BSOD 0x0000009f PC restart

Dusan10 · Oct 12, 2020

Hi,

I have BSOD on my PC, it happend one time but i need help finding cause of the problem.

System Manufacturer? Lenovo
Laptop or Desktop? Desktop
Exact model number (if laptop, check label on bottom)
OS ? (Windows 10, 8.1, 8, 7, Vista) Windows 7
x86 (32bit) or x64 (64bit)? x64
(Only for xp, vista, 7) Service pack? SP1
What was original installed OS on system? Windows 8.1
Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? Purchased from retail
Age of system? (hardware) around 5 years
Age of OS installation? around 5 years
Have you re-installed the OS? Yes, when it came with Windows 8.1 i did downgrade
CPU Intel i3-4160
RAM (brand, EXACT model, what slots are you using?) 2x4GB DDR3
Video Card None
MotherBoard - (if NOT a laptop) Lenovo 3098 sdk0e50510
Power Supply - brand & wattage (if laptop, skip this one)
Is driver verifier enabled or disabled? Enabled
What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth) Eset Endpoint Security, Malwarebyte
Are you using proxy, vpn, ipfilters or similar software? No
Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software) No
Are you currently under/overclocking? Are there overclocking software installed on your system? No

I tried to investigate myself and i think problem is ntoskrnl.exe, but im not sure.

Best regards,
Dusan

philc43 · Oct 12, 2020

The crash was a driver power state failure which triggers the BSOD to prevent further corruption of your operating system.

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8006724940, Physical Device Object of the stack
Arg3: fffff80000b9e428, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
Arg4: fffffa800dcc7010, The blocked IRP

We can examine the blocked IRP to find which driver was causing this:

Code:

0: kd> !irp fffffa800dcc7010
Irp is active with 7 stacks 6 is current (= 0xfffffa800dcc7248)
No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.
     cmd  flg cl Device   File     Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e0 fffffa800b355050 00000000 fffff8800780fa78-fffffa800b3551a0 Success Error Cancel
\Driver\RSUSBSTOR    RtsUStor
            Args: 00000000 00000001 00000003 00000000
>[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e1 fffffa800b355050 00000000 00000000-00000000 pending
\Driver\RSUSBSTOR
            Args: 00000000 00000001 00000003 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-fffffa800afd7580

Args: 00000000 00000000 00000000 00000000

The driver responsible turns out to be the rtsUStor.sys driver which in your system is dated from 2013 and is for the Realtek USB Card Reader. You can either try to find a newer driver from the manufacturers website or simply remove it/disable it to satisfy yourself that it is the cause.

I also notice that you have Driver Verifier enabled - it is not good practice to keep this enabled and so I would disable it if you are not getting any other problems.

Dusan10 · Oct 12, 2020

Thank you very much for your help. I will check for driver update or disable it at the end.

Can i just ask you in which file in attachment did you find this?

philc43 said:

Code:

0: kd> !irp fffffa800dcc7010
Irp is active with 7 stacks 6 is current (= 0xfffffa800dcc7248)
No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.
     cmd  flg cl Device   File     Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e0 fffffa800b355050 00000000 fffff8800780fa78-fffffa800b3551a0 Success Error Cancel
\Driver\RSUSBSTOR    RtsUStor
            Args: 00000000 00000001 00000003 00000000
>[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e1 fffffa800b355050 00000000 00000000-00000000 pending
\Driver\RSUSBSTOR
            Args: 00000000 00000001 00000003 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-fffffa800afd7580

Args: 00000000 00000000 00000000 00000000

When i looked at your post it was clear to me that problem was regarding RSUSBSTOR driver, which i google and find it.
I also tried for myself and found Arg4: fffffa800dcc7010, The blocked IRP. But i cant find more detailed information which you send to know what caused error.

Thank you once again.

philc43 · Oct 12, 2020

To analyse the crash we use the mini-dump file [100820-5834-01.dmp] which was created when your system crashed. The log collector collects this file along with many others that we can use to help us diagnose the problem if the dump file does not provide the answer.

The dump file is analysed with the WinDBG program. Various commands enable you to debug the crash. Once you know the address of the blocked IRP you can explore it with the !irp command which gives the output I included in my response. Towards the end of the stack trace you can see one entry is indicated with the > symbol - this is where the IRP was blocked and it indicates the driver responsible.

If you are interested in learning more about the analysis of crashes please consider working through our BSOD Academy - it can be done at your own pace and you will learn how to analyse 0x9F crashes and many more.

Dusan10 · Oct 12, 2020

Thank you very much. Before my post i tried Blue Screen View, and i didnt got any detailed result. After your post i tried software from Windows (WinDbg Preview), and it gave me similar result as you gave me.
I will definitely try software that you suggested.

Code:

If you are interested in learning more about the analysis of crashes please consider working through our BSOD Academy - it can be done at your own pace and you will learn how to analyse 0x9F crashes and many more.

It is interesting to me, so i will consider that.

zbook · Oct 12, 2020

Had you recently replaced the drive?

Consider upgrading the BIOS:
Flash BIOS Update - ThinkCentre M73 (Tower and Small Form Factor), ThinkCentre E73 - US

Dusan10 · Oct 13, 2020

Yes i did. I cloned old HDD to SSD.

Sure, thanks.

zbook · Oct 13, 2020

The logs had displayed bad block entries that disappeared.

Has the computer been without unexpected shutdowns and restarts?

1) Open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /scanhealth
4) dism /online /cleanup-image /restorehealth
5) sfc /scannow
6) chkdsk /scan
7) wmic recoveros set autoreboot = false
8) wmic recoveros set DebugInfoType = 7
9) wmic recoveros get autoreboot
10) wmic recoveros get DebugInfoType
11) bcdedit /enum {badmemory}

12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

Dusan10 · Oct 13, 2020

Yes it was bad block on old HDD, that's why i replaced him.
I did that maybe a week ago.

I updated Realtek and USB 3.0 drivers, only one that was outdated.
Now i wait and see if everything will be fine, or BSOD will happen again.

If this did not solve a problem i will post logs. Thanks.

zbook · Oct 13, 2020

Nice.

Search

Search

BSOD 0x0000009f PC restart

Dusan10

Active member

Attachments

philc43

BSOD Forum Moderator, BSOD Academy Instructor, BSOD Kernel Dump Expert

Dusan10

Active member

philc43

BSOD Forum Moderator, BSOD Academy Instructor, BSOD Kernel Dump Expert

Dusan10

Active member

zbook

Member

Dusan10

Active member

zbook

Member

Dusan10

Active member

zbook

Member