BSOD - uninstalled Trend Micro AV - Power Driver State Failure

[villageac]

I uninstalled Trend Micro Business Security from my 1 year old Dell Vostro (Win 7 Home Premium 32 bit) a few days ago and since then have had recurrent spontaneous shutdown most times with a BSOD Power Driver State Failure. In Device Manager, it showed a Virtual CD drive with a yellow exclamation point - I uninstalled the program that created the virtual drive but I still have spontaneous BSOD. I tried a System Restore but it failed to help the situation.
I attached my zip files of jcgriff2 and my perfmon html file.

Dell Vostro V13
Win 7 Home Premium 32 bit
OEM never re-installed
hardware and OS are just over a year old

 

[kegobeer]

I'd try using the Trend Micro uninstaller.

Manually uninstalling the Security Agent - Worry-Free Business Security

 

[villageac]

all were removed

Thanks for the reply - I went through the instructions, step by step, and the uninstall program had removed all of the steps - there was nothing on the list of things to remove for me to remove.
Did the log file I submitted as an attachment describe an issue with Trend Micro remnants?

 

[writhziden]

Software Concerns:

Start Menu\Programs\Advanced SystemCare 5
Start Menu\Programs\IObit Malware Fighter
Start Menu\Programs\Smart Defrag 2

• Many of us on the forums actually do not recommend automated optimization tools for Windows 7. Windows 7 does a much better job of handling its own optimization than its predecessors did. We especially do not recommend registry cleaning as an "optimization" step because automated registry cleaning causes more harm to the registry than it actually repairs.
  
  In the future, if you need help optimizing Windows 7, please post a thread in Performance & Maintenance - Windows 7 Forums or follow the tutorial enclosed in that forum to http://www.sevenforums.com/tutorial...ws-7-a.html?filter[2]=Performance Maintenance.
  
  
• IObit Malware Fighter is not the best malware/spyware utility. Take a look at http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better options.
  
  
• I personally do not recommend 3rd party defrag tools. I have seen them damage restore points and even cause blue screen crashes. Windows has some nice command line flags for the defrag command that will accomplish the same tasks as 3rd party programs. The -b and -w flags will defrag boot files and the boot registry items as well as compact the data to the center of the disk for faster access.
  defrag c: -b
  defrag -c -v -w
  ​
  The first command optimizes boot performance for the Windows drive by defragmenting boot files and boot registry items.
  
  The second command includes all drives on the system through the -c command and optimizes the drives by compacting the data to the center of the disk. Verbose output through the -v option is optional to provide the user with more information about the defrag tasks. The commands have to be run in an http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html.
  
  For more flags, see http://www.sevenforums.com/tutorials/11733-disk-defragmenter-open-use.html.
  
  If you are going to use a 3rd party defrag tool, I would recommend Puran defrag since it is widely used by the gurus on this forum and no problems have resulted from its use by them/us. Disk Defragmenter x64 / 64 Bit / 32 Bit Windows 7 / Vista / Xp / 2003 / 2008 | Puran Defrag

Analysis:

Crashes are all Driver Power State Failure BugChecks and point to a USB device driver, the USB port drivers, or the USB ports themselves as the cause. I do not see any drivers loaded in your modules at the time of a crash that are for USB devices. For the USB problems...

• What USB devices are you currently using? Please remove all USB devices prior to doing the following steps.
  
  
• Start with http://www.sevenforums.com/tutorials/165554-usb-driver-general-fix-problems.html to resolve the USB issues. Also, USB ports can sometimes enter a safe power state to protect the system from power surges due to USB devices. To reset the USB ports to a nominal power state:
  
