Windows 10: BSOD and I think Defender is the problem. Can someone confirm?

Hi Nags,

It's been a little over 4 months since your last postings.
The logs reported possible drive corruption and bad blocks.
There were 15 bsod mini dump files debugged which indicated 3 misbehaving drivers.

1) open administrative command prompt and type or copy and paste:
2) sfc /scannow
3) dism /online /cleanup-image /restorehealth
4) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread
5) Run memtest86+ version 5.01 for at least 8 runs.
This may take many hours so plan to run it overnight.Memtest86+ - Advanced Memory Diagnostic Tool
When Memtest86+ has completed 8 or more runs use a camera or smart phone camera to take a picture and post an image into the thread.
Microsoft Community
MemTest86+ - Test RAM Windows 10 BSOD Tutorials
6) run one of the SMART tests on your drives:


CrystalDiskInfo - Software - Crystal Dew World:


Download Center - Crystal Dew World


CrystalDiskMark - Software - Crystal Dew World


Software - Crystal Dew World


HD Tune: HD Tune website


Hard Disk Sentinel - HDD health and temperature monitoring: Hard Disk Sentinel - HDD health and temperature monitoring


When the SMART test has completed open the Microsoft snipping tool and make images of the results to post into the thread.
Take Screenshot in Windows 10 Windows 10 General Tips Tutorials


check the health,
scan for errors, no quick scan but full scan
run a benchmark.


It may take some time, but please take the time you need to perform it properly.
When above is done please make screenshots of the following
the health,
the error scan,
the benchmark incl. following
transfer rate,
access time,
burst rate,
cpu usage.
Take Screenshot in Windows 10 Windows 10 General Tips Tutorials

7) Open the Dell website > enter serial or product number with operating system > view all of the available drivers > look for these drivers:


dnelwf64.sys DNE LightWeight Filter
VBoxDrv.sys VirtualBox Service
Netwsw00.sys Intel(R) Wireless

If any of the drivers are not available on the Dell website then use the blue links below.

Once the replacement drivers are available use device manager or control panel to uninstall the malfunctioning drivers and then install the new drivers.



Code: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: C:, DeviceName: \Device\HarddiskVolume3.(The request failed due to a fatal device hardware error.)[/quote] Code: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: C:, DeviceName: \Device\HarddiskVolume3.[/quote] Code: The IO operation at logical block address 0x15aab030 for Disk 0 (PDO name: \Device\0000003a) failed due to a hardware error.[/quote] Code: The IO operation at logical block address 0x14f0b750 for Disk 0 (PDO name: \Device\0000003a) failed due to a hardware error.[/quote] Code: The IO operation at logical block address 0x248b238 for Disk 0 (PDO name: \Device\0000003b) failed due to a hardware error.[/quote] Code: The IO operation at logical block address 0x248b238 for Disk 0 (PDO name: \Device\0000003b) failed due to a hardware error.[/quote] Code: Event[9971]: Log Name: System Source: Microsoft-Windows-Ntfs Date: 2017-08-14T11:26:18.573 Event ID: 140 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-21-2708557431-859290861-3772443289-1001 User Name: Nags-XPS\Nagarjunam Computer: Nags-XPS Description: The system failed to flush data to the transaction log. Corruption may occur in VolumeId: C:, DeviceName: \Device\HarddiskVolume3.(The request failed due to a fatal device hardware error.)[/quote] Code: Event[9925]: Log Name: System Source: Disk Date: 2017-08-12T17:52:55.634 Event ID: 154 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Nags-XPS Description: The IO operation at logical block address 0x2260b80 for Disk 0 (PDO name: \Device\0000003b) failed due to a hardware error.[/quote] Code: Event[9833]: Log Name: System Source: Microsoft-Windows-Kernel-PnP Date: 2017-08-11T19:44:25.199 Event ID: 219 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: Nags-XPS Description: The driver \Driver\cyhid failed to load for the device {DB743776-404E-4E3B-A236-15BF7E87353A}\HID_DEVICE\5&e0d7f91&0&00.[/quote] Code: Event[9688]: Log Name: System Source: Microsoft-Windows-DNS-Client Date: 2017-08-09T15:58:18.005 Event ID: 8019 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-20 User Name: NT AUTHORITY\NETWORK SERVICE Computer: Nags-XPS Description: The system failed to register host (A or AAAA) resource records (RRs) for network adapterwith settings: Adapter Name : {74D70AA1-4526-4733-999C-42B5EB466DE8} Host Name : Nags-XPS Primary Domain Suffix : wfm.wegmans.com DNS server list : 172.21.18.74, 172.21.18.8 Sent update to server : 172.21.18.74:53 IP Address(es) : 172.21.44.69The reason the system could not register these RRs was because of a security related problem. The cause of this could be (a) your computer does not have permissions to register and update the specific DNS domain name set for this adapter, or (b) there might have been a problem negotiating valid credentials with the DNS server during the processing of the update request.You can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.[/quote] Code: BugCheck 154, {ffffc60ad6d14000, ffffdc816d645050, 2, 0}*** WARNING: Unable to verify timestamp for win32k.sys*** ERROR: Module load completed but symbols could not be loaded for win32k.sysProbably caused by : memory_corruption[/quote]
VBoxDrv.sys VirtualBox http://www.virtualbox.org/wiki/Downloads

