locked
windows maintanince error RRS feed

  • Question

  • Source
    Windows

    Summary
    Shut down unexpectedly

    Date
    ‎6/‎4/‎2015 10:35 AM

    Status
    Solution available

    Problem signature
    Problem Event Name:    BlueScreen
    Code:    9f
    Parameter 1:    3
    Parameter 2:    ffffe0012d4e4d90
    Parameter 3:    fffff800f5a10960
    Parameter 4:    ffffe0012f5d1010
    OS version:    6_3_9600
    Service Pack:    0_0
    Product:    768_1
    OS Version:    6.3.9600.2.0.0.768.101
    Locale ID:    1033

    Extra information about the problem
    Bucket ID:    0x9F_3_UNBIND_PROTOCOL_IMAGE_ndis.sys
    Thursday, June 4, 2015 3:02 PM

Answers

  • That memory dump shows a crash on PCI.sys, which is for PCI plug and play. The driver is either from the OS itself or the PCI Bus driver. If my analysis is correct the driver is L1C63x64.sys; however I could be wrong.


    Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\shawnr\Desktop\MEMORY\MEMORY.DMP]
    Kernel Bitmap Dump File: Only kernel address space is available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 8 Kernel Version 9600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17736.amd64fre.winblue_r9.150322-1500
    Machine Name:
    Kernel base = 0xfffff803`4b804000 PsLoadedModuleList = 0xfffff803`4badd850
    Debug session time: Tue Jun  9 04:27:13.430 2015 (UTC - 5:00)
    System Uptime: 0 days 1:22:36.200
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols

    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 9F, {3, ffffe0019f1b0280, ffffd0004c5ad960, ffffe001a7e94e10}

    Probably caused by : pci.sys

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_POWER_STATE_FAILURE (9f)
    A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: ffffe0019f1b0280, Physical Device Object of the stack
    Arg3: ffffd0004c5ad960, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
    Arg4: ffffe001a7e94e10, The blocked IRP

    Debugging Details:
    ------------------


    DRVPOWERSTATE_SUBCODE:  3

    IMAGE_NAME:  pci.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  53d0f1d4

    MODULE_NAME: pci

    FAULTING_MODULE: fffff800477a0000 pci

    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

    BUGCHECK_STR:  0x9F

    PROCESS_NAME:  System

    CURRENT_IRQL:  2

    TAG_NOT_DEFINED_c000000f:  FFFFD0004C5B4FB0

    STACK_TEXT:  
    ffffd000`4c5ad928 fffff803`4ba0c782 : 00000000`0000009f 00000000`00000003 ffffe001`9f1b0280 ffffd000`4c5ad960 : nt!KeBugCheckEx
    ffffd000`4c5ad930 fffff803`4ba0c6a2 : ffffe001`a212ad90 00000000`00000008 ffffd000`4c5ada58 fffff803`4b8a8391 : nt!PopIrpWatchdogBugcheck+0xde
    ffffd000`4c5ad990 fffff803`4b8aa2d8 : 00000000`00000000 ffffd000`4c5adae0 00000000`00000001 00000000`00000001 : nt!PopIrpWatchdog+0x32
    ffffd000`4c5ad9e0 fffff803`4b9587ea : ffffd000`4c584180 ffffd000`4c584180 00000000`00000000 ffffd000`4c5902c0 : nt!KiRetireDpcList+0x4f8
    ffffd000`4c5adc60 00000000`00000000 : ffffd000`4c5ae000 ffffd000`4c5a8000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a


    STACK_COMMAND:  kb

    FOLLOWUP_NAME:  MachineOwner

    FAILURE_BUCKET_ID:  0x9F_3_L1C63x64_IMAGE_pci.sys

    BUCKET_ID:  0x9F_3_L1C63x64_IMAGE_pci.sys

    Followup: MachineOwner
    ---------

    2: kd> !irp ffffe001a7e94e10
    Irp is active with 4 stacks 3 is current (= 0xffffe001a7e94f70)
     No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
         cmd  flg cl Device   File     Completion-Context
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    

                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    

                Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e1 ffffe001a2350050 00000000 fffff8034bb81b44-ffffe001a212ad90 Success Error Cancel pending
              *** ERROR: Module load completed but symbols could not be loaded for L1C63x64.sys
     \Driver\L1C    nt!PopSystemIrpCompletion
                Args: 00014400 00000000 00000004 00000002
     [  0, 0]   0  0 00000000 00000000 00000000-ffffe001a212ad90    

