Solved BSOD on Sleep mode for ntoskrnl.exe+75bc0 and Shutdown never ends

[Zarathud]

Hello all,

I am looking for help in debugging two issues, which I have been getting for the past week.

1. I have the system Power Management set up to put the system to Sleep, but when it goes to sleep I get a BSOD and the system shut downs.
2. When I try to shut down the system via Windows, the Shut Down screen appears but the loading icon keeps running and the system never actually shuts down.

The BSOD Bug Check Code is 0x0000009f and the Caused by Address is ntoskrnl.exe+75bc0.

I do not get these issues on a Clean Boot so from what I have read I am guessing it is driver related, but I am too novice to determine which driver it is. I ran Windows Update and updated a bunch of the other equipment drivers, but it hasn't helped. Note: I did install a new ASUS RT-AC66U router and a HP Photosmart 7520 printer over the holidays, but this issue did not appear right away after the install.

Diagnostics zip file attached.

Thanks in advance for any help.
-Rob

 

[Arc]

Hi Zarathud.

HP Photosmart 7520 series - Remove it from Startup.

And, Disable USB Selective Suspense too.
USB Selective Suspend - Turn On or Off

Uninstall MCAfee Security Scan Plus.

Also search in Dell using your service tag .... if there is any Chipset and BIOS update for your model.

Let us know how the computer is running.
_______________________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa8011908a00, fffff80004b2f518, fffffa800bf2c9e0}

Probably caused by : usbccgp.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8011908a00, Physical Device Object of the stack
Arg3: fffff80004b2f518, Functional Device Object of the stack
Arg4: fffffa800bf2c9e0, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  usbccgp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52272385

MODULE_NAME: usbccgp

FAULTING_MODULE: fffff88004e75000 usbccgp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

STACK_TEXT:  
fffff800`04b2f4c8 fffff800`035318d2 : 00000000`0000009f 00000000`00000003 fffffa80`11908a00 fffff800`04b2f518 : nt!KeBugCheckEx
fffff800`04b2f4d0 fffff800`034cc85c : fffff800`04b2f600 fffff800`04b2f600 00000000`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x33af0
fffff800`04b2f570 fffff800`034cc6f6 : fffffa80`13e73580 00000000`004264fb 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`04b2f5e0 fffff800`034cc5de : 0000009e`0b61c437 fffff800`04b2fc58 00000000`004264fb fffff800`036411e8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`04b2fc30 fffff800`034cc3c7 : 00000029`0e0babc2 00000029`004264fb 00000029`0e0bab18 00000000`000000fb : nt!KiTimerExpiration+0x1be
fffff800`04b2fcd0 fffff800`034b98ca : fffff800`0363ce80 fffff800`0364acc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`04b2fd80 00000000`00000000 : fffff800`04b30000 fffff800`04b2a000 fffff800`04b2fd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_3_usbscan_IMAGE_usbccgp.sys

BUCKET_ID:  X64_0x9F_3_usbscan_IMAGE_usbccgp.sys

Followup: MachineOwner
---------

0: kd> !irp fffffa800bf2c9e0
Irp is active with 8 stacks 6 is current (= 0xfffffa800bf2cc18)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0  0 fffffa80126acac0 00000000 00000000-00000000    
           \Driver\usbscan
            Args: 00015400 00000001 00000004 00000003
 [ 16, 2]   0 e1 fffffa80126ac890 00000000 fffff800034ad710-fffffa800c4018e0 Success Error Cancel pending
           \Driver\ksthunk    nt!IopUnloadSafeCompletion
            Args: 00015400 00000001 00000004 00000003
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa801516b3e0    

            Args: 00000000 00000000 00000000 00000000

 

[Zarathud]

Removed all HP items from startup and disabled USB Selective Suspense. Uninstalled MCAfee Security Scan Plus. No Chipset and BIOS updates available.

Same exact issues. See attached.

Any other suggestions?

Regards,
-Rob

 

[Arc]

The latest BSOD blames McAfee.

fffff800`00b9c918  fffff880`01cb28ffUnable to load image \SystemRoot\system32\DRIVERS\mfenlfk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfenlfk.sys
[COLOR=Red]*** ERROR: Module load completed but symbols could not be loaded for mfenlfk.sys[/COLOR]
 mfenlfk+0x38ff

But it is now not present in your system. So the question is .... whethere the BSOD occurred before or after uninstalling McAfee?

The answer to the question is very vital.

 

[Zarathud]

The BSODs definitely occurred after the uninstall, although I still do see McAfee services when using MSCONFIG. See attached screen shot. The weird thing is that all McAfee services are stopped, but when I uncheck McAfee McShield and restart it always reappears as checked without a disabled date (but still listed as stopped). Not sure if that matters.

I did a clean boot and have been restoring services a few at a time and then rebooting. So far it is working ok, but I will have to see if one of them triggers the issue again.

 

[Arc]

In such a situation, my first step would be to go for a clean install. Because, the leftovers may be dangerous for the system.

 

[Zarathud]

I downloaded a removal tool from McAfee and it seems to have removed all remnants. It is working ok now, so I will keep an eye on it. If it starts happening again, I will consider the clean install.

Thanks for the help!

 

[Arc]

Good news!

Let us know for any further issue.