Shutdown/hibernate results in memory dump and restart

dave.ruybal · 06-19-2009, 08:40 PM

Howdy y'all,

I am dealing with quite the annoying problem that has been plaguing me for a couple weeks now. When i either hit the power key, or select hibernate/shutdown/restart from the start menu, my laptop will give me the blue screen explaining that a memory dump has been initiated. On this screen it references usbhub.sys as the culprit.

I did a little googling to find out how to debug memory dumps, and I downloaded and installed the WinDbg utility. The problem is that the memory.dmp file in the Windows folder lists June 9th as the date, which is not current as I have recreated this memory dumping situation a few times today. And in the minidumps folder, I see one from 6/9/09, and a couple from 6/6/09, which seem out dated as well.

In looking into these dumps with WinDbg, i see a bunch of references to libusb.sys, which is something I know that I have installed in the recent past in conjunction with another utility to use my Playstation 3 controller over USB. I also installed a cheesy program called WinDS3, which installs custom drivers into my laptops built in bluetooth adapter, allowing use of the Playstation controller over Bluetooth. I have since uninstalled this software, which also uninstalls the custom drivers from my bluetooth adapter.

I have run a full virus scan with AVG, and ran a scan with SpyBot. SpyBot found a couple things and repaired them, but they did not affect this problem in anyway that I'm aware of.

I am dual-booting Vista SP2 and Windows 7 Ultimate. Windows 7 runs just fine and does not display any of these symptoms.

So, I'm obviously not too sure what I'm looking for in the debug data, just trying to find a little guidance in the direction of the problem. If there is a way to force it to find an up to date dump to debug, I'm sure that would be very effective.

I don't know all there is to know, but I'm good at following directions. Thanks for any help in advance.

My system specs are:
Dell XPS M1530 Laptop
Windows Vista Home Premium SP2 32-bit
3GB RAM
1.66Ghz Core 2 Duo

Website for WinDS3: http://www.winds3.com/en/index.htm

usasma · 06-20-2009, 10:30 AM

Dump files are stored in C:\Windows\Minidump, or as the file MEMORY.DMP in the C:\Windows directory (which is overwritten with each memory dump). If nothing is located there, search the entire hard drive for files ending in .dmp There are many reasons for a dump file not being created - so that will be a part of the analysis.

You've done most of what is needed (and thanks for that!). Depending on what you removed with the SpyBot, there may/may not be a malware component to this issue.

Frequently hibernate and sleep issues are due to a corruption in the video drivers. So I'd suggest:
- Downloading the latest video driver for your system from here: http://support.dell.com/support/down...&catid=&impid=
- Uninstall your current video drivers through Control Panel...Programs...Uninstall a program.
- Reboot the system (dismissing any "Found New Hardware" dialogs that may occur).
- double click on the downloaded file to install the new drivers.

If this doesn't solve the problem, then please provide us with the information in this post: http://www.techsupportforum.com/1871981-post2.html

Just FYI, here's my blog post on analyzing these files: http://usasma.vox.com/library/post/d...d-02oct08.html
You'll notice in paragraph G that there are some additional commands, try them to see what you get.
Also, there's a link at the bottom to a general description of how to analyze the debugger's output.

dave.ruybal · 06-20-2009, 01:55 PM

Thanks for the reply usasma!

Here's how it went:

First off, I went to the dell support site and downloaded the Nvidia drivers. I uninstalled the existing nvidia drivers from add/remove programs. It prompted me to restart the computer for the uninstallation to complete, so I selected "yes" to let it continue. Again, it resulted in the same BSOD during the shutdown process. After restarting and logging in, I noticed that Aero effects were missing, so the drivers were definitely gone. Also, I got a pop-up balloon indicating that generic VGA drivers were installed. So I ran the installer for the Nvidia drivers and at the end of the installer it again prompted me to restart the computer, so again I selected "yes" to allow it to continue. Again, it resulted in the BSOD during the shutdown process.

So restarted and logged in again, and tried another shut down that I initiated (separate from installation program) and it resulted in the same BSOD again.

So I figure I'd beat that bush pretty thoroughly at that point and moved on to your second course of action. I have attached 2 zip files, the first containing the output from the tsf_vista_support batch program, and the second contains the perfmon report. Hopefully this get me a little closer to a solution.

Thanks again!

usasma · 06-20-2009, 05:21 PM

From the performance report first:
- There's an unexplained service stopped error. You'll have to look in Event Viewer to see if the service is listed as being stopped in the Windows Logs...System log files. Also check the Application log files just in case.
This appears to be the service in question:

Code:

Event[7]:
  Log Name: System
  Source: Service Control Manager
  Date: 2009-06-20T13:29:45.000
  Event ID: 7001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DaveRuybalXPS
  Description: 
The UPnP Device Host service depends on the SSDP Discovery service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Check to see if it's disabled, if so enable it.

