Frequently BSOD with no memory dump file

Hi, I`m using Windows 11 23H2 (OS Build 22631.3447).

I have a Dell G15 5520 (2022), this laptop doesn`t have warranty and had the original RAM and SSD changed, it was purchased in october 2022.

In the first three/four months it was impossible to use the machine, extremely instable and Dell published several driver and firmware updates.

For work and academic reasons I removed the Windows and installed Ubuntu (doesn`t remember the version, nowadays it`s only Windows) around march 2023, I keep it until august 2023 and installed Windows 11 again.

Most of the problems were fixed by Dell, but it seems the one (annoying) thing still remains.

It`s aleatory when the system starts and in the "Task Manager" at "Perfomance" option, the disk usage is 100% (most of the time, really !!!), this is something that I noticed that is a indicator of BSOD. For months I tried to remove and update drivers, fresh Windows install, remove Alienware Command Center, everything didn`t had success.

Another thing that sometimes happens before the BSOD is the total absence of sound, even when I`m playing and the sound stops and is noticed loading problems (ex. parts of the map doesn`t load) it`s a certainty of BSOD.

I configured the Windows to create a fully dump file, but the file isn`t created. In the event viewer I have Event 161 volmgr and
Source: Kernel-Power
Event ID: 41
Level: Critical"

I arrived here searching for people with the same situation as me.

My V2 Log is here: V2 Log

Please perform the following steps:



1) Run Tuneup plus > post a share link






2) Make a new restore point:





3) Read this link on Windows Driver Verifier (WDV):

zbook said:

Please perform the following steps:



1) Run Tuneup plus > post a share link

https://www.tenforums.com/attachments/bsod-crashes-debugging/360139d1645183596-batch-files-use-bsod-debugging-tuneup_plus_log.zip

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

Batch files for use in BSOD debugging - Windows 10 Help Forums

Information This thread is for use by the BSOD team to store batch files that can be used to collect additional data, fix settings or anything else that is useful in debugging BSOD problems in Windows 10. The way I see it working is the first

www.tenforums.com

2) Make a new restore point:

Create System Restore Point in Windows 11 Tutorial

This tutorial will show you how to manually create a restore point in Windows 11. Turning on system protection for a drive allows System Restore to include the drive when restore points are created so you can undo undesired system changes by reverting to a previous point in time. System...

www.elevenforum.com

3) Read this link on Windows Driver Verifier (WDV):

Enable and Disable Driver Verifier in Windows 10

How to Enable and Disable Driver Verifier in Windows 10

www.tenforums.com

Click to expand...

Thank`s for the feedback zbook.

I followed the instructions and put the file of the Tuneup Plus here.

I created a restore point and read the link about WDV.

Plan to run WDV for 48 hours with various customized tests.

Start the tool with these settings:

a) test all non-Microsoft drivers
b) test no Microsoft drivers
c) start the testing with the 3 customized tests in the TF link

Each time the tool is restarted if there is no immediate BSOD then open administrative command prompt and copy an paste:

verifier /querysettings

Post a share link.



For any BSOD post a new V2 share link into the newest post.



During the troubleshooting WDV can run continuously in the background until the testing is modified.

zbook said:

Plan to run WDV for 48 hours with various customized tests.

Start the tool with these settings:

a) test all non-Microsoft drivers
b) test no Microsoft drivers
c) start the testing with the 3 customized tests in the TF link

Each time the tool is restarted if there is no immediate BSOD then open administrative command prompt and copy an paste:

verifier /querysettings

Post a share link.



For any BSOD post a new V2 share link into the newest post.



During the troubleshooting WDV can run continuously in the background until the testing is modified.

Click to expand...

Hi zbook,

I ran WDV several times along the past 48 hours, this is what happened:

1. Half of the times the computer got locked after I closed down the lid, and at the other half nothing happened.
2. Every time the computer got locked, there wasn`t a BSOD and no memory dump file were created.
3. The same log events described above (id: 41 and 161).

I ran a new V2 log conector, and put the results here.

1) Uninstall Kaspersky AV using the applicable uninstall tool:





2) Make sure that Microsoft defender is on



3) Perform Windows and Microsoft defender updates



4) Reboot



5) Make a new restore point



6) Restart WDV with these customized tests:

[ ] 0x00000001 Special pool.
[ ] 0x00000002 Force IRQL checking.
[ ] 0x00000008 Pool tracking.
[ ] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[ ] 0x00000100 Security checks.
[ ] 0x00000800 Miscellaneous checks.
[ ] 0x00020000 DDI compliance checking.
[ ] 0x00080000 DDI compliance checking (additional).


If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.



