BSOD Kernel Security Check Failure

GuyInDogSuit · 16 Feb 2018

Been getting this ever since the last update or so. I even reinstalled Windows fresh, and it's still happening. From what I can tell it doesn't happen in safe mode or clean boot. I tried to run the driver verifier, though on reboot, nothing happened. Not sure if it did anything or not. My internet wireless adapter has also been acting up, which leads me to think it's a driver issue, though it's never done this before.

Here's my system info attached.
Attachment 177290

philc43 · 16 Feb 2018

Unfortunately, the small crash dumps are not being saved on your system. There might be a full memory dump in your c:\windows directory called memory.dmp. If you can find this please upload it into Onedrive or Dropbox or any other file share to share the file with us. Thanks!

Code:

Event[1296]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2018-02-15T08:23:35.858
  Event ID: 1001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-ASI77N6
  Description: 
The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000139 (0x0000000000000003, 0xffffb0899e2b57a0, 0xffffb0899e2b56f8, 0x0000000000000000). 
A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 9dc4ea45-6aad-4269-8941-0a8be1fff5db.

zbook · 16 Feb 2018

Please run the beta log collector and post a zip into the thread:
log collector v2-beta08.zip

The page file is currently on the D: drive.
The system driver has had problems loading with with windows on C: and the page file on D:

Drive: C:
Free Space: 74.8 GB
Total Space: 121.6 GB
File System: NTFS
Model: TOSHIBA THNSNJ128GCST

Drive: D:
Free Space: 39.1 GB
Total Space: 953.9 GB
File System: NTFS
Model: ST1000DM003-9YN162

Turn off windows fast startup:
Turn On or Off Fast Startup in Windows 10 Windows 10 Tutorials

Code:

Event[1787]:  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2018-02-15T19:24:22.707
  Event ID: 29
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-ASI77N6
  Description: 
Windows failed fast startup with error status 0xC00000D4.

Code:

Event[1002]:  Log Name: System  Source: volmgr  Date: 2018-02-14T14:08:41.407  Event ID: 45  Task: N/A  Level: Error  Opcode: N/A  Keyword: Classic  User: N/A  User Name: N/A  Computer: DESKTOP-ASI77N6  Description: The system could not sucessfully load the crash dump driver.

Code:

Event[1922]:  Log Name: System  Source: volmgr  Date: 2018-02-15T20:27:34.783  Event ID: 45  Task: N/A  Level: Error  Opcode: N/A  Keyword: Classic  User: N/A  User Name: N/A  Computer: DESKTOP-ASI77N6  Description: The system could not sucessfully load the crash dump driver.

GuyInDogSuit · 16 Feb 2018

philc43 said:

Unfortunately, the small crash dumps are not being saved on your system. There might be a full memory dump in your c:\windows directory called memory.dmp. If you can find this please upload it into Onedrive or Dropbox or any other file share to share the file with us. Thanks!

Code:

Event[1296]:
  Log Name: System
  Source: Microsoft-Windows-WER-SystemErrorReporting
  Date: 2018-02-15T08:23:35.858
  Event ID: 1001
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-ASI77N6
  Description: 
The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000139 (0x0000000000000003, 0xffffb0899e2b57a0, 0xffffb0899e2b56f8, 0x0000000000000000). 
A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 9dc4ea45-6aad-4269-8941-0a8be1fff5db.

zbook said:

Please run the beta log collector and post a zip into the thread:
log collector v2-beta08.zip

The page file is currently on the D: drive.
The system driver has had problems loading with with windows on C: and the page file on D:

Drive: C:
Free Space: 74.8 GB
Total Space: 121.6 GB
File System: NTFS
Model: TOSHIBA THNSNJ128GCST

Drive: D:
Free Space: 39.1 GB
Total Space: 953.9 GB
File System: NTFS
Model: ST1000DM003-9YN162

Turn off windows fast startup:
Turn On or Off Fast Startup in Windows 10 Windows 10 Tutorials

Code:

Event[1787]:  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2018-02-15T19:24:22.707
  Event ID: 29
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: DESKTOP-ASI77N6
  Description: 
Windows failed fast startup with error status 0xC00000D4.

Code:

Event[1002]:  Log Name: System  Source: volmgr  Date: 2018-02-14T14:08:41.407  Event ID: 45  Task: N/A  Level: Error  Opcode: N/A  Keyword: Classic  User: N/A  User Name: N/A  Computer: DESKTOP-ASI77N6  Description: The system could not sucessfully load the crash dump driver.

Code:

Event[1922]:  Log Name: System  Source: volmgr  Date: 2018-02-15T20:27:34.783  Event ID: 45  Task: N/A  Level: Error  Opcode: N/A  Keyword: Classic  User: N/A  User Name: N/A  Computer: DESKTOP-ASI77N6  Description: The system could not sucessfully load the crash dump driver.

Turned off fast startup, ran the beta scanner, uploading the memory.dmp file now. Going to take a while.
Attachment 177402

GuyInDogSuit · 16 Feb 2018

I can't seem to upload the memory.dmp file. The PC keeps crashing and forcing the upload to start over.

zbook · 17 Feb 2018

The memory dump is approximately 800 MB.
If the computer is unstable you may be able to find stability in safe mode with networking.
Hold the shift key down and restart the computer to open the advanced troubleshooting menu startup options.
Click restart and select #5 safe mode with networking.
Look for the memory dump file and then zip and post into the thread.

In the left lower corner search type: system > open system control panel > on the left pane click advanced system settings > under startup and recovery click settings > under system failure un-check automatically restart and under write debugging information make sure that it displays automatic memory dump. The dump file should display memory dump.

Iorbit has been a cause of system instability. Please uninstall this software.

The mini dump file displayed problems with symbols or corruption. So any new mini dump files will be useful so they can be debugged.

For any new BSOD dump please post a new beta log collector file into the thread.

Code:

2/15/2018 4:24 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: ffffb0899e2b57a0
P4: ffffb0899e2b56f8
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-6421-01.dmp
\\?\C:\Windows\TEMP\WER-11781-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6987.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69F6.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_22adc68e844521527af95d944b91529992403760_00000000_cab_02c06a04

Analysis symbol: 
Rechecking for solution: 0
Report Id: 9dc4ea45-6aad-4269-8941-0a8be1fff5db
Report Status: 100
Hashed bucket:2/15/2018 4:23 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: ffffb0899e2b57a0
P4: ffffb0899e2b56f8
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-6421-01.dmp
\\?\C:\Windows\TEMP\WER-11781-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6987.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69F6.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_22adc68e844521527af95d944b91529992403760_00000000_cab_02c06a04

Analysis symbol: 
Rechecking for solution: 0
Report Id: 9dc4ea45-6aad-4269-8941-0a8be1fff5db
Report Status: 4
Hashed bucket:
2/15/2018 4:17 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: ffffd80841c45540
P4: ffffd80841c45498
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-6156-01.dmp
\\?\C:\Windows\TEMP\WER-11718-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER730D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER732C.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER73BA.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_f017b7f5c867d47846862a152887be814445f8a_00000000_cab_02bc73b9

Analysis symbol: 
Rechecking for solution: 0
Report Id: 026c1444-87ee-465b-841e-9c07c8cda888
Report Status: 100
Hashed bucket:
2/15/2018 4:16 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: ffffd80841c45540
P4: ffffd80841c45498
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-6156-01.dmp
\\?\C:\Windows\TEMP\WER-11718-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER730D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER732C.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER73BA.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_f017b7f5c867d47846862a152887be814445f8a_00000000_cab_02bc73b9

Analysis symbol: 
Rechecking for solution: 0
Report Id: 026c1444-87ee-465b-841e-9c07c8cda888
Report Status: 4
Hashed bucket:
2/15/2018 2:04 AM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: fffff8022187a8d0
P4: fffff8022187a828
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021418-7500-01.dmp
\\?\C:\Windows\TEMP\WER-12203-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F94.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FD3.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6070.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_861aee108915f5bffc1983de75da54f7c7956a5_00000000_cab_02b8607f

Analysis symbol: 
Rechecking for solution: 0
Report Id: f96f669b-2d23-4fad-a99f-8eb2ab5f64dd
Report Status: 4
Hashed bucket:
2/16/2018 5:23 AM    Windows Error Reporting    Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 139
P2: 3
P3: fffff803ee47a8d0
P4: fffff803ee47a828
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-7468-01.dmp
\\?\C:\Windows\TEMP\WER-13359-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6801.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6820.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER685F.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_139_1466d5e422eb7a45c01a9bad9b2fbe544cf9f45_00000000_cab_02b8686e

Analysis symbol: 
Rechecking for solution: 0
Report Id: 88320eea-9fa4-44e4-9c9f-9b7a632e94db
Report Status: 4
Hashed bucket:

Code:

2/15/2018 5:05 PM    Windows Error Reporting    Fault bucket 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 66947067-c830-427d-8d2b-c80ebbfcbd9c

Problem signature:
P1: 139
P2: 3
P3: ffffb0899e2b57a0
P4: ffffb0899e2b56f8
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-6421-01.dmp
\\?\C:\Windows\TEMP\WER-11781-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6987.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69A6.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER69F6.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_139_22adc68e844521527af95d944b91529992403760_00000000_cab_0aa9e6b1

Analysis symbol: 
Rechecking for solution: 0
Report Id: 9dc4ea45-6aad-4269-8941-0a8be1fff5db
Report Status: 268435556
Hashed bucket:2/15/2018 2:04 AM    Windows Error Reporting    Fault bucket 0x139_3_CORRUPT_LIST_ENTRY_nt!KiRetireDpcList, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 00842db2-075f-4521-9f13-83e8d7d7ec80

Problem signature:
P1: 139
P2: 3
P3: fffff8022187a8d0
P4: fffff8022187a828
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021418-7500-01.dmp
\\?\C:\Windows\TEMP\WER-12203-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F94.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FD3.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6070.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_139_861aee108915f5bffc1983de75da54f7c7956a5_00000000_cab_16209683

Analysis symbol: 
Rechecking for solution: 0
Report Id: f96f669b-2d23-4fad-a99f-8eb2ab5f64dd
Report Status: 268435456
Hashed bucket:
2/16/2018 5:23 AM    Windows Error Reporting    Fault bucket 0x139_3_CORRUPT_LIST_ENTRY_nt!KiRetireDpcList, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 74989b95-7832-41c1-9b66-bac849575ad6

Problem signature:
P1: 139
P2: 3
P3: fffff803ee47a8d0
P4: fffff803ee47a828
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-7468-01.dmp
\\?\C:\Windows\TEMP\WER-13359-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6801.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6820.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER685F.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_139_1466d5e422eb7a45c01a9bad9b2fbe544cf9f45_00000000_cab_17408e07

Analysis symbol: 
Rechecking for solution: 0
Report Id: 88320eea-9fa4-44e4-9c9f-9b7a632e94db
Report Status: 268435456
Hashed bucket:
2/15/2018 4:19 PM    Windows Error Reporting    Fault bucket 0x139_3_CORRUPT_LIST_ENTRY_storport!RaidUnitCompleteRequest, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 714a2bd8-fc5b-4673-b342-94b505713d83

Problem signature:
P1: 139
P2: 3
P3: ffffd80841c45540
P4: ffffd80841c45498
P5: 0
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\Minidump\021518-6156-01.dmp
\\?\C:\Windows\TEMP\WER-11718-0.sysdata.xml
\\?\C:\Windows\MEMORY.DMP
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER730D.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER732C.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER73BA.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_139_f017b7f5c867d47846862a152887be814445f8a_00000000_cab_175f3dd5

Analysis symbol: 
Rechecking for solution: 0
Report Id: 026c1444-87ee-465b-841e-9c07c8cda888
Report Status: 268435556
Hashed bucket:

Code:

2/14/2018 8:13 PM    Windows Error Reporting    Fault bucket LKD_0x15E_MINI_StuckOID_D010310_wdiwifi!MPWrapperOidRequest, type 0
Event Name: LiveKernelEvent
Response: Not available
Cab Id: 737a745b-16d1-437c-aaf7-87c8e4cb4d70

Problem signature:
P1: 1000015e
P2: 25
P3: 23
P4: ffffb2815e4cecf8
P5: d010310
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\LiveKernelReports\NDIS\NDIS-20180214-1212.dmp
\\?\C:\Windows\TEMP\WER-36574812-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BD4.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE3.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C13.tmp.txt
\\?\C:\Windows\Temp\WER9011.tmp.WERDataCollectionStatus.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1000015e_f66a46df6e6b2f7e7691299a7f6efc7402855ca_00000000_cab_0886933d

Analysis symbol: 
Rechecking for solution: 0
Report Id: 56da43de-b9d5-4c46-a0ca-09bcc293d385
Report Status: 268435456
Hashed bucket:

Code:

2/14/2018 8:13 PM    Windows Error Reporting    Fault bucket , type 0
Event Name: LiveKernelEvent
Response: Not available
Cab Id: 0

Problem signature:
P1: 1000015e
P2: 25
P3: 23
P4: ffffb2815e4cecf8
P5: d010310
P6: 10_0_16299
P7: 0_0
P8: 256_1
P9: 
P10: 

Attached files:
\\?\C:\Windows\LiveKernelReports\NDIS\NDIS-20180214-1212.dmp
\\?\C:\Windows\TEMP\WER-36574812-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BD4.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE3.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C13.tmp.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1000015e_f66a46df6e6b2f7e7691299a7f6efc7402855ca_00000000_cab_36924c22

Analysis symbol: 
Rechecking for solution: 0
Report Id: 56da43de-b9d5-4c46-a0ca-09bcc293d385
Report Status: 4
Hashed bucket:

philc43 · 17 Feb 2018

GuyInDogSuit said:

I can't seem to upload the memory.dmp file. The PC keeps crashing and forcing the upload to start over.

It will be too large to upload here - use a file share site like OneDrive or Dropbox.

GuyInDogSuit · 17 Feb 2018

philc43 said:

It will be too large to upload here - use a file share site like OneDrive or Dropbox.

I've been trying to upload it to OneDrive, and it keeps failing because of the crashes.

philc43 · 17 Feb 2018

GuyInDogSuit said:

I've been trying to upload it to OneDrive, and it keeps failing because of the crashes.

Sorry, I misunderstood. If you have access to another computer perhaps you can copy to a USB drive and upload to OneDrive from another PC.

GuyInDogSuit · 17 Feb 2018

I have access to another computer, yes. I was thinking the same thing.

Another note: safe mode with networking is not a viable option as my wireless adapter does not work in safe mode. I tried enabling it but it doesn't even show up.
@zbook: I don't understand what you're asking me to do. Type that where?