[SOLVED] Windows 10 BSOD KERNEL_SECURITY_CHECK_FAILURE on x64 computer ntoskrnl.exe+3f5e40

[AholicKnighter]

After my computer has been BSODing over and over I have restored my computer from a backup, and for some reason, the BSODing is happening again. I have uploaded the memory dump for anybody to look at:

Memory file dump download: https://ufile.io/sewmi1m9

 

[kerberos_20]

hi, ive noticed that your are using AMD sata drivers on windows 10 on AM4 platform
here is a note from amd about this:
AMD SATA AHCI drivers for AMD 6-Series, 7-Series, 8-Series, or 9-Series chipsets are included in the chipset driver package and is compatible only with desktop systems running Windows® 8.1, Windows 7 or older (depending on chipset).
The AMD SATA controller component is not compatible with and will not be offered nor installed by the chipset driver package on AMD desktop systems running Window® 10 or using AMD Socket AM4 and Socket TR4 chipsets. Forcing a manual driver installation via Device Manager on these systems is not supported and may cause stability and performance issues with some mass storage devices, such as solid-state drives (SSD).

https://www.amd.com/en/support/kb/faq/pa-250

 

[Colif]

its always fun trying to convince windows not to use those. It might work but in some cases windows downloads them.

i would clean install, it would flush the drivers and stop us playing "guess which one is wrong" now. I don't normally suggest a clean install but I don't normally see as many drivers on a pc as you have either.

 

[AholicKnighter]

i don't like how the blame is moving around, its never the same thing crashing
last one was clearly internet related, i recognise some of the names in the dump text, but the ones on Saturday? One crashed shadownplay, I not sure if that was internet related or not. Other one was wallpaper engine, internet... could all be avast

Still makes me wonder

Try running memtest86 on each of your ram sticks, one stick at a time, up to 4 passes. Only error count you want is 0, any higher could be cause of the BSOD. Remove/replace ram sticks with errors. Memtest is created as a bootable USB so that you don’t need windows to run it

as moving target can be ram as if you fix one thing, something else pops up.

I will be running memtest86 soon on my computer, should be done by tomorrow. In the meantime, if this is a memory issue, then why is it only happening when my drive is encrypted? When the drive is not encrypted, the computer does not crash and everything works fine. I now know that this is not a drive issue, as I thought it was but it isn't.

 

[AholicKnighter]

its always fun trying to convince windows not to use those. It might work but in some cases windows downloads them.

i would clean install, it would flush the drivers and stop us playing "guess which one is wrong" now. I don't normally suggest a clean install but I don't normally see as many drivers on a pc as you have either.

Is there a way to wipe out all the drivers? Would running sysprep.exe & clicking generalize work?

 

[Colif]

i don't know aboiut sysprep, it looks like its mostly for server work - never used it myself - https://thesolving.com/server-room/when-and-how-to-use-sysprep/

As for ram, just call it a precaution as hate to waste time when its ram causing problems. As for why its only happens during encryption, I am not sure.

 

[Colif]

How many drives do you have?

Generally helps to only have the drive C is on attached when you reinstall.

this is normal way we reinstall - follow this guide: https://forums.tomshardware.com/faq/how-to-do-a-clean-installation-of-windows-10.3170366/

 

[AholicKnighter]

i don't know aboiut sysprep, it looks like its mostly for server work - never used it myself - https://thesolving.com/server-room/when-and-how-to-use-sysprep/

As for ram, just call it a precaution as hate to waste time when its ram causing problems. As for why its only happens during encryption, I am not sure.

VMware & Avast + several other programs have been uninstalled. These programs provided no use to me, so that is why they are uninstalled. I will be running memtest86 at night when I am not doing anything as it won't waste my time.

 

[Colif]

could have been avast conflicting with the encryption process, only based on AV might have been active since files were being moved or changed.

just a thought.

 

[AholicKnighter]

its always fun trying to convince windows not to use those. It might work but in some cases windows downloads them.

i would clean install, it would flush the drivers and stop us playing "guess which one is wrong" now. I don't normally suggest a clean install but I don't normally see as many drivers on a pc as you have either.

Memtest86+ passed with no errors, you can view the full report down below:

 

[AholicKnighter]

Now I am getting a whole new BSOD, which was caused by NTFS again. I don't know how I can repair the NTFS driver.

Dump download: https://ufile.io/s4tie0my

 

[kerberos_20]

Now I am getting a whole new BSOD, which was caused by NTFS again. I don't know how I can repair the NTFS driver.

Dump download: https://ufile.io/s4tie0my

did you uninstall amd sata drivers?

 

[gardenman]

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/2zu6g9xh/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	070421-10765-01.dmp (Jul 4 2021 - 11:06:17)
Bugcheck:	KMODE_EXCEPTION_NOT_HANDLED (1E)
Probably caused by:	memory_corruption (Process: steamcmd.exe)
Uptime:	2 Day(s), 18 Hour(s), 37 Min(s), and 17 Sec(s)

Comment: The overclocking driver "RTCore64.sys" was found on your system. (MSI Afterburner)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[AholicKnighter]

did you uninstall amd sata drivers?

No, When I use Process Hacker checking for SATA drivers, I do see one amdsata driver so it's not uninstalled. Should I uninstall it?

 

[Colif]

No, When I use Process Hacker checking for SATA drivers, I do see one amdsata driver so it's not uninstalled. Should I uninstall it?

https://www.amd.com/en/support/kb/faq/pa-250 << thats what AMD suggest

 

[AholicKnighter]

Sorry for the late reply, my computer has still been crashing but with the stop code: IRQL_NOT_LESS_OR_EQUAL

Windbg suggests that the computer crashed because of csrss.exe & ntkrnlmp.exe

If you would like to take a look at the dump more, I have uploaded the most recent crash dump here: https://ufile.io/a5mk1f0y

EDIT: Running WhoCrashed shows ntkrnlmp.exe & win32full.sys

 

[gardenman]

Those 2 (csrss.exe & ntkrnlmp.exe ) are part of the main Windows program (kernel). They aren't the cause the crash, but if the debugger can't point to a driver it will often just blame them because they are on the next layer down in the system.

I ran the dump file through the debugger and got the following information: https://jsfiddle.net/sjth1bx2/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

File information:	070821-10265-01.dmp (Jul 8 2021 - 09:08:39)
Bugcheck:	IRQL_NOT_LESS_OR_EQUAL (A)
Probably caused by:	memory_corruption (Process: csrss.exe)
Uptime:	0 Day(s), 17 Hour(s), 21 Min(s), and 25 Sec(s)

Comment: The overclocking driver "RTCore64.sys" was found on your system. (MSI Afterburner)

It's good to see that Avast is (temporarily) gone. There's still additional drivers/software that should be removed in order to help eliminate them. VMware appears to be still installed.

If the issue still only happening when you use VeraCrypt, that is very important information that should be repeated. We cannot fix bugs in VeraCrypt (if that is the issue).

 

[kerberos_20]

if you have done memtest while still getting BSODs with memory corruptions
run aida64 stress test with cpu+ram selected, 30minut stress test should be enough, if you get hardware error detected, try increase ram voltage a little bit (by +0.05volts) or reduce ram speed and repeat test
if ram stress test passes (either ram was ok or you changed frequency/voltage),
then run driver verifier
https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier
next BSOD should be with driver in report (if its driver issue)

 

[gardenman]

If you use Driver Verifier, be sure to create a Restore Point first. A backup is recommended also. It can put you into a boot loop. See the directions here: https://forums.tomshardware.com/threads/driver-verifier-instructions.3686888/

 

[Colif]

csrss.exe = client your user runs in, its the user environment.
all parts mentioned are parts of windows. win32kfull.sys is part of kernel
The order of actions leading to error was an interrupt was processed and then deferred procedures were run that led to a page fault.
Interrupts are normal, a high lvl action needed to be done and then windows goes back to what it was doing.
Page faults are badly named normal operations of any operating system that uses virtual memory. It essentially means the CPU didn't have the info it needed in its caches and had to access ram.

It could be a driver error.

 

[AholicKnighter]

I went into my BIOS and changed all the RAM OC's back to auto, will see if that's causing the BSODs

 

[AholicKnighter]

I am going to be running Driver Verifier now as I am still getting BSODs even when I decrypt the main computer with BSODs, a system restore point has already been created & in case <Mod Edit> hits the fan I also burned Hiren's Boot CD

EDIT: I have ran driver verifier and the drivers that shown the errors is the Valorant anti-cheat (vgk.sys), the game has fully been uninstalled as I do not play that anymore and the anti-cheat as that has ring-0 access.

 

[AholicKnighter]

The computer appears to not crash, but time will tell if that was the actual driver causing that problem. Also when I was trying to disable driver-verifier, it would attempt an automatic repair with the driver Ntfs.sys so maybe that driver is corrupted?

 

[Colif]

ntfs.sys - New Technology File System. it is the file system of Windows, or has been since windows XP

right click start button

choose powershell (admin)

type SFC /scannow and press enter

once its completed, copy/paste this command into same window:

Repair-WindowsImage -Online -RestoreHealth and press enter

SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC



Vanguard would be classified as malware if it wasn't needed to play Valorant

 

[AholicKnighter]

ntfs.sys - New Technology File System. it is the file system of Windows, or has been since windows XP

right click start button

choose powershell (admin)

type SFC /scannow and press enter

once its completed, copy/paste this command into same window:

Repair-WindowsImage -Online -RestoreHealth and press enter

SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC



Vanguard would be classified as malware if it wasn't needed to play Valorant

I have run both of those commands and it didn't detect any errors.

 

[Colif]

Did you enable driver verifer? if it is on, its not showing you any errors or driver names
It is actually always running but in its default settings it shouldn't have any effect on windows.
It just seems odd you get a file system error turning it off, as we have tested ram & storage so there aren't many other parts involved.

try running Prime 95, it checks CPU & RAM
https://www.mersenne.org/download/
Prime 95 how to Guide: http://www.playtool.com/pages/prime95/prime95.html