[SOLVED] BSOD during boot up - Windows 8.1 x64

xarive

Active member
Joined
Jan 21, 2015
Posts
27
· OS - Windows 8.1 pro
· x64
· What was original installed OS on system? as stated above.
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? full retail ver.
· Age of system (hardware) 1 month
· Age of OS installation - have you re-installed the OS? no.

· CPU- i7 4710HQ 2.50 GHz
· Video Card GTX 860M 4GB MAXWELL


· System Manufacturer - ILLEGEAR
· Exact model number -Z5

· Laptop

Please kindly help me on this. Thanks.
 

Attachments

DRIVER_POWER_STATE_FAILURE (9f)

This bug check indicates that the driver is in an inconsistent or invalid power state.

Code:
0: kd> !irp ffffe001cf828440
Irp is active with 2 stacks 1 is current (= 0xffffe001cf828510)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
>[ 16, 2]   0 e1 ffffe001c9de4e50 00000000 fffff801ae537f4c-ffffe001cf491a40 Success Error Cancel pending
           \Driver\ACPI    nt!PopRequestCompletion
            Args: 00051100 00000001 00000001 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-ffffe001cf491a40    

            Args: 00000000 00000000 00000000 00000000

I doubt the driver in charge of power management and PnP device enumeration is actually the cause of the crash, but a 3rd party conflict. Please enable verifier:

Driver Verifier:

What is Driver Verifier?

Driver Verifier monitors Windows kernel-mode drivers, graphics drivers, and even 3rd party drivers to detect illegal function calls or actions that might corrupt the system. Driver Verifier can subject the Windows drivers to a variety of stresses and tests to find improper behavior.

Essentially, if there's a 3rd party driver believed to be causing the issues at hand, enabling Driver Verifier will help us see which specific driver is causing the problem.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/8.1 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (only on Windows 7 & 8/8.1)
- DDI compliance checking (only on Windows 8/8.1)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- Perhaps the most important which I will now clarify as this has been misunderstood often, enabling Driver Verifier by itself is not! a solution, but instead a diagnostic utility. It will tell us if a driver is causing your issues, but again it will not outright solve your issues.

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled per my instructions above, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.

- Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

- If you have the system set to generate Small Memory Dumps, they will be located in %systemroot%\Minidump.

- If you have the system set to generate Kernel Memory Dumps, it will be located in %systemroot% and labeled MEMORY.DMP.

Any other questions can most likely be answered by this article:

Using Driver Verifier to identify issues with Windows drivers for advanced users
 
Thanks, we now have the actual culprit driver.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

This is the general bug check code for fatal errors found by Driver Verifier.

Code:
5: kd> .bugcheck
Bugcheck code 000000C4
Arguments 00000000`00020003 fffff800`6741a250 00000000`00000000 00000000`00000000

2003 1st argument, rule violation.

Code:
5: kd> k
Child-SP          RetAddr           Call Site
ffffd000`23c4f5f8 fffff800`67412258 nt!KeBugCheckEx
ffffd000`23c4f600 fffff800`67406105 VerifierExt!SLIC_abort+0x5c
ffffd000`23c4f640 fffff800`6740613b VerifierExt!SLIC_KeAcquireSpinLockAtDpcLevel_entry_IrqlDispatch+0x31
ffffd000`23c4f670 fffff802`408928f0 VerifierExt!KeAcquireSpinLockAtDpcLevel_wrapper+0x33
ffffd000`23c4f6c0 fffff800`68844716 nt!VerifierKeAcquireSpinLockAtDpcLevel+0xa4
ffffd000`23c4f700 ffffcf80`cada0bb0 ndisrd+0x2716
ffffd000`23c4f708 ffffd000`23c4f768 0xffffcf80`cada0bb0
ffffd000`23c4f710 fffff802`404f4060 0xffffd000`23c4f768
ffffd000`23c4f718 fffff802`404ab16c nt!NonPagedPoolDescriptor+0x920
ffffd000`23c4f720 ffffe001`680c4b00 nt!ExAllocatePoolWithTag+0x71c
ffffd000`23c4f7f0 ffffe001`6e1aca00 0xffffe001`680c4b00
ffffd000`23c4f7f8 fffff800`68141bec 0xffffe001`6e1aca00
ffffd000`23c4f800 fffff802`40880911 ndis!ndisDummyIrpHandler+0x88
ffffd000`23c4f830 fffff802`405e81ef nt!IovCallDriver+0x3cd
ffffd000`23c4f880 fffff802`405e778e nt!IopXxxControlFile+0xa4f
ffffd000`23c4fa20 fffff802`403632b3 nt!NtDeviceIoControlFile+0x56
ffffd000`23c4fa90 00000000`77bc2352 nt!KiSystemServiceCopyEnd+0x13
00000000`03e9f128 00000000`00000000 0x77bc2352

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:
5: kd> !irql
Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

Code:
5: kd> lmvm ndisrd
start             end                 module name
fffff800`68842000 fffff800`6884c000   ndisrd   T (no symbols)           
    Loaded symbol image file: ndisrd.sys
    Image path: \SystemRoot\system32\DRIVERS\ndisrd.sys
    Image name: ndisrd.sys
    Timestamp:        Wed Sep 14 06:18:41 2011

2011 driver.

So bottom line, if you have Mionet, or WinpkFilter, uninstall either of them. If you have WinpkFilter as opposed to Mionet, you may need to rename it instead by navigating to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.
 
Thanks, we now have the actual culprit driver.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

This is the general bug check code for fatal errors found by Driver Verifier.

H

Code:
5: kd> .bugcheck
Bugcheck code 000000C4
Arguments 00000000`00020003 fffff800`6741a250 00000000`00000000 00000000`00000000

2003 1st argument, rule violation.

Code:
5: kd> k
Child-SP          RetAddr           Call Site
ffffd000`23c4f5f8 fffff800`67412258 nt!KeBugCheckEx
ffffd000`23c4f600 fffff800`67406105 VerifierExt!SLIC_abort+0x5c
ffffd000`23c4f640 fffff800`6740613b VerifierExt!SLIC_KeAcquireSpinLockAtDpcLevel_entry_IrqlDispatch+0x31
ffffd000`23c4f670 fffff802`408928f0 VerifierExt!KeAcquireSpinLockAtDpcLevel_wrapper+0x33
ffffd000`23c4f6c0 fffff800`68844716 nt!VerifierKeAcquireSpinLockAtDpcLevel+0xa4
ffffd000`23c4f700 ffffcf80`cada0bb0 ndisrd+0x2716
ffffd000`23c4f708 ffffd000`23c4f768 0xffffcf80`cada0bb0
ffffd000`23c4f710 fffff802`404f4060 0xffffd000`23c4f768
ffffd000`23c4f718 fffff802`404ab16c nt!NonPagedPoolDescriptor+0x920
ffffd000`23c4f720 ffffe001`680c4b00 nt!ExAllocatePoolWithTag+0x71c
ffffd000`23c4f7f0 ffffe001`6e1aca00 0xffffe001`680c4b00
ffffd000`23c4f7f8 fffff800`68141bec 0xffffe001`6e1aca00
ffffd000`23c4f800 fffff802`40880911 ndis!ndisDummyIrpHandler+0x88
ffffd000`23c4f830 fffff802`405e81ef nt!IovCallDriver+0x3cd
ffffd000`23c4f880 fffff802`405e778e nt!IopXxxControlFile+0xa4f
ffffd000`23c4fa20 fffff802`403632b3 nt!NtDeviceIoControlFile+0x56
ffffd000`23c4fa90 00000000`77bc2352 nt!KiSystemServiceCopyEnd+0x13
00000000`03e9f128 00000000`00000000 0x77bc2352

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:
5: kd> !irql
Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

Code:
5: kd> lmvm ndisrd
start             end                 module name
fffff800`68842000 fffff800`6884c000   ndisrd   T (no symbols)           
    Loaded symbol image file: ndisrd.sys
    Image path: \SystemRoot\system32\DRIVERS\ndisrd.sys
    Image name: ndisrd.sys
    Timestamp:        Wed Sep 14 06:18:41 2011

2011 driver.

So bottom line, if you have Mionet, or WinpkFilter, uninstall either of them. If you have WinpkFilter as opposed to Mionet, you may need to rename it instead by navigating to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Hi Patrick, I am afraid I didn't install neither of them. At least I couldn't find it in my laptop. Any other ways I could find it and uninstall or determine if I installed them by accidentally?
 
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Hi Patrick. I get an error of WinpkFilter not found, WiFi connected but couldn't connect to the Internet after doing that. I renamed back from .old to .sys and it works again. Any other solutions?
 
ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:
5: kd> !irql
Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

KeAcquireSpinLockAtDpcLevel is bad practice, it assumes the IRQL is at dispatch IRQL. The proper function should be KeAcquireSpinLockForDpc which performs the appropriate checks on the IRQL before trying to acquire the lock, preventing such problems.
Just my little addition.
 
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Hi Patrick. I get an error of WinpkFilter not found, WiFi connected but couldn't connect to the Internet after doing that. I renamed back from .old to .sys and it works again. Any other solutions?

Do you have any Western Digital devices, such as an internal or external drive?
 
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:
5: kd> !irql
Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

KeAcquireSpinLockAtDpcLevel is bad practice, it assumes the IRQL is at dispatch IRQL. The proper function should be KeAcquireSpinLockForDpc which performs the appropriate checks on the IRQL before trying to acquire the lock, preventing such problems.
Just my little addition.

Can you elaborate with more newbie friendly statement? Thanks a lot in advance sir.

With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

Hi Patrick. I get an error of WinpkFilter not found, WiFi connected but couldn't connect to the Internet after doing that. I renamed back from .old to .sys and it works again. Any other solutions?

Do you have any Western Digital devices, such as an internal or external drive?
My internal drives are Crucial SSD and Seagate SSHD. I have an external drive of Toshiba. So, nope. Anyway, I'm using Intel AC Dual band 7640 network card. I just found out that I installed both Intel and Realtek network drivers. Just uninstalled the Realtek one and let's see. Could this be the problem of all these BSOD?
 
Can you elaborate with more newbie friendly statement? Thanks a lot in advance sir.

It was a post directed towards me. Essentially Jared was noting that developers calling KeAcquireSpinLockAtDpcLevel vs the KeAcquireSpinLockForDpc function is bad practice, as you could entirely avoid IRQL issues we see here by simply calling the latter function.

Could this be the problem of all these BSOD?

Depends if it had an effect on whatever ndisrd.sys is, so we'll see. For what it's worth, if you're using an adapter, you generally only want to use your adapter's drivers and then disable the onboard or integrated network card.
 
Can you elaborate with more newbie friendly statement? Thanks a lot in advance sir.

It was a post directed towards me. Essentially Jared was noting that developers calling KeAcquireSpinLockAtDpcLevel vs the KeAcquireSpinLockForDpc function is bad practice, as you could entirely avoid IRQL issues we see here by simply calling the latter function.

Could this be the problem of all these BSOD?

Depends if it had an effect on whatever ndisrd.sys is, so we'll see. For what it's worth, if you're using an adapter, you generally only want to use your adapter's drivers and then disable the onboard or integrated network card.

Nope, I don't use any adapter. I'm using in-built Intel AC Wireless + Bluetooth Dual Band card.
 
Sorry for popping in but:
it seems you are using PC Mechanic which tries to speed up you PC, get rid of it.
 
Could it be Intel Turbo boost? I'm not sure as I don't really acknowledge of any pc mechanic I've installed to speed up my pc.
 
Probably should have taken a look myself before agreeing... just ignore (respectfully of course) the PC mechanic post, then.

Have you crashed at all lately?
 
With that said, rename the driver as I noted above:

Navigate to C:\Windows\System32\Drivers and find and rename ndisrd.sys to ndisrd.old, and then restart the computer.

Consider creating a restore point however before doing so, just in case - Create a Restore Point in Windows 8 - Windows 8 - Windows 8

ndisrd.sys (Mionet driver or WinpkFilter high performance packet filtering framework) called KeAcquireSpinLockAtDpcLevel at the improper IRQL. It's only supposed to be called at DISPATCH_LEVEL (2), but was instead called by ndistd.sys at PASSIVE_LEVEL (0):

Code:
5: kd> !irql
Debugger saved IRQL for processor 0x5 -- 0 (LOW_LEVEL)

KeAcquireSpinLockAtDpcLevel is bad practice, it assumes the IRQL is at dispatch IRQL. The proper function should be KeAcquireSpinLockForDpc which performs the appropriate checks on the IRQL before trying to acquire the lock, preventing such problems.
Just my little addition.

So far so good. BSoD seems afraid to visit me as I have you guys.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top