Kernal Security Check Failure

Hi everyone,

I've looked through other threads here and elsewhere on this topic, and haven't yet found any solutions.

My system:
Windows 10 Home 10.0.19045 Build 19045
Intel Core i5-7600K 3.80 GHz
ASUS Prime Z-270-P
GeForce GTX 1060 6GB
16 GB Ram

Here's my latest minidump file: Dropbox - 071923-8687-01.dmp - Simplify your life

Starting three days ago, I've been getting BSODs with the message "KERNAL SECURITY CHECK FAILURE." It happens more-or-less regardless of what I'm doing on the system at a given time, but usually happens after 10-25 minutes of startup.

I've looked through the web and various forums and taken the following actions :
- loaded a previous restore point (unfortunately my oldest automatically created point is after the error started so this isn't useful
- fully updated Windows (FYI, I cannot upgrade to Win 11. I successfully enabled TPM 2 on my mobo but my processor is apparently incompatible)
- checked that I was on the most recent BIOS firmware
- updated GPU drivers, checked to see if any other components required updated drivers and did my best to update them all
- ran MdSched and allowed it to do its thing. System went through it and provided my with no follow-up messages so I assume it was fine (I could be wrong)
- ran sfc /scannow. The first time I did this it did in fact find a few errors and fixed them. BSOD continued. I then later ran it again and found now errors
- ran chkdsk /f /r /x and found now errors
- tried to run the blue screen troubleshooter, but it only shows "No recommended troubleshooters right now" and doesn't provide any options.
- first disabled Avast Free antivirus. This at first seemed to work! But a couple days later (yesterday), I got another BSOD. I then completely uninstalled it and it worked again for the whole day. Finally, today I have once again had two BSODs.

At this point, I need help from y'all. the link to my dump file is above. I definitely don't have the skills to analyze it so appreciate the assistance!

When you uninstalled Avast did you use the specialised uninstall tool provide by Avast? I suggest you download and run that tool now to be sure Avast is fully uninstalled.

Can you also please follow the BSOD posting instructions and upload the V2 log collector output.

Thanks. Apologies for missing the BSOD instructions. Here is the V2 log ouput file: Dropbox - DESKTOP-RFT55CV-(2023-07-19_10-52-17).zip - Simplify your life

I did not in fact use the bespoke uninstaller from Avast (just did add/remove programs). I will do so now.

There's nothing obvious in the dumps - which are all identical. In your System log however are a very large number of these errors...

Code:

Event[173]:
  Log Name: System
  Source: disk
  Date: 2023-06-20T14:36:38.7680000Z
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: DESKTOP-RFT55CV
  Description: 
The device, \Device\Harddisk1\DR1, has a bad block.

I would expect Harddisk1 to be the system drive, so I suggest you download the WD Digital Dashboard. Use that to check the SMART data for the drive and run any diagnostics there may be.

Hmmmm, I'm not sure what Harddisk1 is. It could be the system drive, but that drive (C:) is a SSD so I'm not sure if they'd call it "Harddisk" in this context. I do have a couple other internal drives, that are in fact hard drives, but they're for document storage and backup purposes so I'd be surprised if they could cause this kind of problem.

In any case, I did run the WD Digital Dashboard full SMART scan on my C drive. It didn't detect anything. This is the SMART Data it has for that drive:

ID Name Value Threshold Health
5 Reassigned NAND Block Count 0 None N/A
9 Power On Hours 29787 None N/A
12 Drive Power Cycle Count 2554 None N/A
165 SLC Block Erase Count 3195845612305 None N/A
166 Minimum P/E Cycles (TLC) 11 None N/A
167 Maximum Bad Blocks per Die 31 None N/A
168 Maximum P/E Cycles (TLC) 62 None N/A
169 Total Bad Blocks 382 None N/A
170 Grown Bad Block Count 0 None N/A
171 Program Fail Count 0 None N/A
172 Erase Fail Count 0 None N/A
173 Average P/E Cycles (TLC) 36 None N/A
174 Unexpected Power Loss Count 64 None N/A
184 End-to-end Error Detection/Correction Count 0 None N/A
187 Reported Uncorrectable Errors 0 None N/A
188 Command Timeout Count 3 None N/A
194 Temperature 100.4ºF | 38ºC 70 N/A
199 CRC Error Count 0 None N/A
230 Media Wearout Indicator 13.94% None N/A
232 Available Reserve Space 100% 4% N/A
233 NAND GB Written TLC 17990 None N/A
234 NAND GB Written SLC 52991 None N/A
241 Total GB Write 38059 None N/A
242 Total GB Read 35016 None N/A
244 Temperature Throttle Status 0 None N/A

Following a post I found elsewhere I'm now going to run a few Driver Verifier tests to see if those create any useful dumps.

