Computer randomly shut downs, BSOD BCCode: 9F

[wxman83]

Hi. In the past couple of days my computer has randomly started shutting down by itself. I'll leave to go somewhere, come home and the computer is shut off. When I cut it back on it says windows shut down incorrectly and eventually, after logging on, it says that windows experienced an error.

I don't know if this has anything to do with it but lately I have noticed my computer lags a great deal at startup. After looking at the task manager on multiple occasions I have found there are always multiple svchost.exe processes running. Another thing that I do not understand is there is always at least 3 or 4 iexplore.exe processes running, even though I never use Internet Explorer. I can close most of them except for the last one, with which I always receive an "access is denied" box. A couple of minutes later I can look at the Task Manager and they are back again. Like I said, I have no clue if that is related but hopefully it helps. I run Malwarebytes Anti-Malware and SUPERAntiSpyware regularly, along with having the Microsoft Security Essentials, but can seem to find a problem. Thanks for any help that can be provided.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800723ca10, fffff80004878518, fffffa800f3e0780}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys

Followup: MachineOwner
---------

0: kd> lmvm rt64win7
start             end                 module name
fffff880`051a5000 fffff880`051fc000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        [COLOR="Red"][B]Fri Mar 05 00:12:52 2010[/B][/COLOR] (4B8FB8DC)
    CheckSum:         000611C5
    ImageSize:        00057000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update the Realtek adapter driver here:
Realtek

 

[wxman83]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800723ca10, fffff80004878518, fffffa800f3e0780}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys

Followup: MachineOwner
---------

0: kd> lmvm rt64win7
start             end                 module name
fffff880`051a5000 fffff880`051fc000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        [COLOR=Red][B]Fri Mar 05 00:12:52 2010[/B][/COLOR] (4B8FB8DC)
    CheckSum:         000611C5
    ImageSize:        00057000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update the Realtek adapter driver here:
Realtek

Ok, just updated the adapter. Thank you for the help and hopefully this fixes things. So what exactly was happening...was this adapter causing the slowness and the random shutdowns?

Also, I just updated my Malwarebytes Anit-Malware and it gave me a free trial of real-time protection. I keep on getting a pop-up that a malicious website is being blocked - xmlclick-a.com using the process iexplore.exe. I realize this is more virus/malware stuff so do I need to post this question in another subforum?

 

[Golden]

Are you trying to navigate to xmclick? If so, the AV is doing its job : preventing you from visiting that site. You don't need to do anything.

 

[wxman83]

Definitely not, I just wanted to know if there was a way to get it off my computer permanently because this trial will not last forever and Microsoft Security Essentials seems to not be picking it up. This must be why I keep on seeing multiple iexplore.exe processes in my task manager, even though I don't even use my IE.

 

[Golden]

Run scan using the ESET on-line virus scanner, and remove any threats it finds. Keep a list of what it finds.

Free Virus Scan | Online Virus Scanner from ESET

 

[wxman83]

Thanks again for the help. I started that scanner last night before I went to bed and it's still running this morning. As of right now its already found 11 threats and its only at 44%.

 

[Golden]

It does take a long time but leave it to finish. Make a note of what was cleaned up.

 

[wxman83]

Just to update, its been 24 hours and it's still running! Hopefully when I wake up in the morning it will be finished. I'll be sure and post what it finds.

 

[wxman83]

Ok, so it finally stopped. I believe it said one threat will need to be cleaned after I restart so I'm going to go ahead and do that.


***Restarted and got a message about RegSvr32 after logging on. I've attached a pic of the message-I have no clue what it means.

 

[wxman83]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800723ca10, fffff80004878518, fffffa800f3e0780}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys

Followup: MachineOwner
---------

0: kd> lmvm rt64win7
start             end                 module name
fffff880`051a5000 fffff880`051fc000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        [COLOR="Red"][B]Fri Mar 05 00:12:52 2010[/B][/COLOR] (4B8FB8DC)
    CheckSum:         000611C5
    ImageSize:        00057000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update the Realtek adapter driver here:
Realtek

Ok, so my computer was working ok for a few days after I updated that realtek adapter and ran that eset program but the BSOD seems to be back again, same code, same problem with randomly shutting the computer down. Did I download the right thing on the realtek site? I downloaded this:

Win7 and Server 2008 R2 Auto Installation Program (SID:1682807) 7.089 2014/9/24

 

[Golden]

Please upload the new zip file....also the link to the Realtek driver you downloaded.

 

[wxman83]

Ok, I've uploaded the zip file. I couldn't get the link's address to copy so I just made a screenshot showing which one I used.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800723ca10, fffff80004881518, fffffa800aa9d010}

*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : Rt64win7.sys

Followup: MachineOwner
---------

0: kd> lmvm Rt64win7
start             end                 module name
fffff880`04cfe000 fffff880`04de6000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:       [B][COLOR="Red"] Wed Jul 16 12:20:41 2014[/COLOR][/B] (53C5E881)
    CheckSum:         000EE582
    ImageSize:        000E8000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> !irp fffffa800aa9d010
Irp is active with 3 stacks 2 is current (= 0xfffffa800aa9d128)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 fffffa8008248050 00000000 fffff8000350c210-fffffa800a7a6870 Success Error Cancel pending
	       \Driver\RTL8167	nt!PopSystemIrpCompletion
			Args: 00015400 00000000 00000005 00000003
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa800a7a6870    

			Args: 00000000 00000000 00000000 00000000

Mmm, its definitely the latest driver, but I'm not sure why it is having issues. Let me see if I can get more help.

 

[wxman83]

Thanks, I really appreciate all the help. Also, every since I ran the ESET scanner I keep on getting a message that says eqnclass.dll fails to load each time I log back in on my computer after restarting. I posted the message on the first page of this thread. I don't think that has anything to do with the random shut downs since my computer worked fine for a couple of days after completing the ESET scan. I just wanted to make sure this wasn't adding to the problems.

 

[Arc]

Hi wxman83.

Does it ever crash/shut down/BSOD when it is in use?

Asking because of this point you stated in the OP ....

I'll leave to go somewhere, come home and the computer is shut off.

A stop 0x9F is a sleep/hibernation caused BSOD, mainly. When the computer goes to sleep or wakes up from sleep, some device fails to react within a stipulated time, and this BSOD occurs. Technically, "A driver has failed to complete a power IRP within a specific time."

It is bad that the device here is the onboard NIC, Realtek RTL8167.

As the driver update did not change anything there, I would suggest you to disable hibernate and sleep. As it is a Desktop PC, you will not loss anything if hibernation and sleep is off. Set the display to go off after a certain time of inactivity.

Leave the computer in this state for a few days. See if it continue to cause BSODs or not.

Whatever the result is, more action will be needed. But it is to know the fact at first.

 

[wxman83]

Hi wxman83.

Does it ever crash/shut down/BSOD when it is in use?

Asking because of this point you stated in the OP ....

I'll leave to go somewhere, come home and the computer is shut off.

A stop 0x9F is a sleep/hibernation caused BSOD, mainly. When the computer goes to sleep or wakes up from sleep, some device fails to react within a stipulated time, and this BSOD occurs. Technically, "A driver has failed to complete a power IRP within a specific time."

It is bad that the device here is the onboard NIC, Realtek RTL8167.

As the driver update did not change anything there, I would suggest you to disable hibernate and sleep. As it is a Desktop PC, you will not loss anything if hibernation and sleep is off. Set the display to go off after a certain time of inactivity.

Leave the computer in this state for a few days. See if it continue to cause BSODs or not.

Whatever the result is, more action will be needed. But it is to know the fact at first.

No, each time it has happened the computer has been idle and not in use. I have witnessed at least three times where the computer has went to sleep and then eventually a BSOD occurs and it shuts off. The other times I have been out of the house so I don't know for a fact that the BSODs only occur after sleeping. I just switched the setting to disable sleep (it was set at 20 minutes). Hibernation was already disabled and the display cuts off after 10 minutes. Hopefully this will help the problem. I'll be sure to report back in a couple of days to let you know the outcome. Thanks for the help, it is greatly appreciated!

 

[Arc]

I just switched the setting to disable sleep (it was set at 20 minutes). Hibernation was already disabled and the display cuts off after 10 minutes.

Perfect.

We will come to know what lies beneath, within coming two/three days.

 

[wxman83]

I just switched the setting to disable sleep (it was set at 20 minutes). Hibernation was already disabled and the display cuts off after 10 minutes.

Perfect.

We will come to know what lies beneath, within coming two/three days.

Ok, so its been three days and I have not had any random shut downs or BSODs after changing the sleep settings!

 

[Arc]

So it appears that the computer works as it should be, when sleep is disabled.

As it is a desktop computer, sleep is not a must for it. Sleep etc are useful for the portable computer running on stored power (battery) to preserve it.

If you like, you may use the computer as it is now.