- Your Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller is disabled. Is this intentional on your part?
- Your Bluetooth peripheral drivers aren't installed (or working). Have you checked Device Manager to see what the reason is?
- Your C: and D: drives are low on free space. If either of them is your recovery partition, then this is normal for that one. But the other(s) should have at least 15% free space (so remove some stuff). This is not likely to be related to your problems - but it will speed up the system a bit.

Dump file analysis to follow (my network is very slow right now). I'll be back in a bit.

usasma · 06-20-2009, 05:37 PM

Interestingly, the last BSOD is caused by your Marvell Yukon network adaptor - which is disabled!

Just because of the sheer numbers, I'd have to suspect the libusb0.sys file and would recommend uninstalling it from your system (I recall one other issue with it from another topic also). This is some sort of USB utility that enables the access of USB devices.

Here's the summary of the BSOD's:

Code:

Built by: 6001.18226.x86fre.vistasp1_gdr.090302-1506
Debug session time: Mon May 11 22:13:45.365 2009 (GMT-4)
System Uptime: 0 days 0:17:22.323
BugCheck D1, {2, 2, 0, 8cc69efb}
*** WARNING: Unable to verify timestamp for Apfiltr.sys
*** ERROR: Module load completed but symbols could not be loaded for Apfiltr.sys
Probably caused by : Apfiltr.sys ( Apfiltr+3efb )  (Alps touchpad driver)
PROCESS_NAME:  svchost.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6000.16551.x86fre.vista_gdr.070828-1515
Debug session time: Sat May 24 16:03:12.687 2008 (GMT-4)
System Uptime: 0 days 0:00:29.499
BugCheck A, {7c, 1b, 0, 81cad9bb}
Probably caused by : dump_iaStor. ( dump_iaStor+5cca4 ) (Intel Storage Matrix drivers)
PROCESS_NAME:  csrss.exe
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Debug session time: Fri Jun  5 19:59:48.715 2009 (GMT-4)
System Uptime: 0 days 0:08:31.602
BugCheck 1000007E, {c0000005, 9121e013, 8b711b68, 8b711864}
*** WARNING: Unable to verify timestamp for libusb0.sys
*** ERROR: Module load completed but symbols could not be loaded for libusb0.sys
Probably caused by : libusb0.sys ( libusb0+428c ) (? http://libusb-win32.sourceforge.net/ )
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Debug session time: Sat Jun  6 13:27:35.708 2009 (GMT-4)
System Uptime: 0 days 17:27:23.841
BugCheck 1000007E, {c0000005, 90a2b013, 805ccb68, 805cc864}
*** WARNING: Unable to verify timestamp for libusb0.sys
*** ERROR: Module load completed but symbols could not be loaded for libusb0.sys
Probably caused by : libusb0.sys ( libusb0+428c ) (? http://libusb-win32.sourceforge.net/ )
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Debug session time: Sat Jun  6 18:47:46.839 2009 (GMT-4)
System Uptime: 0 days 5:19:38.763
BugCheck 1000007E, {c0000005, 8f263013, 9c851b68, 9c851864}
*** WARNING: Unable to verify timestamp for libusb0.sys
*** ERROR: Module load completed but symbols could not be loaded for libusb0.sys
Probably caused by : libusb0.sys ( libusb0+428c ) (? http://libusb-win32.sourceforge.net/ )
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Debug session time: Tue Jun  9 02:39:50.957 2009 (GMT-4)
System Uptime: 0 days 11:10:02.152
BugCheck 1000007E, {c0000005, 8fe60013, a9722b68, a9722864}
*** WARNING: Unable to verify timestamp for libusb0.sys
*** ERROR: Module load completed but symbols could not be loaded for libusb0.sys
Probably caused by : libusb0.sys ( libusb0+428c ) (? http://libusb-win32.sourceforge.net/ )
PROCESS_NAME:  System
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6000.16575.x86fre.vista_gdr.071009-1548
Debug session time: Thu Jun 12 19:06:58.023 2008 (GMT-4)
System Uptime: 0 days 13:50:33.983
BugCheck D1, {88a9820c, 2, 8, 88a9820c}
Probably caused by : monitor.sys ( monitor+120c ) (Windows system driver)
PROCESS_NAME:  Idle
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Built by: 6001.18000.x86fre.longhorn_rtm.080118-1840
Debug session time: Tue Jun 24 23:10:05.884 2008 (GMT-4)
System Uptime: 7 days 7:38:00.663
BugCheck 9F, {3, 84c64578, 86575030, 8646a808}
*** WARNING: Unable to verify timestamp for yk60x86.sys
*** ERROR: Module load completed but symbols could not be loaded for yk60x86.sys
Probably caused by : yk60x86.sys (Marvell Yukon network driver)
PROCESS_NAME:  System

