Windows 7 Bugcheck code: 0x9F (0x3) and "Won't Shutdown Properly" issues

[Mborhman]

Thank you for reading. I have been experiencing shutdown issues for the past 4-5 days now. I click the shutdown option under the start menu, and the screen goes black and the power button is still illuminated. The light had usually gone off, indicating the computer is powered off, but now it's non responsive and I have to hold the power button down to shutdown. Upon further research, I saw a bugcheck on the 20th of Sept 2012, about 4-5 days ago. Has to be related. Furthermore, when the computer goes into hibernate, it becomes non responsive as well, just like the shutdown issue. Of course here is the requested info per the sticky. Thank you very much for reading.

 

[usasma]

Back in the XP days, hibernation issues were caused by video drivers.
With the changes in things through Vista and Win7 - it's now the chipset, storage, and video drivers that are the primary issue (and occasionally the networking drivers also).

Only 121 updates since SP1 - most systems have 130 to 140. Please visit Windows Update and get all available updates.

Watch for conflicts between McAfee and Webroot Secure Anywhere - I am not familiar with these programs but we've had issues with them individually at work. If it were my system, I'd remove one of them completely just to be sure.

This memory dump blames Rt64win7.sys - a driver component of your wired networking device. Please:
- download a fresh copy of the networking drivers from the motherboard manufacturer's support website
- un-install the current networking drivers
- install the freshly downloaded drivers
- test for futher BSOD's

Please note that there are traces of the McAfee in the memory dump also. It's possible that the networking components of McAfee may be causing issues - so if updating the networking drivers doesn't help - removing McAfee would be the next step (but don't leave yourself unprotected - post back for further suggestions)

Analysis:
The following is for information purposes only.

[font=lucida console]**************************Thu Sep 20 09:40:34.992 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\092012-26925-01.dmp]
Windows 7 Kernel Version [B]7601 [/B](Service Pack 1) MP (4 procs) Free x64
Built by: [B]7601[/B].17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:[B]3 days 17:18:37.004[/B]
BugCheck Code: [B]BugCheck 9F, {3, fffffa80058aea10, fffff8000544e3d8, fffffa800fa94790}[/B]
*** WARNING: Unable to verify checksum for win32k.sys
Probably caused by :[B]pci.sys[/B]
BugCheck Info: [B]DRIVER_POWER_STATE_FAILURE (9f)[/B]
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x9F
PROCESS_NAME: [B]System[/B]
FAILURE_BUCKET_ID: [B]X64_0x9F_3_Rt64win7_IMAGE_pci.sys[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Sep 20 09:40:34.992 2012 (UTC - 4:00)**************************
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

[font=lucida console]**************************Thu Sep 20 09:40:34.992 2012 (UTC - 4:00)**************************
intelppm.sys                Mon Jul 13 19:19:25 2009 (4A5BC0FD)
PxHlpa64.sys                Tue Oct 20 14:08:42 2009 (4ADDFCAA)
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
HECIx64.sys                 Tue Sep 21 12:59:04 2010 (4C98E458)
IntcDAud.sys                Fri Oct 15 04:28:17 2010 (4CB810A1)
Rt64win7.sys                Mon Oct 25 05:33:07 2010 (4CC54ED3)
iaStor.sys                  Sat Nov  6 03:44:52 2010 (4CD50774)
TurboB.sys                  Mon Nov 29 18:02:31 2010 (4CF43107)
CtClsFlt.sys                Wed Jan 19 22:20:46 2011 (4D37AA0E)
iwdbus.sys                  Wed Mar  9 18:43:23 2011 (4D78109B)
igdkmd64.sys                Sun Apr 10 14:50:59 2011 (4DA1FC13)
Apfiltr.sys                 Thu May 12 11:28:31 2011 (4DCBFC9F)
btmaud.sys                  Wed May 18 17:11:44 2011 (4DD43610)
btmaux.sys                  Wed May 18 17:11:49 2011 (4DD43615)
btmhsf.sys                  Tue Jul 12 11:45:04 2011 (4E1C6C00)
iBtFltCoex.sys              Tue Jul 19 21:54:03 2011 (4E26353B)
tixhci.sys                  Wed Jul 20 14:38:04 2011 (4E27208C)
tihub3.sys                  Wed Jul 20 14:38:25 2011 (4E2720A1)
stwrt64.sys                 Thu Sep  8 06:48:44 2011 (4E689D8C)
AMPPAL.sys                  Thu Sep 15 12:48:22 2011 (4E722C56)
NETwNs64.sys                Sun Sep 18 05:26:48 2011 (4E75B958)
Sftvollh.sys                Fri Sep 30 12:42:46 2011 (4E85F186)
Sftplaylh.sys               Fri Sep 30 12:43:05 2011 (4E85F199)
Sftfslh.sys                 Fri Sep 30 12:43:06 2011 (4E85F19A)
Sftredirlh.sys              Fri Sep 30 12:43:14 2011 (4E85F1A2)
mfehidk.sys                 Mon Feb 13 18:36:14 2012 (4F399E6E)
mfewfpk.sys                 Mon Feb 13 18:36:29 2012 (4F399E7D)
mfenlfk.sys                 Mon Feb 13 18:36:45 2012 (4F399E8D)
mfeavfk.sys                 Mon Feb 13 18:37:27 2012 (4F399EB7)
mfefirek.sys                Mon Feb 13 18:40:07 2012 (4F399F57)
cfwids.sys                  Mon Feb 13 18:40:56 2012 (4F399F88)
WRkrn.sys                   Mon Aug 27 21:30:35 2012 (503C1F3B)
[/font]

Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed - Invalid URL
Link Removed - Invalid URL
tixhci.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. Texas Instruments USB 3.0 Drivers
tihub3.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed. Texas Instruments USB 3.0 Drivers
Link Removed
Link Removed - Invalid URL
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed

 

[Mborhman]

Thank you very much John, I got off of work late today and will try your suggestions tomorrow. I will post back with updates.

 

[Mborhman]

Hey john, sorry for the delay in responding. I have gone to the Dell support website and attempted to find and download the network drivers relevant to my system, but Dell's driver support pages aren't exactly what I thought it would be. Instead of finding a database of drivers, the site directs me to enter my service tag and shows me a list of subsystems with drivers to download, based on my current configuration. Only networking drivers available to me have to deal with bluetooth wireless adapter, of which I went ahead and updated.
Anyways, my main problem is the shutdown issue, the BSOD only happened one time, i just figured it had something to do with the shutdown issue. Do you have any suggestions about the shutdown issue?
Also, i do have Mcafee and Webroot, i got webroot when i got the system, thinking that Mcafee's subscribtion had run out. Come to find out, the other day when I'm about to uninstall Mcafee altogether, it's still active and in full. Which one do you think i should keep? You mentioned Mcafee was in the dumpfile, so that right there makes me want to ditch it. Webroot got good reviews though.
Really, I just want the shutdown issue resolved, it's maddening. Any help you can provide will be awesome, thank you very much. If you need more precise info on the shutdown issue, let me know, and I'll supply it.

 

[usasma]

Webroot is also in the memory dump. I see a lot of McAfee (and Norton) BSOD's - so I tend to notice these 2.
But the problems that I've seen with Webroot are usually related to networking settings - and are similar to the McAfee issues,.

I'd suggest that it comes down to your personal preference. Each of the programs is very deeply involved in the operation of your system - so I'd suspect that there was a conflict between them, and that you must remove one of them completely. I wouldn't be surprised if it stopped the shutdown issue - but there's no guarantees here.

I'm familiar with the McAfee Consumer Products Removal (MCPR) tool - so I'd be more comfortable using that.
Either way you go, you must use a removal tool in order to ensure that you've gotten rid of all traces of one of these programs (here's a list of different removal tools that I made up a while back: Link Removed

Give that a try and see if it helps. If not, reboot several times and then generate a new set of reports to see if we can find anything additional in them.

Good luck!

 

[Mborhman]

Hey John, thank you for helping me. I completely uninstalled McAfee, using the Add/Remove Programs first as requested then using MCPR afterwards. It's gone. I still have the shutdown issue. Curiously, I had "an unable to start Windows" this morning. My fiance clicked on the first screen without me seeing it first, but the subsequent screen had a progress bar saying that it was scanning for errors and fixing them as needed. I think she hit a restore to previous point option, I don't know for sure.
I checked on the Dell support center history, that's how I knew there was an BSOD that I was initially unaware of, and it said that I had I had some critical events, I attached a pic below of what I'm talking about. How do you want me to send a "snapshot" of this computer, like before, or different since this isn't technically a BSOD? Thanks in advance.

 

[usasma]

See the part where it says "These files may be available here:"?
Please zip those files up and upload them with your next post.

The previous reports are still OK, but the above reports can give us more info on the application crash.
With that in hand, then I'll start scanning through the event viewer logs that you've provided and we'll see what we can find.

This may be 2 separate issues (BSOD and shutdown)
or they may be related.

Keep an eye out for further BSOD's and we'll just work on the errors that we find.

 

[Mborhman]

Here you go, thanks again. I looked briefly at the contents and couldn't make heads or tails of it, except I did see the dates 9/26/12 and 10/03/12 associated with the files. Hope it helps.Link Removed

 

[usasma]

I found problems with the Dell Support Center. Please uninstall it (you can download and install a fresh copy once the problems stop).