For any BSOD post a new V2 share link into the newest post.

zbook said:

1) Uninstall Kaspersky AV using the applicable uninstall tool:

Removal tool for Kaspersky applications (kavremover)

Overview of settings and features available in a Kaspersky application and guides on how to use them.

support.kaspersky.com

How to remove a Kaspersky application

Overview of settings and features available in a Kaspersky application and guides on how to use them.

support.kaspersky.com

2) Make sure that Microsoft defender is on



3) Perform Windows and Microsoft defender updates



4) Reboot



5) Make a new restore point



6) Restart WDV with these customized tests:

[ ] 0x00000001 Special pool.
[ ] 0x00000002 Force IRQL checking.
[ ] 0x00000008 Pool tracking.
[ ] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[ ] 0x00000100 Security checks.
[ ] 0x00000800 Miscellaneous checks.
[ ] 0x00020000 DDI compliance checking.
[ ] 0x00080000 DDI compliance checking (additional).


If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.



For any BSOD post a new V2 share link into the newest post.

Click to expand...

I separated the saturday to do the tasks you recommended.

But before I played a little bit (NFS PayBack), during the game I paused it for a few moments and I had a new feedback.

I received the following BSOD:



And I manually restarted my laptop, and noticed a new event:

"The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c9 (0x0000000000000007, 0xfffff801007923a0, 0xffffad07eff109a0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: ed5aa575-85f9-498c-8392-813684d8cf36."

Id: 1001
Source: BugCheck
Level: Error

With the dump files (MEMORY.DMP and minidump file) available in this link.

I thought could be better to post these new information before execute the tasks asked.

For any BSOD post a new V2 share link into the newest post.

V2 share link here.

1) Please make a new restore point



2) Restart WDV with these customized tests:

[ ] 0x00000001 Special pool.
[ ] 0x00000002 Force IRQL checking.
[ ] 0x00000008 Pool tracking.
[ ] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[ ] 0x00000100 Security checks.
[ ] 0x00000800 Miscellaneous checks.
[ ] 0x00020000 DDI compliance checking.
[ ] 0x00080000 DDI compliance checking (additional).


If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.



For any BSOD post a new V2 share link into the newest post.

Restore point created.
WDV executed.

The command "verifier /querysettings" returns the following:

"
Verifier Flags: 0x001a0fbb

Standard Flags:

[X] 0x00000001 Special pool.
[X] 0x00000002 Force IRQL checking.
[X] 0x00000008 Pool tracking.
[X] 0x00000010 I/O verification.
[X] 0x00000020 Deadlock detection.
[X] 0x00000080 DMA checking.
[X] 0x00000100 Security checks.
[X] 0x00000800 Miscellaneous checks.
[X] 0x00020000 DDI compliance checking.

Additional Flags:

[ ] 0x00000004 Randomized low resources simulation.
[X] 0x00000200 Force pending I/O requests.
[X] 0x00000400 IRP logging.
[ ] 0x00002000 Invariant MDL checking for stack.
[ ] 0x00004000 Invariant MDL checking for driver.
[ ] 0x00008000 Power framework delay fuzzing.
[ ] 0x00010000 Port/miniport interface checking.
[ ] 0x00040000 Systematic low resources simulation.
[X] 0x00080000 DDI compliance checking (additional).
[ ] 0x00200000 NDIS/WIFI verification.
[ ] 0x00800000 Kernel synchronization delay fuzzing.
[ ] 0x01000000 VM switch verification.
[ ] 0x02000000 Code integrity checks.

Internal Flags:

[X] 0x00100000 Extended Verifier flags (internal).

[X] Indicates flag is enabled.

Boot Mode:

Persistent

Rules:

All rules are using default settings

Extensions:

wdm: rules.all

Verified Drivers:

klupd_k4w-21-16_arkmon.sys
cm_km.sys
iastorvd.sys
klupd_k4w-21-16_klbg.sys
klbackupdisk.sys
klflt.sys
klbackupflt.sys
klif.sys
klhk.sys
klpd.sys
klgse.sys
kldisk.sys
googledrivefs31357.sys
klim6.sys
klwtp.sys
klpnpflt.sys
klkbdflt.sys
kneps.sys
tap0901.sys
nvlddmkm.sys
igdkmdn64.sys
netwtw12.sys
ialpss2_i2c_adl.sys
teedriverw10x64.sys
e2k68cx21x64.sys
iccwdt.sys
ipf_acpi.sys
klmouflt.sys
intcaudiobus.sys
ialpss2_gpio2_adl.sys
hideventfilter.sys
nvpcf.sys
dellinstrumentation.sys
kltun.sys
nvvad64v.sys
nvmoduletracker.sys
nvvhci.sys
dcdbas64.sys
dpmdriver.sys
nvhda64v.sys
intcoed.sys
rtkvhd64.sys
intcusb.sys
intcbtau.sys
intcdmic.sys
ibtusb.sys
rzdev_0084.sys
harmanfilter.sys
rzcommon.sys
dump_diskdump.sys
dump_iastorvd.sys
dump_dumpfve.sys
ipf_cpu.sys
ipf_lf.sys
kfeco11x64.sys
klupd_k4w-21-16_klark.sys
klupd_k4w-21-16_mark.sys
klids.sys
"

