First crash with Windows 7 - what happened?

haku7 · 01 Oct 2012

To whom this may be of interest - and might provide an explanation:

Having recently acquired a new desktop PC equipped with Windows 7, I thought everything went hunky dory - until I was confronted tonight with an unexpected crash. It involved a sudden restart of the machine, in fact a complete reboot. Attached you will find the several logs, files and dumps produced at the time of the crash and reboot, some which were sent to Microsoft - automatically on the demand, as it were, of the OS (these are in a zip file together with a screen shot of the Send to MS dialog+translation of the latter). Only file that is missing is Memory.dmp - too large to upload.

Since I was away for a moment from the machine (nothing special was going on like a download or whatever, it just stood there, waiting for my return) when the incident occurred, I don't know whether this was a genuine BSOD incident or not. Moreover, I never experienced a BSOD restarting the computer all by itself but some of the dumps/logs look suspiciously like belonging to such an occurrence. Therefore, I am also including the report of your own diagnostic utility (which also duplicates some files I gathered myself).

Actually, a few days after the purchase of the PS, as I was busy transferring files and reinstall programs on that brand new machine, there was a sudden, unexpected restart, right in the middle of an operation (writing a short text in Word, certainly nothing that could warrant such a reaction).

Second, after starting the machine tonight, something very strange did happen. On the Quick launch part on the taskbar below the screen, the hidden icons (the vertical part containing those hidden icons that appears when you click on the small arrows, which precede the left-hand icons tray part of the taskbar) could not be called up - as if that part was stuck. It's only after a full restart that things appeared to have returned to normal.

Now, this occurrence seems unlikely to have anything to do with the crash, but I mention it to all intents: one never knows.

Since it's also most unlikely that Microsoft will ever send me an explanation (do they ever provide any explanation for whatever?), I'm asking this forum:
- Does anyone out there have an explanation about what could have occurred?
- What should I do to try to avoid such incidents in future?
- Does anyone need more information - beside the Specs and an HiJackThis log I provide in addition to the other attachments with this first thread?

Thanks beforehand,

haku7

koolkat77 · 02 Oct 2012

Welcome

STOP 0x0000009F: DRIVER_POWER_STATE_FAILURE
Usual causes: Device driver

You need to re-install your graphic card drivers

BSOD Analyze

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa8003f9aa10, fffff800053f13d8, fffffa80084e0a70}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : pci.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8003f9aa10, Physical Device Object of the stack
Arg3: fffff800053f13d8, Functional Device Object of the stack
Arg4: fffffa80084e0a70, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  pci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7928f

MODULE_NAME: pci

FAULTING_MODULE: fffff88000ecc000 pci

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

STACK_TEXT:  
fffff800`053f1388 fffff800`041336c2 : 00000000`0000009f 00000000`00000003 fffffa80`03f9aa10 fffff800`053f13d8 : nt!KeBugCheckEx
fffff800`053f1390 fffff800`040d3e3c : fffff800`053f14c0 fffff800`053f14c0 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x34050
fffff800`053f1430 fffff800`040d3cd6 : fffff800`04270f20 00000000`000519c2 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`053f14a0 fffff800`040d3bbe : 0000000c`2436f388 fffff800`053f1b18 00000000`000519c2 fffff800`0423fac8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`053f1af0 fffff800`040d39a7 : 00000003`c9a1bbc1 00000003`000519c2 00000003`c9a1bb3a 00000000`000000c2 : nt!KiTimerExpiration+0x1be
fffff800`053f1b90 fffff800`040c0eca : fffff800`0423be80 fffff800`04249cc0 00000000`00000000 fffff880`04802db0 : nt!KiRetireDpcList+0x277
fffff800`053f1c40 00000000`00000000 : fffff800`053f2000 fffff800`053ec000 fffff800`053f1c00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_3_atikmpag_IMAGE_pci.sys

BUCKET_ID:  X64_0x9F_3_atikmpag_IMAGE_pci.sys

Followup: MachineOwner
---------

0: kd> !irp fffffa80084e0a70
Irp is active with 3 stacks 2 is current (= 0xfffffa80084e0b88)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [ 16, 0]   0  0 fffffa8003f9aa10 00000000 fffff88005667c68-fffff8800c310a80    
	       \Driver\pci	dxgkrnl!DpiFdoDevicePowerCompletionRoutine
			Args: 00000000 00000000 00000000 00000002
>[ 16, 2]   0 e1 fffffa8005adf850 00000000 fffff800040b4ce0-fffffa8006755820 Success Error Cancel pending
	      Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
 \Driver\amdkmdap	nt!IopUnloadSafeCompletion
			Args: 00041100 00000001 00000001 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa8006e151e0    

			Args: 00000000 00000000 00000000 00000000
0: kd> lmvm atikmpag
start             end                 module name
fffff880`0442f000 fffff880`04484000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    Timestamp:        Thu Mar 29 07:09:06 2012 (4F73B632)
    CheckSum:         000529C4
    ImageSize:        00055000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Method for re-installation:

Download and install Driver Sweeper:
→ |MG| Driver Fusion (Driver Sweeper) 1.2.0 Download
Download the auto-detect tool for AMD.
→ AMD Driver Autodetect
Boot into Safe Mode from Advanced Boot Options:
→ Advanced Boot Options
Type in Driver Fusion in Search
Remove all components of your ATI drivers
Boot normally now, and install the latest drivers from the
auto-detect program you downloaded.

You may avoid "CCC" Catalyst Control Center if you download the drivers manually
instead of using the auto-detect tool.

Take a Video Card - Stress Test with Furmark
→ Video Card - Stress Test with Furmark

Monitor your temps with Speccy during these tests
→ Speccy - System Information - Free Download

Problematic software:

Code:

Start Menu\Programs\Norton Utilities 15	Public:Start Menu\Programs\Norton Utilities 15	Public

Please refrain from using such utilities.

If you want to keep your system healthy go through this thread:
→ Optimize Windows 7

What antivirus are you using? I may have missed it.

I and many members on our forum recommend Microsoft security essentials with
a great combination of Malware Bytes.

→ Microsoft Security Essentials - Free Antivirus for Windows
→Malwarebytes - The Free version
→ Good and Free system security combination.

Run a full scan with both (separately) once downloaded, installed and updated.

Suggest you to use Shark007's codecs instead of K-Lite codec pack

Code:

Start Menu\Programs\Systeem Apps\K-Lite Codec Pack x64	HARRY4\Harry:Start Menu\Programs\Systeem Apps\K-Lite Codec Pack x64	HARRY4\Harry

→ Shark007.net - Windows 7 Codecs - WMP12 Codecs

Let us know your feedback

haku7 · 02 Oct 2012

Hello KoolKat,

A great many thanks for the thorough instructions, and the explanation. Although I cannot fathom why such a new machine - not even one month old - would feature defectuous graphic drivers so soon. Pending other instructions, I will execute the present ones faithfully, after having taken the obvious backups and precautions, like Restore Points and ERUNT (the latter having served me well in the past, albeit on XP).

Several 'repliers' on other topics seem to warn users about optimize applications like Norton Utilities. Again, that program's former avatar (System Works) and other cleanup application did serve me well in the past on XP. Apparently the people on this forum are mistrustful about programs intervening one way or another in the registry. However, I never have the registry cleaned up or optimized with Norton, but with Ccleaner. Over the years, I've picked up a thing or two about the Windows registry, so that I can cherrypick whatever I want to see modified - and I do this with the necessary caution. Same goes for services, albeit that such interventions of mine are naturally less 'hazardous'.

A few questions before proceeding:

Point 5, re-installation: Remove all components of your ATI drivers
What do you mean exactly by this? Will these drivers appear after executing Driver Fusion in Safe Mode? Is it safe to remove these drivers, even if only temporarily?

Monitor your temps with Speccy during these tests
Excuse my ignorance - but why should I do this? I have had Speccy installed on all my PCs since long. To me it is 'just' a (very good, complete and thorough) System report.

What antivirus are you using?
Avast Pro, since year and day. Been extremely happy with it. That's why I never use MS security essentials - are you certain it would do a better job than Avast? This question because in other instances, several of your Forum members, 'repliers' and gurus seem to favor the MS virus scan utility. The equally highly recommended Malwarebytes is another kettle of fish altogether: it did detect malware and sundry, when normal virus scanning never noticed a thing on all my machines: 2 XPs, one Win 7. So, this utility is now part of my panoply.

This calls for an aside: Malwarebytes detected a suspicious Registry item in a Quick Scan and a suspicious file after a full scan (see attached logs). Both seem to be related to these download sites that often stand in between the user and the software. It is not a surprise that one should look in that direction because the last weeks I have been busy reinstalling a lot of programs on my new PC, the install files of which I downloaded afresh. So - highly uneducated guess - could such malware be responsible for the incident this discussion is about? I guess things must be more complicated than that, all the more since your conclusion was that it is probably a graphic driver playing havoc. But one never knows.

Suggest you to use Shark007's codecs instead of K-Lite codec pack
No problem. Actually, I only use such codec(s) to be able to see the icons for files of a particular type (like pdf or psd). Frivolous, I know, but I like to keep my PCs visually coherent. However, will two codec packages running alongside not harm the computer's operations? Usually, they don't, but in the past I have noticed several time that one takes over from the other for whatever reason.

So, I will be waiting for your answers before going on with the suggested tests an cleanup operations.

Looking forward to receiving your answers and thanking you beforehand,

haku6

koolkat77 · 02 Oct 2012

Good job on taking "the obvious backups and precautions, like Restore Points and ERUNT"

Most OP's here come with pre-built OS/systems that contain bloatware and sometimes install stuffs unintentionally. You can keep the optimization apps if you have experience with them.

