Win 8.1 - freeze after awaking from hibernation or standby

M

Megagoth1702

Active member
Joined
Jul 3, 2015
Posts
26
Hello guys,

I am new to these awesome forums and am happy that was able to solve a BSOD myself with the information provided here, thank you for that!

At the same time I am pretty desperate about one thing and I really hope for your help with this one.
010.png


My system is unstable and I have had this for a while now. Sometimes my PC freezes after I wake it up from hibernation or standby. No input is possible, no BSOD happens and all I can do is hard-reset my PC. There are no logs in the administrative eventlog so I really have no clue on what's going on.

From the how to post a BSOD post I learned that you guys need specific information to troubleshoot.Well - the SysnativeFileCollectionApp hangs on "waiting for SystemInfo" and perfmon /report is broken in Windows 8.1 so I had to use a workaround (running it from the GUI instead of CMD) to get you guys the data. The report.html is pretty ugly in German, sorry guys. :noidea:

What other information can I provide in orer to help you help me?

I had some memory issues a few months ago but I switched out the RAM and they were gone. I still will run Memtest overnight tonight. My hard drives are perfectly fine but if I find time tomorrow I will run the HDD Diagnostics tools.

Thank you very much in advance folks!
 

Attachments

We can give Driver Verifier a go. See if it picks up a driver misbehaving.

What is Driver Verifier?

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior.

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7 & 8/8.1)
- DDI compliance checking (Windows 8/8.1)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

- If you have the system set to generate Small Memory Dumps, they will be located in %systemroot%\Minidump.

- If you have the system set to generate Kernel-Memory Dumps, it will be located in %systemroot% and labeled MEMORY.DMP.
 
Hey Jared, thanks for your response!

I already have Driver Veryfier running. Thanks to information in this forum I used it to fix a BSOD and I keep it running to find flaws in drivers. :) There was a problem with the Realtek network driver. When I disabled "allow device to wake PC" and clicked "ok" a "driver_veryfier enabled" BSOD happened and WinDBG showed me the network driver as the corrupt one. I updated it and now it runs flawlessly.

By the way - is it safe/okay to keep driver veryfier running? I don't want to wait until the next BSOD and start the troubleshooting procedure from the beginning again, I'd rather get informative BSODs as soon as possible.

MemTest overnight was fine, 7 hrs = errors.

Perhaps it might be possible, that by fixing my BSODs with the network driver I also fixed my freeze issues, so far none have happened. But it only has been a day so I need to keep watching it.
 
Event Log says there are errors loading drivers, but for what devices?

Hey guys,

my eventlog says that there are errors loading drivers for device "some cryptic symbols and numbers"...
ExbPEg1.jpg
I have no idea what the device is, please can you help me out? How do I find the device mentioned? I attached the eventlog to this post.

I guess I have to re-install drivers for the device, right?
 

Attachments

Re: Event Log says there are errors loading drivers, but for what devices?

WudfRd is the Windows Usermode Driver Framework that provides a standard, and thus set of rules for software devices to abide by.
This means, it could be any piece of software, rather than a hardware device, and its associated device driver.

For example, an anti virus program uses the Usermode and Kernel mode driver framework standards to create their software for Windows. The key point being that there are no hardware anti virus devices attached to the computer, meaning it is a software device.

Those errors you are seeing are very common, which, from my experience, do not impact on the computer performance. If you aren't getting any problems, I would just leave it.
It's nothing to worry about unless you are experiencing problems.

One point I have just missed is the cryptic type of information in that particular log, the WPDBUSENUM.
I believe it stands for Windows Portable Devices Bus Enumeration, which means it's a portable technology device attached to the computer, such as a digital camera or mobile phone.
WPD is a driver technology that supports such devices, again, a standard for Windows driver functionality.
 
Last edited:
Re: Event Log says there are errors loading drivers, but for what devices?

Thank you Jared, good to know. I just had my first freeze in days while booting the PC from a "shutdown, with enabled fast-boot". I looked at the eventlog and the only thing I found was this. :( I will continue in my freeze-thread.

EDIT: Hah, well done! Thanks for combining the threads! :)
 
Okay, I've merged both threads for simplicity reasons seen as it has developed upon the same topic.

Upload any .dmp files using the Sysnative collection app, or if it doesn't work, manually by finding the .dmp files here:

C:\Windows\minidump

Firstly, I would disable Fast Startup on Windows 8, it's just awful.
I started getting issues, and I know a friend who did as well.
 
Jared said:
Okay, I've merged both threads for simplicity reasons seen as it has developed upon the same topic.

Upload any .dmp files using the Sysnative collection app, or if it doesn't work, manually by finding the .dmp files here:

C:\Windows\minidump

Firstly, I would disable Fast Startup on Windows 8, it's just awful.
I started getting issues, and I know a friend who did as well.
Click to expand...

