Windows 8 and 8.1 Forums


BSOD upgraded from 8.0 to 8.1 Kernel Security Check Failur

  1. #1


    Posts : 2
    Windows 8.1

    BSOD upgraded from 8.0 to 8.1 Kernel Security Check Failur


    upgraded laptop from 8.0 to 8.1 couple weeks ago. Since then my system crashes every once in a while. Attached is the dmp file as requested.

    Not exactly sure where to go from here. Crashed several times over weekend. But thats because I had in verifier on thinking I could trouble shoot myself.

      My System SpecsSystem Spec

  2. #2


    Posts : 660
    windows 8.1


    Sorry for the delay in responding. There just aren't that many people who do BSOD analysis,so at times we get a bit overwhelmed!

    Most of your dumpfiles blames Atikmdag.sys this is the driver for your graphic card.
    Two dumpfiles points at NDis, probably your networkcard.

    Analysing your drivers most are still windows 8.0 drivers please upload all your drivers to windows 8.1 from here Drivers & Software Support | Toshiba . Your model is Satellite S855D-S5120 . There are many new drivers from 2014 (LAN,wireless, AMD,Atheros bluetooth, Realtek audio etc.)

    A few dumpfiles are bugcheck 139, this can point to a malware/virus infection, please use Antimalwarebytes to check your system for malware/virus.

    Code:
     Use !analyze -v to get detailed debugging information.
    BugCheck 3B, {c0000005, fffff800021e6fd8, ffffd000271c6490, 0}
    *** WARNING: Unable to verify timestamp for atikmdag.sys
     *** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
     Probably caused by : atikmdag.sys ( atikmdag+720fd8 )
    Followup: MachineOwner
     ---------
    0: kd> !analyze -v
     *******************************************************************************
     *                                                                             *
     *                        Bugcheck Analysis                                    *
     *                                                                             *
     *******************************************************************************
    SYSTEM_SERVICE_EXCEPTION (3b)
     An exception happened while executing a system service routine.
     Arguments:
     Arg1: 00000000c0000005, Exception code that caused the bugcheck
     Arg2: fffff800021e6fd8, Address of the instruction which caused the bugcheck
     Arg3: ffffd000271c6490, Address of the context record for the exception that caused the bugcheck
     Arg4: 0000000000000000, zero.
    Debugging Details:
     ------------------
    
     EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. Een lees- of schrijfbewerking op het geheugen is mislukt: %s.
    FAULTING_IP: 
     atikmdag+720fd8
     fffff800`021e6fd8 488b01          mov     rax,qword ptr [rcx]
    CONTEXT:  ffffd000271c6490 -- (.cxr 0xffffd000271c6490;r)
     rax=0000000000000001 rbx=ffffc0000d754020 rcx=0000000000000000
     rdx=0000000000000003 rsi=ffffd000271c6f58 rdi=ffffc0000dcef950
     rip=fffff800021e6fd8 rsp=ffffd000271c6ec0 rbp=ffffd000271c6fc0
      r8=000000000000003c  r9=ffffcf8004330f3c r10=ffffd000271c7028
     r11=0000000000000001 r12=0000000000000001 r13=ffffcf800a0dafc0
     r14=0000000000000000 r15=ffffc00000749020
     iopl=0         nv up ei pl nz na pe nc
     cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
     atikmdag+0x720fd8:
     fffff800`021e6fd8 488b01          mov     rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
     Last set context:
     rax=0000000000000001 rbx=ffffc0000d754020 rcx=0000000000000000
     rdx=0000000000000003 rsi=ffffd000271c6f58 rdi=ffffc0000dcef950
     rip=fffff800021e6fd8 rsp=ffffd000271c6ec0 rbp=ffffd000271c6fc0
      r8=000000000000003c  r9=ffffcf8004330f3c r10=ffffd000271c7028
     r11=0000000000000001 r12=0000000000000001 r13=ffffcf800a0dafc0
     r14=0000000000000000 r15=ffffc00000749020
     iopl=0         nv up ei pl nz na pe nc
     cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
     atikmdag+0x720fd8:
     fffff800`021e6fd8 488b01          mov     rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
     Resetting default scope
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    BUGCHECK_STR:  0x3B
    PROCESS_NAME:  explorer.exe
    CURRENT_IRQL:  0
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    LAST_CONTROL_TRANSFER:  from ffffc0000d754020 to fffff800021e6fd8
    STACK_TEXT:  
     ffffd000`271c6ec0 ffffc000`0d754020 : ffffd000`271c6fc0 00000000`00000000 ffffc000`0dcef950 ffffd000`271c7780 : atikmdag+0x720fd8
     ffffd000`271c6ec8 ffffd000`271c6fc0 : 00000000`00000000 ffffc000`0dcef950 ffffd000`271c7780 ffffd000`271c6f58 : 0xffffc000`0d754020
     ffffd000`271c6ed0 00000000`00000000 : ffffc000`0dcef950 ffffd000`271c7780 ffffd000`271c6f58 ffffc000`00000000 : 0xffffd000`271c6fc0
    
