BSOD x9F after sleep.

[jychang]

Same problem here. Frequent BSOD with error code 9f pointing to NTOSKRNL.exe as the crash driver. Please assist.

Windows 7 (64bit)
Acer OEM

 

[JMH]

1. Your single DMP was inconclusive.
It is much easier to find patterns, etc, when there are more than one crash.

We prefer you wait until you have at least two so that if one is corrupt the other probably wont be.


2. I note you have AVG.
AVG can be a contributing cause of BSOD'S .
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows

 

[jychang]

Many unsuccessful tries to upload all DMP zip. Will give it a try again. Thanks.

 

[JMH]

Try this way next time...

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[jychang]

More DMP files.

 

[zigzag3143]

It seems AVG is still resident and loading. You really should remove it at least to test.

All of these were related to a driver taking too long to respond (could be AVG), and all of them had you machine up for at least a day each.

Because of the way your machine crashes it cant tell us what driver without running some additional tests.


These crashes were caused by memory corruption/exception (probably a driver).
Please run these two tests to verify your memory and find which driver is causing the problem.

* If you are overclocking anything reset to default before running these tests.
In other words STOP!!!

* If you have raid update its Driver.



Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html



Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

 

[jychang]

Just removed AVG and installed MS Security. We'll wait and see. Thanks.

 

[jychang]

Unfortunately, BSOD.

It stayed up for a few days and it BSOD again while in Chrome. Uploaded the latest dump.

 

[zigzag3143]

It stayed up for a few days and it BSOD again while in Chrome. Uploaded the latest dump.

It is much easier to find patterns, etc, when there are more than one crash.

We prefer you wait until you have at least two so that if one is corrupt the other probably wont be.





Related to mwlPSDNServ.sys MyWinLocker PSD Named Pipe Driver from Egis Incorporated.

Plus your machine uptime was 4 + days. Might want to reboot once a day just to test.

 

[jychang]

Please help.

BSOD many times in the last few days.

 

[writhziden]

Security Software:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	904	8	200	1380	3/23/2012 5:41 AM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 6:21 PM
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2712	8	200	1380	3/23/2012 5:41 AM	3.0.8402.0	281.52 KB (288,272 bytes)	4/27/2011 6:21 PM
msseces.exe	c:\program files\microsoft security client\msseces.exe	3428	8	200	1380	3/23/2012 5:43 AM	2.1.1116.0	1.37 MB (1,436,736 bytes)	6/15/2011 3:35 PM
[B][COLOR="Red"]mcsacore.exe	c:\progra~2\mcafee\sitead~1\mcsacore.exe	2004	8	3072	4608	3/23/2012 5:41 AM	3.4.1.118	101.02 KB (103,440 bytes)	2/25/2012 9:30 AM
saui.exe	c:\progra~2\mcafee\sitead~1\saui.exe	3532	8	200	1380	3/23/2012 5:52 AM	3.4.1.195	276.02 KB (282,648 bytes)	2/25/2012 9:30 AM[/COLOR][/B]

Please remove McAfee site advisor through Start Menu -> Control Panel -> Uninstall a program


Out of date driver:

SynTP	fffff880`03a7a000	fffff880`03ac5000	Fri Jun 16 16:50:32 2006 (449335b8)	0004d8b9		SynTP.sys

This is your Synaptics Touchpad Mouse built into the Acer laptop. I imagine there is a more up to date version through Acer support. Please install the latest driver.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\jychang\032312-41075-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`00ba2730?
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03012000 PsLoadedModuleList = 0xfffff800`03256650
Debug session time: Fri Mar 23 04:39:43.859 2012 (UTC - 6:00)
System Uptime: 0 days 9:37:12.683
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa80054e9060, fffff80000ba2748, fffffa8004192170}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa80054e9060, Physical Device Object of the stack
Arg3: fffff80000ba2748, Functional Device Object of the stack
Arg4: fffffa8004192170, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IRP_ADDRESS:  fffffa8004192170

DEVICE_OBJECT: 0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  mscorsvw.exe

CURRENT_IRQL:  2

STACK_TEXT:  
fffff800`00ba26f8 fffff800`030fc192 : 00000000`0000009f 00000000`00000003 fffffa80`054e9060 fffff800`00ba2748 : nt!KeBugCheckEx
fffff800`00ba2700 fffff800`03099a6c : fffff800`00ba2830 fffff800`00ba2830 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x34040
fffff800`00ba27a0 fffff800`03099906 : fffff800`03238f00 00000000`0021dffd 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00ba2810 fffff800`030997ee : 00000050`a2b0260b fffff800`00ba2e88 00000000`0021dffd fffff800`03208228 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00ba2e60 fffff800`030995d7 : fffff800`03203ec1 fffffa80`0021dffd 00000000`00000000 00000000`000000fd : nt!KiTimerExpiration+0x1be
fffff800`00ba2f00 fffff800`03091f15 : 00000000`00000000 fffffa80`038bb950 00000000`00000000 fffff880`03e75588 : nt!KiRetireDpcList+0x277
fffff800`00ba2fb0 fffff800`03091d2c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`09b56be0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_0x9F_3_ANALYSIS_INCONCLUSIVE

BUCKET_ID:  X64_0x9F_3_ANALYSIS_INCONCLUSIVE

Followup: MachineOwner
---------

The module was inconclusive. This could indicate a virus.

• Scan for viruses with a full scan using the free version (do not start the trial) of Malwarebytes : Free anti-malware, anti-virus and spyware removal download and see the http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627 for better security steps and scanning tools.
  
  
• Also, run a full scan with Microsoft Security Essentials.