Any storage device is called a Harddisk. I don't think you can ignore those errors, you need to check all your drives. At a minimum I would suggest you run a chkdsk /f command on the SSDs and a chkdsk /r on the HDDs.

Driver Verifier isn't a bad idea at all, but it needs to be run with the right options. To enable Driver Verifier do the following:

1. Take a System Restore point and/or take a disk image of your system drive (with Acronis, Macrium Reflect, or similar). It is possible that Driver Verifier may BSOD a driver during the boot process (some drivers are loaded during boot). If that happens you'll be stuck in a boot-BSOD loop.

If you should end up in a boot-BSOD loop, boot the Windows installation media and use that to run system restore and restore to the restore point you took, to remove Driver Verifier and get you booting again. Alternatively you can use the Acronis, Macrium Reflect, or similar, boot media to restore the disk image you took.

Please don't skip this step. it's the only way out of a Driver Verifier boot-BSOD loop.

2. Start the Driver Verifier setup dialog by entering the command verifier in either the Run command box or in a command prompt.

3. On that initial dialog, click the radio button for 'Create custom settings (for code developers)' - the second option - and click the Next button.

4. On the second dialog check (click) the checkboxes for the following tests...

• Special Pool
• Force IRQL checking
• Pool Tracking
• Deadlock Detection
• Security Checks
• Miscellaneous Checks
• Power framework delay fuzzing
• DDI compliance checking

Then click the Next button.

5. On the next dialog click the radio button for 'Select driver names from a list' - the last option - and click the Next button.

6. On the next dialog click on the 'Provider' heading, this will sort the drivers on this column (it makes it easier to isolate Microsoft drivers).

7. Now check (click) ALL drivers that DO NOT have Microsoft as the provider (ie. check all third-party drivers).

8. Then, on the same dialog, check the following Microsoft drivers (and ONLY these Microsoft drivers)...

• Wdf01000.sys
• ndis.sys
• fltMgr.sys
• Storport.sys

9. Now click Finish and then reboot. Driver Verifiier will be enabled.

Be aware that Driver Verifier will remain enabled across all reboots and shutdowns. It can only be disabled manually.

Also be aware that we expect BSODs. Indeed, we want BSODs, to be able to identify the flaky driver(s). You MUST keep all minidumps created whilst Driver Verifier is running, so disable any disk cleanup tools you may have.

10. Leave Driver Verifier running until you have between 5 and 10 BSODs/dumps, or for 24 hours. Use your PC as normal during this time, but do try and make it BSOD. Use every game or app that you normally use, and especially those where you have seen it BSOD in the past.

11. To turn Driver Verifier off enter the command verifier /reset in either Run command box or a command prompt and reboot.

Should you wish to check whether Driver Verfier is enabled or not, open a command prompt and enter the command verifier /query.

12. When Driver Verifier has been disabled, navigate to the folder C:\Windows\Minidump and locate all .dmp files in there that are related to the period when Driver Verifier was running (check the timestamps). Zip these files up (using the Windows built-in zip tool) and upload that zip file to here.

OK, trying this post again. I got a BSOD (Kernal again) while typing and lost quite a bit of progress. Going to post in two parts

- Re: checking the drives. WD Dashboard recognizes two of the drives (the system drive and one backup - not the document drive - and found no errors.

I'm currently running a chkdsk /r on the documents drive. I got a BSOD midway the last attempt so let's see what happens...

I did a chkdsk /f on the system drive a few days ago (post BSOD's) and got no errors. Can do another after other diagnostics are done.

Re: Minidumps - any idea why it wouldn't be collecting new minidump files? I have had a few BSODs in the past few hours ago and it hasn't created new ones. Here are my minidump settings:

In Startup and Recovery:
- Windows 10
- Time to Display list is checked (30 seconds)
Write an event to the system log is checked
Write debugging information: Automatic memory dump
- Dump file: %SystemRoot$\Minidump
- all other boxes are unchecked. "Overwrite any existing file" had been previously checked but I recently unchecked it worrying that it was a problem.

I also uninstalled CCleaner because I was worried it was automatically nuking them. The most recent .dmp file is from around 8 hours ago, this is despite me getting something like 4 BSODs since then.

Will follow up in a subsequent post about the Verifier runs I've done.

