BSOD after shutdown, error 0x00000d1, shutdown not complete

[Jhony Smith]

Hi guys,

I have a problem , from a few days now I have these BSOD, and could not imagine why, can't remember if I installed anything wrong. Maybe you can help i will attach the archive so I hope it will work. I tried to uninstall the video driver, didn't help.

error is [FONT=&quot]Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL[/FONT]
[FONT=&quot]Bug Check Code : 0x000000d1[/FONT]
[FONT=&quot]Parameter 1 : 0xcff30023[/FONT]
[FONT=&quot]Parameter 2 : 0x000000ff[/FONT]
[FONT=&quot]Parameter 3 : 0x00000008[/FONT]
[FONT=&quot]Parameter 4 : 0xcff30023[/FONT]
(founded and match my case it dosent write anything else down of the error. could it be because of same issue that i found in a guy's post ?). this is what i found in his post
[FONT=&quot]Dump File : Mini100811-01.dmp[/FONT]
[FONT=&quot]Crash Time : 8/10/2011 7:00:42 ??[/FONT]
[FONT=&quot]Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL[/FONT]
[FONT=&quot]Bug Check Code : 0x000000d1[/FONT]
[FONT=&quot]Parameter 1 : 0xcff30023[/FONT]
[FONT=&quot]Parameter 2 : 0x000000ff[/FONT]
[FONT=&quot]Parameter 3 : 0x00000008[/FONT]
[FONT=&quot]Parameter 4 : 0xcff30023[/FONT]
[FONT=&quot]Caused By Driver : hal.dll[/FONT]
[FONT=&quot]Caused By Address : hal.dll+bead[/FONT]
[FONT=&quot]File Description : Hardware Abstraction Layer DLL[/FONT]
[FONT=&quot]Product Name : Microsoft® Windows® Operating System[/FONT]
[FONT=&quot]Company : Microsoft Corporation[/FONT]
[FONT=&quot]File Version : 6.0.6001.18000 (longhorn_rtm.080118-1840)[/FONT]
[FONT=&quot]Processor : 32-bit[/FONT]
[FONT=&quot]Crash Address : ntkrnlpa.exe+5ad54[/FONT]
[FONT=&quot]Stack Address 1 : [/FONT]
[FONT=&quot]Stack Address 2 : ntkrnlpa.exe+2da7da[/FONT]
[FONT=&quot]Stack Address 3 : ntkrnlpa.exe+2da46d[/FONT]
[FONT=&quot]Computer Name : [/FONT]
[FONT=&quot]Full Path : C:\Windows\Minidump\Mini100811-01.dmp[/FONT]
[FONT=&quot]Processors Count : 2[/FONT]
[FONT=&quot]Major Version : 15[/FONT]
[FONT=&quot]Minor Version : 6001[/FONT]
[FONT=&quot]Dump File Size : 138.784[/FONT]

Could you help me fix it ?
Prospects:
Windows 7 Ultimate x32
[FONT=&quot] Operating System: Windows 7 Ultimate 32-bit (6.1, Build 7601) Service Pack 1 (7601.win7sp1_gdr.120830-0333)[/FONT]
[FONT=&quot] Language: English (Regional Setting: English)[/FONT]
[FONT=&quot]System Manufacturer: ASUSTeK Computer Inc. [/FONT]
[FONT=&quot] System Model: F5V [/FONT]
[FONT=&quot] BIOS: Default System BIOS[/FONT]
[FONT=&quot] Processor: Intel(R) Core(TM) Duo CPU T2250 @ 1.73GHz (2 CPUs), ~1.7GHz[/FONT]
[FONT=&quot] Memory: 2048MB RAM[/FONT]
[FONT=&quot]Available OS Memory: 2048MB RAM[/FONT]
[FONT=&quot] Page File: 1275MB used, 2818MB available[/FONT]
[FONT=&quot] Windows Dir: C:\Windows[/FONT]
[FONT=&quot] DirectX Version: DirectX 11[/FONT]
[FONT=&quot]DX Setup Parameters: Not found[/FONT]
[FONT=&quot] User DPI Setting: 96 DPI (100 percent)[/FONT]
[FONT=&quot] System DPI Setting: 96 DPI (100 percent)[/FONT]
[FONT=&quot] DWM DPI Scaling: Disabled[/FONT]

Thank you.

 

[Arc]

Hello Johny, for a Stop 0xD1, we need to see the crash dumps to have the closest look. The zip you uploaded does not contain any crash dump.

