BSOD's dell xps crash address ntoskrnl.exe+16bf70

[Brech]

Hi all,

For the last few weeks I’ve been having BSOD’s on my brand new DELL XPS 15 9560. The BSOD’s occur approximately once every 3 days. The crash address is almost always ntoskrnl.exe+16bf70, but they are caused by different drivers: avc3.sys, nwifi.sys, tcpip.sys and hal.dll. The BSOD’s are not related to any software running (as far as I noted), I get them even when under very light load (actually mostly then, I never got the while gaming). Sometimes they also happen when my laptop awakes from sleep.
Here is a link to my last 5 dumpfiles: https://drive.google.com/drive/folders/0BxgDZG7kgSuBVmsyTTZpNk5Fak0?usp=sharing
The last dump file's bug check string was 'WHEA_UNCORRECTABLE_ERROR', but it wasn't saved as I had to hard shut down the laptop.

Probably worth noting too:

- I’ve done a fresh install of windows 10 when I got the laptop. I changed Bios mode to AHCI. Only have a few applications installed, including antivirus software Bitdefender 2017 total security.
- I use throttlestop for undervolting my CPU and GPU (-140 for CPU and CPU cache, -70 for GPU).
After undervolting I ran wprime and furmark for a few hours, and they both ran fine, no crashes.
- I repasted my CPU and GPU, after that wprime and furmark again, system was still stable.
- I already updated my wifi driver (for killer ac1535) to the latest version, and also ran chkdsk in cmd, this didn’t report any errors.

What could be the cause?

Thanks in advance!

Brech

 

[johnbl]

normally you would run verifier for as long as you can tolerate it (it makes things slow)
drivers can mess up during boot, but often after a system sleeps, some have I have seen one driver that required 16 sleep cycles before verifier bugchecked. (took 9 days)

dism.exe /online /cleanup-image /restorehealth
should go to the microsoft servers for the sources: if your internet was up it would not be a good sign. Some of the malware blocks access to the microsoft servers.

you can also run it from a boot image, but you should google for the exact command and how to specifiy the source and target.

you will also want to check the task scheduler, some of these hacks come back because they are scheduled to install every day. just in case you removed the program.

If I run a questionable program, I run it in a Hypervisor get the info I want and shutdown the hypervisor or reset the OS image back to the default. Mostly, I do it just to see what the tool is doing to the windows image and see what hidden things are being installed.

most likely your machine will be ok, if malwarebytes, and a rootkit scan are ok.
(and you remove the hack programs)

it would be good to make sure
sfc.exe /scannow
and the dism.exe command work.

the system file checker can fix some problems but mostly the malware knows how to get around it.

Thanks for the explanation!

So I if Malwarebytes, Malwarebytes rootkitscan and bitdefender don't find any issues or rootkits, do you think the system is clean, or could they still miss something?

I also ran the driver verifier software after reading instructions, but it didn't cause a bsod. When I rebooted the machine, it instead entered the dell repair or diagnostic thing, and started checking my hardware (which by the way also didn't report any hardware issues). After that, the laptop got stuck in a sort of loop where it always rebooted to the repair screen of windows 10. From there I just selected troubleshoot -> advanced startup -> after startup chose safe boot and then turned of verifier again with the cmd command.

Does this mean there were nog faulty drivers, or did it simply not work?
I tried running the dism.exe /online /cleanup-image /restorehealth command too, but after hitting 100 percent it says sources were not found, and that I need to specify an image location.
BTW, it's been three days now without a crash.

 

[johnbl]

normally you would run verifier for as long as you can tolerate it (it makes things slow)
drivers can mess up during boot, but often after a system sleeps, some have I have seen one driver that required 16 sleep cycles before verifier bugchecked. (took 9 days)

dism.exe /online /cleanup-image /restorehealth
should go to the microsoft servers for the sources: if your internet was up it would not be a good sign. Some of the malware blocks access to the microsoft servers.

you can also run it from a boot image, but you should google for the exact command and how to specifiy the source and target.

you will also want to check the task scheduler, some of these hacks come back because they are scheduled to install every day. just in case you removed the program.