All non Microsoft drivers showed in the WDV list were tested, I forgot to post before but all the times WDV was executed and after "verifier /querysettings" was used, the same result was shown.

1) Please uninstall Kaspersky AV per the earlier post.

2) Create a new restore point

3) Restart WDV with these customized tests:



If there is no immediate BSOD then open administrative command prompt and copy and paste:

verifier /querysettings

Post a share link.



For any BSOD post a new V2 share link into the newest post.

rodrigoti said:

"The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c9 (0x0000000000000007, 0xfffff801007923a0, 0xffffad07eff109a0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: ed5aa575-85f9-498c-8392-813684d8cf36."

Click to expand...

I'm not sure why this hasn't been mentioned but your Stop 0xC9 bugcheck seems to have been caused by xusb22.sys which is a Xbox 360 controller driver, I've seen it cause a number of issues in the past and I don't think it is actively maintained anymore. I would strongly suggest removing the driver completely, however, you'll need to do a FRST registry search in order to find the relevant package details:

FRST Registry Search
1. Click your Start button and type in cmd.
2.After you find the Command Prompt, right click on it and select Run as Administrator.
3. Copy and paste the following into the Command Prompt:

reg load HKLM\DRIVERS C:\WINDOWS\SYSTEM32\CONFIG\DRIVERS

4. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
5. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
6. Copy and paste xusb22.sys;xusb22 into the Search box and click the Search Registry button.
7. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named SearchReg.txt.

Please follow the steps in post #12.

With the same WDV customized tests there was no recurrent BSOD displaying xbox.

That may be a false positive.

In addition, the logs reported xbox updates.

At this time uninstall Kaspersky AV and see if there are any new BSOD with the new customized tests.

All customized tests can be used again to see if there is a misbehaving driver.

xbook and x BlueRobot, thanks for the help !!!

I started the tests on saturday, and this is what happened.

I followed the instructions of post #12, and after I restarted the laptop I got around 8 BSOD of the following image:


The "rzdev_0084.sys" is related with Razer Synapse (I use a Deatheadder V2 mouse), and the laptop keep restarting with BSOD in an eternal loop.
In post #12 there is a "restore point" after the Kasperky uninstall, I had to use it to bring the laptop back from the dead.

Instead of remove Razer Synapse, I didn't select "rzdev_0084.sys" from the drivers list and repeat the the WDV tests.

Same situation as before, but now the BSOD is related with another driver from Razer Synapse "rzcommon.sys". I had to execute the same steps to bring the laptop from dead and started another WDV test, this time without checking both Razer Synapse drivers.

The machine restarted without BSOD with the following output from verifier /querysettings:

"
Verifier Flags: 0x03b4e610

Standard Flags:

[ ] 0x00000001 Special pool.
[ ] 0x00000002 Force IRQL checking.
[ ] 0x00000008 Pool tracking.
[X] 0x00000010 I/O verification.
[ ] 0x00000020 Deadlock detection.
[ ] 0x00000080 DMA checking.
[ ] 0x00000100 Security checks.
[ ] 0x00000800 Miscellaneous checks.
[ ] 0x00020000 DDI compliance checking.

Additional Flags:

[ ] 0x00000004 Randomized low resources simulation.
[X] 0x00000200 Force pending I/O requests.
[X] 0x00000400 IRP logging.
[X] 0x00002000 Invariant MDL checking for stack.
[X] 0x00004000 Invariant MDL checking for driver.
[X] 0x00008000 Power framework delay fuzzing.
[ ] 0x00010000 Port/miniport interface checking.
[X] 0x00040000 Systematic low resources simulation.
[ ] 0x00080000 DDI compliance checking (additional).
[X] 0x00200000 NDIS/WIFI verification.
[X] 0x00800000 Kernel synchronization delay fuzzing.
[X] 0x01000000 VM switch verification.
[X] 0x02000000 Code integrity checks.

Internal Flags:

[X] 0x00100000 Extended Verifier flags (internal).

[X] Indicates flag is enabled.