Hey,

I just had another freeze coming back from hibernation. Goddamit, I will try to see what I did last with this computer. As this is no BSOD there are NO dumps in the Minidumps directory. :(

I have disabled fast startup now. I ran so well for nearly a week, yesterday I rolled back to a previous AMD driver version to fix sony vegas crashes, and then tried a system restore (I created a restore point hoping to use it to get me back to the NEWER drivers) but it failed so I had to cleanly re-installed the newest drivers.

What is weird is that every time the freeze happens and I actually get to see the windows desktop, the network symbol in the bottom right corner is either yellow or red. Last week I used driver verifyer (which I have running right now) to find the bad network driver, I installed the newest one and things became stable. I am starting to think that by doing that again (remove network drivers, re-install) I might fix this... :( Shite, I hate that there are absolutely no logs!
 
Good idea.

Yep, that what makes freezes so frustrating, because there is basically no indication to the cause.

Are you on a desktop or laptop?
 
Is there a reason you're using hibernation?
It isn't necessary to use on a desktop, so if you only get the crashes from that, I would just stop using it.
 
Boot time. Thanks to my SSD booting from hibernation means I have EVERYTHING open in no time. Browser, Email, Clients (Steam etc.) are ready to go. :) Also there were no stability issues for a long time so it was the way to go! I would use Energy Saving mode but I have a "master electricity button" on my socket that I use every night.

I have a rather laggy boot when I start "fresh", the PC hangs for a few seconds on desktop and then suddenly all the autostart programs launch. So I prefer the hibernation to clean boots.

Before my first "reinstall network driver" fix I actually used to do fresh boots every time and just occasionally hibernate, since it seemed it happened more often when the system was off for a long time (over night).

Also I am the kind of guy who want's to "fix" stuff whereever possible instead of working around issues by not using OS features. :-/
 
Okay, screw my realtek driver problems. Not only did the driver setup not finish EVER (had to manually reboot after 30mins of "installing drivers..." and manually update the drivers via device manager) I also just had a BSOD which followed a peculiar situation. Troubleshooting my thunderbird I disabled the network adapter in "network adapters" (not device manager), when I tried enabling it again 4 mins later it failed to do so and in device manager the device was still shown as "off". So I reboot, get a BSOD. Using windbg ntoskernel is the faulty piece - network...

So I just rebooted into safe mode, deleted all realtek stuff and from now on will be using Windows drivers for network - that's okay, right? The performance differences are probably minor/not detectable.
 
Yeah, I would stick with the generic Windows drivers if you're having no problems with it.
See how it goes, and report back with any further developments.
 
Yup, having zero troubles with booting with windows drivers.

What I did have though was a driver_verifier enabled BSOD when I disabled "this device can wake up the PC from sleep" and clicked OK, just like I had with Realtek drivers. Hmm. Hardware problem? Network adapter broken? If yes, the windows drivers seem to cushion it very well, hehe. :) I attached the minidump. Is there anything interesting about it besides the ntoskernel being the breaking-reason?
 

Attachments

Not much to debug in this file as it's a minidump.
Any chance we could get the Kernel dump from C:\Windows\MEMORY.dmp
It will be too large to upload here, so compress it in a .zip folder and upload it to a reputable 3rd part file sharing site. For example, Onedrive, Google Drive or Dropbox.
 
Last edited:
Code: 
0: kd> !ndiskd.oid ffffcf810b216f10


OID REQUEST

    OID_PM_REMOVE_WOL_PATTERN

    Request type:      SET
    Completed:         Not completed
    Cloned from:       OID_PM_REMOVE_WOL_PATTERN



