BSOD's dell xps crash address ntoskrnl.exe+16bf70

Toggle sidebar Toggle sidebar
B

Brech

Prominent
Apr 13, 2017
21
0
510
Hi all,

For the last few weeks I’ve been having BSOD’s on my brand new DELL XPS 15 9560. The BSOD’s occur approximately once every 3 days. The crash address is almost always ntoskrnl.exe+16bf70, but they are caused by different drivers: avc3.sys, nwifi.sys, tcpip.sys and hal.dll. The BSOD’s are not related to any software running (as far as I noted), I get them even when under very light load (actually mostly then, I never got the while gaming). Sometimes they also happen when my laptop awakes from sleep.
Here is a link to my last 5 dumpfiles: https://drive.google.com/drive/folders/0BxgDZG7kgSuBVmsyTTZpNk5Fak0?usp=sharing
The last dump file's bug check string was 'WHEA_UNCORRECTABLE_ERROR', but it wasn't saved as I had to hard shut down the laptop.

Probably worth noting too:

- I’ve done a fresh install of windows 10 when I got the laptop. I changed Bios mode to AHCI. Only have a few applications installed, including antivirus software Bitdefender 2017 total security.
- I use throttlestop for undervolting my CPU and GPU (-140 for CPU and CPU cache, -70 for GPU).
After undervolting I ran wprime and furmark for a few hours, and they both ran fine, no crashes.
- I repasted my CPU and GPU, after that wprime and furmark again, system was still stable.
- I already updated my wifi driver (for killer ac1535) to the latest version, and also ran chkdsk in cmd, this didn’t report any errors.

What could be the cause?

Thanks in advance!

Brech
 
Sort by date Sort by votes
If this is a bran new Dell, if there are any hardware errors, you should return it to them and ask them to replace/fix. Shouldn't get WHEA errors on brand new PC.

avc3.sys is Bitdefender's driver for Active Virus Control. You can actually see this feature in the Bitdefender product if you go to Settings > Antivirus > Shield tab.
Click to expand...
https://forum.bitdefender.com/index.php?/topic/44775-avc3sys/
nwifi.sys = network driver - was this error before or after you swapped the drivers?
tcpip.sys = transmission control protocol/internet protocol. Part of windows that talks to outside networks

hal.dll - hardware abstraction layer. Part of windows that sits between windows and hardware
ntoskrnl = new technology operating system kernel. It gets the blame for lots of things because its at the centre of it all. Windows cannot work without it.

WHEA stands for Windows Hardware error Architecture.


certainly a theme to top 3, all internet related. Try removing bitdefender until we figure this out (as I know others will suggest you do that just to remove it as a possibility). Have you done an AV scan?

I can't read dumps but I have a program that can look at them, Can you download and run who crashed - it will give us a glimpse of the errors you getting and might help us solve them

Copy/paste summary in here and I see what I can do :)
 
Upvote 0 Downvote
Thanks for your reply!
The nwifi.sys bsod was actually before I swapped the wifi driver, so this one may be fixed now.

Just this morning, I got another WHEA bsod, I didn’t get a dump file from it though, as it stayed at 0% so I had to hard shut down the laptop. I’m asking myself, could this have anything to do with my undervolting?
I’ve also done an AV scan, which didn’t find any viruses, and now I’ve uninstalled bitdefender.

Here is a summary of the who crashed report:
System Information (local)
________________________________________

Computer name: BRECHT-9560
Windows version: Windows 10 , 10.0, build: 15063
Windows dir: C:\Windows
Hardware: XPS 15 9560, Dell Inc., 05FFDN
CPU: GenuineIntel Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz Intel586, level: 6
8 logical processors, active mask: 255
RAM: 16989007872 bytes total


________________________________________
Crash Dump Analysis
________________________________________

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Thu 13/04/2017 18:26:54 your computer crashed
crash dump file: C:\Windows\Minidump\041317-16281-01.dmp
This was probably caused by the following module: hal.dll (hal+0x395CF)
Bugcheck code: 0x124 (0x0, 0xFFFFA303F80B4028, 0xBA000000, 0x11000402)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\hal.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Hardware Abstraction Layer DLL
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA).
This is likely to be caused by a hardware problem problem. This problem might also be caused because of overheating (thermal issue).
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 13/04/2017 18:26:54 your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: hal.dll (hal!HalBugCheckSystem+0xCF)
Bugcheck code: 0x124 (0x0, 0xFFFFA303F80B4028, 0xBA000000, 0x11000402)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\hal.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Hardware Abstraction Layer DLL
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA).
This is likely to be caused by a hardware problem problem. This problem might also be caused because of overheating (thermal issue).
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Mon 10/04/2017 13:56:53 your computer crashed
crash dump file: C:\Windows\Minidump\041017-8078-01.dmp
This was probably caused by the following module: avc3.sys (avc3+0xA0801)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF805A4470801, 0xFFFFA500845877D8, 0xFFFFA50084587010)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: avc3.sys .
Google query: avc3.sys SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M



On Sat 8/04/2017 15:14:52 your computer crashed
crash dump file: C:\Windows\Minidump\040817-9000-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16BF70)
Bugcheck code: 0xA (0x8, 0x2, 0x1, 0xFFFFF80388D2B6BC)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 5/04/2017 23:32:03 your computer crashed
crash dump file: C:\Windows\Minidump\040517-8703-01.dmp
This was probably caused by the following module: nwifi.sys (0xFFFFF8037225E418)
Bugcheck code: 0xD1 (0xDECAFC37, 0x2, 0x0, 0xFFFFF8037225E418)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\nwifi.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NativeWiFi Miniport Driver
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



________________________________________
Conclusion
________________________________________

6 crash dumps have been found and analyzed. Only 5 are included in this report. 2 third party drivers have been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

cpuz136_x64.sys
avc3.sys

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination with the errors that have been reported for these drivers. Include the brand and model name of your computer as well in the query. This often yields interesting results from discussions on the web by users who have been experiencing similar problems.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.





 
Upvote 0 Downvote
Thanks for the replies!

I uninstalled bitdefender and ran the uninstall tool you pointed too.
I never heard of Soluto, nor Corsairlink, don't have any of those installed.

Also ran the intel diagnostic tool, and it says the laptop passed.
Here is a link to the results file: https://drive.google.com/open?id=0BxgDZG7kgSuBaEcxeTBiVm1VNW8 .
It did freeze a bit while doing the cpuload test, is this normal?

EDIT: Dell just updated the bios for this laptop a few days ago, so I updated to that version now.

 
Upvote 0 Downvote

Yep, going to wait a few days now and see. That intel diagnostic tool's test passed,
the dell diagnostics also didn't report any problems, and no viruses, so i'm hoping
this is just a problem with bitdefender.

Still, can the WHEA error be caused by bitdefender? Undervolting can't have anything
to do with this right?
 
Upvote 0 Downvote
The whea stop error can be caused by bitdefender.

You can also get this stop error if you overclock, or if the cpu is overheating

And if the BIOS is out of date. Sometimes a BIOS update can fix it

Possible undervolting can cause it. I've never had this stop error myself

But bitdefender was one the causes of your crashes.

And it may have been the cause of the other crashes in the dmp file you posted





 
Upvote 0 Downvote
I got another bsod this morning, again a WHEA error, which resulted in two dump files.
One remarkable thing though is that the bsod occurred right when I attached my second monitor. Now that I think about it,
the other WHEA bsods all occurred while my laptop was attached to my second monitor, so maybe they have something to do
with that too?
Also, how does one bsod produce two different dump files?

Here's a summary of the dump files:

On Sun 16/04/2017 12:27:07 your computer crashed
crash dump file: C:\Windows\Minidump\041617-10218-01.dmp
This was probably caused by the following module: hal.dll (hal+0x395CF)
Bugcheck code: 0x124 (0x0, 0xFFFFDE04E9AF0028, 0xBA000000, 0x11000402)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\hal.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Hardware Abstraction Layer DLL
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA).
This is likely to be caused by a hardware problem problem. This problem might also be caused because of overheating (thermal issue).
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sun 16/04/2017 12:27:07 your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: igdkmd64.sys (igdkmd64+0x120BFE)
Bugcheck code: 0x124 (0x0, 0xFFFFDE04E9AF0028, 0xBA000000, 0x11000402)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_dada2949e7e4cbd9\igdkmd64.sys
product: Intel HD Graphics Drivers for Windows(R)
company: Intel Corporation
description: Intel Graphics Kernel Mode Driver
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA).
This is likely to be caused by a hardware problem problem. This problem might also be caused because of overheating (thermal issue).
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: igdkmd64.sys (Intel Graphics Kernel Mode Driver, Intel Corporation).
Google query: Intel Corporation WHEA_UNCORRECTABLE_ERROR

I already had installed the latest driver for the intel graphics card from the dell website, but I've now updated to the latest version listed on the
intel website.


 
Upvote 0 Downvote
undevolting the cpu would be a likely cause of bugcheck 0x124
your error was called by the CPU because of a internal error on core 5 cache bank 4
the system uptime was 1 day 8.5 hours. I would look into overheating also but I would first reset the bios to stock voltages.

-looks like you have a keyserver installed also.
-router software installed
some driver? 53804c30-234
debugger is does not like your core windows drivers. going to update the debugger in case something has changed in the layout.
 
Upvote 0 Downvote
Thans for the reactions; and thanks johnbl for the debugging efforts!
So something is wrong with my memory dumps?
About the keyserver, could this have something to do with a vpn client? Because I use open vpn to connect to work.
Apart from that, I wouldn't know about a keyserver.


Also, after uninstalling bitdefender, the problem persisted, and I got two more bsods recently.
Here's the dump file analysis:

On Fri 21/04/2017 11:06:24 your computer crashed
crash dump file: C:\Windows\Minidump\042117-10093-01.dmp
This was probably caused by the following module: win32kfull.sys (win32kfull+0xDB347)
Bugcheck code: 0xBE (0xFFFFC1415B4DB347, 0x100000447EA5021, 0xFFFFC9806E96AF00, 0xB)
Error: ATTEMPTED_WRITE_TO_READONLY_MEMORY
file path: C:\Windows\system32\win32kfull.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Full/Desktop Win32k Kernel Driver
Bug check description: This is issued if a driver attempts to write to a read-only memory segment.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sun 16/04/2017 12:27:07 your computer crashed
crash dump file: C:\Windows\Minidump\041617-10218-01.dmp
This was probably caused by the following module: hal.dll (hal+0x395CF)
Bugcheck code: 0x124 (0x0, 0xFFFFDE04E9AF0028, 0xBA000000, 0x11000402)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\hal.dll
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Hardware Abstraction Layer DLL
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA).
This is likely to be caused by a hardware problem problem. This problem might also be caused because of overheating (thermal issue).
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

Here is a link to the dumpfiles too: https://drive.google.com/open?id=0BxgDZG7kgSuBTE5YTDh1VC0zbVU

I now reset my bios and voltages. Let's see if that makes a difference.


Update: I also don't think overheating would be a reason, as I monitor my temps with HWinfo and they are always very low (CPU,GPU under 40 degrees), and I've really not put the laptop under any heavy load since I got it.
 
