Solved bsod on shutdown

[payhel]

In reply to richc46's instructions from Friday post#18: Followed the instructions and enabled startup itemes one at at time w/o bsod followed by a shutdown. Later in the day, after the computer went to sleep, went to shut it down and the usual bsod occured. Performed a clean boot and disabled all but one startup item. Performed a shutdown, no bsod. Let the computer go to sleep and shut it down got a bsod. Performed another clean boot and restarted the machine went to desktop and then shut down the machine no bsod. Performed another clean boot, disabled the remaining startup item. Restarted the computer. After login, went to desktop ran a program then shutdown and no bsod. Restarted the computer went to desktop allowed the computer to go to sleep then woke it up and shutdown and got a bsod. No startup items are enabled and only ms services are running so it appears that whatever is happening is in conjunction with sleep and then shutdown, not restart. Restart, out of a sleep, will not cause a bsod. Attached SF has latest files since last Friday.

 

[jmv2009]

Loading Dump File [C:\Users\Johannes\Downloads\SF_19-11-2012\SF_19-11-2012\111912-20640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9200 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16424.amd64fre.win8_gdr.120926-1855
Machine Name:
Kernel base = 0xfffff802`5007a000 PsLoadedModuleList = 0xfffff802`50344a60
Debug session time: Mon Nov 19 15:52:31.629 2012 (UTC + 1:00)
System Uptime: 0 days 0:09:07.320
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck AB, {1, 460, 0, 7}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SESSION_HAS_VALID_POOL_ON_EXIT (ab)
Caused by a session driver not freeing its pool allocations prior to a
session unload.  This indicates a bug in win32k.sys, atmfd.dll,
rdpdd.dll or a video driver.
Arguments:
Arg1: 0000000000000001, session ID
Arg2: 0000000000000460, number of paged pool bytes that are leaking
Arg3: 0000000000000000, number of nonpaged pool bytes that are leaking
Arg4: 0000000000000007, total number of paged and nonpaged allocations that are leaking.
 nonpaged allocations are in the upper half of this word,
 paged allocations are in the lower half of this word.
Debugging Details:
------------------

TAG_NOT_DEFINED_405: Gh1?
BUGCHECK_STR:  0xAB_Gh1?
IMAGE_NAME:  win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  0
MODULE_NAME: win32k
FAULTING_MODULE: fffff960000e6000 win32k
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff80250679c2a to fffff802500f4d40
STACK_TEXT:  
fffff880`065e89b8 fffff802`50679c2a : 00000000`000000ab 00000000`00000001 00000000`00000460 00000000`00000000 : nt!KeBugCheckEx
fffff880`065e89c0 fffff802`503e1bd1 : fffff880`0e7a7b40 00000000`00000000 fffff880`0e7a7000 ffffffff`ffffffe4 : nt! ?? ::NNGAKEGL::`string'+0x3619a
fffff880`065e8a10 fffff802`504987aa : 00000000`00000c04 fffff880`0e7a7000 fffffa80`10c1fb00 fffffa80`11c59080 : nt!MiDereferenceSessionFinal+0xf1
fffff880`065e8a80 fffff802`5049fd48 : fffff8a0`002a1060 00000000`00000000 00000000`00000001 00000000`00000001 : nt!MmCleanProcessAddressSpace+0x2be
fffff880`065e8af0 fffff802`504a0442 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x668
fffff880`065e8c10 fffff802`500dae16 : fffff880`02c5e180 00000000`00000080 fffffa80`10c1fb00 fffffa80`11c59080 : nt!PspTerminateThreadByPointer+0x4e
fffff880`065e8c60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND:  kb
FOLLOWUP_NAME:  MachineOwner
FAILURE_BUCKET_ID:  LEAKED_SESSION_POOLTAG_Gh1?
BUCKET_ID:  LEAKED_SESSION_POOLTAG_Gh1?
Followup: MachineOwner
---------

 

[payhel]

Okay, I have Windows debugger on my machine and have been viewing and posting that same analysis for more than a week and richc46 has claimed it to be a hardware driver. Explain how it is that I have all of the startup processes disabled and when I shutdown the machine, after it has been in sleep mode, I get the bsod (listed back in the first page of this thread) and the machine restarts. But if I shutdown prior to sleep the machine shuts down, no bsod no restart. There were no problems with shutdown in win 7. Driver verifier found nothing so are we still talking hardware?

