none
BSOD Kernel_Security_Check_Failure Win 8.1 RRS feed

  • Question

  • About 1 month ago I just solved my other BSOD issue and now there's another one. Damn you DJ Khaled. This started happening about 3 days ago. Anyways, here are my dump files

    https://mega.nz/#!9sxhzBCK!4NRaAeyVkHj7NBv0DBDqd-RxHD6ToMQ2JfToFUfWq98

    Happen this morning trying to edit a video in premiere pro

    https://mega.nz/#!tgJgUbBB!pwmSc_5mdbzM5eaKvdA1952FPoqQXPh3bLzCzizO9Q0

    Happened an hour ago trying to browse on Firefox.




    Thursday, December 24, 2015 6:02 PM

Answers

  • I did the SFC and had some issues but DISM fixed those and ran SFC again detected no issues. I finally got memtest to work and did 11 passes all had no errors detected. What could be the issue then?


    Fixed it. I first did device manager and searched for driver updates but it said they were all up to date but I don't rely much on that so did some research and found Driver pack (Create a restore point just in case). I updated some drivers (not all) then reinstalled the software to test if it worked and wala. Anyways, thanks for the help. If I get any issues expect me right back.


    Tuesday, December 29, 2015 6:35 PM

All replies

  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Thursday, December 24, 2015 8:20 PM
    Moderator
  • Alright here's the dump file driver verifier gave me

    https://mega.nz/#!h0w3lS6b!f-k4YdodUz5bmSBrKGGVouJO-MP8bCqjRQQv_CT-LOI

    Thursday, December 24, 2015 8:53 PM
  • Driver verified and Related to 000.fcl CyberLink FCL Driver from Cyberlink Corp.  I would remove it

    Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\122415-15734-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 8.1 Kernel Version 9600 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 9600.18146.amd64fre.winblue_ltsb.151121-0600
    Machine Name:
    Kernel base = 0xfffff803`f6e1a000 PsLoadedModuleList = 0xfffff803`f70ee630
    Debug session time: Thu Dec 24 15:43:52.270 2015 (UTC - 5:00)
    System Uptime: 0 days 0:01:21.036
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...................................................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck C4, {f6, 4, ffffe0014c788080, fffff80190bc0e2f}
    
    *** WARNING: Unable to verify timestamp for 000.fcl
    *** ERROR: Module load completed but symbols could not be loaded for 000.fcl
    Probably caused by : 000.fcl ( 000+1e2f )
    
    Followup:     MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
    A device driver attempting to corrupt the system has been caught.  This is
    because the driver was specified in the registry as being suspect (by the
    administrator) and the kernel has enabled substantial checking of this driver.
    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
    be among the most commonly seen crashes.
    Arguments:
    Arg1: 00000000000000f6, Referencing user handle as KernelMode.
    Arg2: 0000000000000004, Handle value being referenced.
    Arg3: ffffe0014c788080, Address of the current process.
    Arg4: fffff80190bc0e2f, Address inside the driver that is performing the incorrect reference.
    
    Debugging Details:
    ------------------
    
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    BUILD_VERSION_STRING:  9600.18146.amd64fre.winblue_ltsb.151121-0600
    
    SYSTEM_MANUFACTURER:  Micro-Star International Co., Ltd.
    
    SYSTEM_PRODUCT_NAME:  GT70 2PC
    
    SYSTEM_SKU:  To be filled by O.E.M.
    
    SYSTEM_VERSION:  REV:0.C
    
    BIOS_VENDOR:  American Megatrends Inc.
    
    BIOS_VERSION:  E1763IMS.50W
    
    BIOS_DATE:  05/02/2014
    
    BASEBOARD_MANUFACTURER:  Micro-Star International Co., Ltd.
    