If I run a questionable program, I run it in a Hypervisor get the info I want and shutdown the hypervisor or reset the OS image back to the default. Mostly, I do it just to see what the tool is doing to the windows image and see what hidden things are being installed.

most likely your machine will be ok, if malwarebytes, and a rootkit scan are ok.
(and you remove the hack programs)

it would be good to make sure
sfc.exe /scannow
and the dism.exe command work.

the system file checker can fix some problems but mostly the malware knows how to get around it. the dism /online is much harder for the malware to defeat. They generally replace the dism command or block its access to the window server so the files can not be checked.

Thanks for the explanation!

So I if Malwarebytes, Malwarebytes rootkitscan and bitdefender don't find any issues or rootkits, do you think the system is clean, or could they still miss something?

I also ran the driver verifier software after reading instructions, but it didn't cause a bsod. When I rebooted the machine, it instead entered the dell repair or diagnostic thing, and started checking my hardware (which by the way also didn't report any hardware issues). After that, the laptop got stuck in a sort of loop where it always rebooted to the repair screen of windows 10. From there I just selected troubleshoot -> advanced startup -> after startup chose safe boot and then turned of verifier again with the cmd command.

Does this mean there were nog faulty drivers, or did it simply not work?
I tried running the dism.exe /online /cleanup-image /restorehealth command too, but after hitting 100 percent it says sources were not found, and that I need to specify an image location.
BTW, it's been three days now without a crash.

 

[Brech]

I'm trying to get verifier to keep running, but everytime I enable it, my computer won't boot anymore and keeps going into the recovery screen, so I'm forced to enter safe mode and disable it. It hasn't given me any memory dumps yet.

Also, it seems that my dism command is indeed broken.. I was already familiar to the dism commands, I used them in the past. I tried every command that I could find on the internet, every variant ('Dism /Online /Cleanup-Image /RestoreHealth'; specifying a .esd file in a windows iso, specifying a .wim file, running the /StartComponentCleanup command first... and a lot of others).

The 'Dism /Online /Cleanup-Image /ScanHealth' reports that my 'component store is repairable, but all of the 'Dism /Online /Cleanup-Image /RestoreHealth' attempts and its variants seem to fail with

"Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature".

Spoiler

1]-------------
PS C:\WINDOWS\system32> Dism /Online /Cleanup-Image /CheckHealth
Deployment Image Servicing and Management tool
Version: 10.0.10240.16384
Image Version: 10.0.10240.16384
The component store is repairable.
The operation completed successfully.

2]-------------
PS C:\WINDOWS\system32> DISM /Online /Cleanup-Image /RestoreHealth /source:WIM:E:\sources\Install.wim:1 /LimitAccess
Deployment Image Servicing and Management tool
Version: 10.0.10240.16384
Image Version: 10.0.10240.16384
[==========================100.0%==========================]
Error: 0x800f081f
The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see
http://go.microsoft.com/fwlink/?LinkId=243077.
The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

I followed pretty much every solution on this forum: https://www.tenforums.com/performance-maintenance/17360-hopeless-windows-10-infamouse-error-0x800f081f-2.html, but none of them worked for me.

Last thing i could come up with is do an 'in-place windows upgrade". Unfortunately, the dism command still doesn't work after this, and gives the same error.

I also checked task scheduler, and there are only some 10 scheduled tasks, all of them of which I know that they are from trustworthy software.

 

[Colif]

You are on Version 1507, Build 10.0.10240 of Windows 10, this was the release version in July 2015.
The current Version is 1703, build 10.0.15063, you are 3 versions behind.

That is a problem if you are being told to run the source command as unless you have the USB you used to install it, any ISO you make now will be version 1703 and the source files have to match the version you are using.