Netwsw00.sys Intel® Wireless WiFi Link Adapter Intel® Support
dnelwf64.sys Citrix Deterministic Networks DNE Driver (Cisco VPM Client) NetScaler Unified Gateway - Support and Self-Help Resources

Code: NETwNs64 ___ Intel(R) Wireless ___ Intel(R) Wireless Kernel Manual Running OK TRUE FALSE 4,096 4,333,568 0 2/5/2013 2:00:21 PM C:\WINDOWS\system32\drivers\Netwsw00.sys 4,096[/quote] Code: DNE DNE LightWeight Filter DNE LightWeight Filter Kernel System Running OK TRUE FALSE 0 139,264 0 10/13/2015 2:21:22 PM C:\WINDOWS\system32\DRIVERS\dnelwf64.sys 8,192[/quote] Code: VBoxDrv VirtualBox Service VirtualBox Service Kernel System Running OK TRUE FALSE 0 606,208 0 3/15/2017 11:17:49 AM C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys 4,096[/quote]

 

Here is the output of step 2 & step 3 commands.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.15063.0

Image Version: 10.0.15063.0

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

I will complete step 4 and send later

 

Here is the rest of the information.Attachment 149157Attachment 149156Attachment 149159

- Updated Iintel drivers
- removed VirtualBox software.
- Ran Dell Detect & Update Drivers and found no new drivers

Working on the DNE software. Looking if I can uninstall it.

Let me know, if I missed anything.

 

On the drive scan please perform the visual error testing. This will take time and map all of the good and bad sectors of the drive. This can be done in the evening so that the results are available in the morning.

Open administrative command prompt and type or copy and paste: chkdsk /x /f /r
This may take many hours so plan to run overnight.
Please post the results into the thread:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials

 

Here is the output from Event Viewer



Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
505088 file records processed. File verification completed.
9010 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
608482 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered to lost and found.
Stage 3: Examining security descriptors ...
Cleaning up 2085 unused index entries from index $SII of file 0x9.
Cleaning up 2085 unused index entries from index $SDH of file 0x9.
Cleaning up 2085 unused security descriptors.
CHKDSK is compacting the security descriptor stream
Security descriptor verification completed.
51698 data files processed. CHKDSK is verifying Usn Journal...
41010528 USN bytes processed. Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
505072 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...
19437785 free clusters processed. Free space verification is complete.
Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.
No further action is required.

225707007 KB total disk space.
147148876 KB in 292241 files.
184908 KB in 51701 indexes.
0 KB in bad sectors.
622083 KB in use by the system.
65536 KB occupied by the log file.
77751140 KB available on disk.