  1. Shut down and turn off the computer.
  2. Unplug the computer from the wall or surge protector (then remove the battery if it is a laptop).
  3. "Remove the computer from any port replicator or docking station, disconnect
     cables to printers or devices such as external monitors, USB memory sticks or SD cards, headset or external speakers, mouse or auxiliary keyboard, turn off WIFI and Bluetooth wireless devices." (Use Hard Reset to Resolve Hardware and Software Issues HP Pavilion dv5000 Notebook PC series - HP Customer Care (United States - English))
  4. Hold down the power button for 30 seconds. This closes the circuit and ensures all
     power from components is drained to clear the software connections between the BIOS
     and hardware and clear any corruption in the temporary memory.
  5. (If it is a laptop, plug the battery back into the laptop and then) Plug the computer back into the wall. Do not reconnect any unnecessary peripherals; monitor, keyboard,
     and mouse should suffice and be the only peripherals reconnected.
  6. Turn it on to reinitialize the software connections between the BIOS and hardware

3rd Party Drivers:

The following is for informational purposes only:

MRESP50.SYS Sat Nov 19 01:13:16 2005 (437EDE9C)
Acceler.sys Fri Jun 26 14:56:26 2009 (4A4535FA)
intelppm.sys Mon Jul 13 17:11:03 2009 (4A5BBF07)
stdflt.sys Thu Jul 16 09:36:41 2009 (4A5F4909)
BCM42RLY.sys Fri Aug 21 18:07:12 2009 (4A8F36B0)
igdkmd32.sys Wed Sep 2 12:48:03 2009 (4A9EBDE3)
RTKVHDA.sys Tue Oct 13 03:38:46 2009 (4AD44AA6)
SynTP.sys Thu Dec 10 19:29:22 2009 (4B21AE82)
amdxata.sys Fri Mar 19 10:19:01 2010 (4BA3A3F5)
pcdsrvc.pkms Sun May 2 21:01:06 2010 (4BDE3C72)
CtClsFlt.sys Wed Aug 11 20:50:20 2010 (4C63616C)
iaStor.sys Sat Nov 6 01:37:33 2010 (4CD505BD)
SmartDefragDriver.sys Fri Nov 26 02:30:35 2010 (4CEF7E3B)
SYMDS.SYS Mon May 16 16:14:26 2011 (4DD1A1C2)
Rt86win7.sys Fri Jun 10 00:31:55 2011 (4DF1BA5B)
ccSetx86.sys Fri Nov 4 15:52:52 2011 (4EB45EB4)
SYMNETS.SYS Sat Nov 12 13:58:19 2011 (4EBEDDEB)
Ironx86.SYS Mon Nov 14 19:00:13 2011 (4EC1C7AD)
SYMEVENT.SYS Tue Nov 22 11:30:26 2011 (4ECBEA42)
SYMEFA.SYS Tue Nov 22 17:48:14 2011 (4ECC42CE)
SRTSP.SYS Thu Mar 15 12:05:33 2012 (4F622F6D)
SRTSPX.SYS Thu Mar 15 12:05:40 2012 (4F622F74)
NAVEX15.SYS Wed Apr 25 02:36:43 2012 (4F97B79B)
NAVENG.SYS Wed Apr 25 02:38:43 2012 (4F97B813)
EraserUtilRebootDrv.sys Tue May 15 18:33:04 2012 (4FB2F5C0)
eeCtrl.sys Tue May 15 18:33:04 2012 (4FB2F5C0)
BHDrvx86.sys Wed May 16 19:41:23 2012 (4FB45743)
IDSvix86.sys Thu May 24 18:08:07 2012 (4FBECD67)

MRESP50.SYS
Acceler.sys
intelppm.sys
stdflt.sys
BCM42RLY.sys
igdkmd32.sys
RTKVHDA.sys
SynTP.sys
amdxata.sys
pcdsrvc.pkms
CtClsFlt.sys
iaStor.sys
SmartDefragDriver.sys
SYMDS.SYS
Rt86win7.sys
ccSetx86.sys
SYMNETS.SYS
Ironx86.SYS
SYMEVENT.SYS
SYMEFA.SYS
SRTSP.SYS
SRTSPX.SYS
NAVEX15.SYS
NAVENG.SYS
EraserUtilRebootDrv.sys
eeCtrl.sys
BHDrvx86.sys
IDSvix86.sys
​

 

[villageac]

Thank you for your time and information. I uninstalled the 3 3rd party programs you cited. I do not have any USB devices normally in use on this computer. This computer has an sealed battery - so if I need to, I can get to it to disconnect it and hold down the power key for 30 seconds, but it is a bit of a project on this laptop.
I did follow your link to USB Driver - General Fix for Problems
and followed those instructions.
I will post back if I have problems. Thanks again for your attention.

 

[writhziden]

Ah, you have one of those netbook type laptops... Horrible design flaw putting the battery inside. As an engineer with design background and electrical background, I would love to speak with the engineers who thought up that idiocy.

 

[villageac]

power failure returned

My system had been behaving since I posted. About a month ago the problem returned. I did the steps that solved my problem the last time, but the problem won't go away. I downloaded the SF diagnostic tool and created the zip folder
I appreciate your help

 

[koolkat77]

My system had been behaving since I posted. About a month ago the problem returned. I did the steps that solved my problem the last time, but the problem won't go away. I downloaded the SF diagnostic tool and created the zip folder
I appreciate your help

Hi

Unforturnately the dumps do not load. Can you grab and post them again following the instructions?

 

[villageac]

redid SF diagnostic

I redid the diagnostics and am attaching the new file
Thanks

 

[Vir Gnarus]

Looks good now. Each one reports an issue with a USB HID (Human Interface Device; e.g. keyboard, mouse, touchpad). It's being held up somehow when attempting to do a remove device, which is kinda unusual normal activity. There's a good possibility that we're dealing with an internal issue with one of the input devices on your laptop, such as a connection problem or a motherboard malfunction, which would cause it to lose connection to the input device and have it meet an unexpected demise. I do know that the reason it was held up was because the request given to it was not supported, so it doesn't quite understand this device remove request given to it.

I recommend you go to the Dell website and find updates for your drivers involving your Touchpad and any other input device present. If you are using an external device like a mouse with its own drivers get updates (and firmware if available) for that too. BIOS updates may also help in this regard. Otherwise, you may have a hardware failure here.

This is just a rudimentary analysis. I cannot delve further into it without a MEMORY.DMP file from your Windows directory.

Analysts:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: 887dc030, Physical Device Object of the stack
Arg3: 82f7bae0, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: [COLOR=Green]9e5cd340[/COLOR], The blocked IRP

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: USBHUB!_DEVICE_EXTENSION_PDO                  ***
***                                                                   ***
*************************************************************************
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

DRVPOWERSTATE_SUBCODE:  3

DRIVER_OBJECT: 887fb3d8

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d8c04da

MODULE_NAME: usbhub

FAULTING_MODULE: 8afb8000 usbhub

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

STACK_TEXT:  
82f7ba94 82f1aecf 0000009f 00000003 887dc030 nt!KeBugCheckEx+0x1e
82f7bb00 82f1af48 82f7bba0 00000000 82f88380 nt!PopCheckIrpWatchdog+0x1f5
82f7bb38 82ece019 82f966e0 00000000 73379a5e nt!PopCheckForIdleness+0x73
82f7bb7c 82ecdfbd 82f7ed20 82f7bca8 00000001 nt!KiProcessTimerDpcTable+0x50
82f7bc68 82ecde7a 82f7ed20 82f7bca8 00000000 nt!KiProcessExpiredTimerList+0x101
82f7bcdc 82ecc00e 0000abff 8acca7f8 82f88380 nt!KiTimerExpiration+0x25c
82f7bd20 82ecbe38 00000000 0000000e 00000000 nt!KiRetireDpcList+0xcb
82f7bd24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  0x9F_3_IMAGE_usbhub.sys

