turning on groups at a time and testing to see if the bsod returns, and when it does drill down until you have only the one that turning it on or off toggles the crash. Note that you want to test services first, since you should have all services enabled before you go and start turing on items in the startup list. So if services have all been ruled out as the problem, then turn them all on before continuing to startup items.

You can of course do this in any way you want, I'm just proposing a way to narrow it down faster than turning items on one at a time and testing. There's a name for this kind of simple search but it is long forgotten to me

You can of course leave off all startup stuff as well if you don't want to bother, but some programs might stop working if you disable their dependancies.

Hopefully this helps you narrow down the culprit, then all that's left is to identify the program that deals with the driver and update said program, or uninstall it. That should resolve the crashes.

Edit: Forgot to mention, that if disabling all of this stuff doesn't fix the problem, then it may be a system driver that is causing the problem, which is a little more difficult to troubleshoot. That or I may be wrong and maybe it's not a driver at all, that's just what it looks like to me, maybe someone else has some insight.

 

[johntitor123]

okay i will try. ill let you know how it turns out

 

[johntitor123]

I ran that driver verifier and it crashed it a few more times. something or some driver was causing ntoskrnl.exe to crash. ehhh i just couldnt narrow it down and was getting frustrated. well i decided that I would just reformat my entire drive. it fixed it. and no more blue screens. I figure if i start out fresh it would be better. I thought it might be the ram at first and did the memtest86 and it ran it with zero errors on all tests for a couple hours. I did re seat the ram, graphics card, and hard drive just to be sure. All of that seems to have fixed it. though i know better next time to make a back up of all my movies on usb drive... ahh o well. hehe. thanks for help kada.

 

[Kadathan]

Sorry it didn't work out the best, a format is always so much work getting everything back to the way you want it. Keep in mind, also, that if you have access to another computer, it is trivial to pull data off of a hardrive if you plug it in as a secondary disk on the other computer. Can't recover programs but data files are easy to recover.