 

[richc46]

If you continue to get Microsoft Drivers, as the cause (may be drivers or hardware); different drivers as the cause, it points to hardware. This solution does not show in the report, it comes from experience. This is an art not a science. Your questions are very appropriate.
The BSOD on shutdown, in theory, can be caused by an essential driver, that has not been eliminated. Try a shutdown in safe mode a further test for hardware or driver.

 

[payhel]

Machine shuts down with "no problems or bsods" from safe mode. Shutdown several times after varying the time in safe mode, no problems. After safe mode shutdown rebooted, logged in to win 8, went to desk top, shutdown and the bsod is immediate. I have searched for a list of essential drivers you mentioned in your last post, with no luck. How do I test said drivers? Dell claims it is a win 8 problem and suggests some sort of reinstall.

Thanks

 

[richc46]

Go to the device manager, make sure there are no small yellow markers indicating a problem driver. Up date all the basic drivers, network, audio, graphics etc. Update from the company website not the device manager. Other members have been experiencing problems with network, and graphic drivers.

 

[payhel]

Are the present drivers to be uninstalled first, rolled back, or just updated from device manager? If I am going to do this driver update I want to perform it in the proper order. Also, I have been checking the device manager, continually, since the start of the problem, never a yellow warning sign.

Thanks

 

[richc46]

There is no need to uninstall the drivers, which is a good thing. These are the essential drivers, if you uninstall first you will experience problems. For example uninstall network, you have no internet, etc. Many of the websites have a scan your system, it will find which drivers need to be updated (for that particular company, Intel etc.)
Dont update from device manager, go to company websites.

 

[payhel]

Updated several Intel drivers (Wimax, raid, wireless, and nic) from the web site, and still have the bsod on shutdown plus Office 2010 wants me to re-verify the license. I have had to perform the re-verification once already immediately after I upgraded to win 8. Any idea why is happening, again?

 

[richc46]

I was surprised to read about your Office 2010 problem, I Googled. I found out that this is common. My guess is that 8 is a whole new concept and its just a bug. Just activate, you should not have a problem.

 

[payhel]

I could not find non-dell drivers for everything on the computer, but I did get the main ones including those listed in a earlier post and the video drivers. Still produces the same bsod on shutdown then a restart and still produces the same dump file. It seems strange that the bsod is not producing some sort of crash info and seems to be exclusive to this machine. Also, 2 other software programs had to have licenses re-activated, along with office 2010, after yesterdays Intel update day. Next.

 

[jmv2009]

You said "Driver verifier found nothing" a couple of posts ago. Does that mean you left it running until the same bsod occurred again? Please leave it running until the same bsod occurs again.

 

[payhel]

Verifier ran for 48 hours, at least. The BSOD occurs every single time I shutdown the computer. You want a BSOD all I have to do is go to the power button and click shutdown. I posted the SF files from the verifier time period and it had several dump files from several bsods, it is all in the previous posts.

 

[jmv2009]

Please run sfc /scannow

 

[jmv2009]

The following drivers seem a bit old:
fffff880`01c90000 fffff880`01c9c000 PBADRV PBADRV.sys Mon Jan 07 20:12:13 2008 (4782798D)
fffff880`01f56000 fffff880`01f5f000 stdcfltn stdcfltn.sys Sat Jul 16 06:31:13 2011 (4E211411)
fffff880`07822000 fffff880`07832000 cvusbdrv cvusbdrv.sys Wed Oct 05 09:01:37 2011 (4E8C00D1)
fffff880`05a8b000 fffff880`05a9b000 accelern accelern.sys Fri Jul 22 21:28:40 2011 (4E29CF68)
fffff880`057ef000 fffff880`05800000 HECIx64 HECIx64.sys Thu Sep 22 18:38:44 2011 (4E7B6494)
fffff880`05a1e000 fffff880`05a7c000 Apfiltr Apfiltr.sys Thu May 26 03:54:58 2011 (4DDDB2F2)
fffff880`04a13000 fffff880`057ef000 nvlddmkm nvlddmkm.sys Fri May 11 06:16:23 2012 (4FAC9297)
PxHlpa64.sys
stwrt64.sys
PdiPorts.sys

Your problem could occur due to any of these drivers, as far as I can tell.