Follow it: http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html
Go to Option Two, Point 2. Download the .reg file and merge it in registry by double clicking it.

Search the .dmp files manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump. If anything is there, upload it. If not, wait for the next system crash. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[Jhony Smith]

Thank you for you fast reply, I was able to stop that BSOD, by downgrading the video card driver, I think. a few hours after the post I uninstalled the video driver, restart the pc, the instal a older version of driver, more indicated for ati mobility radeon x2300 (lame video). Bow I tried to create the minidump file, but nothing happen, no minidump no BSOD.
Finally it shuts down properly.
Thank you so much. have a great day.

 

[Arc]

Nice to know that you have solved the issue. If there ia a further issue, let us know

 

[Jhony Smith]

Seems like its back, didn't cure it ... the problem is that windows dosent create a dump file like you recomended. What should I do ? Thank you again...

Nice to know that you have solved the issue. If there ia a further issue, let us know

 

[Arc]

Hello Johny, if there is a BSOD, and dump creation is properly configured, there must be a crash dump.

Are you sure that you are having a BSOD, or it is a random shutdown? BSOD is a thing that you pointed out in your first post. If you are getting a similar blue screen, go to Dump Files - Configure Windows to Create on BSOD and check if everything is properly configured or not. If not, re-configure it.

As a Stop 0xD1 is driver related, a crash dump is the only thing that givves the closest look to the situation. Otherwise you may post it following the Blue Screen of Death (BSOD) Posting Instructions, clicking all the buttons of the SF Diag tool, if in case of absence of a dump, we can get some more, as far as possible more information.

 

[Jhony Smith]

The thing is, i tried manually to do the settings, and then the reg files...nothing worked... their is a cache ... my settings say that the mini-dump file should be 128 KB not 256 KB like in your recommendations.
Neither the SF Diag tool(i did use "run as admin."- should i run it in compatibility mode) dosent create a dump file when im clicking Minidump, or grab all...
I'm using Tune Up utilities...does that messes things up ?
and Nod 32 and 4.0 version...
Maybe its because it happends after the windows shuts down i think there is only the part of bios that needs to shut down...or something like that...and it sounds like the cooler from procesor is restarting...
Btw my video card driver is run in compatibility cause there is no win 7 driver. (im using it from vista)
L.E. I even tried the command from that special CMD ... didn't create a dump file...
L.L.E I uninstalled Tune Up...nothing
I installed whocrashed ... i did did mananged to get a dump file on the crash test, but none on live one...tried the minidump and complete memory dump..
Such a big headache, should i just clean instal windows again...i might happen the same thing...

BTW if i have the same parametere presented up top, dosent meen its caused by the same thing ?
[FONT=&quot]Bug Check Code : 0x000000d1[/FONT]
[FONT=&quot]Parameter 1 : 0xcff30023[/FONT]
[FONT=&quot]Parameter 2 : 0x000000ff[/FONT]
[FONT=&quot]Parameter 3 : 0x00000008[/FONT]
[FONT=&quot]Parameter 4 : 0xcff30023[/FONT]

 

[Arc]

Yes, it is TuneUp utilities

Most of us SF members believe that it is not tune up but tune down; but that is a different story. Uninstall it for the time being (the best option is to not use it at all; windows 7 does not need any of those programs, and they are not enough efficient to deal with windows 7's file and registry structure. It is good for XP).

I hope you will be able to upload a crash dump after uninstalling it.

 

[Jhony Smith]

I did manage to get 2 minidumps, but there were created by 2 programs, as a test crush to see if its possible to create dumps, it works but not for my crush, I will still update them, maybe there is some vital information.
Thanks again...
Just 1 worked for update...
Again why doesent creat a crush dump ? Is it that the error happens after windows shut down ? should I try to Update Bios.
I did uninstaled Tune up, but the BSOD happend before, thats why I installed tune up, and still happens now, when its uninstalled.

 

[Jhony Smith]

Btw my video card driver is run in compatibility cause there is no win 7 driver. (im using it from vista)
L.E. I even tried the command from that special CMD ... didn't create a dump file...
L.L.E I uninstalled Tune Up...nothing
I installed whocrashed ... i did did mananged to get a dump file on the crash test, but none on live one...tried the minidump and complete memory dump..
Such a big headache, should i just clean instal windows again...i might happen the same thing...