4096 bytes in each allocation unit.
56426751 total allocation units on disk.
19437785 allocation units available on disk.

Internal Info:
00 b5 07 00 c0 3e 05 00 f0 9c 09 00 00 00 00 00 .....>..........
80 08 00 00 93 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

Please run a visual error scan on the drive using crystal disk, hd tune, or hd sentinel

 

Can you give me the exact software that I need to run from "crystal disk"? I went to the website you gave me, but I am unable to figure out what to run.

 

Here is the link to HDTune: http://www.hdtune.com/files/hdtune_255.exe

After installing and launching HDTune, select the "Error Scan" tab, and then click the "Start" button. Post a screenshot when it has finished.


Also, have you continued to have blue screen issues since repairing your filesystem with chkdsk?

 

I will run HD Tune ASAP. Yes it has already crashed once.

 

Here is the screenshot after I ran HDTune error scan.

Attachment 150284

 

Thanks for posting that, it looks like everything is ok with your drive.

Could you re-run the log collection so we can see the newest crash dumps?

 

I just got a BSOD and here are the logs.

Attachment 150313

 

nags,

What was happening before the blue screen? Did you just wake up your computer, or had it been idle for a bit of time?

Could you also please send us the output of the following command from a PowerShell prompt:

Code: Get-Disk | Select FriendlyName, Model, BusType, FirmwareVersion, IsBoot | Format-List[/quote]

 

This time, I was not on the computer when it crashed. I had the computer running the whole time when it crashed.

But, there have been instances when it crashed while I am working. Here is the output of the command.

PS C:\Users\Nagarjunam> Get-Disk | Select FriendlyName, Model, BusType, FirmwareVersion, IsBoot | Format-List


FriendlyName : LITEONIT LMT-256M3M
Model : LITEONIT LMT-256M3M
BusType : SATA
FirmwareVersion : VZDB
IsBoot : True

 

The crash dumps from the BSODs describe similar exceptions (errors):

Code: ExceptionAddress: fffff8006f8ea700 (nt!RtlDecompressBufferXpressLz+0x0000000000000060) ExceptionCode: c0000006 (In-page I/O error) ExceptionFlags: 00000000 NumberParameters: 3 Parameter[0]: 0000000000000000 Parameter[1]: 0000000023308810 Parameter[2]: 00000000c0000483Inpage operation failed at 0000000023308810, due to I/O error 00000000c0000483[/quote]
You are also continuing to get event log entries that suggest issues with your disk, such as:

Code: Event[11863]: Log Name: System Source: Disk Date: 2017-08-24T10:49:03.338 Event ID: 154 Task: N/A Level: Error Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: Nags-XPS Description: The IO operation at logical block address 0x24353e8 for Disk 0 (PDO name: \Device\0000003a) failed due to a hardware error.[/quote] Given that your SSD has passed several tests, it appears that most of the time your disk is functioning properly. However it looks like in certain circumstances something is causing I/O operations to fail entirely, as if your disk is dying or freezing up. This leads me to believe there is something more subtle going on than just disk failure, as generally we would be seeing problems during the disk tests.

From the information you just gave me about your disk, it looks like you are running a version of disk firmware that does have problems with causing the disk to freeze. Dell has released a newer version of firmware for your disk (VZDC, A02).

Here is a link to the firmware updater: LiteOn IT LMT-256M3M Solid State Drive Firmware Update Driver Details | Dell US

Notice that in the change log, Dell mentions the following: Code: - Fixed issue where SSD freezes for 30s when waking up from LPM[/quote] Note: LPM = Link Power management, this is how Windows/firmware govern power to connected devices in order to conserve energy.

I would also suggest that you disable link power management for your disk, at least temporarily.

To do this, go to "Power Options" in the Control Panel, select "High Performance" as your power plan. Then follow this guide on disabling AHCI power management.