    BASEBOARD_PRODUCT:  MS-1763
    
    BASEBOARD_VERSION:  REV:0.C
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: f6
    
    BUGCHECK_P2: 4
    
    BUGCHECK_P3: ffffe0014c788080
    
    BUGCHECK_P4: fffff80190bc0e2f
    
    BUGCHECK_STR:  0xc4_f6
    
    CPU_COUNT: 8
    
    CPU_MHZ: aea
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 3c
    
    CPU_STEPPING: 3
    
    CPU_MICROCODE: 6,3c,3,0 (F,M,S,R)  SIG: 1A'00000000 (cache) 1A'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    PROCESS_NAME:  audiodg.exe
    
    CURRENT_IRQL:  0
    
    ANALYSIS_SESSION_HOST:  DESKTOP-CIVFBSU
    
    ANALYSIS_SESSION_TIME:  12-24-2015 07:17:14.0431
    
    ANALYSIS_VERSION: 10.0.10586.567 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff803f74996b0 to fffff803f6f688a0
    
    STACK_TEXT:  
    ffffd000`35918018 fffff803`f74996b0 : 00000000`000000c4 00000000`000000f6 00000000`00000004 ffffe001`4c788080 : nt!KeBugCheckEx
    ffffd000`35918020 fffff803`f749efa0 : ffffe001`4c788080 00000000`00000000 ffffe001`00000000 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
    ffffd000`35918060 fffff803`f7348141 : 00000000`00000000 ffffe001`42fa7c60 ffffd000`359184a0 ffffe001`4c78a080 : nt!VfCheckUserHandle+0x1b8
    ffffd000`35918140 fffff803`f71c4775 : 00000000`00000000 ffffd000`00000000 ffffe001`42fa7c60 fffff803`f71c4700 : nt! ?? ::NNGAKEGL::`string'+0xaa11
    ffffd000`359181e0 fffff803`f71e252f : 00000000`00000000 ffffd000`359184a0 00000000`00000010 fffff803`f71efe90 : nt!ObReferenceObjectByHandle+0x25
    ffffd000`35918230 fffff803`f6f740b3 : 1a100001`059bc001 ffffd000`35918400 fffff803`f716fdc0 00000000`00000000 : nt!NtQueryInformationFile+0x19f
    ffffd000`359183b0 fffff803`f6f6c520 : fffff801`90bc0e2f ffffd000`359186c8 00000000`0000003e 00000000`000011a0 : nt!KiSystemServiceCopyEnd+0x13
    ffffd000`359185b8 fffff801`90bc0e2f : ffffd000`359186c8 00000000`0000003e 00000000`000011a0 00000000`00000000 : nt!KiServiceLinkage
    ffffd000`359185c0 ffffd000`359186c8 : 00000000`0000003e 00000000`000011a0 00000000`00000000 fffff803`00000005 : 000+0x1e2f
    ffffd000`359185c8 00000000`0000003e : 00000000`000011a0 00000000`00000000 fffff803`00000005 ffffe001`00000000 : 0xffffd000`359186c8
    ffffd000`359185d0 00000000`000011a0 : 00000000`00000000 fffff803`00000005 ffffe001`00000000 00000000`00000000 : 0x3e
    ffffd000`359185d8 00000000`00000000 : fffff803`00000005 ffffe001`00000000 00000000`00000000 00000000`00000001 : 0x11a0
    
    
    STACK_COMMAND:  kb
    
    THREAD_SHA1_HASH_MOD_FUNC:  e897beb21c4ab875252ccde8ba7534f60839bc7f
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  e33a8348fc8e4334ed19e174dee91e6fd1c9c7d6
    
    THREAD_SHA1_HASH_MOD:  fd9e61c63d2db7335f38c3ee368964d40f516494
    
    FOLLOWUP_IP: 
    000+1e2f
    fffff801`90bc0e2f 85c0            test    eax,eax
    
    FAULT_INSTR_CODE:  d88bc085
    
    SYMBOL_STACK_INDEX:  8
    
    SYMBOL_NAME:  000+1e2f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: 000
    
    IMAGE_NAME:  000.fcl
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5260e04f
    
    BUCKET_ID_FUNC_OFFSET:  1e2f
    
    FAILURE_BUCKET_ID:  0xc4_f6_VRF_000!Unknown_Function
    
    BUCKET_ID:  0xc4_f6_VRF_000!Unknown_Function
    
    PRIMARY_PROBLEM_CLASS:  0xc4_f6_VRF_000!Unknown_Function
    
    TARGET_TIME:  2015-12-24T20:43:52.000Z
    
    OSBUILD:  9600
    
    OSSERVICEPACK:  0
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  784
    
    PRODUCT_TYPE:  1
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 8.1
    
    OSEDITION:  Windows 8.1 WinNt TerminalServer SingleUserTS Personal
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2015-11-21 11:42:09
    
    BUILDDATESTAMP_STR:  151121-0600
    
    BUILDLAB_STR:  winblue_ltsb
    
    BUILDOSVER_STR:  6.3.9600.18146.amd64fre.winblue_ltsb.151121-0600
    
    ANALYSIS_SESSION_ELAPSED_TIME: 8eb
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:0xc4_f6_vrf_000!unknown_function
    
    FAILURE_ID_HASH:  {e6a6550e-d45b-158b-9442-3f9da7f896d4}
    
    Followup:     MachineOwner
    ---------
    
    1: kd> lmvm 000
    Browse full module list
    start             end                 module name
    fffff801`90bbf000 fffff801`90bcd000   000      T (no symbols)           
        Loaded symbol image file: 000.fcl
        Image path: \??\C:\Program Files (x86)\CyberLink\PowerDVD14\Common\NavFilter\000.fcl
        Image name: 000.fcl
        Browse all global symbols  functions  data
        Timestamp:        Fri Oct 18 03:16:31 2013 (5260E04F)
        CheckSum:         00015E5E
        ImageSize:        0000E000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Thursday, December 24, 2015 9:43 PM
    Moderator
  • Uninstalled the programs since I didn't even use them (bloatware from msi). Anyways, Thank you sir and I hope you have a great Merry Christmas.
    Thursday, December 24, 2015 11:51 PM
  • Thanks for letting us know and Happy holidays to you as well.

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Thursday, December 24, 2015 11:53 PM
    Moderator
  • Shortly after your reply BSOD with the same message. Dump file

    https://mega.nz/#!wsh0ERAQ!X4pqW9lj_Gebp48Ffxyes1__YGVWiD-rD9qtLQHMXG



    Something that might help out. I just noticed that this happens when I try to open Photoshop cc, premiere pro and haven't tried for after affects but mostly likely it will happen too.

    Friday, December 25, 2015 12:18 AM
  • That link is encrypted and requires a password.  Please fix it

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Sunday, December 27, 2015 3:27 PM
    Moderator
  • Sorry about that

    https://mega.nz/#!wsh0ERAQ!X4pqW9lj_Gebp48Ffxyes1__YGVWiD-rD9qtLQHMXGU

    Sunday, December 27, 2015 8:15 PM
  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Sunday, December 27, 2015 9:26 PM
    Moderator
  • Here you go

    https://mega.nz/#!BlAT1LgT!g89bk6kn-5d6ZJEkV21e6vT4iRd_PPxrNdYPeroeffs

    Sunday, December 27, 2015 10:38 PM
  • This one was driver verified but it did not catch the mis behaving driver.  This can happen if it is an OS driver or the physical memory itself.  I would run memtest and a system file check

    Please run a system file check (SFC) & DISM  if you are on win 8 or higher

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.




    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Monday, December 28, 2015 1:18 AM
    Moderator
  • I did the SFC and had some issues but DISM fixed those and ran SFC again detected no issues. I finally got memtest to work and did 11 passes all had no errors detected. What could be the issue then?


    Fixed it. I first did device manager and searched for driver updates but it said they were all up to date but I don't rely much on that so did some research and found Driver pack (Create a restore point just in case). I updated some drivers (not all) then reinstalled the software to test if it worked and wala. Anyways, thanks for the help. If I get any issues expect me right back.


    Tuesday, December 29, 2015 6:35 PM