[SOLVED] BSOD during boot up - Windows 8.1 x64

xarive · Jan 21, 2015

· OS - Windows 8.1 pro
· x64
· What was original installed OS on system? as stated above.
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? full retail ver.
· Age of system (hardware) 1 month
· Age of OS installation - have you re-installed the OS? no.

· CPU- i7 4710HQ 2.50 GHz
· Video Card GTX 860M 4GB MAXWELL

· System Manufacturer - ILLEGEAR
· Exact model number -Z5

· Laptop

Please kindly help me on this. Thanks.

Patrick · Jan 22, 2015

DRIVER_POWER_STATE_FAILURE (9f)

This bug check indicates that the driver is in an inconsistent or invalid power state.

Code:

0: kd> !irp ffffe001cf828440
Irp is active with 2 stacks 1 is current (= 0xffffe001cf828510)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
>[ 16, 2]   0 e1 ffffe001c9de4e50 00000000 fffff801ae537f4c-ffffe001cf491a40 Success Error Cancel pending
           \Driver\ACPI    nt!PopRequestCompletion
            Args: 00051100 00000001 00000001 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-ffffe001cf491a40    

            Args: 00000000 00000000 00000000 00000000

I doubt the driver in charge of power management and PnP device enumeration is actually the cause of the crash, but a 3rd party conflict. Please enable verifier:

Driver Verifier:

What is Driver Verifier?

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior.

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/8.1 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (only on Windows 7 & 8/8.1)
- DDI compliance checking (only on Windows 8/8.1)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not! a solution, but instead a diagnostic utility. It will tell us if a driver is causing your issues, but again it will not outright solve your issues.

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

- Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

- If you have the system set to generate Small Memory Dumps, they will be located in %systemroot%\Minidump.

- If you have the system set to generate Kernel Memory Dumps, it will be located in %systemroot% and labeled MEMORY.DMP.

Any other questions can most likely be answered by this article:

Using Driver Verifier to identify issues with Windows drivers for advanced users

xarive · Jan 22, 2015

Patrick said:
DRIVER_POWER_STATE_FAILURE (9f)

Dear @Patrick, thank you for your swift reply. I would like to express my gratitude towards you.

Here's the crash dump for the driver verifier utility. Your help is much appreciated.

Patrick · Jan 22, 2015

Thanks, we now have the actual culprit driver.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

This is the general bug check code for fatal errors found by Driver Verifier.

Code:

5: kd> .bugcheck
Bugcheck code 000000C4
Arguments 00000000`00020003 fffff800`6741a250 00000000`00000000 00000000`00000000

2003 1st argument, rule violation.

Code:

5: kd> k
Child-SP          RetAddr           Call Site
ffffd000`23c4f5f8 fffff800`67412258 nt!KeBugCheckEx
ffffd000`23c4f600 fffff800`67406105 VerifierExt!SLIC_abort+0x5c
ffffd000`23c4f640 fffff800`6740613b VerifierExt!SLIC_KeAcquireSpinLockAtDpcLevel_entry_IrqlDispatch+0x31
ffffd000`23c4f670 fffff802`408928f0 VerifierExt!KeAcquireSpinLockAtDpcLevel_wrapper+0x33
ffffd000`23c4f6c0 fffff800`68844716 nt!VerifierKeAcquireSpinLockAtDpcLevel+0xa4
ffffd000`23c4f700 ffffcf80`cada0bb0 ndisrd+0x2716
ffffd000`23c4f708 ffffd000`23c4f768 0xffffcf80`cada0bb0
ffffd000`23c4f710 fffff802`404f4060 0xffffd000`23c4f768
ffffd000`23c4f718 fffff802`404ab16c nt!NonPagedPoolDescriptor+0x920
ffffd000`23c4f720 ffffe001`680c4b00 nt!ExAllocatePoolWithTag+0x71c
ffffd000`23c4f7f0 ffffe001`6e1aca00 0xffffe001`680c4b00
ffffd000`23c4f7f8 fffff800`68141bec 0xffffe001`6e1aca00
ffffd000`23c4f800 fffff802`40880911 ndis!ndisDummyIrpHandler+0x88
ffffd000`23c4f830 fffff802`405e81ef nt!IovCallDriver+0x3cd
ffffd000`23c4f880 fffff802`405e778e nt!IopXxxControlFile+0xa4f
ffffd000`23c4fa20 fffff802`403632b3 nt!NtDeviceIoControlFile+0x56
ffffd000`23c4fa90 00000000`77bc2352 nt!KiSystemServiceCopyEnd+0x13
00000000`03e9f128 00000000`00000000 0x77bc2352

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:

5: kd> !irql
Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

Code:

5: kd> lmvm ndisrd
start             end                 module name
fffff800`68842000 fffff800`6884c000   ndisrd   T (no symbols)           
    Loaded symbol image file: ndisrd.sys
    Image path: \SystemRoot\system32\DRIVERS\ndisrd.sys
    Image name: ndisrd.sys
    Timestamp:        Wed Sep 14 06:18:41 2011

2011 driver.

So bottom line, if you have Mionet, or WinpkFilter, uninstall either of them. If you have WinpkFilter as opposed to Mionet, you may need to rename it instead by navigating to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

xarive · Jan 22, 2015

Patrick said:
Thanks, we now have the actual culprit driver.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

This is the general bug check code for fatal errors found by Driver Verifier.

H

Code:

5: kd> .bugcheck Bugcheck code 000000C4 Arguments 00000000`00020003 fffff800`6741a250 00000000`00000000 00000000`00000000

2003 1st argument, rule violation.

Code:

5: kd> k Child-SP RetAddr Call Site ffffd000`23c4f5f8 fffff800`67412258 nt!KeBugCheckEx ffffd000`23c4f600 fffff800`67406105 VerifierExt!SLIC_abort+0x5c ffffd000`23c4f640 fffff800`6740613b VerifierExt!SLIC_KeAcquireSpinLockAtDpcLevel_entry_IrqlDispatch+0x31 ffffd000`23c4f670 fffff802`408928f0 VerifierExt!KeAcquireSpinLockAtDpcLevel_wrapper+0x33 ffffd000`23c4f6c0 fffff800`68844716 nt!VerifierKeAcquireSpinLockAtDpcLevel+0xa4 ffffd000`23c4f700 ffffcf80`cada0bb0 ndisrd+0x2716 ffffd000`23c4f708 ffffd000`23c4f768 0xffffcf80`cada0bb0 ffffd000`23c4f710 fffff802`404f4060 0xffffd000`23c4f768 ffffd000`23c4f718 fffff802`404ab16c nt!NonPagedPoolDescriptor+0x920 ffffd000`23c4f720 ffffe001`680c4b00 nt!ExAllocatePoolWithTag+0x71c ffffd000`23c4f7f0 ffffe001`6e1aca00 0xffffe001`680c4b00 ffffd000`23c4f7f8 fffff800`68141bec 0xffffe001`6e1aca00 ffffd000`23c4f800 fffff802`40880911 ndis!ndisDummyIrpHandler+0x88 ffffd000`23c4f830 fffff802`405e81ef nt!IovCallDriver+0x3cd ffffd000`23c4f880 fffff802`405e778e nt!IopXxxControlFile+0xa4f ffffd000`23c4fa20 fffff802`403632b3 nt!NtDeviceIoControlFile+0x56 ffffd000`23c4fa90 00000000`77bc2352 nt!KiSystemServiceCopyEnd+0x13 00000000`03e9f128 00000000`00000000 0x77bc2352

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:

5: kd> !irql Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

Code:

5: kd> lmvm ndisrd start end module name fffff800`68842000 fffff800`6884c000 ndisrd T (no symbols) Loaded symbol image file: ndisrd.sys Image path: \SystemRoot\system32\DRIVERS\ndisrd.sys Image name: ndisrd.sys Timestamp: Wed Sep 14 06:18:41 2011

2011 driver.

So bottom line, if you have Mionet, or WinpkFilter, uninstall either of them. If you have WinpkFilter as opposed to Mionet, you may need to rename it instead by navigating to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Hi Patrick, I am afraid I didn't install neither of them. At least I couldn't find it in my laptop. Any other ways I could find it and uninstall or determine if I installed them by accidentally?

Patrick · Jan 22, 2015

With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

xarive · Jan 22, 2015

Patrick said:
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Click to expand...

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Hi Patrick. I get an error of WinpkFilter not found, WiFi connected but couldn't connect to the Internet after doing that. I renamed back from .old to .sys and it works again. Any other solutions?

Jared · Jan 22, 2015

Patrick said:
ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:

5: kd> !irql Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

KeAcquireSpinLockAtDpcLevel is bad practice, it assumes the IRQL is at dispatch IRQL. The proper function should be KeAcquireSpinLockForDpc which performs the appropriate checks on the IRQL before trying to acquire the lock, preventing such problems.
Just my little addition.

Patrick · Jan 22, 2015

xarive said:
Patrick said:

With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Click to expand...

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Click to expand...

Hi Patrick. I get an error of WinpkFilter not found, WiFi connected but couldn't connect to the Internet after doing that. I renamed back from .old to .sys and it works again. Any other solutions?

Do you have any Western Digital devices, such as an internal or external drive?

xarive · Jan 22, 2015

Patrick said:
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Click to expand...

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Jared said:
Patrick said:

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:

5: kd> !irql Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

Click to expand...

KeAcquireSpinLockAtDpcLevel is bad practice, it assumes the IRQL is at dispatch IRQL. The proper function should be KeAcquireSpinLockForDpc which performs the appropriate checks on the IRQL before trying to acquire the lock, preventing such problems.
Just my little addition.

Can you elaborate with more newbie friendly statement? Thanks a lot in advance sir.

Patrick said:
xarive said:

Patrick said:

With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Click to expand...

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Click to expand...

Hi Patrick. I get an error of WinpkFilter not found, WiFi connected but couldn't connect to the Internet after doing that. I renamed back from .old to .sys and it works again. Any other solutions?

Click to expand...

Do you have any Western Digital devices, such as an internal or external drive?

My internal drives are Crucial SSD and Seagate SSHD. I have an external drive of Toshiba. So, nope. Anyway, I'm using Intel AC Dual band 7640 network card. I just found out that I installed both Intel and Realtek network drivers. Just uninstalled the Realtek one and let's see. Could this be the problem of all these BSOD?

Patrick · Jan 22, 2015

Can you elaborate with more newbie friendly statement? Thanks a lot in advance sir.

It was a post directed towards me. Essentially Jared was noting that developers calling KeAcquireSpinLockAtDpcLevel vs the KeAcquireSpinLockForDpc function is bad practice, as you could entirely avoid IRQL issues we see here by simply calling the latter function.

Could this be the problem of all these BSOD?

Depends if it had an effect on whatever ndisrd.sys is, so we'll see. For what it's worth, if you're using an adapter, you generally only want to use your adapter's drivers and then disable the onboard or integrated network card.

xarive · Jan 22, 2015

Patrick said:
Can you elaborate with more newbie friendly statement? Thanks a lot in advance sir.

Click to expand...

It was a post directed towards me. Essentially Jared was noting that developers calling KeAcquireSpinLockAtDpcLevel vs the KeAcquireSpinLockForDpc function is bad practice, as you could entirely avoid IRQL issues we see here by simply calling the latter function.

Could this be the problem of all these BSOD?

Click to expand...

Depends if it had an effect on whatever ndisrd.sys is, so we'll see. For what it's worth, if you're using an adapter, you generally only want to use your adapter's drivers and then disable the onboard or integrated network card.

Nope, I don't use any adapter. I'm using in-built Intel AC Wireless + Bluetooth Dual Band card.

Patrick · Jan 23, 2015

Got it. Well, keep me updated on the crash situation.

MichaelB · Jan 23, 2015

Sorry for popping in but:
it seems you are using PC Mechanic which tries to speed up you PC, get rid of it.

Patrick · Jan 23, 2015

I agree.

xarive · Jan 23, 2015

Could it be Intel Turbo boost? I'm not sure as I don't really acknowledge of any pc mechanic I've installed to speed up my pc.

Patrick · Jan 24, 2015

Probably should have taken a look myself before agreeing... just ignore (respectfully of course) the PC mechanic post, then.

Have you crashed at all lately?

xarive · Jan 24, 2015

Patrick said:
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Click to expand...

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Jared said:
Patrick said:

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:

5: kd> !irql Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

Click to expand...

KeAcquireSpinLockAtDpcLevel is bad practice, it assumes the IRQL is at dispatch IRQL. The proper function should be KeAcquireSpinLockForDpc which performs the appropriate checks on the IRQL before trying to acquire the lock, preventing such problems.
Just my little addition.

So far so good. BSoD seems afraid to visit me as I have you guys.

xarive · Jan 25, 2015

View attachment perfmon.rar View attachment 10625

Just got BSOD 20 minutes ago. These are the necessary reports. Looking forward to see your reply soon.

xarive · Jan 25, 2015

View attachment minidump 26jan bsod.rar

Here's the minidump file. Please, have a look if you do. Thanks a lot in advanced.

[SOLVED] BSOD during boot up - Windows 8.1 x64

Active member

Attachments

Sysnative Staff

Active member

Attachments

Sysnative Staff

Active member

Sysnative Staff

Active member

Sysnative Staff, BSOD Kernel Dump Expert

Sysnative Staff

Active member

Sysnative Staff

Active member

Sysnative Staff

Sysnative Staff, BSOD Kernel Dump Senior Analyst

Sysnative Staff

Active member

Sysnative Staff

Active member

Active member

Active member