HI

I Have this couple of days had problem with my Computer, when i am shutting my Computer down it takes ages until it shutdown, just today i notice that  in event viewer, i see my computer do get a Error Critical ( Kernel -Power ID 41), this happens when i try to restart my computer or just to shutdown, any ideas?

ROLN

Please provide us with your Event Viewer administrative logs by following these steps:


Click Start Menu
Type eventvwr into Search programs and files (do not hit enter)
Right click eventvwr.exe and click Run as administrator
Expand Custom Views
Click Administrative Events
Right click Administrative Events
Save all Events in Custom View As...
Save them in a folder where you will remember which folder and save as Errors.evtx
Go to where you saved Errors.evtx
Right click Errors.evtx -> send to -> compressed (zipped) folder
Upload the .zip file to Onedrive or a file sharing service and put a link to it in your next post * If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem.  The work around is to edit the registry.  If you are not comfortable doing this DONT.  If you are, backup the key before you do Press Win+"R" and input regedit

Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"

ALSO

 We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  

Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here If you have any questions about the procedure please ask

Hello

Here are the information you asked about.


https://www.zeta-uploader.com/nb/browse?hash=333137735



Kind regards
RN

Hi ROLN,

The kernel power event ID 41 error occurs when the computer is shut down, or it restarts unexpectedly. When a computer that is running Windows starts, a check is performed to determine whether the computer was shut down cleanly. If the computer was not shut down cleanly, a Kernel Power Event 41 message is generated.

An event 41 is used to report that something unexpected happened that prevented Windows from shutting down correctly. There may be insufficient information to explicitly define what happened. To determine what may have happened and to identify a potential resolution, it is important to know what the computer was doing at the time just before the event occurred.

For more information:

Windows Kernel event ID 41 error "The system has rebooted without cleanly shutting down first" in Windows 8.1, Windows 8, Windows Server 2012 R2, Windows Server 2012, Windows 7, or Windows Server 2008 R2

http://support.microsoft.com/en-us/kb/2028504#method3

Regards,

Alex Zhao

ROLN

These were related to yourdne64x.sys (cisco vpn)Yours is from 2008.  You need to remove it or update it to current.  I believe I have seen these DMPS elsewhere

Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ken\Desktop\031515-22984-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.17668.amd64fre.winblue_r8.150127-1500
Machine Name:
Kernel base = 0xfffff802`efa8d000 PsLoadedModuleList = 0xfffff802`efd66250
Debug session time: Sun Mar 15 11:32:55.130 2015 (UTC - 4:00)
System Uptime: 0 days 0:16:09.840
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, ffffe00037f30060, ffffd0010cdec960, ffffe0003dbc46a0}

Unable to load image \SystemRoot\system32\DRIVERS\dne64x.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dne64x.sys
*** ERROR: Module load completed but symbols could not be loaded for dne64x.sys
Probably caused by : ntkrnlmp

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: ffffe00037f30060, Physical Device Object of the stack
Arg3: ffffd0010cdec960, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
Arg4: ffffe0003dbc46a0, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IMAGE_NAME:  ntkrnlmp

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAULTING_MODULE: fffff80139600000 dne64x

IRP_ADDRESS: ffffe0003dbc46a0

DEVICE_OBJECT: ffffe0003cb13050

DRIVER_OBJECT: ffffe0003c2ed060

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

DPC_STACK_BASE:  FFFFD0010CDF3FB0

STACK_TEXT:  
ffffd001`0cdec928 fffff802`efc95e3e : 00000000`0000009f 00000000`00000003 ffffe000`37f30060 ffffd001`0cdec960 : nt!KeBugCheckEx
ffffd001`0cdec930 fffff802`efc95d5e : ffffe000`3f032240 00000000`00000001 ffffe000`409349f0 ffffe000`4093a2b0 : nt!PopIrpWatchdogBugcheck+0xde
ffffd001`0cdec990 fffff802`efb41428 : 00000000`00000016 00000000`00342791 ffffd001`0cdc2180 00000000`01d05f35 : nt!PopIrpWatchdog+0x32
ffffd001`0cdec9e0 fffff802`efbe14ea : ffffd001`0cdc2180 ffffd001`0cdc2180 ffffd001`0cdce3c0 ffffe000`41638080 : nt!KiRetireDpcList+0x4f8
ffffd001`0cdecc60 00000000`00000000 : ffffd001`0cded000 ffffd001`0cde7000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ntkrnlmp

IMAGE_VERSION:  

FAILURE_BUCKET_ID:  0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp

BUCKET_ID:  0x9F_3_POWER_DOWN_IMAGE_ntkrnlmp

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x9f_3_power_down_image_ntkrnlmp

FAILURE_ID_HASH:  {678b3384-34e9-dafc-d401-53951e725571}

Followup: MachineOwner
---------

2: kd> !irp ffffe0003dbc46a0 1
Irp is active with 3 stacks 2 is current (= 0xffffe0003dbc47b8)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
Flags = 00000000
ThreadListEntry.Flink = ffffe0003dbc46c0
ThreadListEntry.Blink = ffffe0003dbc46c0
IoStatus.Status = c00000bb
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = ffffe0003dbc4718
Tail.Overlay.Thread = 00000000
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = fffff802efd4cc60
Tail.Overlay.ListEntry.Blink = fffff802efd4cc60
Tail.Overlay.CurrentStackLocation = ffffe0003dbc47b8
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 ffffe0003cb13050 00000000 fffff802efe0ab3c-ffffe0003f032240 Success Error Cancel pending
	       \Driver\DNE	nt!PopSystemIrpCompletion
			Args: 00015600 00000000 00000005 00000003
 [  0, 0]   0  0 00000000 00000000 00000000-ffffe0003f032240    

			Args: 00000000 00000000 00000000 00000000