- - - Updated - - -

OK, regarding Verifier, here's what I've experienced thus far:

- following advice I found online, a few days ago I ran verifier with a few things checked on the list off tests and all non-Microsoft drivers selected. Booted normally and got a BSOD pretty soon after, "Driver Verifier iomanager violation". Didn't know how to harvest minidumps at the time (still don't, see above) so didn't know what to do after that. so disabled.
- Before I saw your post above, I tried another Verifier run. For this one, following a post on the microsoft board, I enabled all tests, and ran the test only on non-microsoft drivers. I got as far as the second screen of my ASUS motherboard (right after the one that lets be get into the BIOS), right before Windows launches. Froze there (no actual BSOD). Disabled from safe mode (/reset)
- I then did exactly as you suggested. This time, I got an actual BSOD before Windows launched: "Bad Pool Caller wdf01000.sys", which I notice is one of the microsoft drivers. It happened a few times and I sent it to safe mode and /reset. I'll note again that it did not create a dump file for these BSODs

In order to produce dumps ALL of the following must be true...

• The page file must be on the same drive as your operating system
• Set page file to 'system managed', it must be on the OS drive
• Set system crash/recovery options to "Automatic memory dump"
• Windows Error Reporting (WER) system service should be set to MANUAL
• User account control must be running.

Sometimes SSD drives with older firmware do not create dumps (update firmware)
Cleaner applications like Ccleaner delete DMP files so don't run them until you are fixed.
Bad RAM may prevent the data from being saved and written to the dump file on reboot.

1) Run Tuneup plus > post images or share links into this thread using one drive, drop box, or google drive


https://www.tenforums.com/attachment...p_plus_log.bat


2) Run HD Tune (free or trial version) (all drives)
HD Tune website
Post images or share links for result on these tabs:

a) Health
b) Benchmark
c) Full error scan


3) Run Sea Tools for Windows long generic test > post images or share links into this thread using one drive, drop box, or google drive

https://www.seagate.com/content/dam/...00869623_B.pdf

https://www.seagate.com/content/dam/...sInstaller.exe


4) Upgrade the BIOS: 1002 > 1205

PRIME Z270-P - Support

Code:

Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.

ubuysa said:

In order to produce dumps ALL of the following must be true...

• The page file must be on the same drive as your operating system
• Set page file to 'system managed', it must be on the OS drive
• Set system crash/recovery options to "Automatic memory dump"
• Windows Error Reporting (WER) system service should be set to MANUAL
• User account control must be running.

Sometimes SSD drives with older firmware do not create dumps (update firmware)
Cleaner applications like Ccleaner delete DMP files so don't run them until you are fixed.
Bad RAM may prevent the data from being saved and written to the dump file on reboot.

OK, I've gone through all of this:
- Page file is on C (same as Minidump folder)
- Page file is "system managed"
- "Automatic memory dump" has been enabled.
- WER is set to manual
- User account control is running, (setting is 2nd from the top)
- CCleaner was uninstalled.
- Just did the windows memory check app for the second time. Didn't appear to find any errors
- The SSD is another issue... I do in fact have a firmware update I could do. The ASUS website notes that updating the firmware could wipe the drive so I'm trying to put that last piece off as long as I can.

- - - Updated - - -

zbook said:

1) Run Tuneup plus > post images or share links into this thread using one drive, drop box, or google drive


https://www.tenforums.com/attachment...p_plus_log.bat


2) Run HD Tune (free or trial version) (all drives)
HD Tune website
Post images or share links for result on these tabs:

a) Health
b) Benchmark
c) Full error scan


3) Run Sea Tools for Windows long generic test > post images or share links into this thread using one drive, drop box, or google drive

https://www.seagate.com/content/dam/...00869623_B.pdf

https://www.seagate.com/content/dam/...sInstaller.exe


4) Upgrade the BIOS: 1002 > 1205

PRIME Z270-P - Support

Code:

Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.

Thank you for your help with this. I've tried to do as much of this as possible today.

Here is a .zip with much of what you've suggested: Dropbox - System test results 7-20-23.zip - Simplify your life. In there is:
- the results from Tuneup Plus
- The HD Tune Health and Benchmark tests for all four drives in the mix, as well as one full error scan (the others are taking forever and I will upload later)

SeaTools has also been running for a few hours and I'll leave it going overnight. So far the system drive looks clear.

Tomorrow I'll post more, most likely the SeaTools results and at least one more HDTune full drive scan. I'll get to the BIOS upgrade as soon as I can.

- - - Updated - - -

Here's a little more https://www.dropbox.com/scl/fo/cczqb...hbqq36hbg&dl=0 though I'm not sure how useful it is.

I did find one of my drives had some bad sectors and coulnd't run the SeaTools scan at all. I'm junking it (it was just a layer of redundancy)

still no minidumps being created (got one BSOD today)