I don't know what John suggests but I think having latest version of win 10 might help some errors. You can either run the upgrade assistant from 1st link here and run it and see if it upgrades you or download a new copy of the ISO - from the 2nd link on same page - and do a fresh install which might wipe out any problem drivers

edit: after reading last part of above post, wonder what version you on now
can you right click start button
choose run...type winver and press enter
what build are you on?

 

[Brech]

Yes, I was using the iso which was on a flash drive I got with the laptop, it had the same image version.
After the upgrade, I am indeed on version 1703, build 15063.250. I then used the windows media creation tool to make a new iso again, but the dism commands still don't work, I get the same erros.

I also have this problem where the laptop will be stuck at a screen saying "Getting windows ready. Please Do Not Turn Off Your Computer" , every time I try to reboot. I've let it on that screen once for more than two hours, but it won't do anything so I'm forced to hard shutdown.

Something remarkable about the dism command I noticed, is even if I give a wrong source, say "dism /online /cleanup-image /restorehealth /Source:wim:K\sources\install.wim:2", and the drive letter K does not even exist, the command will still start executing, and run until 94.5%, and than give the same error.

Spoiler

"Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature".

 

[Colif]

I am not sure DISM source command actually works at the moment, you not the only person I have found that gets that error but I wouldn't worry about running dism after the upgrade as what it did was put a fresh copy of windows on your PC right now so there shouldn't be anything wrong with the files.

that other problem is more intriguing. Did it start before or after the upgrade?

 

[johnbl]

I would think that if the dism.exe /online command is not working, then it has been modified or something is blocking access to the Microsoft server. Some hack tools would block access so the fake activation software will not be removed.
(or the rootkits, and malware)

 

[Colif]

i have seen it enough recently to start questioning if they changed the commands, it might be as you say another reason though. Makes me question if its worth offering the source command line choice, as it should be using the iso itself and not online

 

[Brech]

The problem with the ""Getting windows ready. Please Do Not Turn Off Your Computer" on startup fixed itself, so the laptop is now restarting and shutting down just fine.
I would leave it like this if I didn't have any visible problems with the laptop, but the problem is I'm still getting bsod's.
This is one I never got before:

On Wed 3/05/2017 18:58:49 your computer crashed
crash dump file: C:\WINDOWS\Minidump\050317-8531-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16BFD0)
Bugcheck code: 0x139 (0x3, 0xFFFF9101347D28C0, 0xFFFF9101347D2818, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


About the dism command, I think it wasn't changed, the syntax, as it's still listed that way on the microsoft website. Could it be that the malware changed the dism command? I find it weird though, because I've also tried to boot the laptop in 'safe mode', and even there the dism command with the \source tag pointing to my .wim file, fails and gives the same error.

 

[Colif]

can you upload and share the last dump file so john can have a look at it. whocrashed is only helpful if it isn't blaming windows, and ntoskrnl is windows kernel.

the key software may have changed locations of files or changed them completely. when you use them, you never sure what else comes along for ride.

 

[johnbl]

I have seen cases where the malware replaces the dism.exe command with a version that does not work.
at least when we did a binary compare between the dism.exe that the person had and the one from the windows disk. they did not match. I don't use the /source option so I don't know if that has changed or is broken in the build.

with the security check failure you also want to confirm memtest86 passes with out any errors.
a single bit error can trigger this bugcheck. It seems to happen a lot more now that windows is compressing data structures in memory.

most people would do a wipe and clean install of a known good copy of windows just because it is faster than trying to figure out what is going on.