     FOLLOWUP_IP: 
     atikmdag+720fd8
     fffff800`021e6fd8 488b01          mov     rax,qword ptr [rcx]
    SYMBOL_STACK_INDEX:  0
    SYMBOL_NAME:  atikmdag+720fd8
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: atikmdag
    IMAGE_NAME:  atikmdag.sys
    DEBUG_FLR_IMAGE_TIMESTAMP:  52125cd5
    STACK_COMMAND:  .cxr 0xffffd000271c6490 ; kb
    FAILURE_BUCKET_ID:  0x3B_VRF_atikmdag+720fd8
    BUCKET_ID:  0x3B_VRF_atikmdag+720fd8
    ANALYSIS_SOURCE:  KM
    FAILURE_ID_HASH_STRING:  km:0x3b_vrf_atikmdag+720fd8
    FAILURE_ID_HASH:  {907f8bc9-fae4-bf1e-e3b9-f5b00822e763}
      
    
    
    
    Followup: MachineOwner
    
     *******************************************************************************
     *                                                                             *
     *                        Bugcheck Analysis                                    *
     *                                                                             *
     *******************************************************************************
     Use !analyze -v to get detailed debugging information.
     BugCheck C4, {94009, fffff800002f7a10, ffffe00002505e60, ffffe00002505e98}
     Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+76 )
     Followup: MachineOwner
     ---------
     0: kd> !analyze -v
     *******************************************************************************
     *                                                                             *
     *                        Bugcheck Analysis                                    *
     *                                                                             *
     *******************************************************************************
     DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
     A device driver attempting to corrupt the system has been caught.  This is
     because the driver was specified in the registry as being suspect (by the
     administrator) and the kernel has enabled substantial checking of this driver.
     If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
     be among the most commonly seen crashes.
     Arguments:
     Arg1: 0000000000094009, ID of the 'WlanTimedConnectRequest' rule that was violated.
     Arg2: fffff800002f7a10, A pointer to the string describing the violated rule condition.
     Arg3: ffffe00002505e60, Address of internal rule state (second argument to !ruleinfo).
     Arg4: ffffe00002505e98, Address of supplemental states (third argument to !ruleinfo).
     Debugging Details:
     ------------------
    
     DV_VIOLATED_CONDITION:  Timeout on NDIS_STATUS_DOT11_CONNECTION_START after OID_DOT11_CONNECT_REQUEST.
     DV_MSDN_LINK: WlanTimedConnectRequest rule (ndis) (Windows Drivers)
     DV_RULE_INFO: 0x94009
     BUGCHECK_STR:  0xc4_WlanTimedConnectRequest_XDV
     CUSTOMER_CRASH_COUNT:  1
     DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
     PROCESS_NAME:  System
     CURRENT_IRQL:  2
     ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
     LAST_CONTROL_TRANSFER:  from fffff800002eb487 to fffff80339f54ca0
     STACK_TEXT:  
     ffffd000`209e98f8 fffff800`002eb487 : 00000000`000000c4 00000000`00094009 fffff800`002f7a10 ffffe000`02505e60 : nt!KeBugCheckEx
     ffffd000`209e9900 fffff800`002ee79c : ffffe000`013ae840 ffffe000`000f7000 ffffe000`02cdad20 ffffd000`209e9b50 : VerifierExt!SLIC_StatefulAbort+0x22b
     ffffd000`209e99f0 fffff800`002ede0f : 00000000`00000000 ffffe000`000f7060 fffff800`002eddcc ffffe000`013b6980 : VerifierExt!Ndis_OnTimerExpire+0xa8
     ffffd000`209e9a40 fffff803`39ea7a0e : ffffcf80`004defb0 00000000`00000000 00000000`00000000 ffffe000`0260ce50 : VerifierExt!XdvPassiveTimerRoutine+0x43
     ffffd000`209e9a70 fffff803`39ea81b9 : fffff803`3a234200 fffff803`39ea7998 ffffd000`209e9b50 ffffcf80`000cafb0 : nt!IopProcessWorkItem+0x76
     ffffd000`209e9ad0 fffff803`39e942e4 : ffffe000`001a4040 ffffe000`013b6880 ffffe000`013b6880 ffffe000`000d2440 : nt!ExpWorkerThread+0x2b5
     ffffd000`209e9b80 fffff803`39f5b2c6 : ffffd000`20be2180 ffffe000`013b6880 ffffe000`001a4040 00000000`00000000 : nt!PspSystemThreadStartup+0x58
     ffffd000`209e9be0 00000000`00000000 : ffffd000`209ea000 ffffd000`209e3000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
    
