KERNEL_SECURITY_CHECK_FAILURE BSOD on Win8 64x

[Renault925]

Hi,
I`ve been getting this BSOD on ntoskrnl.exe, usually when i restart the computer and windows is updating. Can one of you help?
The bluescreenviewer and .dmp files are attached.

Thanks in advance.

 

[Patrick]

Hi,

KERNEL_SECURITY_CHECK_FAILURE (139)

This bug check indicates that the kernel has detected the corruption of a critical data structure.

BugCheck 139, {[COLOR=#ff0000]3[/COLOR], ffffd001a3c64910, ffffd001a3c64868, 0}

- The first argument is 3 which indicates a LIST_ENTRY was corrupted.

7: kd> k
Child-SP          RetAddr           Call Site
ffffd001`a3c645e8 fffff802`15762ce9 nt!KeBugCheckEx
ffffd001`a3c645f0 fffff802`15763010 nt!KiBugCheckDispatch+0x69
ffffd001`a3c64730 fffff802`15762234 nt!KiFastFailDispatch+0xd0
ffffd001`a3c64910 fffff801`f1d1d8be [COLOR=#ff0000]nt!KiRaiseSecurityCheckFailure+0xf4[/COLOR]
ffffd001`a3c64aa0 fffff801`f1d1d422 [COLOR=#0000cd]wanarp!WanpRemoveAllAdaptersFromIp+0x33a[/COLOR]
ffffd001`a3c64b30 fffff801`f1d246ba wanarp!WanpRemoveAllAdapters+0x1a
ffffd001`a3c64b70 fffff801`f0cef12b wanarp!WanNdisCloseAdapterComplete+0x46
ffffd001`a3c64ba0 fffff801`f0c5878e ndis!ndisMQueuedFinishClose+0x4f
ffffd001`a3c64bd0 fffff802`15706e70 ndis!ndisWorkerThread+0x8e
ffffd001`a3c64c00 fffff802`1575d7c6 nt!PspSystemThreadStartup+0x58
ffffd001`a3c64c60 00000000`00000000 nt!KiStartSystemThread+0x16

The list corruption occurred when removing adapters from the Remote Access and Routing ARP driver.

7: kd> u wanarp!WanpRemoveAllAdaptersFromIp+0x33a
wanarp!WanpRemoveAllAdaptersFromIp+0x33a:
fffff801`f1d1d8be cd29            [COLOR=#ff0000]int     29h[/COLOR]
fffff801`f1d1d8c0 b903000000      mov     ecx,3
fffff801`f1d1d8c5 cd29            int     29h
fffff801`f1d1d8c7 4c8d5c2460      lea     r11,[rsp+60h]
fffff801`f1d1d8cc 498b5b30        mov     rbx,qword ptr [r11+30h]
fffff801`f1d1d8d0 498b7338        mov     rsi,qword ptr [r11+38h]
fffff801`f1d1d8d4 498b7b40        mov     rdi,qword ptr [r11+40h]
fffff801`f1d1d8d8 498be3          mov     rsp,r11

7: kd> .trap 0xffffd001a3c64910
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffd001a3c64ac0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801f1d1d8be rsp=ffffd001a3c64aa0 rbp=ffffd001a3c64b00
 r8=ffffd001a3c64ac0  r9=000000000000002f r10=fffff80215da4501
r11=ffffd001a3c64a50 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
[COLOR=#0000cd]wanarp!WanpRemoveAllAdaptersFromIp+0x33a[/COLOR]:
fffff801`f1d1d8be cd29            [COLOR=#ff0000]int     29h[/COLOR]

It essentially looks like the list corruption occurred due to a software interrupt occurring (int), and the interrupt likely went unserviced. Without a kernel dump, it's impossible to say. Regardless, something 3rd party working with the network is causing network conflicts.

---

1. Uninstall Connectify ASAP, terribly buggy software that's likely conflicting with Avira.

2. Update your Hauwei drivers ASAP - Huawei - Support - Downloads

3. If you continue to crash after the above, please remove and replace Avira with Windows Defender:

Avira removal - How do I uninstall my Avira product?

Windows Defender (how to turn on after removal)

A.Navigate to Control Panel (with icons). You can do this by hitting Start > Search > Control Panel. Once in Control Panel, change the drop-down from Category to Large and/or Small icons.

B.Among the list of icons, find and click Action Center.

C.Assuming the removal of your prior antivirus software went properly, you will notice for both Spyware and unwated software protection (important) and Virus protection (important), it'll have a button labeled Turn on now. Click this button (it doesn't matter which, as Windows Defender serves as both in Windows 8/8.1).

 

[Renault925]

Thanks again for the help Patrick, you`ve been really helpful.

 

[Patrick]

Glad to help.

Regards,

Patrick