The problem with the ""Getting windows ready. Please Do Not Turn Off Your Computer" on startup fixed itself, so the laptop is now restarting and shutting down just fine.
I would leave it like this if I didn't have any visible problems with the laptop, but the problem is I'm still getting bsod's.
This is one I never got before:

On Wed 3/05/2017 18:58:49 your computer crashed
crash dump file: C:\WINDOWS\Minidump\050317-8531-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x16BFD0)
Bugcheck code: 0x139 (0x3, 0xFFFF9101347D28C0, 0xFFFF9101347D2818, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


About the dism command, I think it wasn't changed, the syntax, as it's still listed that way on the microsoft website. Could it be that the malware changed the dism command? I find it weird though, because I've also tried to boot the laptop in 'safe mode', and even there the dism command with the \source tag pointing to my .wim file, fails and gives the same error.

 

[Colif]

Fresh install might be best place to start from at least. He has ISO of current build, getting older ones is possible but not easy

 

[Brech]

I a kind of busy right now, but if the problems persist I might indeed try a clean install. It's just really a lot of work as I have programs like adobe lightroom,
my music program and others that have a lot of settings and take a lot of time to set up.
Here is a link to the latest 3 dump files: https://drive.google.com/open?id=0BxgDZG7kgSuBTE5YTDh1VC0zbVU

I'm gonna try running memtest too!
Thanks for all the help again!

 

[johnbl]

you might also update this driver
RealTek RTS PCIE READER Driver
RtsPer.sys

http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=15&PFid=25&Level=4&Conn=3&DownTypeID=3&GetDown=false

the dates in the driver table are all messed up so I can not tell if it is updated. (but something is going wrong with the driver)
-----------
second bugcheck was a stack buffer overflow. driver table is corrupted.
I would google "how to force a memory dump using a keyboard" make the registry settings, change the memory dump type to kernel, reboot. wait 5 or 10 minutes and then force a memory dump before the system bugchecks.

make sure you have a pagefile.sys on drive c: and that your system has plenty of space on drive c

then put the memory dump of the working system on a server and post a link.
----------------
you need to change the memory dump type to kernel, and reproduce the bugcheck.
the memory dump was corrupted, and the problem looks like it was in power management (sleep functions)
minidumps don't save the required info to debug. Need the kernel memory dump
from c:\windows\memory.dmp when you get it.

also need to check to see if your system is out of memory for device drivers.

--------
Windows 10 Kernel Version 15063 MP (8 procs) Free x64
System Uptime: 0 days 3:46:30.813
SYSTEM_MANUFACTURER: Dell Inc.
SYSTEM_PRODUCT_NAME: XPS 15 9560
BIOS_VERSION: 1.2.4
BIOS_DATE: 03/29/2017

I a kind of busy right now, but if the problems persist I might indeed try a clean install. It's just really a lot of work as I have programs like adobe lightroom,
my music program and others that have a lot of settings and take a lot of time to set up.
Here is a link to the latest 3 dump files: https://drive.google.com/open?id=0BxgDZG7kgSuBTE5YTDh1VC0zbVU

I'm gonna try running memtest too!
Thanks for all the help again!

 

[Brech]

So I ran memtest86 via a usb bootable drive and it passed all tests, including the 'hammer test'. 0 errors.
I also updated the realtek driver.

I checked the pagefile and it's set to 18gb. Also checked and enabled kernel memory dump.
I set up the crash on keyboard combination and let the laptop run for 15 minutes, while doing my typical work.
Then hit the combination and it crashed, indeed reporting "Manually_initialised_crash".Here is the link to the memory.dmp file: http://gofile.me/6sfED/tUEiSOXQS.

you might also update this driver
RealTek RTS PCIE READER Driver
RtsPer.sys

http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=15&PFid=25&Level=4&Conn=3&DownTypeID=3&GetDown=false

the dates in the driver table are all messed up so I can not tell if it is updated. (but something is going wrong with the driver)
-----------
second bugcheck was a stack buffer overflow. driver table is corrupted.
I would google "how to force a memory dump using a keyboard" make the registry settings, change the memory dump type to kernel, reboot. wait 5 or 10 minutes and then force a memory dump before the system bugchecks.

make sure you have a pagefile.sys on drive c: and that your system has plenty of space on drive c

then put the memory dump of the working system on a server and post a link.
----------------
you need to change the memory dump type to kernel, and reproduce the bugcheck.
the memory dump was corrupted, and the problem looks like it was in power management (sleep functions)
minidumps don't save the required info to debug. Need the kernel memory dump
from c:\windows\memory.dmp when you get it.

also need to check to see if your system is out of memory for device drivers.