Upvote 0 Downvote
I loaded the newer dump, it said Insufficient Dumpfile Size
i guess you might be out of space on the hard drive, or have two small of a setting

the memory dump I can read indicates some driver attempted to write to read only memory
it looks like some sort of call to a video port trying to set something related to a display setting

google how to force a memory dump via keyboard, make the registry setting and force a memory dump right after you reboot.
set the size of the pagefile.sys to be larger (several gigabytes)
how to increase page file size:http://www.thewindowsclub.com/increase-page-file-size-virtual-memory-windows

looks like you have a key server running so you should run a malwarebytes scan, and a rootkit scan.
I would also start cmd.exe as an admin and run
sfc.exe /scannow
dism.exe /online /cleanup-image /restorehealth

the memory dump still shows corruption, all of the driver dates are invalid
it might just be problem that their was not enough room to store the actual memory dump file.
start cleanmgr.exe to clean up space if you are out of space.
you can also run cmd.exe as an admin and remove old windows updates (to free more space)

dism /online /Cleanup-Image /SPSuperseded



 
Upvote 0 Downvote
I have around 200gb of ssd space left, so that shouldn't be the problem. I'll try setting the pagefile size larger, thanks for the link!

For the write to read only memory: It had indeed something to do with the video driver. I now see that every time I plug in my external monitor, I will get a bsod if I close my laptop lid. Using it in "extend to this display" mode works fine. Also, when the laptops enters sleep and I then wake it up (all with the second monitor attached), it will bsod too. Looks like there was a problem with the intel hd 630 graphics driver. I updated it to the latest version, and the problem with the bsods related to closing the lid and the sleep mode are gone now.
For the key server: could this have something to do with a key generator program? A friend of mine installed a program on my laptop which needed a serial code, and used a sort of key generator to get the serial code (I know it's probably illegal). Could it have something to do with that?

I'm trying anti malware byts and a rootkit scan in the mean time.

EDIT: pagefile size is already 16304 mb, should I increase it further?
 
Upvote 0 Downvote
I increased the pagefile size to 18gb just to be sure.

Malwarybytes scan and rootkit scan didn't report any problems. Also the sfc /scannow tells there are no integrity violations.
I tried a few methods on the internet to force a memory dump, but none of them are working. Most use the scroll lock key, which I don't have on my keyboard.
 
Upvote 0 Downvote
You can try running driver verifer, just read the instructions carefully. It is part of win 10 designed to find misbehaving drivers. It will cause BSOD, that is its job since it tests drivers.

Once it bsod, upload the dump files so John can help you.

I have found that sometimes this puts windows into a boot loop so its handy to have a copy of the win 10 installer around to use as a boot disc to get into CMD to turn it off - instructions are in top link.
download the Windows 10 media creation tool and use it to make a win 10 installer on USB

This won't cause whea errors unless they are being caused by drivers. but it will cause dumps to be created if they can be.
 
Upvote 0 Downvote
the key generators work by installing software that re routes the license checking back to your own machine. Then the program always responds that your license is valid.
Often the programs will block all of the windows updates and make it appear that your system is updated when it is not. Some also install malware and rootkits and break programs that can be used to remove the software. IE they delete the recovery files, backups for system restore and modify the dism.exe command so it does not work.
 
Upvote 0 Downvote
Thanks for the explanation!

So I if Malwarebytes, Malwarebytes rootkitscan and bitdefender don't find any issues or rootkits, do you think the system is clean, or could they still miss something?

I also ran the driver verifier software after reading instructions, but it didn't cause a bsod. When I rebooted the machine, it instead entered the dell repair or diagnostic thing, and started checking my hardware (which by the way also didn't report any hardware issues). After that, the laptop got stuck in a sort of loop where it always rebooted to the repair screen of windows 10. From there I just selected troubleshoot -> advanced startup -> after startup chose safe boot and then turned of verifier again with the cmd command.

Does this mean there were nog faulty drivers, or did it simply not work?

I also tried running the dism.exe /online /cleanup-image /restorehealth command too, but after hitting 100 percent it says
"The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077." When I run dism.exe /online /cleanup-image /scanhealth , it says 'the component store is repairable'

BTW, it's been three days now without a crash.
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom