BSOD 0x0000009f PC restart

D

Dusan10

Active member
Joined
Sep 7, 2017
Posts
41
Hi,

I have BSOD on my PC, it happend one time but i need help finding cause of the problem.

  • System Manufacturer? Lenovo
  • Laptop or Desktop? Desktop
  • Exact model number (if laptop, check label on bottom)
  • OS ? (Windows 10, 8.1, 8, 7, Vista) Windows 7
  • x86 (32bit) or x64 (64bit)? x64
  • (Only for xp, vista, 7) Service pack? SP1
  • What was original installed OS on system? Windows 8.1
  • Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? Purchased from retail
  • Age of system? (hardware) around 5 years
  • Age of OS installation? around 5 years
  • Have you re-installed the OS? Yes, when it came with Windows 8.1 i did downgrade
  • CPU Intel i3-4160
  • RAM (brand, EXACT model, what slots are you using?) 2x4GB DDR3
  • Video Card None
  • MotherBoard - (if NOT a laptop) Lenovo 3098 sdk0e50510
  • Power Supply - brand & wattage (if laptop, skip this one)
  • Is driver verifier enabled or disabled? Enabled
  • What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth) Eset Endpoint Security, Malwarebyte
  • Are you using proxy, vpn, ipfilters or similar software? No
  • Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software) No
  • Are you currently under/overclocking? Are there overclocking software installed on your system? No

I tried to investigate myself and i think problem is ntoskrnl.exe, but im not sure.

Best regards,
Dusan
 

Attachments

The crash was a driver power state failure which triggers the BSOD to prevent further corruption of your operating system.

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8006724940, Physical Device Object of the stack
Arg3: fffff80000b9e428, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
Arg4: fffffa800dcc7010, The blocked IRP

We can examine the blocked IRP to find which driver was causing this:

Code: 
0: kd> !irp fffffa800dcc7010
Irp is active with 7 stacks 6 is current (= 0xfffffa800dcc7248)
No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.
     cmd  flg cl Device   File     Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e0 fffffa800b355050 00000000 fffff8800780fa78-fffffa800b3551a0 Success Error Cancel
\Driver\RSUSBSTOR    RtsUStor
            Args: 00000000 00000001 00000003 00000000
>[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e1 fffffa800b355050 00000000 00000000-00000000 pending
\Driver\RSUSBSTOR
            Args: 00000000 00000001 00000003 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-fffffa800afd7580

Args: 00000000 00000000 00000000 00000000

The driver responsible turns out to be the rtsUStor.sys driver which in your system is dated from 2013 and is for the Realtek USB Card Reader. You can either try to find a newer driver from the manufacturers website or simply remove it/disable it to satisfy yourself that it is the cause.

I also notice that you have Driver Verifier enabled - it is not good practice to keep this enabled and so I would disable it if you are not getting any other problems.
 
Thank you very much for your help. I will check for driver update or disable it at the end.

Can i just ask you in which file in attachment did you find this?
philc43 said:
Code: 
0: kd> !irp fffffa800dcc7010
Irp is active with 7 stacks 6 is current (= 0xfffffa800dcc7248)
No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.
     cmd  flg cl Device   File     Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e0 fffffa800b355050 00000000 fffff8800780fa78-fffffa800b3551a0 Success Error Cancel
\Driver\RSUSBSTOR    RtsUStor
            Args: 00000000 00000001 00000003 00000000
>[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
0 e1 fffffa800b355050 00000000 00000000-00000000 pending
\Driver\RSUSBSTOR
            Args: 00000000 00000001 00000003 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-fffffa800afd7580

Args: 00000000 00000000 00000000 00000000
Click to expand...

When i looked at your post it was clear to me that problem was regarding RSUSBSTOR driver, which i google and find it.
I also tried for myself and found Arg4: fffffa800dcc7010, The blocked IRP. But i cant find more detailed information which you send to know what caused error.

Thank you once again.
 
To analyse the crash we use the mini-dump file [100820-5834-01.dmp] which was created when your system crashed. The log collector collects this file along with many others that we can use to help us diagnose the problem if the dump file does not provide the answer.

The dump file is analysed with the WinDBG program. Various commands enable you to debug the crash. Once you know the address of the blocked IRP you can explore it with the !irp command which gives the output I included in my response. Towards the end of the stack trace you can see one entry is indicated with the > symbol - this is where the IRP was blocked and it indicates the driver responsible.

If you are interested in learning more about the analysis of crashes please consider working through our BSOD Academy - it can be done at your own pace and you will learn how to analyse 0x9F crashes and many more.
 
Last edited:
Thank you very much. Before my post i tried Blue Screen View, and i didnt got any detailed result. After your post i tried software from Windows (WinDbg Preview), and it gave me similar result as you gave me.
I will definitely try software that you suggested.

Code: 
If you are interested in learning more about the analysis of crashes please consider working through our BSOD Academy - it can be done at your own pace and you will learn how to analyse 0x9F crashes and many more.

It is interesting to me, so i will consider that.
 
The logs had displayed bad block entries that disappeared.

Has the computer been without unexpected shutdowns and restarts?

1) Open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /scanhealth
4) dism /online /cleanup-image /restorehealth
5) sfc /scannow
6) chkdsk /scan
7) wmic recoveros set autoreboot = false
8) wmic recoveros set DebugInfoType = 7
9) wmic recoveros get autoreboot
10) wmic recoveros get DebugInfoType
11) bcdedit /enum {badmemory}

12) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
 
Yes it was bad block on old HDD, that's why i replaced him.
I did that maybe a week ago.

I updated Realtek and USB 3.0 drivers, only one that was outdated.
Now i wait and see if everything will be fine, or BSOD will happen again.

If this did not solve a problem i will post logs. Thanks.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top