Boot Mode:

Persistent

Rules:

All rules are using default settings

Extensions:

ndis: rules.default

Verified Drivers:

klupd_k4w-21-16_arkmon.sys
cm_km.sys
iastorvd.sys
klupd_k4w-21-16_klbg.sys
klbackupdisk.sys
klflt.sys
klbackupflt.sys
klif.sys
klhk.sys
klpd.sys
klgse.sys
kldisk.sys
googledrivefs31357.sys
klim6.sys
klwtp.sys
klpnpflt.sys
klkbdflt.sys
kneps.sys
tap0901.sys
nvlddmkm.sys
igdkmdn64.sys
netwtw12.sys
ialpss2_i2c_adl.sys
teedriverw10x64.sys
e2k68cx21x64.sys
iccwdt.sys
ipf_acpi.sys
klmouflt.sys
intcaudiobus.sys
ialpss2_gpio2_adl.sys
hideventfilter.sys
nvpcf.sys
dellinstrumentation.sys
kltun.sys
nvvad64v.sys
nvmoduletracker.sys
nvvhci.sys
dcdbas64.sys
dpmdriver.sys
nvhda64v.sys
intcoed.sys
rtkvhd64.sys
intcusb.sys
intcbtau.sys
intcdmic.sys
ibtusb.sys
harmanfilter.sys
dump_diskdump.sys
dump_iastorvd.sys
dump_dumpfve.sys
ipf_cpu.sys
ipf_lf.sys
kfeco11x64.sys
mpksldrv.sys
ndis.sys
netadaptercx.sys
mbbcx.sys
wificx.sys
wdiwifi.sys
"
The V2 log file can be accessed here.

At the moment only the Kasperky AV was removed from the laptop and I`m using it from the restore point created after the KAV removal.

1) If possible, please temporarily uninstall these drivers: (reinstall now only if needed)


a) Razer drivers:
rzdev_0084 Razer 0084 Service c:\windows\system32\drivers\rzdev_0084.sys
rzcommon Razer Control Service c:\windows\system32\drivers\rzcommon.sys



b) harmanaudioservice Harman Audio Service c:\windows\system32\driverstore\filerepository\quantumusbaudio.inf_amd64_852f2a346c05a7cd\harmanfilter.sys



c) Kaspersky AV software



2) Make a new restore point.




3) Restart WDV with all customized tests except:


[ ] 0x00000004 Randomized low resources simulation.





4) System restore often results in the loss of dump files.

Whenever possible reboot to safe mode with command prompt to turn off WDV (verifier /reset).








RzDev_0084.sys Mon Aug 17 22:59:17 2020 (5F3B5215)

HarmanFilter.sys Thu Jan 12 00:27:52 2023 (63BFA868)

I removed all the drivers/softwares, one thing I'm not sure if it's clear for you zbook.

I remove Kasperky AV Software, but still have installed Kasperky VPN and Kasperky Password Manager.

When the laptop reboot after de WDV configuration, I received this BSOD:


After the restart proccess Windows booted normally.

V2 log file here.

rodrigoti said:

I removed all the drivers/softwares, one thing I'm not sure if it's clear for you zbook.

I remove Kasperky AV Software, but still have installed Kasperky VPN and Kasperky Password Manager.

When the laptop reboot after de WDV configuration, I received this BSOD:
View attachment 94169

After the restart proccess Windows booted normally.

V2 log file here.

Click to expand...

After these proccess the sound of the laptop is getting "metalized" and "slow-motion" when playing video...

1) If possible temporarily uninstall all Kaspersky software.


2) Uninstall:

Dell
dcdbas System Management Driver c:\windows\system32\drivers\dcdbas64.sys

Uninstall Dell support assistant


Restart WDV with the same settings.



Once the computer is stable (no BSOD) for 12 - 24 hours turn off WDV.


Then monitor the computer for 24 hours using reliability monitor.



If there are no recurrent BSOD or unexpected shutdowns and restarts then reinstall drivers as needed.

zbook said:

With the same WDV customized tests there was no recurrent BSOD displaying xbox.

That may be a false positive.

Click to expand...

These are the settings which you consistently recommend, it might be helpful if you understood the cases which they're designed to test against.

There's clearly a bug in that driver and only because it doesn't consistently occur on every run of Driver Verifier, it doesn't necessarily mean that it is a false positive, that bug will only occur when the driver attempts to complete the IRP, that's not going to happen all the time. This is one of the reasons we used to always recommend a testing period of 24-48 hours.

To give an anecdotal example, there was a bug found in some code which I wrote recently, however, this bug was only found to occur in production and only when a particular dataset was returned from the database. I guess then if you were testing that same code, you would assume that it was a false positive because it didn't happen consistently? I think you should put aside your prejudice and look at the dump files objectively.