BTW if i have the same parametere presented up top, dosent meen its caused by the same thing ?
[FONT=&quot]Bug Check Code : 0x000000d1[/FONT]
[FONT=&quot]Parameter 1 : 0xcff30023[/FONT]
[FONT=&quot]Parameter 2 : 0x000000ff[/FONT]
[FONT=&quot]Parameter 3 : 0x00000008[/FONT]
[FONT=&quot]Parameter 4 : 0xcff30023[/FONT]

Same parameteres = same issue ?

 

[Arc]

Johny, your crash dump makes me a bit :sarc:. It's strange, and its rare.

Unable to load image rspCrash32.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for [COLOR=Red][B]rspCrash32.sys[/B][/COLOR]
*** ERROR: Module load completed but symbols could not be loaded for [COLOR=Red][B]rspCrash32.sys[/B][/COLOR]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[U][COLOR=Red][B]BugCheck DEADDEAD[/B][/COLOR][/U], {0, 0, 189dbc49, 3c2a58ed}

[COLOR=Red]Probably caused by : rspCrash32.sys [/COLOR]( rspCrash32+10b2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[SIZE=3][COLOR=Red][U][I][B]MANUALLY_INITIATED_CRASH1 (deaddead)[/B][/I][/U][/COLOR][/SIZE]
The user manually initiated this crash dump.
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 189dbc49
Arg4: 3c2a58ed

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

[COLOR=Red]BUGCHECK_STR:  0xDEADDEAD[/COLOR]

[COLOR=Red]PROCESS_NAME:  WhoCrashedEx.e[/COLOR]

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 9c5480b2 to 83d2ae98

STACK_TEXT:  
aef82ad0 9c5480b2 deaddead 00000000 00000000 [COLOR=Blue]nt!KeBugCheckEx+0x1e[/COLOR]
WARNING: Stack unwind information not available. Following frames may be wrong.
aef82aec 84a2ead1 00000000 0012f508 00000018 [COLOR=Blue]rspCrash32+0x10b2[/COLOR]
aef82b38 84a44641 9cf10c28 0012f508 00000018 fltmgr!FltpFilterMessage+0x9d
aef82b6c 84a44a69 8b4dc300 00000000 0012f508 fltmgr!FltpMsgDeviceControl+0xa9
aef82bb0 84a2d339 8b3b0148 a0ea6f68 8b2c2898 fltmgr!FltpMsgDispatch+0x91
aef82bdc 83f7e6c3 8b3b0148 a0ea6f68 8b4dc398 fltmgr!FltpDispatch+0x33
aef82c00 83c82be0 00000000 a0ea6f68 8b3b0148 nt!IovCallDriver+0x258
aef82c14 83e77b29 8b4dc398 a0ea6f68 a0ea6fd8 nt!IofCallDriver+0x1b
aef82c34 83e7acfb 8b3b0148 8b4dc398 00000000 nt!IopSynchronousServiceTail+0x1f8
aef82cd0 83ec163b 8b3b0148 a0ea6f68 00000000 nt!IopXxxControlFile+0x6aa
aef82d04 83c898fa 000001cc 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
aef82d04 77147094 000001cc 00000000 00000000 nt!KiFastCallEntry+0x12a
0012f490 00000000 00000000 00000000 00000000 0x77147094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
rspCrash32+10b2
9c5480b2 6a04            push    4

SYMBOL_STACK_INDEX:  1

[COLOR=Red]SYMBOL_NAME:  rspCrash32+10b2[/COLOR]

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: rspCrash32

IMAGE_NAME:  rspCrash32.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50976853

[COLOR=Red]FAILURE_BUCKET_ID:  0xDEADDEAD_rspCrash32+10b2

BUCKET_ID:  0xDEADDEAD_rspCrash32+10b2[/COLOR] 

Followup: MachineOwner
---------

0: kd> lmvm rspCrash32
start    end        module name
9c547000 9c54e000   rspCrash32 T (no symbols)           
    Loaded symbol image file: rspCrash32.sys
    Image path: rspCrash32.sys
[COLOR=Red]    Image name: rspCrash32.sys
    Timestamp:        Mon Nov 05 12:48:43 2012[/COLOR] (50976853)
    CheckSum:         000041EC
    ImageSize:        00007000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So, it says that it is manually initiated. It may not be a fact, coz only the trolls do it, and you are not a troll It may be something happened, may be something played there beyond your knowledge.

This bugcheck code 0xDEADDEAD is some results of a registry manipulation, some registries of keyboard/mouse usage. TuneUp may cause it, as it mess up with the registries upto a great extent, and sometimes it comes to be beyond repair. Uninstall TuneUp Utilities. Run SFC /SCANNOW Command - System File Checker

It is expected that SFC will recover those errors of registry. If not, we need to take some different ways.

