[SOLVED] Windows 10 BSOD KERNEL_SECURITY_CHECK_FAILURE on x64 computer ntoskrnl.exe+3f5e40

Page 2 - Seeking answers? Join the Tom's Hardware community: where nearly two million members share solutions and discuss the latest tech.
Toggle sidebar Toggle sidebar
AholicKnighter

AholicKnighter

Reputable
Dec 3, 2020
46
3
4,535
0KrK7Gs.png


After my computer has been BSODing over and over I have restored my computer from a backup, and for some reason, the BSODing is happening again. I have uploaded the memory dump for anybody to look at:

Memory file dump download: https://ufile.io/sewmi1m9
 
Solution
kerberos_20
if you have done memtest while still getting BSODs with memory corruptions
run aida64 stress test with cpu+ram selected, 30minut stress test should be enough, if you get hardware error detected, try increase ram voltage a little bit (by +0.05volts) or reduce ram speed and repeat test
if ram stress test passes (either ram was ok or you changed frequency/voltage),
then run driver verifier
https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier
next BSOD should be with driver in report (if its driver issue)
Sort by date Sort by votes
hi, ive noticed that your are using AMD sata drivers on windows 10 on AM4 platform
here is a note from amd about this:
AMD SATA AHCI drivers for AMD 6-Series, 7-Series, 8-Series, or 9-Series chipsets are included in the chipset driver package and is compatible only with desktop systems running Windows® 8.1, Windows 7 or older (depending on chipset).
The AMD SATA controller component is not compatible with and will not be offered nor installed by the chipset driver package on AMD desktop systems running Window® 10 or using AMD Socket AM4 and Socket TR4 chipsets. Forcing a manual driver installation via Device Manager on these systems is not supported and may cause stability and performance issues with some mass storage devices, such as solid-state drives (SSD).

https://www.amd.com/en/support/kb/faq/pa-250
 
Upvote 0 Downvote
its always fun trying to convince windows not to use those. It might work but in some cases windows downloads them.

i would clean install, it would flush the drivers and stop us playing "guess which one is wrong" now. I don't normally suggest a clean install but I don't normally see as many drivers on a pc as you have either.
 
Upvote 0 Downvote
Colif said:
i don't like how the blame is moving around, its never the same thing crashing
last one was clearly internet related, i recognise some of the names in the dump text, but the ones on Saturday? One crashed shadownplay, I not sure if that was internet related or not. Other one was wallpaper engine, internet... could all be avast

Still makes me wonder

Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors. Memtest is created as a bootable USB so that you don’t need windows to run it

as moving target can be ram as if you fix one thing, something else pops up.
Click to expand...

I will be running memtest86 soon on my computer, should be done by tomorrow. In the meantime, if this is a memory issue, then why is it only happening when my drive is encrypted? When the drive is not encrypted, the computer does not crash and everything works fine. I now know that this is not a drive issue, as I thought it was but it isn't.
 
Upvote 0 Downvote
Colif said:
its always fun trying to convince windows not to use those. It might work but in some cases windows downloads them.

i would clean install, it would flush the drivers and stop us playing "guess which one is wrong" now. I don't normally suggest a clean install but I don't normally see as many drivers on a pc as you have either.
Click to expand...

Is there a way to wipe out all the drivers? Would running sysprep.exe & clicking generalize work?
 
Upvote 0 Downvote
Colif said:
i don't know aboiut sysprep, it looks like its mostly for server work - never used it myself - https://thesolving.com/server-room/when-and-how-to-use-sysprep/

As for ram, just call it a precaution as hate to waste time when its ram causing problems. As for why its only happens during encryption, I am not sure.
Click to expand...

VMware & Avast + several other programs have been uninstalled. These programs provided no use to me, so that is why they are uninstalled. I will be running memtest86 at night when I am not doing anything as it won't waste my time.
 
Upvote 0 Downvote
Colif said:
its always fun trying to convince windows not to use those. It might work but in some cases windows downloads them.

i would clean install, it would flush the drivers and stop us playing "guess which one is wrong" now. I don't normally suggest a clean install but I don't normally see as many drivers on a pc as you have either.
Click to expand...
VJ74u79.png


Memtest86+ passed with no errors, you can view the full report down below:
jmuCmRa.png
 
  • Like
Reactions: Colif
Upvote 0 Downvote
I ran the dump file through the debugger and got the following information: https://jsfiddle.net/2zu6g9xh/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:070421-10765-01.dmp (Jul 4 2021 - 11:06:17)
Bugcheck:KMODE_EXCEPTION_NOT_HANDLED (1E)
Probably caused by:memory_corruption (Process: steamcmd.exe)
Uptime:2 Day(s), 18 Hour(s), 37 Min(s), and 17 Sec(s)

Comment: The overclocking driver "RTCore64.sys" was found on your system. (MSI Afterburner)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.
 
Upvote 0 Downvote
Sorry for the late reply, my computer has still been crashing but with the stop code: IRQL_NOT_LESS_OR_EQUAL

Windbg suggests that the computer crashed because of csrss.exe & ntkrnlmp.exe
lYOKung.png


If you would like to take a look at the dump more, I have uploaded the most recent crash dump here: https://ufile.io/a5mk1f0y

EDIT: Running WhoCrashed shows ntkrnlmp.exe & win32full.sys
OyD2Yp5.png
 
Last edited:
Upvote 0 Downvote
Those 2 (csrss.exe & ntkrnlmp.exe ) are part of the main Windows program (kernel). They aren't the cause the crash, but if the debugger can't point to a driver it will often just blame them because they are on the next layer down in the system.

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/sjth1bx2/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:070821-10265-01.dmp (Jul 8 2021 - 09:08:39)
Bugcheck:IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:memory_corruption (Process: csrss.exe)
Uptime:0 Day(s), 17 Hour(s), 21 Min(s), and 25 Sec(s)

Comment: The overclocking driver "RTCore64.sys" was found on your system. (MSI Afterburner)

It's good to see that Avast is (temporarily) gone. There's still additional drivers/software that should be removed in order to help eliminate them. VMware appears to be still installed.

If the issue still only happening when you use VeraCrypt, that is very important information that should be repeated. We cannot fix bugs in VeraCrypt (if that is the issue).
 
Upvote 0 Downvote
if you have done memtest while still getting BSODs with memory corruptions
run aida64 stress test with cpu+ram selected, 30minut stress test should be enough, if you get hardware error detected, try increase ram voltage a little bit (by +0.05volts) or reduce ram speed and repeat test
if ram stress test passes (either ram was ok or you changed frequency/voltage),
then run driver verifier
https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier
next BSOD should be with driver in report (if its driver issue)
 
Upvote 0 Downvote
Solution
csrss.exe = client your user runs in, its the user environment.
all parts mentioned are parts of windows. win32kfull.sys is part of kernel
The order of actions leading to error was an interrupt was processed and then deferred procedures were run that led to a page fault.
Interrupts are normal, a high lvl action needed to be done and then windows goes back to what it was doing.
Page faults are badly named normal operations of any operating system that uses virtual memory. It essentially means the CPU didn't have the info it needed in its caches and had to access ram.

It could be a driver error.
 
Upvote 0 Downvote
I am going to be running Driver Verifier now as I am still getting BSODs even when I decrypt the main computer with BSODs, a system restore point has already been created & in case <Mod Edit> hits the fan I also burned Hiren's Boot CD

EDIT: I have ran driver verifier and the drivers that shown the errors is the Valorant anti-cheat (vgk.sys), the game has fully been uninstalled as I do not play that anymore and the anti-cheat as that has ring-0 access.
 
Last edited by a moderator:
Upvote 0 Downvote
The computer appears to not crash, but time will tell if that was the actual driver causing that problem. Also when I was trying to disable driver-verifier, it would attempt an automatic repair with the driver Ntfs.sys so maybe that driver is corrupted?
 
Upvote 0 Downvote
ntfs.sys - New Technology File System. it is the file system of Windows, or has been since windows XP

right click start button

choose powershell (admin)

type SFC /scannow and press enter

once its completed, copy/paste this command into same window:

Repair-WindowsImage -Online -RestoreHealth and press enter

SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC



Vanguard would be classified as malware if it wasn't needed to play Valorant
 
Upvote 0 Downvote
Colif said:
ntfs.sys - New Technology File System. it is the file system of Windows, or has been since windows XP

right click start button

choose powershell (admin)

type SFC /scannow and press enter

once its completed, copy/paste this command into same window:

Repair-WindowsImage -Online -RestoreHealth and press enter

SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC



Vanguard would be classified as malware if it wasn't needed to play Valorant
Click to expand...

TzDRaSb.png


I have run both of those commands and it didn't detect any errors.
 
Upvote 0 Downvote
Did you enable driver verifer? if it is on, its not showing you any errors or driver names
It is actually always running but in its default settings it shouldn't have any effect on windows.
It just seems odd you get a file system error turning it off, as we have tested ram & storage so there aren't many other parts involved.

try running Prime 95, it checks CPU & RAM
https://www.mersenne.org/download/
Prime 95 how to Guide: http://www.playtool.com/pages/prime95/prime95.html
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom