BSOD 0x9F in NTOSKRNL.EXE

I have uninstalled SpeedFan and cleaned up everything that seemed related to Wondershare or Apowersoft software.

I'm now thinking it might be good to remove or upgrade other pre-2010 drivers, and have come up with the following list (extracted from the latest dump by looking at timestamps in the output from 'lm ot'):

C:/Windows/system32/drivers/PxHelp20.sys:

File Version:  3.0.56.0

Product Version: 2.0.0.0

File Flags:  

File OS:  WINDOWS32

File Type:  DLL

Language: English (United States), Code Page: Unicode

 CompanyName: Sonic Solutions

 FileDescription: Px Engine Device Driver for Windows 2000/XP

 FileVersion: 3.00.56a

 InternalName: PxHelp20

 LegalCopyright: Copyright © Sonic Solutions

 OriginalFilename: PxHelp20.sys

 ProductName: PxHelp20

C:/Windows/system32/drivers/itecir.sys:

File Version:  5.0.0.0

Product Version: 6.1.7000.0

File Flags:  PRIVATEBUILD

File OS:  NT_WINDOWS32

File Type:  DLL

Language: English (United States), Code Page: Unicode

 CompanyName: ITE Tech. Inc.

 FileDescription: ITE Consumer IR Driver for eHome

 FileVersion: 6.1.7000.0 built by: WinDDK

 InternalName: itecir.sys

 LegalCopyright: Copyright (c) ITE Tech. Inc. 2006

 OriginalFilename: itecir.sys

 ProductName: ITE Consumer IR Driver for eHome

 ProductVersion: 6.1.7000.0

C:/Windows/system32/drivers/rimmptsk.sys:

File Version:  6.10.1.3

Product Version: 1.0.0.0

File Flags:  PRIVATEBUILD, SPECIALBUILD

File OS:  NT_WINDOWS32

File Type:  APP

Language: Japanese (Japan), Code Page: Unicode

 CompanyName: REDC

 FileDescription: RICOH SD/MMC Driver

 FileVersion: 6.10.01.03

 InternalName: R853

 LegalCopyright: Copyright c 2001-2009, Ricoh Company Ltd.,

 OriginalFilename: rimmptsk.sys

 ProductName: RICOH SD/MMC Driver

 ProductVersion: 1, 0, 0, 0

 Comments: RICOH SD/MMC Driver

 PrivateBuild: 2009.06.25.6.10.01.03

 SpecialBuild: 2009.06.25.6.10.01.03

C:/Windows/system32/drivers/rimsptsk.sys:

File Version:  6.10.1.3

Product Version: 6.0.0.0

File Flags:  PRIVATEBUILD, SPECIALBUILD

File OS:  NT_WINDOWS32

File Type:  APP

Language: Japanese (Japan), Code Page: Unicode

 CompanyName: REDC

 FileDescription: RICOH MS Driver

 FileVersion: 6.10.01.03

 InternalName: r592

 LegalCopyright: Copyright c 2001-2009, Ricoh Company Ltd.,

 OriginalFilename: rimsptsk.sys

 ProductName: Ricoh Memorystick Controller

 ProductVersion: 6, 0, 0, 0

 Comments: RICOH MS Driver

 PrivateBuild: 2009.06.25.6.10.01.03

 SpecialBuild: 2009.06.25.6.10.01.03

C:/Windows/system32/drivers/rixdptsk.sys:

File Version:  6.10.1.4

Product Version: 6.0.0.0

File Flags:  PRIVATEBUILD, SPECIALBUILD

File OS:  NT_WINDOWS32

File Type:  APP

Language: Japanese (Japan), Code Page: Unicode

 CompanyName: REDC

 FileDescription: RICOH XD SM Driver

 FileVersion: 6.10.01.04

 InternalName: r852

 LegalCopyright: Copyright c 2001-2009, Ricoh Company Ltd.,

 OriginalFilename: rixdptsk.sys

 ProductName: R5C852 Ricoh xD Controller

 ProductVersion: 6, 0, 0, 0

 Comments: RICOH XD SM Driver

 PrivateBuild: 2009.06.25.6.10.01.04

 SpecialBuild: 2009.06.25.6.10.01.04

C:/Windows/system32/drivers/secdrv.SYS:

File Version:  4.3.86.0

Product Version: 4.3.86.0

File Flags:  

File OS:  NT_WINDOWS32

File Type:  DRV

File Subtype:  SYSTEM

Language: English (United States), Code Page: Multilingual

 CompanyName: Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.

 FileDescription: Macrovision SECURITY Driver

 FileVersion: 4.03.086

 InternalName: SECDRV

 LegalCopyright: © 2006 Macrovision Corporation

 OriginalFilename: SECDRV.SYS

 ProductName: Macrovision SECURITY Driver

 ProductVersion: SECURITY Driver 4.03.086 2006/09/13

 Comments: StringFileInfo: U.S. English

The ITECIR thing is the driver for the Dell infrared mini-remote; don't know if they have anything newer (I remember that upgrading to 8.0 then 8.1 caused the remote to stop functioning).

Dunno what software PxHelp20.sys and secdrv.sys are associated with.

I will try to find a newer driver for the Ricoh SD card reader (could have some influence on the USB issue?)

Any (other) suggestions? Do you think my list of "old" stuff is complete or should I use other criteria?

There are some older drivers on the system in particular the giveo.sys (Speedfan) which appears dated 1996 and the Apowersoft_AudioDevice.sys (Wondershare) which appears to be from 2008.

Before running the Driver Verifier I might suggest to try uninstalling these two software.

If the BSODs continue then enabling the Driver Verifier on all-non-Microsoft drivers as you did before may be advised.

If you cannot start Windows after enabling the Driver Verifier you can launch the Driver Verifier (verifier.exe > Delete existing settings > Finish) from a command prompt by booting recovery media.

That may be what you did before.

Hopefully a dump file will be created which would identify the offending driver.

Thx for the links.

Generation of the memory dump works fine with no pagefile on C: and the previously mentioned settings (I'm assuming uploading yet another dump is useless at this point. I get at least one BSOD per day...)

Yes the issue looks similar to the one in the Dell article, but it refers to a Windows 7 QFE whose code/logic I assume is built into [recent] Windows 8.1 code.

What older drivers on my systems are you referring to?

I can't say that I'm familiar with Driver Verifier. I know the principle of operation, and once followed the advice in an article that suggested to enable it for all non-Microsoft drivers, with quite a bunch of checks turned on. All this got me was a non-bootable system (endless reboot loop) and it was quite difficult to recover (needed to use a bootable USB key to disable DV from WinPE).

Which drivers do you suggest to turn DV on for, and with which checks?

What is the recommended approach for determining the faulty driver using DV? Plain old dichotomy?

From my understanding in Windows 8 if you use the DedicatedDumpFile registry value you do not need a page file on C: or any other paging file.

You shouldn't have to make any change at the CrashControl\MachineCrash key as the system should modify that with a new crash.

There is some good information on this in the following article:

https://support.microsoft.com/en-us/kb/969028

What you are experiencing with the BSODs and USB devices not being detected seems to match what is discussed in the following article from Dell but the article is for Windows 7:

http://www.dell.com/support/article/us/en/19/SLN295673/EN

Perhaps a similar issue may exist in certain setups in Windows 8 or the issue may be from another, perhaps third party, driver.

There are some older drivers loaded on your system which have the potential to be problematic.

Are you familiar with using the Driver Verifier?

I'm going to try:

DumpFile d:\dumps\MEMORY.DMP

DedicatedDumpFile d:\dumps\DedicatedDumpFile.Ddmp

I presume with this it's now OK to not have any pagefile on C:, correct?

Do I also have to change the settings under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\MachineCrash?

For now I have:

DumpFile C:\Windows\MEMORY.DMP

FinalDumpFileLocation C:\Windows\MEMORY.DMP

there...