                Args: 00000000 00000000 00000000 00000000


    • Edited by Acreed02 Tuesday, June 9, 2015 12:58 PM
    • Proposed as answer by ZigZag3143x Tuesday, June 9, 2015 1:14 PM
    • Marked as answer by Johnp57 Tuesday, June 9, 2015 1:34 PM
    Tuesday, June 9, 2015 12:56 PM

All replies

  •  
    We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  


    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask


    Wanikiya and Dyami--Team Zigzag

    Thursday, June 4, 2015 3:12 PM
  • Bluescreens will leave a DMP file located in C:\Windows\minidump, navigate there and upload the DMP file to your onedrive or another file sharing program. Then post the link here so I can download and analyze it. If your account is not verified it will not allow you to post links, to bypass this replace HTTP with HXXP
    Thursday, June 4, 2015 3:14 PM
  • http://1drv.ms/1FxNQQ6

    Here is the folder with files

    Thursday, June 4, 2015 4:17 PM
  • @Acreed02

    Better but no  You could have left it.

    @johnp57

    This was Related to vwifimp.sys Virtual WiFi Miniport Driver from Microsoft Corporation.  Because it is part of the OS I would start by running a systme file check & DISM

    Please run a system file check (SFC) & DISM (if necessary) if you are on win 8 or higher

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.



    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\MEMORY.DMP]
    Kernel Bitmap Dump File: Only kernel address space is available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8 Kernel Version 9600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17736.amd64fre.winblue_r9.150322-1500
    Machine Name:
    Kernel base = 0xfffff800`f388f000 PsLoadedModuleList = 0xfffff800`f3b68850
    Debug session time: Thu Jun  4 10:01:06.780 2015 (UTC - 4:00)
    System Uptime: 0 days 1:22:36.551
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 9F, {3, ffffe0012d4e4d90, fffff800f5a10960, ffffe0012f5d1010}
    
    Probably caused by : vwifibus.sys
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver has failed to complete a power IRP within a specific time.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: ffffe0012d4e4d90, Physical Device Object of the stack
    Arg3: fffff800f5a10960, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
    Arg4: ffffe0012f5d1010, The blocked IRP
    
    Debugging Details:
    ------------------
    
    
    DRVPOWERSTATE_SUBCODE:  3
    
    IMAGE_NAME:  vwifibus.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5215f854
    
    MODULE_NAME: vwifibus
    
    FAULTING_MODULE: fffff801d4d1b000 vwifibus
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  0x9F
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    DPC_STACK_BASE:  FFFFF800F5A17FB0
    
    STACK_TEXT:  
    fffff800`f5a10928 fffff800`f3a97782 : 00000000`0000009f 00000000`00000003 ffffe001`2d4e4d90 fffff800`f5a10960 : nt!KeBugCheckEx
    fffff800`f5a10930 fffff800`f3a976a2 : ffffe001`2e5ec4a0 00000000`00000008 fffff800`f5a10a58 fffff800`f3933391 : nt!PopIrpWatchdogBugcheck+0xde
    fffff800`f5a10990 fffff800`f39352d8 : 00000000`00000000 fffff800`f5a10ae0 00000000`00000001 00000000`00000001 : nt!PopIrpWatchdog+0x32
    fffff800`f5a109e0 fffff800`f39e37ea : fffff800`f3b92180 fffff800`f3b92180 fffff800`f3beba00 ffffe001`2eba1080 : nt!KiRetireDpcList+0x4f8
    fffff800`f5a10c60 00000000`00000000 : fffff800`f5a11000 fffff800`f5a0b000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_NAME:  MachineOwner
    
    FAILURE_BUCKET_ID:  0x9F_3_POWER_DOWN_vwifimp_IMAGE_vwifibus.sys
    
    BUCKET_ID:  0x9F_3_POWER_DOWN_vwifimp_IMAGE_vwifibus.sys
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0x9f_3_power_down_vwifimp_image_vwifibus.sys
    