BUCKET_ID:  0x9F_3_IMAGE_usbhub.sys

Followup: MachineOwner
---------
0: kd> !irp [COLOR=Green]9e5cd340[/COLOR] 1
Irp is active with 9 stacks 6 is current (= 0x9e5cd464)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
Flags = 00000000
ThreadListEntry.Flink = 9e5cd350
ThreadListEntry.Blink = 9e5cd350
IoStatus.Status = [COLOR=Red]c00000bb[/COLOR]
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = 9e5cd380
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 82f96178
Tail.Overlay.ListEntry.Blink = 82f96178
Tail.Overlay.CurrentStackLocation = 9e5cd464
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 887dc030 00000000 9b9905b4-00000000 Success Error Cancel pending
           \Driver\usbhub    hidusb!HumPowerCompletion
            Args: 00000000 00000001 00000001 00000000
 [ 16, 2]   0 e0 8a9efb78 00000000 9b9a0464-8a9efc30 Success Error Cancel 
           \Driver\[COLOR=DarkOrange]HidUsb    HIDCLASS!HidpFdoPowerCompletion[/COLOR]
            Args: 00000000 00000001 00000001 00000000
 [ 16, 2]   0 e1 8a9efb78 00000000 00000000-00000000    pending
           \Driver\[COLOR=DarkOrange]HidUsb [/COLOR](IopUnloadSafeCompletion)
            Args: 00000000 00000001 00000001 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-9e561e38    

            Args: 00000000 00000000 00000000 00000000
0: kd> !error [COLOR=Red]c00000bb[/COLOR]
Error code: (NTSTATUS) 0xc00000bb (3221225659) - [COLOR=Red]The request is not supported.[/COLOR]

I can't go much further with the minidumps. I tried looking at the device nodes to see what types of states they support, but I can only view the parent node (the usbhub itself) and not the child (the actual usb device), which is what I need. However, I have seen this before in other PCs and often it's because of some internal hardware issue with the laptop.

 

[villageac]

uninstalled and reinstalled Drivers

I uninstalled keyboard and touchpad drivers and then downloaded the latest version of touchpad driver from Dell and installed. I don't use an external mouse or keyboard on this and don't think I've ever done so.

I zipped the memory.dmp file but it won't upload - I think it's too big - the zipped folder properties says it's 160 MB and it looks like the max zip file size for upload is 8 mb.

 

[Vir Gnarus]

You'll need to upload to a 3rd-party filesharing site.

 

[villageac]

another crash after new keyboard and touchpad drivers

just crashed again. I redid the SF diagnostic tool. If you think the memory.dmp file is needed - if I delete the existing one, will the one created during the next crash be smaller?

 

[Vir Gnarus]

No, the size will only change based on how much memory was utilized at the time, so the filesize will hardly change. Every crash you experience that successfully dumps a crashdump will overwrite the existing MEMORY.DMP file, so the MEMORY.DMP file only pertains to the latest crash you experienced.

 

[villageac]

Google Drive Memory.dmp

will this work?

https://docs.google.com/open?id=0By85VEybwyyka2MyX3Z1YUg5WkU

 

[Vir Gnarus]

I discovered it's your keyboard that's causing the problem (TBH, I should've known that just from the HID name). What exactly it's doing that that's unsupported, I don't know (I do know it has something to do with the power state), as I don't quite have the expertise yet to delve that far.

I did see two drivers present in the stack for the thread here, which may or may not be involved. One is what looks to be an Intel LAN/wifi driver (dated Jan 23, 2012) and the other is an old Intel graphics driver (dated Sep 2009, pre-Windows 7). You will want to update these drivers at your earliest convenience. Grab them from the Dell website. BIOS update will also be beneficial.

If that does not resolve your problem, it's time to turn the system in for replacement. Hopefully your warranty has yet to expire. You may wanna try and persuade them to replace the laptop rather than service it, since if they try servicing it then it probably will be done 2-4 times before they end up replacing the right part. Remember to back everything up (like with Clonezilla if you want full disk image) before sending it to them, as they might end up replacing/formating your drive (which I know isn't involved but they'll do it anyways) and you'll lose your data from it if that happens.

 

[villageac]

thanks for your help and advice. I deleted and updated the drivers and I did a OS repair. Machine is out of warranty, so if this recurs, I'll live with it or consider an attempt to make it a Linux machine - just to see if that helps - before pitching the computer.