     STACK_COMMAND:  kb
     FOLLOWUP_IP: 
     nt!IopProcessWorkItem+76
     fffff803`39ea7a0e f70570c62a0000000008 test dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff803`3a154088)],8000000h
     SYMBOL_STACK_INDEX:  4
     SYMBOL_NAME:  nt!IopProcessWorkItem+76
     FOLLOWUP_NAME:  MachineOwner
     MODULE_NAME: nt
     IMAGE_NAME:  ntkrnlmp.exe
     DEBUG_FLR_IMAGE_TIMESTAMP:  52718d9c
     IMAGE_VERSION:  6.3.9600.16452
     BUCKET_ID_FUNC_OFFSET:  76
     FAILURE_BUCKET_ID:  0xc4_WlanTimedConnectRequest_XDV_VRF_nt!IopProcessWorkItem
     BUCKET_ID:  0xc4_WlanTimedConnectRequest_XDV_VRF_nt!IopProcessWorkItem
     ANALYSIS_SOURCE:  KM
     FAILURE_ID_HASH_STRING:  km:0xc4_wlantimedconnectrequest_xdv_vrf_nt!iopprocessworkitem
     FAILURE_ID_HASH:  {242d917d-5f3a-24d7-7135-8eb692bd3090}
     Followup: MachineOwner
    
     *******************************************************************************
     *                                                                             *
     *                        Bugcheck Analysis                                    *
     *                                                                             *
     *******************************************************************************
     Use !analyze -v to get detailed debugging information.
     BugCheck 139, {3, fffff8037c468650, fffff8037c4685a8, 0}
     Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )
     Followup: MachineOwner
     ---------
     0: kd> !analyze -v
     *******************************************************************************
     *                                                                             *
     *                        Bugcheck Analysis                                    *
     *                                                                             *
     *******************************************************************************
     KERNEL_SECURITY_CHECK_FAILURE (139)
     A kernel component has corrupted a critical data structure.  The corruption
     could potentially allow a malicious user to gain control of this machine.
     Arguments:
     Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
     Arg2: fffff8037c468650, Address of the trap frame for the exception that caused the bugcheck
     Arg3: fffff8037c4685a8, Address of the exception record for the exception that caused the bugcheck
     Arg4: 0000000000000000, Reserved
     Debugging Details:
     ------------------
    