 

[payhel]

May have found the problem. I was reading some past forum bsod posts and read where the bluetooth device, in device manager, was set to save energy, they clicked that off and no more bsods. Apparently, that energy saving thing was default on this machine, just clicked it off and have shutdown 3 times and no bsod. I am going to check it coming out of sleep, etc. if it works will call it good even though it is probably not exactly the problem. Will mark the thread solved if I get no more bsods today.

 

[payhel]

I found the fix after googling the problem I was having , over and over again, worded differently each time then reading many threads in many blogs. The was in eightforums, by chance, concerning a Dell m6400. The stop screen (bsod without an error code) was fixed as follows:
1. Click on device manager, 2. Click on Bluetooth, 3. Click on Dell Wireless 375 Bluetooth Module, 4. Click on the Power Management Tab, 5. Click "OFF" the "Allow This Computer to TURN Off This Device to Save Power" button. That's it, after 10 days of analysis it was a bug caused by Dell's poorly written driver and its incompatibility with win 8. Apparently, this button is switched on by default and every so often it clicks itself back on again causing another bsod, so watch for that. Do not expect dell support to catch this type of error.

One further note. I appreciate the help by Richc46 in showing me the necessary tools required to fix the problem. But as an analytical chemist, someone trained in analysis, I have to disagree with his assessment that bsod problem solving is an art not a science. Wine making, farming, making compost, gardening etc. they involve the term "art" as they involve biological processes that don't always go as planned. Computer science is a science, systems with lists. The verifier, dell's diagnostics, and finally the re-installation of all of the essential drivers pointed to something other than drivers. At that point there is no room for gut feelings. It has to be a bug and some reading is in order, because the answer is out there, somewhere.

I started using microsoft DOS, went thru Windows 3.0, 3.2, 95, 98, ME, XP sp1-sp2-sp3, skipped vista, and loved win 7, and that whole series of OSs was a pile of troubleshooting, none of it entailed the gut, just massive amounts of time. Of course hindsight is always 100% correct but stick to the data and believe what it is saying, facts and knowledge always trump beliefs.

Thanks again for the help.

 

[payhel]

Update note: 3 nights ago, unexpectedly, the same exact bsods, as explained throughout this thread, started occurring. There were no yellow cautions in device manager, the dump files read the same as before, and the bsods only occurred on shutdown. Decided to employ the verifier once again, even though it did not work last month. This time, while running the verifier, I performed clean boots with startup items enabled then disabled. Finally, the verifier identified the following driver: PxH1pa64.sys (sonic) which was being used by Roxio Creator Starter. I uninstalled the program, rebooted, found the driver in the System32 driver files and renamed it to PxH1pa64.old and shutdown the computer. No bluescreens so far. Also, the computer shuts down faster than at any previous time since win 8 upgrade with very little cooling fan commotion. Not sure what the driver has in common with the bluetooth driver power switch fix I found as the original solution (worked for two weeks)? But so it goes. I also read somewhere that the sonic driver PxH1pa64.sys could be used by Dell's Command Center program, I removed the program as it seemed to be unnecessary. I have attached the latest SF file (all the dumps for the past couple of days) just in case it may help someone else. Win 8 has become quite the burden.

 

[payhel]

Update note 2: After 6 days, upon waking up the computer from sleep and shutting it down another stop screen. Same dump file bug check analysis as from the start of this thread. However, this time, in device manager, the Matshita BD-RE uj262 driver shows the following error:
Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)

{Unable to Load Device Driver}
%hs device driver could not be loaded.
Error Status was 0x%x

I have tried uninstalling and reinstalling the driver no luck. I also uninstalled the drive, operated it without the drive, shut it down reinstalled the drive, the error persists. However, after uninstalling the drive the stop screens have stopped. I have not been able to find the driver nor have had any luck finding this exact problem?