    FAILURE_ID_HASH:  {0723cd8f-d174-0851-252b-1f5f4bf49d7c}
    
    Followup: MachineOwner
    ---------
    
    0: kd> !irp ffffe0012f5d1010
    Irp is active with 4 stacks 3 is current (= 0xffffe0012f5d1170)
     No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
         cmd  flg cl Device   File     Completion-Context
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    			Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    			Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e1 ffffe0012cb53050 00000000 fffff800f3c0cb44-ffffe0012e5ec4a0 Success Error Cancel pending
    	       \Driver\vwifimp	nt!PopSystemIrpCompletion
    			Args: 00014400 00000000 00000004 00000002
     [  0, 0]   0  0 00000000 00000000 00000000-ffffe0012e5ec4a0    
    
    			Args: 00000000 00000000 00000000 00000000
    0: kd> !devstack ffffe0012f5d1010
      !DevObj           !DrvObj            !DevExt           ObjectName
    Invalid type for DeviceObject 0xffffe0012f5d1010
    0: kd> !devnode ffffe0012f5d1010
    DevNode 0xffffe0012f5d1010 for PDO 0xffffe0012f5d1030
      Parent 0000000000   Sibling 0x01f00006   Child 0000000000   
      InterfaceType 0  Bus Number 0
      InstancePath is ""
      ServiceName is ""
      State = Unknown State (0x0)
      Previous State = Unknown State (0x0)
      StateHistory[19] = Unknown State (0x2)
      StateHistory[18] = Unknown State (0x0)
      StateHistory[17] = Unknown State (0x4)
      StateHistory[16] = Unknown State (0x0)
      StateHistory[15] = Unknown State (0x0)
      StateHistory[14] = Unknown State (0x0)
      StateHistory[13] = Unknown State (0x14400)
      StateHistory[12] = Unknown State (0x0)
      StateHistory[11] = Unknown State (0xe1000216)
      StateHistory[10] = Unknown State (0x0)
      StateHistory[09] = Unknown State (0x0)
      StateHistory[08] = Unknown State (0x0)
      StateHistory[07] = Unknown State (0x0)
      StateHistory[06] = Unknown State (0x0)
      StateHistory[05] = Unknown State (0x0)
      StateHistory[04] = Unknown State (0x0)
      StateHistory[03] = Unknown State (0x0)
      StateHistory[02] = Unknown State (0x0)
      StateHistory[01] = Unknown State (0x0)
      StateHistory[00] = Unknown State (0x0)
      Flags (0xffffe001)  DNF_MADEUP, DNF_HAS_PROBLEM, 
                          DNF_HAS_PRIVATE_PROBLEM, DNF_HARDWARE_VERIFICATION, 
                          DNF_DEVICE_GONE, DNF_LEGACY_RESOURCE_DEVICENODE, 
                          DNF_NEEDS_REBALANCE, DNF_LOCKED_FOR_EJECT, 
                          DNF_DRIVER_BLOCKED, DNF_CHILD_WITH_INVALID_ID, 
                          DNF_ASYNC_START_NOT_SUPPORTED, DNF_ASYNC_ENUMERATION_NOT_SUPPORTED, 
                          DNF_LOCKED_FOR_REBALANCE, DNF_UNINSTALLED, 
                          DNF_NO_LOWER_DEVICE_FILTERS, DNF_NO_LOWER_CLASS_FILTERS, 
                          DNF_NO_SERVICE, DNF_NO_UPPER_DEVICE_FILTERS, 
                          DNF_NO_UPPER_CLASS_FILTERS, DNF_WAITING_FOR_FDO
      DisableableDepends = 794628840 (from children)
      Problem = Unknown problem (0)
    0: kd> !drvobj \Driver\vwifimp
    Driver object (ffffe0012d4dfca0) is for:
     \Driver\vwifimp
    Driver Extension List: (id , addr)
    (4e4d4944 ffffe0012d4df7e0)  
    Device Object list:
    ffffe0012cb53050  


    Wanikiya and Dyami--Team Zigzag


    • Edited by ZigZag3143x Thursday, June 4, 2015 5:23 PM
    • Proposed as answer by Deason Wu Monday, June 8, 2015 2:24 AM
    Thursday, June 4, 2015 5:19 PM
  • @Acreed02

    Better but no  You could have left it.


    Figured it would be best to not have false information, less confusion. :D
    Thursday, June 4, 2015 5:25 PM
  • It only seems to happen if I let the laptop run daily maintenance on it's own for too long

    the only usb i have is the mouse on the usb 3.0 port and the PNY file history drive on the other usb port

    Thursday, June 4, 2015 5:36 PM
  • @Acreed02

    Was not false just incomplete.  Anyone learning to debug is bound to over reach every now and then

    @Johnp57

    Did you run the system file check & DISM?


    Wanikiya and Dyami--Team Zigzag

    Thursday, June 4, 2015 6:11 PM
  • http://1drv.ms/1HYR9Bv   memory dumps

    ran sfc unable to repair will run dism next

    Tuesday, June 9, 2015 12:40 PM
  • That memory dump shows a crash on PCI.sys, which is for PCI plug and play. The driver is either from the OS itself or the PCI Bus driver. If my analysis is correct the driver is L1C63x64.sys; however I could be wrong.


    Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Users\shawnr\Desktop\MEMORY\MEMORY.DMP]
    Kernel Bitmap Dump File: Only kernel address space is available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 8 Kernel Version 9600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.17736.amd64fre.winblue_r9.150322-1500
    Machine Name:
    Kernel base = 0xfffff803`4b804000 PsLoadedModuleList = 0xfffff803`4badd850
    Debug session time: Tue Jun  9 04:27:13.430 2015 (UTC - 5:00)
    System Uptime: 0 days 1:22:36.200
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols

    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 9F, {3, ffffe0019f1b0280, ffffd0004c5ad960, ffffe001a7e94e10}

    Probably caused by : pci.sys

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_POWER_STATE_FAILURE (9f)
    A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: ffffe0019f1b0280, Physical Device Object of the stack
    Arg3: ffffd0004c5ad960, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
    Arg4: ffffe001a7e94e10, The blocked IRP

    Debugging Details:
    ------------------


    DRVPOWERSTATE_SUBCODE:  3

    IMAGE_NAME:  pci.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  53d0f1d4

    MODULE_NAME: pci

    FAULTING_MODULE: fffff800477a0000 pci

    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

    BUGCHECK_STR:  0x9F

    PROCESS_NAME:  System

    CURRENT_IRQL:  2

    TAG_NOT_DEFINED_c000000f:  FFFFD0004C5B4FB0

    STACK_TEXT:  
    ffffd000`4c5ad928 fffff803`4ba0c782 : 00000000`0000009f 00000000`00000003 ffffe001`9f1b0280 ffffd000`4c5ad960 : nt!KeBugCheckEx
    ffffd000`4c5ad930 fffff803`4ba0c6a2 : ffffe001`a212ad90 00000000`00000008 ffffd000`4c5ada58 fffff803`4b8a8391 : nt!PopIrpWatchdogBugcheck+0xde
    ffffd000`4c5ad990 fffff803`4b8aa2d8 : 00000000`00000000 ffffd000`4c5adae0 00000000`00000001 00000000`00000001 : nt!PopIrpWatchdog+0x32
    ffffd000`4c5ad9e0 fffff803`4b9587ea : ffffd000`4c584180 ffffd000`4c584180 00000000`00000000 ffffd000`4c5902c0 : nt!KiRetireDpcList+0x4f8
    ffffd000`4c5adc60 00000000`00000000 : ffffd000`4c5ae000 ffffd000`4c5a8000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a


    STACK_COMMAND:  kb

    FOLLOWUP_NAME:  MachineOwner

    FAILURE_BUCKET_ID:  0x9F_3_L1C63x64_IMAGE_pci.sys

    BUCKET_ID:  0x9F_3_L1C63x64_IMAGE_pci.sys

    Followup: MachineOwner
    ---------

    2: kd> !irp ffffe001a7e94e10
    Irp is active with 4 stacks 3 is current (= 0xffffe001a7e94f70)
     No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
         cmd  flg cl Device   File     Completion-Context
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    

                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    

                Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e1 ffffe001a2350050 00000000 fffff8034bb81b44-ffffe001a212ad90 Success Error Cancel pending
              *** ERROR: Module load completed but symbols could not be loaded for L1C63x64.sys
     \Driver\L1C    nt!PopSystemIrpCompletion
                Args: 00014400 00000000 00000004 00000002
     [  0, 0]   0  0 00000000 00000000 00000000-ffffe001a212ad90    

                Args: 00000000 00000000 00000000 00000000


    • Edited by Acreed02 Tuesday, June 9, 2015 12:58 PM
    • Proposed as answer by ZigZag3143x Tuesday, June 9, 2015 1:14 PM
    • Marked as answer by Johnp57 Tuesday, June 9, 2015 1:34 PM
    Tuesday, June 9, 2015 12:56 PM