BSOD Kernel Security Check Failure

1) There were multiple misbehaving drivers identified in the memory dump debugging:
a) 1 recurrent Nvidia GPU driver
b) 1 Realtek wireless LAN driver
c) 2 ESET AV drivers

2) Open administrative command prompt and type or copy and paste:
3) sfc /scannow
4) dism /online /cleanup-image /restorehealth
5) chkdsk /scan
6) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

7) Make sure that there is no over clocking during the troubleshooting process

8) Uninstall ESET using the applicable uninstall tool:
Uninstall ESET manually using the ESET uninstaller toolESET Knowledgebase
Uninstallers (removal tools) for common Windows antivirus softwareESET Knowledgebase
a) Turn on Windows defender
b) Wait 2 weeks before reinstalling ESET so that there is sufficient time to observe the Nvidia GPU drivers
and have a significant period of stability.
c) If there are BSOD after re-installing ESET AV in 2 weeks then find alternative AV software.
d) If there are no BSOD after re-installing ESET in 2 weeks then continue using the AV software.

9) Update Rtwlanu.sys using device manager and source below

10) Run memtest86+ version 5.01 for at least 8 passes. Memtest86+ - Advanced Memory Diagnostic Tool
This may take hours so plan to run it overnight.
a) Please make sure you use the Memtest86+ version 5.01 with the link below.
Memtest86+ - Advanced Memory Diagnostic Tool
The testing is done not by time but by passes.
The more passes the better.
There are a significant number of false negatives if fewer than 8 passes are made.
A false negative is a test pass when there is malfunctioning RAM.
There is 16 GB of RAM on the computer.
Memtest86+ version 5.01 testing takes approximately 1 - 2 hours /GB RAM
Just 1 error is a fail and you can abort testing.
Then test 1 RAM module at a time in the same DIMM each for 8 or more passes.
b) When Memtest86+ has completed 8 or more passes use a camera or smart phone camera to take a picture and post an image into the thread.
Memory problems. - Microsoft Community
MemTest86+ - Test RAM Windows 10 Tutorials

11) If there are any BSOD after the uninstallation of ESET and updating rtwlanu please post a new zip (beta) into the thread:
log collector v2-beta08.zip


rtwlanu.sys Tue Jan 30 19:48:54 2018 (5A712086)
nvlddmkm.sys Fri Oct 27 10:49:39 2017 (59F35593)
nvlddmkm.sys (23.21.13.8813, 16.15 MB (16,936,048 bytes), 11/9/2017 4:40 AM)
epfw.sys Wed Jan 25 06:40:04 2017 (58889CA4)
em008k_64.dll Fri Oct 27 09:15:42 2017 (59F33F8E)

rtwlanu.sys

Realtek RTLxxxxx Wireless USB 2.0 Adapter Used by different manufacturer's

http://www.realtek.com.tw/downloads/

nvlddmkm.sys

nVidia Video drivers

http://www.nvidia.com/Download/index.aspx Get from OEM for laptops

epfw.sys

ESET

Support: http://kb.eset.com/ Downloads: http://www.eset.com/int/download/home/

Code:

Name    [00000002] Realtek 8812AU Wireless LAN 802.11ac USB NICAdapter Type    Ethernet 802.3Product Type    Realtek 8812AU Wireless LAN 802.11ac USB NICInstalled    YesPNP Device ID    USB\VID_0BDA&PID_8812\123456Last Reset    2/15/2018 9:23 PMIndex    2Service Name    RtlWlanuIP Address    192.168.1.90, fe80::700f:6f36:44e4:ab96IP Subnet    255.255.255.0, 64Default IP Gateway    192.168.1.254DHCP Enabled    YesDHCP Server    192.168.1.254DHCP Lease Expires    1/2/1970 11:06 AMDHCP Lease Obtained    1/1/1970 11:06 AMMAC Address    ‪80:3F:5D:11:04:9A‬Driver    c:\windows\system32\drivers\rtwlanu.sys (1030.23.502.2017, 6.82 MB (7,147,888 bytes), 10/2/2017 8:30 PM)

Code:

rtlwlanu    Realtek Wireless LAN 802.11n USB 2.0 Network Adapter    c:\windows\system32\drivers\rtwlanu.sys    Kernel Driver    No    Manual    Stopped    OK    Normal    No    No

Code:

Name    NVIDIA GeForce GTX 760PNP Device ID    PCI\VEN_10DE&DEV_1187&SUBSYS_27683842&REV_A1\4&AAF0B89&0&0011Adapter Type    GeForce GTX 760, NVIDIA compatibleAdapter Description    NVIDIA GeForce GTX 760Adapter RAM    (1,048,576) bytesInstalled Drivers    C:\Windows\System32\DriverStore\FileRepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvldumdx.dll,C:\Windows\System32\DriverStore\FileRepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvldumdx.dll,C:\Windows\System32\DriverStore\FileRepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvldumdx.dll,C:\Windows\System32\DriverStore\FileRepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvldumdx.dllDriver Version    23.21.13.8813INF File    oem5.inf (Section022 section)Color Planes    Not AvailableColor Table Entries    4294967296Resolution    1920 x 1080 x 60 hertzBits/Pixel    32Memory Address    0xFD000000-0xFE0FFFFFMemory Address    0xF0000000-0xF9FFFFFFMemory Address    0xF8000000-0xF9FFFFFFI/O Port    0x0000E000-0x0000EFFFIRQ Channel    IRQ 24I/O Port    0x000003B0-0x000003BBI/O Port    0x000003C0-0x000003DFMemory Address    0xA0000-0xBFFFFDriver    c:\windows\system32\driverstore\filerepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvlddmkm.sys (23.21.13.8813, 16.15 MB (16,936,048 bytes), 11/9/2017 4:40 AM)

Code:

nvlddmkm    nvlddmkm    c:\windows\system32\driverstore\filerepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvlddmkm.sys    Kernel Driver    No    Manual    Stopped    OK    Ignore    No    No

Jeezus.... I might be better off just buying a new computer at this rate. I'll try to run those tests when I get home, and report back. Thanks again.

philc43 said:

I also looked at the dump file and agree that there were some indicators of other drivers possibly causing the problem.

As you have already replaced the NVidia driver I would focus on the ESET software as a possible cause first. For troubleshooting I would be inclined to remove it completely and see if it stops the BSOD events. Windows Defender will protect your PC for now.

I hope it's as simple as that. I really do. Thanks again! I'll let you know how it goes!

Ran the ESET uninstaller in safe mode, then rebooted and ran the commands as per your request. This is the result:

Microsoft Windows [Version 10.0.16299.248]
(c) 2017 Microsoft Corporation. All rights reserved.


C:\Windows\system32>sfc /scannow


Beginning system scan. This process will take some time.


Beginning verification phase of system scan.
Verification 100% complete.


Windows Resource Protection did not find any integrity violations.


C:\Windows\system32>dism /online /cleanup-image /restorehealth


Deployment Image Servicing and Management tool
Version: 10.0.16299.15


Image Version: 10.0.16299.248


[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.


C:\Windows\system32>chkdsk /scan
The type of the file system is NTFS.


Stage 1: Examining basic file system structure ...
196864 file records processed.
File verification completed.
4596 large file records processed.
0 bad file records processed.


Stage 2: Examining file name linkage ...
1282 reparse records processed.
264314 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
1282 reparse records processed.


Stage 3: Examining security descriptors ...
Security descriptor verification completed.
33726 data files processed.
CHKDSK is verifying Usn Journal...
40356760 USN bytes processed.
Usn Journal verification completed.


Windows has scanned the file system and found no problems.
No further action is required.


124470271 KB total disk space.
55418800 KB in 144449 files.
105436 KB in 33727 indexes.
0 KB in bad sectors.
307943 KB in use by the system.
65536 KB occupied by the log file.
68638092 KB available on disk.


4096 bytes in each allocation unit.
31117567 total allocation units on disk.
17159523 allocation units available on disk.


C:\Windows\system32>

Things seemed to be going fine as it ran for nearly an hour. I went to go make a snack, and came back to another BSOD.

The Device Manager insists that the Realtek wireless adapter already has the "best driver," and won't let me install the one from the Realtek site.

I'm going to have to run Memtest 86+ after all, sadly. Unless you have any other suggestions I can try first?

Attachment 177719

I keep getting an error with Memtest86+. I'm trying to create a bootable USB loader, but I keep getting an error regarding syslinux and says the drive won't be bootable. What do I do?

Nevermind, I got it running. I just used a Linux Mint USB instead. The test is now running.

Some of the latest bugchecks were:
19
139
10D

The BAD_POOL_HEADER bug check has a value of 0x00000019. This indicates that a pool header is corrupt.


The KERNEL_SECURITY_CHECK_FAILURE bug check has a value of 0x00000139. This bug check indicates that the kernel has detected the corruption of a critical data structure.

The WDF_VIOLATION bug check has a value of 0x0000010D. This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.

The latest driver is most often the best driver.
The latest version of Windows may become corrupted and in a similar fashion the latest driver may become corrupted.
When this happens the latest driver is uninstalled.
Most often a replacement with the latest driver produces a stable computer environment.
At times the latest driver may need to be rolled back to find a more stable driver.

When Memtest86+ version 5.01 has completed 8 or more passes please post an image into the thread.

After the Memtest86+ version 5.01 testing has completed the Realtek driver can be replaced.

In order to do this the Realtek driver is download to the desktop.

The computer is disconnected from the internet (wireless hardware off if available) (Ethernet,cat5e, LAN is disconnected) and if necessary a router can be disconnected.

Using device manager the driver is uninstalled and the driver on the desktop is then installed.

Doing the memory test at this point. It's been 13 and a half hours and it's on the 3rd pass? I'm not sure.

Attachment 177832

The memory test didn't finish, unfortunately. We are currently in the dark because of an issue with SMUD (our power utility provider). They said there's two lines to our area and one of them got knocked out, probably by a vehicle. I'm going to try the wireless driver replacement when we get the power on again. If that fails, guess I'm starting the memory test again.

*sigh*
Makes me wish I had an APC unit.