--------
Windows 10 Kernel Version 15063 MP (8 procs) Free x64
System Uptime: 0 days 3:46:30.813
SYSTEM_MANUFACTURER: Dell Inc.
SYSTEM_PRODUCT_NAME: XPS 15 9560
BIOS_VERSION: 1.2.4
BIOS_DATE: 03/29/2017

I a kind of busy right now, but if the problems persist I might indeed try a clean install. It's just really a lot of work as I have programs like adobe lightroom,
my music program and others that have a lot of settings and take a lot of time to set up.
Here is a link to the latest 3 dump files: https://drive.google.com/open?id=0BxgDZG7kgSuBTE5YTDh1VC0zbVU

I'm gonna try running memtest too!
Thanks for all the help again!

 

[johnbl]

dell updated the motherboard audio driver on 20 Apr 2017
http://www.dell.com/support/home/us/en/04/product-support/product/xps-15-9560-laptop/drivers/advanced
you have one from RTKVHD64.sys Fri Jan 6 02:00:59 2017
it has a chance of fixing this problem.

looks like they also updated the built in intel graphics driver on the same date.
(this is the one that was not responding to power events (wake up)

it also has a good chance of fixing the problem.

i would also take a look at the other driver updates. looks like a custom nvidia driver is installed also.


-----------
downloaded the memory dump
first look indicates a problem with Intel Graphics Media Accelerator
IntcAudioBus.sys not responding to a request to wake.

the memory dump shows corruption in the driver table. You might consider deleting your c:\pagefile.sys and recreating it.

you have \SystemRoot\System32\drivers\IntcOED.sys Fri Nov 4 09:42:47 2016
ntel® Smart Sound Technology (Intel® SST) OED
installed, not sure if it is related to the problem with your sound driver.
(you might check for a update or remove the software if you don't actually use it)


got to run to lunch, will try and look at the dump some more when I get back

 

[Brech]

Thanks for the effort, John!

I updated the motherboard audio driver to the latest version, also updated the intel hd graphics.
The Nvidia driver is one I installed from the NVidia website itself, it was the latest version available for my graphics card.
I also updated the intel sst driver, did some googling and seems like this is a driver used for voice input, such as Cortana.

I deleted the pagefile and set it up again.
I'm now looking into the intel graphics media accelerator driver.

 

[johnbl]

I have been seeing a lot of memory dumps that are corrupted. I am starting to think it might be related to the new build of windows.
(Windows 10 Kernel Version 15063 MP)

there was something weird going on with your usb hub also, it had 1.2 million log entries just going in a loop. ( normally I see less than 200)
need to go back and see what was connected.
you might download and run usbview.exe to see if it shows any errors:
http://www.uwe-sieber.de/usbtreeview_e.html

---------
be sure to also update the network driver. Seems like I keep seeing killer network drivers corrupting memory

Thanks for the effort, John!

I updated the motherboard audio driver to the latest version, also updated the intel hd graphics.
The Nvidia driver is one I installed from the NVidia website itself, it was the latest version available for my graphics card.
I also updated the intel sst driver, did some googling and seems like this is a driver used for voice input, such as Cortana.

I deleted the pagefile and set it up again.
I'm now looking into the intel graphics media accelerator driver.

 

[Brech]

I'll try out the usbview tool, and post results in a few minutes. Also downloading the latest killer network driver.
I've read on fora that a lot or people are having driver problems with this killer network card!

-----------------
I ran the usbview tool, here is the report I got, not sure if this is what you need, I just got it by hitting ctrl+s:
http://gofile.me/6sfED/Dj5t7b3Cf

-----------------

Btw, I just found a forum with people reporting same dism behavior as me: https://www.tenforums.com/performance-maintenance/81413-creators-update-component-store-shows-corruption-but-unable-repair.html

Their sfc /scannow does not report any errors, however the dism /scanhealth says "the component store is repairable" and none of the dism /restore commands work, reporting that "the source files could not be found". This is exactly the same behavior as I am experiencing with these commands. Maybe it does indeed have something to do with this build?

UPDATE: seems there is indeed something wrong with the dism command in the current build:

Spoiler

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/dism-problem-to-repair-image-after-upgrading-to/c9bce512-232a-4fc2-97d0-1c417248ca88 / https://social.technet.microsoft.com/Forums/windows/en-US/44505e80-8b44-400e-be6f-2d95b8a7805e/dism-problem-to-repair-image-after-upgrading-to-1703-enterprise?forum=win10itprosetup

And apparently, here is the cause: http://borncity.com/win/2017/04/26/windows-10-v1703-fix-for-dism-error-0x800f081f/

UPDATE2: I followed the fix on http://borncity.com/win/2017/04/26/windows-10-v1703-fix-for-dism-error-0x800f081f for the dism command problem, and it worked, so I'm glad that has been resolved now. Both sfc /scannow and dism /scanhealth report no errors now!

 

[johnbl]

looks like there is a usb device that has issues running with the microsoft generic USB driver.

Child Device 1 : USB Video Device
Device ID : USB\VID_0C45&PID_6713&MI_00\6&4851259&0&0000
idVendor : 0x0C45 (Sonix Technology Co., Ltd.)
idProduct : 0x6713

bFunctionProtocol : 0x00 (PC_PROTOCOL_UNDEFINED protocol)
----------------- Unknown Descriptor ------------------
bLength : 0x28 (40 bytes)
bDescriptorType : 0xFF
Data (HexDump) : 28 FF 42 49 53 54 00 01 06 01 10 00 00 00 00 00
D1 10 F4 01 D2 11 F4 01 D3 12 F4 01 D4 13 F4 01
D5 14 F4 01 D6 15 F4 01



I would disable the built in webcam and see if it helps. (or look for a BIOS update and custom USB drivers for the webcam)

generally when you see fields set to zero or FF it turns out to be that a device needs a custom driver from the hardware vendor.
(sometimes the support is done in BIOS and in a custom driver)

 

[Brech]

I checked the dell website, but it looks like I got the latest bios (v 1.2.4) installed.
I disabled the integrated webcam in device manager, is that enough or should I do something else too?

 

[johnbl]

you might have to disable it in BIOS or install a custom driver from the dell website.
i just don't know. I think it might be ok to disable the device and reboot but the hardware might still be responding some other hardware signals.

I checked the dell website, but it looks like I got the latest bios (v 1.2.4) installed.
I disabled the integrated webcam in device manager, is that enough or should I do something else too?

 

[Brech]

Okay, I will try that out! Anyway, the system seems a lot more stable already, it's been a few days without a bsod.
So the other fixes probably helped!

you might have to disable it in BIOS or install a custom driver from the dell website.
i just don't know. I think it might be ok to disable the device and reboot but the hardware might still be responding some other hardware signals.

I checked the dell website, but it looks like I got the latest bios (v 1.2.4) installed.
I disabled the integrated webcam in device manager, is that enough or should I do something else too?

 

[Brech]

Seems like the problems are all solved, I haven't gotten any bsods or other problems anymore in a few weeks.
Thanks for all the help, johnbl and colif!
Regards, Brecht

 

[Colif]

Seems like the problems are all solved, I haven't gotten any bsods or other problems anymore in a few weeks.
Thanks for all the help, johnbl and colif!
Regards, Brecht

and there was much rejoicing