06-19-2009, 08:40 PM	#1 (permalink)
dave.ruybal Registered User Join Date: Jun 2009 Posts: 2 OS: Vista SP2, Win 7 Ult	Shutdown/hibernate results in memory dump and restart Howdy y'all, I am dealing with quite the annoying problem that has been plaguing me for a couple weeks now. When i either hit the power key, or select hibernate/shutdown/restart from the start menu, my laptop will give me the blue screen explaining that a memory dump has been initiated. On this screen it references usbhub.sys as the culprit. I did a little googling to find out how to debug memory dumps, and I downloaded and installed the WinDbg utility. The problem is that the memory.dmp file in the Windows folder lists June 9th as the date, which is not current as I have recreated this memory dumping situation a few times today. And in the minidumps folder, I see one from 6/9/09, and a couple from 6/6/09, which seem out dated as well. In looking into these dumps with WinDbg, i see a bunch of references to libusb.sys, which is something I know that I have installed in the recent past in conjunction with another utility to use my Playstation 3 controller over USB. I also installed a cheesy program called WinDS3, which installs custom drivers into my laptops built in bluetooth adapter, allowing use of the Playstation controller over Bluetooth. I have since uninstalled this software, which also uninstalls the custom drivers from my bluetooth adapter. I have run a full virus scan with AVG, and ran a scan with SpyBot. SpyBot found a couple things and repaired them, but they did not affect this problem in anyway that I'm aware of. I am dual-booting Vista SP2 and Windows 7 Ultimate. Windows 7 runs just fine and does not display any of these symptoms. So, I'm obviously not too sure what I'm looking for in the debug data, just trying to find a little guidance in the direction of the problem. If there is a way to force it to find an up to date dump to debug, I'm sure that would be very effective. I don't know all there is to know, but I'm good at following directions. Thanks for any help in advance. My system specs are: Dell XPS M1530 Laptop Windows Vista Home Premium SP2 32-bit 3GB RAM 1.66Ghz Core 2 Duo Website for WinDS3: http://www.winds3.com/en/index.htm

06-20-2009, 10:30 AM	#2 (permalink)
usasma Tech Hardware Team Join Date: Apr 2009 Location: Southeastern CT, USA Posts: 1,572 OS: Vista (x64); Win7 (x32 & x64)	Re: Shutdown/hibernate results in memory dump and restart Dump files are stored in C:\Windows\Minidump, or as the file MEMORY.DMP in the C:\Windows directory (which is overwritten with each memory dump). If nothing is located there, search the entire hard drive for files ending in .dmp There are many reasons for a dump file not being created - so that will be a part of the analysis. You've done most of what is needed (and thanks for that!). Depending on what you removed with the SpyBot, there may/may not be a malware component to this issue. Frequently hibernate and sleep issues are due to a corruption in the video drivers. So I'd suggest: - Downloading the latest video driver for your system from here: http://support.dell.com/support/down...&catid=&impid= - Uninstall your current video drivers through Control Panel...Programs...Uninstall a program. - Reboot the system (dismissing any "Found New Hardware" dialogs that may occur). - double click on the downloaded file to install the new drivers. If this doesn't solve the problem, then please provide us with the information in this post: http://www.techsupportforum.com/1871981-post2.html Just FYI, here's my blog post on analyzing these files: http://usasma.vox.com/library/post/d...d-02oct08.html You'll notice in paragraph G that there are some additional commands, try them to see what you get. Also, there's a link at the bottom to a general description of how to analyze the debugger's output. __________________ aka John MVP Windows - Desktop Experience "There are very few problems in life that can't be fixed by the proper application of high explosives" If I haven't replied in 48 hours, please send me a PM. Last edited by usasma; 06-20-2009 at 10:31 AM.

06-20-2009, 05:21 PM	#4 (permalink)
usasma Tech Hardware Team Join Date: Apr 2009 Location: Southeastern CT, USA Posts: 1,572 OS: Vista (x64); Win7 (x32 & x64)	Re: Shutdown/hibernate results in memory dump and restart From the performance report first: - There's an unexplained service stopped error. You'll have to look in Event Viewer to see if the service is listed as being stopped in the Windows Logs...System log files. Also check the Application log files just in case. This appears to be the service in question: Code: Event[7]: Log Name: System Source: Service Control Manager Date: 2009-06-20T13:29:45.000 Event ID: 7001 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: DaveRuybalXPS Description: The UPnP Device Host service depends on the SSDP Discovery service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. Check to see if it's disabled, if so enable it. - Your Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller is disabled. Is this intentional on your part? - Your Bluetooth peripheral drivers aren't installed (or working). Have you checked Device Manager to see what the reason is? - Your C: and D: drives are low on free space. If either of them is your recovery partition, then this is normal for that one. But the other(s) should have at least 15% free space (so remove some stuff). This is not likely to be related to your problems - but it will speed up the system a bit. Dump file analysis to follow (my network is very slow right now). I'll be back in a bit. __________________ aka John MVP Windows - Desktop Experience "There are very few problems in life that can't be fixed by the proper application of high explosives" If I haven't replied in 48 hours, please send me a PM. Last edited by usasma; 06-20-2009 at 05:24 PM.