Dump inspection for BSOD on brand new Windows 10 PC

Oct 18, 2018
13
0
10
Hi,
I built my pc some weeks ago, and since then it was working fine, until I had to open it up to install a WiFi card (Intel 9260). (I had to disassemble almost the entire computer, except for the cpu and heatsink).
After the first boot, I installed the card's driver from Intel's website.
From then, every 2nd or 3rd boot the system does, it runs in a bsod some minutes after being on
(like 5 minutes). The bsod claims to have failed to create a dump and it doesn't proceed to the automatic reboot even if specified in the settings.
The error displayed is meaningless, "power state failure".
After 2 bsod, I completely removed Intel's wireless and bluetooth drivers, and installed windows default ones, but It didn't help.
I just waited so long for my first pc and now it has a problem for which I don't even know from where to start.
I tried to inspect the miniDumps with some tools but I couldn't extrapolate anything useful.
Here they are.

Thank you
 
Solution
you would have to find out what you ran that modified the kernel and make sure it does not get run again.
if it were me, I would make a new windows install image from a known good source.
https://www.microsoft.com/en-us/software-download/windows10

then be careful about what you install, get it from the makers of the software rather than a software collection website.

find out what this driver is: HIPS64.sys and see if it should be installed
C:\Program Files\ReHIPS\HIPS64.sys Sun Jun 3 08:05:29 2018

you can google this to find info on what the hack that is installed on your machine: nt!_guard_check_icall_fptr


you can also downlaod and run usbview from here:
https://www.uwe-sieber.de/usbtreeview_e.html
to see if you are getting any...

Colif

Win 11 Master
Moderator
i will get a friend to convert those minidumps into a format I can read and we see what windows is blaming this time. Gardenman will reply but he may not be able to help, he just posting a link to the conversion file.
 
looks like a bug.

download and run autoruns from here:
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
find the entry for \SystemRoot\System32\drivers\xusb22.sys
and uncheck the check box so it does not load and reboot and see if you have a problem.

also, start cmd.exe or powershell as an admin then run
dism.exe /online /cleanup-image /restorehealth


-you could also try and put your xbox device on a usb 2 connector.

i was unable to read bios info from the memory dump. this generally means the bios should be updated.

usb problems generally require a kernel dump to debug, a mini memory dump does not contain the correct info.

the actual bugcheck was in power management routine, to debug these you would also have to change the memory dump to a kernel memory dump and provide the file c:\windows\memory.dmp
a minidump does not contain the info.

you might also be able to work around the problem by setting the system into performance mode so it does not put devices to sleep. (just a guess)

bios update and usb 3.x driver update from the motherboard vendor could also fix the problem.
(nvidia 3.1 usb ?
guess the problem is with this device:
Name: NVIDIA USB Type-C Port Policy Controller
Device ID: PCI\VEN_10DE&DEV_1AD7&SUBSYS_86671043&REV_A1\4&30C250C0&0&0300
Driver: C:\WINDOWS\system32\DRIVERS\UcmCxUcsiNvppc.sys, 1.01.0012.0831 (English),

would need the kernel memory dump to make sure.


 
Oct 18, 2018
13
0
10
I'm sorry I thought that the dump contained all the info about the pc main components:

Motherboard: Asrock Z370 extreme4, the bios is up to date, and I've installed the drivers provided by Asrock, of course I'm not currently doing any overclock
Ram: G.Skill 2x8GB ddr4 3200MHz dual channel
Cpu: Intel Core i7 8086k
Gpu: nvidia geforce rtx 2080 <-that's where the nvidia usb c is from
1 SATA3 ssd Samsung 860evo (with windows)
1 hdd

running Windows 10 Pro, a weeks-old installation, as I accidentally installed Intel optane drivers on the first one, and after seeing the condition of the os after their removal, i decided to re-do a clean install to avoid eventual complications (how funny).
As I said the system was running perfectly fine before the installation of the wireless card, I used and configured it for at least a week.

Potentially useful things worth to mention:
-The gpu drivers updated probably hours before I proceeded to install the wifi card, then, I didn't use the pc until the card installation was complete.
So, I can't tell if they where running correctly before since I simply didn't use the pc enough
-The BSOD appears *minutes* after the boot of windows. Not during the process. Up to 10 minutes after, if the pc is unused
-It *never* appeared during normal use of the pc, even after being on for hours
-I could probably say that it happens only if the pc is left untouched after windows' boot, but I'm not sure.
-It doesn't happen at every boot, maybe one every three times, or even four. But after the crash, it's unable to reboot automatically and it stucks at 100%
-I actually had an xbox 360 usb controller attached to an usb port the first two times, but not the third.