At the same time, rspCrash32.sys indicates to WhoCrashed. So better you uninstall it, too.

Let us know the results.

 

[Vir Gnarus]

The DEADDEAD bugcheck means that a driver (in this case, rspCrash32.sys) called KeBugCheckEx and forced a crash to occur. I don't know why a program that informs you of system crashes will actually force a crash itself, but I advise along with Arc to remove WhoCrashed. The TuneUp Utilities are also a no-no. Remove them.

 

[Jhony Smith]

Yes, it is TuneUp utilities

Most of us SF members believe that it is not tune up but tune down; but that is a different story. Uninstall it for the time being (the best option is to not use it at all; windows 7 does not need any of those programs, and they are not enough efficient to deal with windows 7's file and registry structure. It is good for XP).

I hope you will be able to upload a crash dump after uninstalling it.

I finally manage to get some minidump...didnt know what to select...so i compressed them all, try to get last one might be 2 that were caused by seem programs intentionally.
please heeelp

 

[Jhony Smith]

The DEADDEAD bugcheck means that a driver (in this case, rspCrash32.sys) called KeBugCheckEx and forced a crash to occur. I don't know why a program that informs you of system crashes will actually force a crash itself, but I advise along with Arc to remove WhoCrashed. The TuneUp Utilities are also a no-no. Remove them.

Told you, some crashes were intentionally to see if its possible to write some minidumps...
the last minidump that I attched earlier said this...(i will atach a file .txt from windbg)
Please translate what he sais

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

[COLOR=Red]BugCheck D1[/COLOR], {cff30023, ff, 8, cff30023} [COLOR=Red]DRIVER_IRQL_NOT_LESS_OR_EQUAL[/COLOR]

Probably caused by : ntkrpamp.exe ( nt!KiTrap0E+2cf )

Followup: MachineOwner
---------

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

 

[Jhony Smith]

Got 2 minidumps Hope it helps !

 

[Arc]

It indicates to Motorola SM56 voice modem driver.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23e, 94e942cc, 94956ed8, 0}

*** WARNING: Unable to verify timestamp for smserial.sys
*** ERROR: Module load completed but symbols could not be loaded for smserial.sys
[COLOR=Red]Probably caused by : smserial.sys[/COLOR] ( smserial+82cc )

Followup: MachineOwner
---------

And that is really old.

94e8c000 94fa0000   smserial T (no symbols)           
    Loaded symbol image file: smserial.sys
    Image path: \SystemRoot\system32\DRIVERS\smserial.sys
  [COLOR=Red]  Image name: smserial.sys
    Timestamp:        Fri Sep 26 13:53:38 2008[/COLOR] (48DC9C0A)
    CheckSum:         0010D5AE
    ImageSize:        00114000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Try to update it from Motorola Mobility - Motorola Solutions - India

 

[Vir Gnarus]

The Motorola driver one may be a false positive because Force Pending I/O Requests check on Driver Verifier was enabled. Please do not have that option checked. The driver is very old, though, as it predates Windows 7. Please find an update as Arc mentioned, or remove it altogether.

The other DV crashdump showed behavior I cannot interpret with just the minidump. However, I'm concerned that if DV didn't catch a 3rd-party driver immediately in its tracks, then we may very well be dealing with hardware failure. I recommend doing a battery of hardware tests as follows:

RAM: Memtest86+ - 7+ passes
CPU: Prime95 - Torture Test; Blend; overnight (9+ hours)
Drives: Seatools - All basic tests aside from the Fix all or the advanced ones or Long Generic.

All of these are included in the UBCD if you prefer a Live CD environment (which is the best environment to test hardware on). Note that Prime95 currently does not work on the latest version of UBCD due to a bug. Also, please provide us temps/voltages using HWInfo with Sensors only option checked. Log two 30-minute instances: one for idle, and one for high load. If you can get the system to crash during high load logging, that's even better. Be careful with Prime95, as it will generate high heat for your CPU. Make sure your CPU cooling is stable before letting it run for an extended period of time.

 

[Jhony Smith]

Sorry it took a while for me to get back, the error is still on, so ill try that...I am assuming that the error might come from CPU, 'cause its always hot, and the cooler sounds like an rocket engine...Am I risking a CPU failure ? with or without the tests ?

 

[Arc]

If it is a hit CPU, first dismantle the system and make it sure that the thermal paste still exists. If not, apply Arctic Silver.

Then stress test the CPU.
Hardware - Stress Test With Prime95