I suggested for MSE & MBAM cause I did not see an antivirus program listed in your msinfo file. Now that you told me you use Avast! and if Avast! works good for you, keep it..no need to switch.

The part about graphic card drivers. Your computer is new, probably having the latest pieces of hardware, so 'older' drivers would act sort of buggy with them. So it's preferred with latest hardware parts you get the latest drivers for best performance and if it turns out that latest drivers are the buggy, getting the old ones back ain't a big deal. Plus, your one and only Blue Screen Dump file pointed to your graphics driver, an older version hence my suggestion to get the latest driver for it.

Haku7/6 says: "What do you mean exactly by this? Will these drivers appear after executing Driver Fusion in Safe Mode? Is it safe to remove these drivers, even if only temporarily?"

I'm not sure what you mean by this question. But answering anyway, out of what I understood:

If it wasn't safe, I wouldn't have suggested that method. Driver fusion allows advanced system driver removal which even deletes those files, directories and registry entries that are left behind by the normal vendor uninstallers. Seeing your first post and seeing your answer to my reply, I take it that you like reading and writing allot. If you read the apps description on the website Driver Fusion - The Complete Driver Solution you'll understand what it does - better than I can explain with the limited time.

Re Speccy, it can be used for monitoring temps also although it might not be the best program for that purpose. If you're aware of CPUZ, GPUZ and HWmonitor, you can use them as well. They're all here on this link: CPUID - System & hardware benchmark, monitoring, reporting

The MBAM logs suggest the "KLiteMegaCodecPack_downloader_by_Downloadhr.exe" as a problem but doesn't sound like a problem really. Viruses can be the causes of BSODs sometimes - yup, one never knows but the ways to solve those with out a clean install of the hard drive with windows from scratch is even harder than getting the latest drivers for a particular hardware/device.

I experienced problems with the newer versions of K-Lite Codec pack and switched to Shark007's codec ever since. That's a personal experience and again, if you want to keep both and can adjust with the "taking over from the other for whatever reason" you may keep both if you like.

No need to thank so early. I'll appreciate it only after I know that the suggested steps were done and resolved the issues (after a while of observation of course) and I just want you the "OP" to be informed that I have lots of threads under subscription waiting to be answered.

So proceed with the steps provided to you, take your time and let us know the progress.

Good luck.

PS; Ms. or Mr. Haku6 - 7. How many names do you have?

haku7 · 02 Oct 2012

Hi again KoolKat!

Thanks for your prompt reaction, additions and reassurances. Not to take up too much of your time, some answers in telegraphic style (I'm of the old school!)

Ms. or Mr. haku6 - 7. How many names do you have?
a) It's 'Mr." / b) Those two names because your brother/sister forum for Vista needed another user name than the one I had already registered under in your SevenForum. As Sherlock Holmes said: when all possible solutions don't fit, choose the impossible one. By the way, I use the Vista forum on behalf of a friend, who does not know chalk from cheese about computers, unfortunately, and because it is a torture to see him struggle with his machine.

What I meant in the passage about Driver Fusion
I simply wanted to know whether eliminating drivers even temporarily would not impair the functioning of the PC. Apparently it doesn't, so I'll go ahead with that instruction.

Be sure that I'll keep you informed. That is my wont, even if sometimes my literature gets out of bounds. It's easier to write amply than write succinctly, as any writer will tell you. Moreover, I'm not a writer. But the real answers I get from all of you demand the courtesy of a real reaction.

As said, keep on the lookout for my next info when all is said and done.

Best,

haku7 (on this forum)

haku7 · 03 Oct 2012

Hi KoolKat!

Just started to download/install the utilities mentioned in one of your first posts.

Encountered a snag, which may or may not be important.

I thought that the AMD Driver downloader was just the installation exe for that utility. But when I double clicked on it, it became clear that this was the program itself. And, before I could stop it, it started to do its job. Meaning that it apparently replaced the drivers where it thought necessary before me having gone through the Driver Fusion procedure in Safe Mode. Attached, you will find an xml AMD Report, which reports that many drivers and other items were updated or replaced with success, without any further errors.

Hence my question: do I still have to do the whole operation from the beginning as indicated by you? Or can I proceed, going from there?

Best,

haku6

haku7 · 03 Oct 2012

Forgot to attach the xml file. Here it is!

haku7

koolkat77 · 03 Oct 2012

It looks okay.

Come and update this thread when you need to.

haku7 · 04 Oct 2012

Thanks, KoolKat. But this morning, at boot, there was a short error message saying: "AMD Quickstream not intended for this computer" just before boot almost completed. After clicking the message away, everything seemed normal. What shall I do? Perhaps do the whole procedure again? Or should I mail you one or other log, or report?

Have a good morning.

haku7

koolkat77 · 04 Oct 2012

haku7 said:

Perhaps do the whole procedure again?
haku7

Yup, go ahead