I'm going to send a more detailed dump but I didn't understand if I should select "full memory" or "kernel", or if one contains the other, I'll upload as soon as it occurs again.
I'd really really like to solve this by the "nice" way instead of going brute force with dism.
Reinstalling windows a third time is out of discussion, as I'm studying at the University and I don't have even closely enough time to rebuild everything from scratch.
I doubt something broke by itself alone anyway, It didn't even have to perform the October's update as it was already up to date.
The same installation media was succesfully used on other pcs as well.

 

gardenman

Splendid
Moderator
I think johnbl wants a Kernel dump. Choose "Kernel memory dump" from the options. After the crash, a new C:\Windows\Memory.dmp will be created. Upload it. It will likely be a rather large file, maybe a gig or larger.

I ran the minidump files through the debugger and got the following information: https://pste.eu/p/vbg2.html

File: 101818-7796-01.dmp (Oct 18 2018 - 02:05:38)
BugCheck: [DRIVER_POWER_STATE_FAILURE (9F)]
*** WARNING: Unable to verify timestamp for nvvhci.sys
Probably caused by: memory_corruption (Process: System)
Uptime: 0 Day(s), 15 Hour(s), 07 Min(s), and 06 Sec(s)

File: 101718-7562-01.dmp (Oct 17 2018 - 06:42:10)
BugCheck: [DRIVER_POWER_STATE_FAILURE (9F)]
Probably caused by: xusb22.sys (Process: System)
Uptime: 0 Day(s), 13 Hour(s), 52 Min(s), and 49 Sec(s)

File: 101718-7375-01.dmp (Oct 17 2018 - 10:42:46)
BugCheck: [DRIVER_POWER_STATE_FAILURE (9F)]
Probably caused by: xusb22.sys (Process: System)
Uptime: 0 Day(s), 3 Hour(s), 52 Min(s), and 20 Sec(s)

I can't help you with this. Wait for additional replies. Good luck.
 
usb drivers are just hidden when a device is removed. the driver still remains active

it is a bug in xusb22.sys. holding the power irp too long. you will have to remove the driver from your system, not just the device. (use the autoruns tool to get rid of the driver)

you have other issues on the system:
your nt kernel has been modified (6 corruptions)
your usb drivers logs are not in the correct format, this might indicate that the bios and usb drivers installed do not match. it looks like you have the generic microsoft drivers installed.
i would not think the bug in the xbox usb driver would cause the internal error logs to be of the incorrect format.

run cmd.exe or powershell as an admin then run
dism.exe /online /cleanup-image /restorehealth
to attempt to fix the modified kernel.
I would then run a malwarebytes scan
then check the task scheduler for a malware task.

i would also turn off virtual memory, reboot then turn it back on to get a new c:\pagefile.sys
since it looks like there is some issue with the pagefile.sys.
BUT, make sure you update the sata drivers from th emotherboard vendors website in case it is a bug in the driver.
use crystaldiskinfo.exe to read the firmware version if you have a ssd then see if there is a updated firmware.
 
Oct 18, 2018
13
0
10
..Oh
It seems it's falling all apart
How could all of that happen? I've never seen anything like that before.
Kernel modified? what could have been? And everything just broke together from one day to another..
I really haven't a clue about that usb driver, my bios is up to date, and I've installed everything relevant the motherboard's vendor
provided me, it has even an automatic driver version checker. If I uninstall it, what should take it's place exactly?
I ran all the hardware tests I could think of, everything passed correctly, both ssd and hdd. The ssd came from Amazon with the latest
firmware, I checked. All I know is that they're not running in AHCI mode, but instead in some "Intel rst premium".
The system is new and still almost empty! It has barely two weeks
I'll run dism but What the ..? All of a sudden!
I'll probably stick with those bsod for a while, I really don't that much time to look after a self-destructing pc.
If the pc is'n left alone after boot, it runs perfectly for an undetermined amount of time, good enough for me for now.

Just when I needed it the most, it just keeps going better it seems.

Thank You
 
you would have to find out what you ran that modified the kernel and make sure it does not get run again.
if it were me, I would make a new windows install image from a known good source.
https://www.microsoft.com/en-us/software-download/windows10

then be careful about what you install, get it from the makers of the software rather than a software collection website.

find out what this driver is: HIPS64.sys and see if it should be installed
C:\Program Files\ReHIPS\HIPS64.sys Sun Jun 3 08:05:29 2018

you can google this to find info on what the hack that is installed on your machine: nt!_guard_check_icall_fptr


you can also downlaod and run usbview from here:
https://www.uwe-sieber.de/usbtreeview_e.html
to see if you are getting any errors from your usb subsystem. I think it will show hidden device drivers.
autoruns is a better tool for removing them since you can just uncheck by the name to prevent the driver from loading on the next boot.

you might also be able to work around the xusb22.sys bug by going into bios and make sure that the power management does not let your usb devices/ports go to sleep. I would also go into windows control panel, find the device manager and do the same thing for the usb devices.

make sure you do install the asmedia usb drivers for your machine from the motherboard vendors website.
the configuration in the debugger was kind of unexpected.
the strange thing about the debug output from memory dump, it looked like your ASMedia ASM1074 hub was connected to your intel usb 3.1 hub. I don't know how that would be. maybe you should check the cables connecting the usb headers. (not sure)







 
Solution
Oct 18, 2018
13
0
10
I've run dism and an sfc/scannow, but they didn't found anything. Disabling xusb22 seemed to work, windows did three successful boots.
And now I can say almost for sure that the error occurs only if the pc is left untouched for a while after windows boots.
If I do something before the "timeout", then it's safe to use it until power off.
Resets performed after the bsod and reboots (via start->reboot) seem to prevent the error from appearing as well.
But now that it's disabled there's a problem: the xbox controllers aren't recognized anymore, nor the usb one, nor the "virtual" one used by the nvidia shield controller.
That's interesting

Edit 1: Oh, you've found some of reHips' files! It's a sandboxing solution I've been using lately.
It's main key point is that it shouldn't use kernel hacks, but only windows built-in features. I excluded it at the beginning because it's one of the first programs i have installed, and it didn't cause errors (well, till now at least). I uninstalled it anyway before running dism and nfc.
The asmedia drivers have been happily installed together with the other motherboard drivers
 
not having the xbox driver will prevent the bugcheck system crash but does not address the hack.
the hack was an exploit that came out in 2016. it would be nice to know what is installing it. windows 10 should call a bugcheck when it checks the kernel when the system goes idle.

when you install the drivers from here: https://www.asrock.com/MB/Intel/Z370%20Extreme4/index.asp#Download
i would not install the utilities or tools. i would not do any automatic installs using a tool from this site. these tools are pretty easy to spoof.

dism command will be your friend, hacks seem to get reinstalled from various sources over time. they also get updated for new exploits.



 
Oct 18, 2018
13
0
10
Mistery solved! Yaaaay!!
After you mentioning the xusb22 driver, known to be associated with the xbox 360 controller, I drove my attention on the Nvidia Shield controller. You see, that device is an Android usb/Bluetooth controller that works on Windows via GeForce Now, by creating a twin virtual "Xbox 360 controller", that somehow is mapped to the "Nvidia controller".
Before installing the wireless card I used it with the USB cable only, I needed the card to use Bluetooth. Well it turns out that the Nvidia controller causes bsods if used through Bluetooth.
Weird combination of conditions.
By reading the forum I was almost laughing by seeing everyone accusing the same identical symptoms but in a context so different.
Well, it seem that's it's up to Nvidia from now on, thank you all!

Thanks for the driver tools and asmedia tips too, it could be that I've accidentally connected the case's USB ports to a connector reserved to asmedia ports, I'll check on the manual
 
the only people that got the files deleted were the ones that had a registry setting/ group policy to delete their docs when they reached a certain age. most users would never have that setting. microsoft screwed up the age calculation and deleted the files early.




 
some corporations do not want their users to keep documents for a long time. when they get sued they might have to provide them so they set a policy not to keep temp documents for more than 30 days. This is a way of enforcing that.
that way they know they only have to look in certain spots for old documents for discovery and they can just point to the policy about deleting the docs in other places and not have to look docs older than a certain date.

the users generally work around the policy by moving their docs to thumb devices anyway.

you also get rid of backups on a schedule to protect the company during law suits.