DATA PAYLOAD

    db ffffd0004f9b07c0 L0n4
    01 00 00 00 


0: kd> kn
 # Child-SP          RetAddr           Call Site
00 ffffd000`4f9af9b8 fffff801`9b766487 nt!KeBugCheckEx
01 ffffd000`4f9af9c0 fffff801`9b755637 VerifierExt!SLIC_StatefulAbort+0x22b
02 ffffd000`4f9afab0 fffff801`9b755db3 VerifierExt!SLIC_XdvNdisMiniportOidRequestHandler_exit_NdisOidComplete+0xc7
03 ffffd000`4f9afaf0 fffff801`9c0f2ea4 VerifierExt!XdvNdisMiniportOidRequestHandler_wrapper+0x777
04 ffffd000`4f9afb60 fffff801`9c0463c9 ndis!ndisMInvokeOidRequest+0x23df8
05 ffffd000`4f9afba0 fffff801`9c044f4f ndis!ndisMDoOidRequest+0x42d
06 ffffd000`4f9afc50 fffff801`9c0454ce ndis!ndisQueueOidRequest+0x4bf
07 ffffd000`4f9afdf0 fffff801`9c51fa1e ndis!NdisFOidRequest+0xc2
08 ffffd000`4f9afeb0 fffff801`9c04698e wfplwfs!LwfLowerOidRequest+0x6e
09 ffffd000`4f9afee0 fffff802`3f280703 ndis!ndisFDoOidRequestInternal+0x2ee
0a ffffd000`4f9affe0 fffff801`9c044d5a nt!KeExpandKernelStackAndCalloutInternal+0xf3
0b ffffd000`4f9b00d0 fffff801`9c0454ce ndis!ndisQueueOidRequest+0x2ca
0c ffffd000`4f9b0270 fffff801`9cb6b0b8 ndis!NdisFOidRequest+0xc2
0d ffffd000`4f9b0330 fffff801`9c04698e pacer!PcFilterRequest+0x5c
0e ffffd000`4f9b0360 fffff802`3f280703 ndis!ndisFDoOidRequestInternal+0x2ee
0f ffffd000`4f9b0460 fffff801`9c044d5a nt!KeExpandKernelStackAndCalloutInternal+0xf3
10 ffffd000`4f9b0550 fffff801`9c04b69b ndis!ndisQueueOidRequest+0x2ca
11 ffffd000`4f9b06f0 fffff801`9c04b74d ndis!ndisQuerySetMiniportEx+0x1e3
12 ffffd000`4f9b0750 fffff801`9c10231d ndis!ndisQuerySetMiniport+0x19
13 ffffd000`4f9b0790 fffff801`9c1006da ndis!ndisRejectUnsupportedWoLPatterns+0x13d
14 ffffd000`4f9b0960 fffff801`9c101ea0 ndis!ndisIndicatePMCapabilities+0x96
15 ffffd000`4f9b0a10 fffff802`3f2bb6bc ndis!ndisQueuedUpdatePMCapabilities+0x60
16 ffffd000`4f9b0b50 fffff802`3f30e36c nt!ExpWorkerThread+0x28c
17 ffffd000`4f9b0c00 fffff802`3f3652c6 nt!PspSystemThreadStartup+0x58
18 ffffd000`4f9b0c60 00000000`00000000 nt!KiStartSystemThread+0x16


Loaded Module Info: [rt630x64] 
         Module: Rt630x64
   Base Address: fffff8019ec28000
     Image Name: Rt630x64.sys
   Machine Type: 34404 (X64)
     Time Stamp: 518cc4ec Fri May 10 10:59:08 2013
           Size: 94000
       CheckSum: 9d8fe
Characteristics: 22  
Debug Data Dirs: Type  Size     VA  Pointer
             CODEVIEW    25, 8cd94,   8bd94 RSDS - GUID: {84216331-04A2-47B5-AFFC-EF54DE1E8DD4}
               Age: 1, Pdb: rt630x64.pdb
                   ??    10, 8cdf8,   8bdf8 [Data not mapped]
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: PDB      - Symbols loaded successfully from image header.
                 D:\Windows Software Development Kit\Debuggers\x64\sym\rt630x64.pdb\8421633104A247B5AFFCEF54DE1E8DD41\rt630x64.pdb
    Load Report: public symbols , not source indexed 
                 D:\Windows Software Development Kit\Debuggers\x64\sym\rt630x64.pdb\8421633104A247B5AFFCEF54DE1E8DD41\rt630x64.pdb

ndis!_NDIS_OID_REQUEST
   +0x000 Header           : _NDIS_OBJECT_HEADER
   +0x004 RequestType      : 1 ( NdisRequestSetInformation )
   +0x008 PortNumber       : 0
   +0x00c Timeout          : 0
   +0x010 RequestId        : (null) 
   +0x018 RequestHandle    : (null) 
   +0x020 DATA             : _NDIS_OID_REQUEST::_REQUEST_DATA
   +0x048 NdisReserved     : [128]  "x???"
   +0x0c8 MiniportReserved : [16]  ""
   +0x0d8 SourceReserved   : [16]  ""
   +0x0e8 SupportedRevision : 0x1 ''
   +0x0e9 Reserved1        : 0 ''
   +0x0ea Reserved2        : 0

Not as much saved as I would have liked in this Kernel dump.
However, it's looking promising that this is a driver bug.

What has happened is basically, the OID request being sent to the miniport driver has returned the wrong ntstatus value, which is illegal, thus the bugcheck.
The OID request OID_PM_REMOVE_WOL_PATTERN removes the power management wake value, basically telling the adapter to wake up.
The miniport driver however, return the invalid value, whether success or fail, and thus the bugcheck.

Are there no updates for the driver? You need a different version to the one you're using.

Can you not just use the Windows driver, seen as that isn't creating any problems?
 
Not much saved as you would have liked? I have the dump setting on "auto". Should I change that?

I thought I was using the windows driver! Hmm, maybe I posted the wrong memory dump?

Anyway, I disabled "allow wake up from this device" in safe mode+network drivers without problem and now all runs smoothly. :) Thanks for the help!
 
I mean that there isn't always all the information necessary to perform a full analysis.
It doesn't usually hinder my ability to find the culprit. It's usually for finding out why, which is what makes debugging interesting.

Report back with any other problems.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top