I also found unexplained shutdowns - which tend to point at hardware or malware. Please run these free hardware diagnostics: Link Removed - Invalid URL

Please make sure that the system isn't overheating - that could cause unexplained shutdowns.

Have you updated or replaced the network drivers that I mentioned in an earlier post?

 

[Mborhman]

Sorry for the delay, my job and family take most of my time nowadays, good thing though. Anyways, I have updated the drivers and uninstalled Dell Support Center. I still have problems with shutting down, (eg, Clicking the shutdown button under the start menu, and the cpu never shuts down, screen goes black after the cpu goes through the shutting down screens, but the power button is still illuminated as the cpu never turns off, forcing me to hold the power button down until it turns off).
Now you mentioned overheating and I wondered if you're on to something. I purchased a laptop cooler awhile ago, dual fan type, to combat laptop overheating because I use the laptop a lot. I suspect if it has overheated, I wonder if something has happened, causing my lack of shutting down properly issues. Naive as I think I have been if this is the case, I figured that the cooling fans would be more than sufficient to cool the laptop, and it would be fine to leave the laptop on overnight sometimes while downloading via bittorrent. If the laptop has been damaged because of that treatment, then.... ****! And btw, I download quite a lot, I have 4tb worth and counting.
Oh yeah, I ran memory test on a bootable disk, from your website, and it tested fine. I ran a couple of the malware scans and all was fine as well. I'm off of work tomorrow so I should be able to post back sooner. Thank you very much for helping me out thus far.

 

[usasma]

If the BSOD issues are fixed, then we've gotta wonder why the system won't shutdown for you.
Most transition problems of this sort are also caused by problem drivers.
I'd suggest updating (if you haven't already) the:
- chipset drivers (the second and third ones - both Intel - in the chipset category)
- storage drivers (the third one - Intel - in the Serial ATA category)
- video drivers (the last one - Intel - in the video category)
- network drivers (the last one - Realtek - in the networking category)

All should be available at this page: Link Removed - Invalid URL

 

[Mborhman]

Hi John, I installed the drivers you suggested, I still have the shutdown problem. Under "chipset drivers", the third one was an older driver than what was on my system, Windows said, so I left it alone. If I should replace it, let me know and I will. Every other driver was problem-free. I will check back here before I go to work tomorrow, in the mean time, I'll continue researching every forum I can get my eyes on. Thank you very much for helping me, if you need automotive advice, hit me up, I work on them for a living, bumper to bumper problems that is, not just tires and oil. Thank you.

If you need me to clarify anything, let me know, I know how it is when trying to help someone diagnosis a problem when the information is vague or limited. Thanks again.

 

[usasma]

Thanks for the kind words!

Please shut the system down and let it sit for about 10 minutes before forcing a shutdown.
Then generate a fresh copy of the reports that you submitted with your first post
The delay in shutting down should produce a gap in a couple of the reports (and they should be near the start of the reports) so that we'll have an easier time trying to figure out what's causing this.

 

[Mborhman]

Hi John, I've been busy, finally got some time. Yesterday, 10/11/12, I was closing the computer by clicking the shutdown button and while it was shutting down, a BSOD appeared. Here is the report. Hopefully it tells us something! Thank you very much.Link Removed

 

[usasma]

Trying out a new program, so the format may look a bit different. Will add more in a second post.....

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

MDPMGRNT.SYS Wed Sep 23 15:23:04 2009 (4ABA7598)
MacDrive Partition Driver
Link Removed

CBDisk.sys Wed Jan 13 04:15:47 2010 (4B4D8F43)
CallbackDisk Virtual Storage Driver
Link Removed

MDFSYSNT.sys Thu Feb 4 10:14:15 2010 (4B6AE447)
MacDrive file system driver
Link Removed

Analysis:
The following is for informational purposes only.
Code:

**************************Thu Oct 11 21:56:40.360 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\101112-25896-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime:0 days 2:36:06.656
BugCheck Code: BugCheck 1E, {0, 0, 0, 0}
Probably caused by :NETIO.SYS ( NETIO!RtlGetNextExpiredTimerWheelEntry+5e )
BugCheck Info: KMODE_EXCEPTION_NOT_HANDLED (1e)
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_NETIO!RtlGetNextExpiredTimerWheelEntry+5e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Oct 3 06:01:27.502 2012 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\100312-32073-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime:0 days 0:00:08.814
BugCheck Code: BugCheck D3, {fffff880012362b9, 2, 0, fffff80003510912}
Probably caused by :ntkrnlmp.exe ( nt!RtlDispatchException+122 )
BugCheck Info: DRIVER_PORTION_MUST_BE_NONPAGED (d3)
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xD3
PROCESS_NAME: smss.exe
FAILURE_BUCKET_ID: X64_0xD3_VRF_nt!RtlDispatchException+122
CPUID: "Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz"
MaxSpeed: 2500
CurrentSpeed: 2494
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Oct 11 21:56:40.360 2012 (UTC - 4:00)**************************


3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.
Code:

**************************Thu Oct 11 21:56:40.360 2012 (UTC - 4:00)**************************
intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
MDPMGRNT.SYS Wed Sep 23 15:23:04 2009 (4ABA7598)
PxHlpa64.sys Tue Oct 20 14:08:42 2009 (4ADDFCAA)
CBDisk.sys Wed Jan 13 04:15:47 2010 (4B4D8F43)
MDFSYSNT.sys Thu Feb 4 10:14:15 2010 (4B6AE447)
amdxata.sys Fri Mar 19 12:18:18 2010 (4BA3A3CA)
IntcDAud.sys Fri Oct 15 04:28:17 2010 (4CB810A1)
HECIx64.sys Tue Oct 19 19:33:43 2010 (4CBE2AD7)
Rt64win7.sys Mon Oct 25 05:33:07 2010 (4CC54ED3)
iaStor.sys Sat Nov 6 03:44:52 2010 (4CD50774)
TurboB.sys Mon Nov 29 18:02:31 2010 (4CF43107)
CtClsFlt.sys Wed Jan 19 22:20:46 2011 (4D37AA0E)
iwdbus.sys Wed Mar 9 18:43:23 2011 (4D78109B)
igdkmd64.sys Sun Apr 10 14:50:59 2011 (4DA1FC13)
Apfiltr.sys Thu May 12 11:28:31 2011 (4DCBFC9F)
tixhci.sys Wed Jul 20 14:38:04 2011 (4E27208C)
tihub3.sys Wed Jul 20 14:38:25 2011 (4E2720A1)
stwrt64.sys Thu Sep 8 06:48:44 2011 (4E689D8C)
AMPPAL.sys Thu Sep 15 12:48:22 2011 (4E722C56)
NETwNs64.sys Sun Sep 18 05:26:48 2011 (4E75B958)
Sftvollh.sys Fri Sep 30 12:42:46 2011 (4E85F186)
Sftplaylh.sys Fri Sep 30 12:43:05 2011 (4E85F199)
Sftfslh.sys Fri Sep 30 12:43:06 2011 (4E85F19A)
Sftredirlh.sys Fri Sep 30 12:43:14 2011 (4E85F1A2)
btmaux.sys Sun Feb 12 22:34:50 2012 (4F3884DA)
btmhsf.sys Sun Feb 12 23:00:06 2012 (4F388AC6)
iBtFltCoex.sys Wed Mar 21 14:13:12 2012 (4F6A1A38)
WRkrn.sys Mon Oct 8 00:37:48 2012 (5072589C)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Oct 3 06:01:27.502 2012 (UTC - 4:00)**************************
Rt64win7.sys Tue Jun 12 10:00:29 2012 (4FD74B7D)
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed - Invalid URL
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed
Link Removed - Invalid URL
Link Removed - Invalid URL
Link Removed
Link Removed

 

[usasma]

There are no log files availabe for the System log in the Windows Logs section since 03 September. Something unknown must be suppressing the capture of logged events.

Here's the 3 errors from the Application log file around the time of the last BSOD:
BSOD was at: Thu Oct 11 21:56:40.360 2012 (UTC - 4:00)

Event[15429]:
Log Name: Application
Source: Desktop Window Manager
Date: 2012-10-11T21:56:26.000
Event ID: 9009
Task: N/A
Level: Information
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Borhman
Description:
The Desktop Window Manager has exited with code (0x40010004)

Event[15430]:
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 2012-10-11T21:56:26.000
Event ID: 6000
Task: N/A
Level: Information
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Borhman
Description:
The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.

Event[15431]:
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 2012-10-11T21:56:30.579
Event ID: 1532
Task: N/A
Level: Information
Opcode: Info
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: Borhman
Description:
The User Profile Service has stopped.

10 seconds later the system had a BSOD.

I'm not familiar with the inner workings of the Event Viewer and it's logs, but maybe you could delete some of the events (in the System Log File) in order to make room for more? I did note that the last event was numbered 34999 - so I have to wonder if there's a 35,000 entry limit (the first error is number 0)

 

[Mborhman]

I will try to remove some of the log files to see about making room for more information. I was looking around the event viewer and saw this stuffLink Removed. I'll post back when I do more with your suggestions.



Wondering about this ------->Link Removed






and I completely removed that MacDrive software