     TRAP_FRAME:  fffff8037c468650 -- (.trap 0xfffff8037c468650)
     NOTE: The trap frame does not contain all registers.
     Some register values may be zeroed or incorrect.
     rax=ffffe000004954b0 rbx=0000000000000000 rcx=0000000000000003
     rdx=fffff8037c468660 rsi=0000000000000000 rdi=0000000000000000
     rip=fffff8037ab9f95a rsp=fffff8037c4687e0 rbp=0000000000000000
      r8=fffff8037c468670  r9=000000000000002f r10=fffff8037b19d520
     r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
     r14=0000000000000000 r15=0000000000000000
     iopl=0         nv up ei pl nz na po cy
     nt! ?? ::FNODOBFM::`string'+0x2b7ba:
     fffff803`7ab9f95a cd29            int     29h
     Resetting default scope
     EXCEPTION_RECORD:  fffff8037c4685a8 -- (.exr 0xfffff8037c4685a8)
     ExceptionAddress: fffff8037ab9f95a (nt! ?? ::FNODOBFM::`string'+0x000000000002b7ba)
        ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
       ExceptionFlags: 00000001
     NumberParameters: 1
        Parameter[0]: 0000000000000003
     CUSTOMER_CRASH_COUNT:  1
     DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT
     BUGCHECK_STR:  0x139
     PROCESS_NAME:  System
     CURRENT_IRQL:  2
     ERROR_CODE: (NTSTATUS) 0xc0000409 - Er is een bufferoverschrijdingsfout opgetreden voor stack-buffer in deze toepassing. Via deze overschrijdingsfout kan een kwaadwillige gebruiker de controle over deze toepassing verkrijgen.
     EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - Er is een bufferoverschrijdingsfout opgetreden voor stack-buffer in deze toepassing. Via deze overschrijdingsfout kan een kwaadwillige gebruiker de controle over deze toepassing verkrijgen.
     EXCEPTION_PARAMETER1:  0000000000000003
     ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
     DPC_STACK_BASE:  FFFFF8037C470FB0
     LAST_CONTROL_TRANSFER:  from fffff8037ab6f7e9 to fffff8037ab63ca0
     STACK_TEXT:  
     fffff803`7c468328 fffff803`7ab6f7e9 : 00000000`00000139 00000000`00000003 fffff803`7c468650 fffff803`7c4685a8 : nt!KeBugCheckEx
     fffff803`7c468330 fffff803`7ab6fb10 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff3563`11dcdfab : nt!KiBugCheckDispatch+0x69
     fffff803`7c468470 fffff803`7ab6ed34 : fffff803`7c468668 fffff800`0293c732 fffffff6`00000004 00000001`ffffffff : nt!KiFastFailDispatch+0xd0
     fffff803`7c468650 fffff803`7ab9f95a : 00000000`00000000 fffff803`7ad04180 ffffe000`00e7e1f0 00000000`234052a8 : nt!KiRaiseSecurityCheckFailure+0xf4
     fffff803`7c4687e0 fffff803`7aac3fe3 : ffffe000`0231dd20 00000000`00000001 fffff803`7c4688b9 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x2b7ba
     fffff803`7c468840 fffff803`7aac4478 : 00000000`00000001 ffffe000`02437328 fffff803`7ad04180 fffff803`7ad08480 : nt!KiProcessExpiredTimerList+0x257
     fffff803`7c468920 fffff803`7ab20478 : fffff803`7ad04180 00000000`00223570 00000000`028c1380 00000000`028c1398 : nt!KiExpireTimerTable+0x218
     fffff803`7c4689c0 fffff803`7aa70abc : ffffe000`00000000 00001f80`00000001 00000a30`4e02d999 00000000`00000002 : nt!KiTimerExpiration+0x148
     fffff803`7c468a70 fffff803`7ab677ea : fffff803`7ad04180 fffff803`7ad04180 00000000`001a3fc0 fffff803`7ad5ca80 : nt!KiRetireDpcList+0x19c
     fffff803`7c468be0 00000000`00000000 : fffff803`7c469000 fffff803`7c462000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a
    
     STACK_COMMAND:  kb
     FOLLOWUP_IP: 
     nt!KiFastFailDispatch+d0
     fffff803`7ab6fb10 c644242000      mov     byte ptr [rsp+20h],0
     SYMBOL_STACK_INDEX:  2
     SYMBOL_NAME:  nt!KiFastFailDispatch+d0
     FOLLOWUP_NAME:  MachineOwner
     MODULE_NAME: nt
     IMAGE_NAME:  ntkrnlmp.exe
     DEBUG_FLR_IMAGE_TIMESTAMP:  52718d9c
     IMAGE_VERSION:  6.3.9600.16452
     BUCKET_ID_FUNC_OFFSET:  d0
     FAILURE_BUCKET_ID:  0x139_3_nt!KiFastFailDispatch
     BUCKET_ID:  0x139_3_nt!KiFastFailDispatch
     ANALYSIS_SOURCE:  KM
     FAILURE_ID_HASH_STRING:  km:0x139_3_nt!kifastfaildispatch
     FAILURE_ID_HASH:  {36173680-6f08-995f-065a-3d368c996911}
     Followup: MachineOwner  



    Please update these older drivers. Linksare included to assist in looking up the source of the drivers. If unable tofind an update, please remove (un-install) the program responsible for thatdriver. DO NOT manually delete/rename the driver as it may make the systemunbootable! :
    Note: If you updated all your drivers from your mainboard /OEM in your case Toshiba as mentioned above, most may already be updated.

    PxHlpa64 fffff800`006c9000 fffff800`006d51a0 Tue Apr 24 19:26:29 2012 (4f96e245) 0000e1ad PxHlpa64.sys
    Driver Description: Sonic CD/DVD driver (used by many different CD/DVD programs)Driver Update Site: pxHelp20.sys programs lists some of the programs that it's used in.

    GEARAspiWDM fffff800`02bb2000 fffff800`02bb8c00 Thu May 03 21:56:17 2012 (4fa2e2e1) 00008963 GEARAspiWDM.sys
    Driver Description: CD-ROM Class Filter Driver by Gear Software.
    Also comes with iTunes
    Driver Update Site: http://www.gearsoftware.com

    tos_sps64 fffff800`00b73000 fffff800`00bf1000 Mon Jun 18 03:21:30 2012 (4fde829a) 0008784a tos_sps64.sys

    Driver Description: Toshiba tos_sps64 Service
    Driver Update Site: Official Toshiba Support | Toshiba

    FwLnk fffff800`027d4000 fffff800`027dd000 Tue Jul 10 10:35:43 2012 (4ffbe
    95f) 0000b7c8 FwLnk.sys

    Driver Description: Toshiba Firmware Linkage service system driver (included in the Toshiba Value Added Package)
    Driver Update Site: Official Toshiba Support | Toshiba

    TVALZFL fffff800`027e9000 fffff800`027f1000 Sun Jul 22 00:29:07 2012 (500b2d33) 00005ee2 TVALZFL.sys
    TVALZ_O fffff800`027dd000 fffff800`027e9000 Thu Jul 26 01:23:25 2012 (50107fed) 00012fdc TVALZ_O.SYS
    Driver Description: TVALZ Filter Driver - Toshiba
    Driver Description: TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver
    Driver Update Site: Official Toshiba Support | Toshiba

    tdcmdpst fffff800`02ba6000 fffff800`02bb2000 Thu Jul 26 01:41:48 2012 (5010843c) 00011047 tdcmdpst.sys
    Driver Description: Toshiba ODD Writing Driver (CD/DVD)
    Driver Update Site: Official Toshiba Support | Toshiba

    THAccel fffff800`011bd000 fffff800`011e0000 Thu Aug 09 05:44:38 2012 (50233226) 0002e27f THAccel.sys
    Driver Description: TOSHIBA HDD Accelerator Driver
    Driver Update Site: Official Toshiba Support | Toshiba

    usbfilter fffff800`02bc6000 fffff800`02bd7000 Wed Aug 29 03:27:12 2012 (503d6ff0) 00016b8f usbfilter.sys
    Driver Description: AMD USB Filter Driver (likely part of the chipset drivers)
    Driver Update Site: Support & Drivers





      My System SpecsSystem Spec

  3. #3


    Posts : 2
    Windows 8.1


    Thank you!!! System has not crashed since I did updates

    I thought that system was auto updating.
      My System SpecsSystem Spec

BSOD upgraded from 8.0 to 8.1 Kernel Security Check Failur
Related Threads
Solved BSOD Kernel Security Check Failure in BSOD Crashes and Debugging
Hi, BSOD comes out lately very often with kernel security check failure. İt's come out i guess when watching youtube video in fullscreen and paused video and away from keyboard and screen goes off (power managment). Then i come and saw BSOD with kernel security check.
Hi, I've been getting a BSOD saying Kernel Security Check Failure for quite awhile now and it tends to happen every 2-3 days sometimes less. I'm pretty certain it's happening due to either a Windows update or some driver incompatibility. Let me know if I can provide any other details to help....
BSOD - kernel security check failure in BSOD Crashes and Debugging
After having my laptop for about a year (HP Envy) I recently started experiencing the BSOD for the first time in the past 2 weeks. It started about 10 days ago. After repeat occurrences, I thought I should reset my computer to factory state. So i backed up my hard drive to and external drive. ...
BSOD Kernel Security Check Failure in BSOD Crashes and Debugging
Hello, I get randomly BSOD on my Windows 8.1 and I don't know whats the problem. I have attached the files made with SF Diagnostic Tool
Solved BSOD kernel security check failure in BSOD Crashes and Debugging
Recently I started getting BSOD when the PC is restarting saying kernel security check failure. I have to hard reset 3-4 times in order for it to boot normally. I have no clue why, hope someone can help me :/
BSOD Kernel security check failure in BSOD Crashes and Debugging
I tried so many ways that I can find on Google.com and Youtube.com, but the problem still unsolved. Please help me out! Thank you,
BSOD & Kernel Security Check Failure in BSOD Crashes and Debugging
Hey everyone, I've been having some problems after doing a clean install of Windows 8. At least once a day now, I get a BSOD with the error message of "Kernel Security Check Failure". Some googling says it seems to be due to drivers but I can't seem to find anything. Perhaps someone could take a...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook