[SOLVED] KERNEL_SECURITY_CHECK_FAILURE BSOD

christantoan

Active member
Joined
May 22, 2015
Posts
43
I get this BSOD randomly

· Windows 10
· X64
· What was original installed OS on system? DOS
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? Retail
· Age of system (hardware): 3 Years
· Age of OS installation - have you re-installed the OS?: 3 months

· CPU: Intel i7 3630QM
· Video Card: Nvidia 740M
· MotherBoard - (if NOT a laptop)
· Power Supply - brand & wattage (if laptop, skip this one)

· System Manufacturer: ASUS
· Exact model number (if laptop, check label on bottom): N56VB

· Laptop or Desktop? Laptop

View attachment Report.zip
View attachment 18469


Thanks
 
Hi Christantoan,

The dump file from December 15th, 2015, points towards a driver called sptd2.sys. This driver is used as part of a SCSI passthrough (SPTD = SCSI Pass Through Direct), and is typically associated with Daemon Tools or Alcohol 120%.

Code:
Child-SP          RetAddr           Call Site
ffffd000`2942c048 fffff803`243512e9 nt!KeBugCheckEx
ffffd000`2942c050 fffff803`2434fac7 nt!KiBugCheckDispatch+0x69
ffffd000`2942c190 fffff801`fcc03c08 nt!KiPageFault+0x247
ffffd000`2942c328 fffff801`fcb85143 [COLOR=#ff0000]sptd2+0x3c08[/COLOR]
ffffd000`2942c330 fffff801`fcb8e24a pci!PciReadDeviceConfig+0x73
ffffd000`2942c3a0 fffff801`fcb8e157 pci!PciEarlyRestoreSkipAllowed+0x7e
ffffd000`2942c500 fffff803`245a12d4 pci!PciEarlyRestoreResourcesInternal+0x23
ffffd000`2942c540 fffff803`2434bd64 nt!PopHiberCheckResume+0x8c
ffffd000`2942c6d0 fffff803`249d62ab nt!PopSaveHiberContextWrapper+0x24
ffffd000`2942c700 fffff803`245a41dd hal!HaliAcpiSleep+0x1bb
ffffd000`2942c790 fffff803`245a3fd6 nt!PopHandleNextState+0x18d
ffffd000`2942c7e0 fffff803`245a3d47 nt!PopIssueNextState+0x1a
ffffd000`2942c810 fffff803`245a26cc nt!PopInvokeSystemStateHandler+0x25f
ffffd000`2942c9f0 fffff803`245a23b4 nt!PopEndMirroring+0x198
ffffd000`2942cab0 fffff803`245a1bca nt!MmDuplicateMemory+0x7a4
ffffd000`2942cba0 fffff803`2420d125 nt!PopTransitionToSleep+0xd6
ffffd000`2942cc10 fffff803`2434b906 nt!PspSystemThreadStartup+0x41
ffffd000`2942cc60 00000000`00000000 nt!KiStartSystemThread+0x16

Do you currently have any virtual drives mapped, and/or are you currently using Daemon Tools, Alcohol 120%, or a similar program? If so, I'd recommend unmounting any of those drives, removing that program in its entirety, and seeing if the crash persists.

Most of the dump files are KERNEL_SECURITY_CHECK_FAILURE BSODs. These occur when a critical data structure is corrupted. Pretty consistently through your dump files, we can see the corruption is happening to NTSTATUS, e.g.:

Code:
(NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
 
NTSTATUS is the notification of what went wrong, it isn't an actual data structure.
It is simply NT (Windows Kernel) status.
 
NTSTATUS is the notification of what went wrong, it isn't an actual data structure.
It is simply NT (Windows Kernel) status.

Whoops, my mistake, you are correct.
 
Sorry but the crash on 15th December is DRIVER_IRQL_NOT_LESS_OR_EQUAL. Not the KERNEL_SECURITY_CHECK_FAILURE

Thanks
 
Sorry but the crash on 15th December is DRIVER_IRQL_NOT_LESS_OR_EQUAL. Not the KERNEL_SECURITY_CHECK_FAILURE

Thanks

Yes, I didn't mean to imply it was. Unless you resolved that as a separate issue and are sure it was no longer causing BSODs, I would still recommend starting there.
 
Upload the dump file from C:\Windows\MEMORY.dmp to a file sharing site and paste the download link here.
 
Sorry, but it's not working. I just got the BSOD after uninstalled Alcohol 120%

Hi everyone, let's see:
Except the crash on 15th December, every dump shows

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).

Found in your dump:
6: kd> lmDvmtib
Browse full module list
start end module name
fffff801`3e830000 fffff801`3e92c000 tib (deferred)
Image path: \SystemRoot\system32\DRIVERS\tib.sys
Image name: tib.sys
Browse all global symbols functions data
Timestamp: Tue Nov 03 19:30:08 2015 (5638FD30)
CheckSum: 001071B0
ImageSize: 000FC000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
6: kd> lmDvmvmx86
Browse full module list
start end module name
fffff801`44270000 fffff801`4428a000 vmx86 (deferred)
Image path: \??\C:\WINDOWS\system32\drivers\vmx86.sys
Image name: vmx86.sys
Browse all global symbols functions data
Timestamp: Thu Nov 26 03:05:01 2015 (565668CD)
CheckSum: 00016346
ImageSize: 0001A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
6: kd> lmDvmDefragFS
Browse full module list
start end module name
fffff801`43eb0000 fffff801`43ed1000 DefragFS (deferred)
Image path: \SystemRoot\System32\Drivers\DefragFS.SYS
Image name: DefragFS.SYS
Browse all global symbols functions data
Timestamp: Tue Jun 09 14:49:05 2015 (5576E0C1)
CheckSum: 000273FF
ImageSize: 00021000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

6: kd> lmDvmteamviewervpn
Browse full module list
start end module name
fffff801`408c0000 fffff801`408cd000 teamviewervpn (deferred)
Image path: \SystemRoot\System32\drivers\teamviewervpn.sys
Image name: teamviewervpn.sys
Browse all global symbols functions data
Timestamp: Thu Dec 13 10:22:09 2007 (4760F9C1)
CheckSum: 00017C81
ImageSize: 0000D000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

6: kd> lmDvmsnapman
Browse full module list
start end module name
fffff801`3f760000 fffff801`3f7b1000 snapman (deferred)
Image path: \SystemRoot\system32\DRIVERS\snapman.sys
Image name: snapman.sys
Browse all global symbols functions data
Timestamp: Thu Nov 05 22:25:15 2015 (563BC93B)
CheckSum: 0005359B
ImageSize: 00051000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

7: kd> lmDvmveracrypt
Browse full module list
start end module name
fffff800`ea820000 fffff800`ea858000 veracrypt (deferred)
Image path: \SystemRoot\System32\drivers\veracrypt.sys
Image name: veracrypt.sys
Browse all global symbols functions data
Timestamp: Wed Oct 07 12:46:11 2015 (5614F7F3)
CheckSum: 00033971
ImageSize: 00038000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4


That means, True Image (Acronis) on board as well as vmware as well as Kaspersky, outdated? teamviewer, even cfosspeed6 was found.
One dump blames ape.exe (Kaspersky) as active but not functional App, another dump blames your RazorIngame Driver as not functional.

Depending on your Kaspersky and of course Dameontools some Apps interfere not proper and lead to the above mentioned buffer overrun.
Even the outdated Bios can cause this, BIOS_DATE: 01/21/2013

regards
Michael
 
It's best to search for the cause, and not just find a list of installed apps, then remove them (one by one, or all at once) until you find the culprit.
Chances are, only one is causing the issue, so it's pointless removing the rest.
Hence why we need a Kernel dump.
 
> It's best to search for the cause,

Minidumps don't reveal the cause, rarely, but some dumps may lead to a list and this one is handcrafted, mainly virtual SW.

> Hence why we need a Kernel dump.
word.
 
Hi. . .

See if Driver Verifier flags any 3rd party drivers - https://www.sysnative.com/forums/bs...er-bsod-related-windows-10-8-1-8-7-vista.html

Let Driver Verifier run for 24 hours minimum.

If Driver Verifier flags a driver, it will force a BSOD. If so, get the dump from c:\windows\minidump; copy it to Documents or Desktop; zip it up and attach. You can't zip the dump up while it's in c:\windows\minidump due to permission settings.

Have you checked for a BIOS update?

Is Alcohol 120/Daemon Tools uninstalled?

Regards. . .

jcgriff2
 
Last edited:
Just a note: I can do a force crash with verifier on and off by running image editing program (I tested with Photoshop and ACDSee; Paint doesn't trigger the BSOD).
Here's the minidump from forced crash with Photoshop and verifier turned on:
View attachment 012016-83234-01.zip

Should I continue with verifier?

Thanks
 
Yes - continue with verifier unless BSODs are at an end.

The fact that you can force a BSOD indicates not to perform the same task again!

The dump you attached listed NVIDIA video as the probable cause.
Code:
nvlddmkm.sys Wed Dec 16 09:03:30 2015 (56716F32)
I know it's a fairly new driver, but check for an update - Driver Reference Table - nvlddmkm.sys

Regards. . .

jcgriff2
 
Just a note: I can do a force crash with verifier on and off by running image editing program (I tested with Photoshop and ACDSee; Paint doesn't trigger the BSOD).
Here's the minidump from forced crash with Photoshop and verifier turned on:
View attachment 18634

Should I continue with verifier?

Thanks

Hello,

Just to follow up on what jcgriff2 had said:

That most recent dump is blaming your video driver, nvlddmkm.sys. Relevant stack text below.
Code:
Child-SP          RetAddr           Call Site
ffffd000`240900d8 fffff803`176c72c8 nt!KeBugCheckEx
ffffd000`240900e0 fffff803`176d0869 nt!VerifierBugCheckIfAppropriate+0x3c
ffffd000`24090120 fffff803`17216b3f nt!VfCheckForResource+0x99
ffffd000`24090170 fffff803`17239d32 nt!ExpCheckForResource+0x3b
ffffd000`240901c0 fffff803`173da150 nt!ExFreePool+0x212
ffffd000`240902a0 fffff803`17058d2f nt!ObpRemoveObjectRoutine+0x80
ffffd000`24090300 fffff803`170f08da nt!ObfDereferenceObjectWithTag+0xbf
ffffd000`24090340 fffff803`170f077c nt!IopCompleteUnloadOrDelete+0xa6
ffffd000`24090400 fffff801`f11fb908 nt!IoDeleteDevice+0x9c
ffffd000`24090430 ffffe000`d665c260 [B][COLOR=#ff0000]nvlddmkm[/COLOR][/B]+0x3b908
ffffd000`24090438 ffffd000`24090530 0xffffe000`d665c260
ffffd000`24090440 ffffe000`d665c330 0xffffd000`24090530
ffffd000`24090448 ffffe000`d665c2c8 0xffffe000`d665c330
ffffd000`24090450 fffff6e8`00000000 0xffffe000`d665c2c8
ffffd000`24090458 00000000`00000000 0xfffff6e8`00000000

Looking at which driver you have from that original file collection, it seems you're already on the most up-to-date version for the GT 740M. The two options in this case are basically to: try rolling the driver back to an older version, or download a new copy of the current driver and re-install it. Sometimes a third option would be to download a beta driver, but the GT 740M doesn't appear to have a new one available.

With regards to your operating system, as your laptop is a few years old: did you perform a fresh/clean installation of Windows 10 a few months ago, or did you follow the upgrade path? If you took the upgrade path, it may be imperative that we ensure any previous drivers for your 740M have been cleared in their entirety. The manufacturer's default uninstaller for both for NVidia and AMD is not always enough to completely remove the old drivers, and it can cause issues, especially when upgrading operating systems.

I can't speak to ACDSee, but at least in the case of Photoshop, the process referred to in the dump is sniffer.exe. Sniffer is supposed to detect your hardware, and typically if it fails to detect what GPU you have, it disables certain graphics enhancements within Photoshop. If you wanted to test it, browse to the directory you have Photoshop installed in, and rename 'sniffer.exe' to '~sniffer.exe', then try to launch Photoshop. Because you're having this issue with multiple programs however, it seems likely a crash will still occur.

The graphics issue seems unrelated to what you were dealing with originally however, so for now it might be better just to avoid Photoshop/ACDSee until you get one of the other crashes you were experiencing originally, and just leave Verifier turned on until then.
 
Alright, I thought I'd try some digging. I usually find 0x139s pretty tricky as the culprit is usually long gone before the system crashes.
I'm not certain on this, but let's do a step through.

Code:
//the call stack of the thread which initiated the crash

ffffd000`7f9cd428 fffff800`665da2e9 : 00000000`00000139 00000000`00000003 ffffd000`7f9cd750 ffffd000`7f9cd6a8 : nt!KeBugCheckEx
ffffd000`7f9cd430 fffff800`665da610 : 00000000`00000000 00000000`00000008 fffffa80`01765bc0 fffff800`664d799b : nt!KiBugCheckDispatch+0x69
ffffd000`7f9cd570 fffff800`665d97f3 : e3911be3`00000011 ffffc001`eb40e3e0 ffffd000`7f9cd840 00000000`00000010 : nt!KiFastFailDispatch+0xd0
ffffd000`7f9cd750 fffff800`665e6d82 : ffffe001`03105e78 fffff800`664bf72f 00000000`00000000 fffff800`664a2197 : nt!KiRaiseSecurityCheckFailure+0xf3
ffffd000`7f9cd8e0 fffff800`664a12c4 : ffffe001`00000000 ffffe001`03105dd0 ffffe001`03105dd0 00000000`ffffffff : nt! ?? ::FNODOBFM::`string'+0x8c82
ffffd000`7f9cd910 fffff800`664a11e2 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000001 : nt!CcDeallocateBcb+0x1c
ffffd000`7f9cd940 fffff800`664a0daa : ffffe001`00000000 00000000`01c7b000 00000000`000002fd 00000000`00000001 : nt!CcUnpinFileDataEx+0x3c2
ffffd000`7f9cd9a0 fffff800`6652d180 : 00000000`01c7b000 ffffd000`7f9cdaa9 00000000`0000dafd 00000000`01c7b000 : nt!CcReleaseByteRangeFromWrite+0xaa
ffffd000`7f9cd9f0 fffff800`6652d686 : ffffe000`fe90bc80 00000000`00000000 00000000`00000001 ffffd000`7f9cdb98 : nt!CcFlushCachePriv+0x450
ffffd000`7f9cdb00 fffff800`664f7b79 : fffff800`66820200 ffffe000`00001000 7fffffff`00000000 00000006`584c0451 : nt!CcWriteBehindInternal+0x156
ffffd000`7f9cdb80 fffff800`66496125 : 00000005`bd9bbfff 00000000`00000080 ffffe000`fe888040 ffffe000`ff7f0040 : nt!ExpWorkerThread+0xe9
ffffd000`7f9cdc10 fffff800`665d4906 : ffffd000`7ed55180 ffffe000`ff7f0040 fffff800`664960e4 00000000`00000000 : nt!PspSystemThreadStartup+0x41
ffffd000`7f9cdc60 00000000`00000000 : ffffd000`7f9ce000 ffffd000`7f9c8000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

//Trap frame for the faulting instruction
4: kd> .trap 0xffffd0007f9cd750
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe0010996e260 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe00107fb0c60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800665e6d82 rsp=ffffd0007f9cd8e0 rbp=0000000000000001
 r8=ffffe0010316f9b8  r9=0000000000000000 r10=7fffe0010316f9b8
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt! ?? ::FNODOBFM::`string'+0x8c82:
fffff800`665e6d82 cd29            int     29h

4: kd> !stack ffffd0007f9cd8e0
Call Stack : 9 frames
## Stack-Pointer    Return-Address   Call-Site       
00 ffffd0007f9cd8e0 fffff800664a12c4 nt!ExDeleteResourceLite+145aa2 (perf)
01 ffffd0007f9cd910 fffff800664a11e2 nt!CcDeallocateBcb+1c 
02 ffffd0007f9cd940 fffff800664a0daa nt!CcUnpinFileDataEx+3c2 (perf)
03 ffffd0007f9cd9a0 fffff8006652d180 nt!CcReleaseByteRangeFromWrite+aa 
04 ffffd0007f9cd9f0 fffff8006652d686 nt!CcFlushCachePriv+450 (perf)
05 ffffd0007f9cdb00 fffff800664f7b79 nt!CcWriteBehindInternal+156 (perf)
06 ffffd0007f9cdb80 fffff80066496125 nt!ExpWorkerThread+e9 (perf)
07 ffffd0007f9cdc10 fffff800665d4906 nt!PspSystemThreadStartup+41 
08 ffffd0007f9cdc60 0000000000000000 nt!KiStartSystemThread+16

29:	fffff800665d9700 nt!KiRaiseSecurityCheckFailure


//Here is what I believe to be the faulting thread
//Lets check the IRPs, I see a lot of activity from the disk subsystem

4: kd> !thread ffffe000fff7f800
THREAD ffffe000fff7f800  Cid 2d18.2d30  Teb: 0000003861200000 Win32Thread: ffffe00109e2a950 WAIT: (Executive) KernelMode Non-Alertable
    ffffd000809e53e8  NotificationEvent
IRP List:
    ffffe0010eaf7900: (0006,0478) Flags: 00020043  Mdl: ffffe001006d2f50
    ffffe0010eb15680: (0006,0478) Flags: 00060800  Mdl: 00000000
    ffffe0010f6d3220: (0006,0478) Flags: 00000884  Mdl: 00000000
Not impersonating
DeviceMap                 ffffc001eb250b60
Owning Process            ffffe0010e80c080       Image:         backgroundTaskHost.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      56486          Ticks: 218 (0:00:00:03.406)
Context Switch Count      863            IdealProcessor: 2             
UserTime                  00:00:00.015
KernelTime                00:00:00.000
Win32 Start Address 0x00007ffdf765b050
Stack Init ffffd000809e7c90 Current ffffd000809e4cc0
Base ffffd000809e8000 Limit ffffd000809e2000 Call 0
Priority 12 BasePriority 8 UnusualBoost 3 ForegroundBoost 0 IoPriority 2 PagePriority 5
Scheduling Group: ffffe0010e4a02c0

Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffffd000`809e4d00 fffff800`664dedca : ffffd000`00000000 00000000`00000001 00000000`fff7fc30 00000000`00000000 : nt!KiSwapContext+0x76
ffffd000`809e4e40 fffff800`664de859 : fffff801`05d7cb70 ffffd000`809e5008 ffffe001`09665ec0 ffffd000`809e2000 : nt!KiSwapThread+0x15a
ffffd000`809e4ef0 fffff800`664de4c5 : ffffd000`809e5140 ffffd000`809e5008 ffffe001`0eaf7900 00000000`00000000 : nt!KiCommitThreadWait+0x149
ffffd000`809e4f80 fffff801`05d71257 : ffffd000`809e53e8 ffffd000`00000000 ffffc001`f3571b00 ffffd000`809e5400 : nt!KeWaitForSingleObject+0x375
ffffd000`809e5040 fffff801`05d7358f : 00000000`00000001 00000000`0023ae8c ffffd000`00000000 ffffc001`f3571b40 : NTFS!NtfsNonCachedIo+0x417
ffffd000`809e52c0 fffff801`05d728b2 : ffffd000`809e54a0 ffffe001`0eaf7900 00000000`000a0000 ffffe001`0f7f3300 : NTFS!NtfsCommonRead+0xb1f
ffffd000`809e5470 fffff801`04157895 : ffffe001`0ea354f0 ffffe001`0eaf7900 ffffe001`0eaf7900 ffffe001`0eaf7ce8 : NTFS!NtfsFsdRead+0x1f2
ffffd000`809e56f0 fffff801`04155816 : ffff8000`00000000 fffff800`664cb1ef 00000000`00000001 ffffe001`0310fdf0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5
ffffd000`809e5780 fffff800`664d081d : ffffe001`0eaf7920 c0020425`fa100404 fffff800`66789700 fffff6fb`6c0072a0 : FLTMGR!FltpDispatch+0xb6
ffffd000`809e57e0 fffff800`6653562c : ffffd000`809e5a00 00000000`00000000 ffffe001`006d2eb0 ffffe001`006d2e70 : nt!IoPageRead+0x23d
ffffd000`809e5840 fffff800`66534b02 : 00000000`00000002 00000000`00000000 ffffe001`006d2e50 ffffe001`0f5654a0 : nt!MiIssueHardFaultIo+0xd4
ffffd000`809e58c0 fffff800`664c637f : 00000000`c0033333 fffff800`66789700 00000000`00000000 ffffc002`0425f800 : nt!MiIssueHardFault+0x162
ffffd000`809e59a0 fffff800`664bbf91 : 00000000`000000a0 00000000`00000000 ffffe001`0049cf20 00000000`00000000 : nt!MmAccessFault+0x82f
ffffd000`809e5b10 fffff800`664bba85 : ffffe001`0310df20 00000000`00000001 ffffd000`809e5dd8 00000000`00001000 : nt!MmCheckCachedPageStates+0x421
ffffd000`809e5cb0 fffff800`668580d7 : ffffc001`00000000 00000000`00000000 ffffd000`809e5d01 00000000`00000001 : nt!CcMapAndRead+0xe5
ffffd000`809e5d10 fffff801`05e3181c : ffffe000`fee681f0 ffffc001`f6319348 00000000`00043000 fffff800`0003e000 : nt!CcMapData+0x97
ffffd000`809e5d80 fffff801`05e3125f : ffffe001`0eabb428 ffffc001`f6319340 ffffb001`7849b918 ffffe001`00000000 : NTFS!ReadIndexBuffer+0xdc
ffffd000`809e5e30 fffff801`05e4b2f5 : ffffc001`f3571b40 00000000`00000068 ffffd000`7f500180 ffffb001`7849b918 : NTFS!FindFirstIndexEntry+0x17f
ffffd000`809e5ee0 fffff801`05e2effb : ffffc001`f3571e08 ffffc001`f3571b40 ffffe001`0eabb428 00000000`0000002a : NTFS!NtfsRestartIndexEnumeration+0x145
ffffd000`809e6160 fffff801`05e2dcf3 : 00000000`00000000 ffffe001`0310fdf0 ffffd000`809e66b0 00000000`00000000 : NTFS!NtfsQueryDirectory+0xbab
ffffd000`809e6550 fffff801`05e2dc09 : 00000000`00000000 ffffe001`0eb15680 ffffe001`0eb15601 00000000`00000000 : NTFS!NtfsCommonDirectoryControl+0xa3
ffffd000`809e6590 fffff801`04157895 : ffffd000`809e66b0 ffffe001`0eb15680 ffffe001`0eabb428 ffffd000`809e65b8 : NTFS!NtfsFsdDirectoryControl+0xb9
ffffd000`809e6600 fffff801`04155816 : ffffe001`009f7e80 ffffe001`0f7d5758 ffffffff`80007701 ffffe001`00984f80 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5
ffffd000`809e6690 fffff800`6688faf6 : ffffe001`0049cd10 ffffd000`809e6771 00000000`00000001 ffffe001`0049cc04 : FLTMGR!FltpDispatch+0xb6
ffffd000`809e66f0 fffff800`6688f96f : ffffffff`800077d4 00000000`00000000 00000000`00000000 ffffd000`809e6aa8 : nt!IopSynchronousServiceTail+0x176
ffffd000`809e67c0 fffff800`665d9fa3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryDirectoryFile+0xcf
ffffd000`809e6880 fffff800`665d2650 : fffff801`04189415 ffffe001`0310fdf0 ffffe001`6e664d46 ffffe001`00000102 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`809e68f0)
ffffd000`809e6a88 fffff801`04189415 : ffffe001`0310fdf0 ffffe001`6e664d46 ffffe001`00000102 00000000`00000000 : nt!KiServiceLinkage
ffffd000`809e6a90 fffff801`0418972c : 00000000`00000000 ffffe001`0e4e57c0 00000000`0000007e 00000000`00000001 : FLTMGR!FltpNormalizeNameComponent+0x95
ffffd000`809e6bb0 fffff801`04187ad6 : ffffe001`0e4e0001 ffffe001`00000017 00000000`0000007f ffffe001`0e4e57c0 : FLTMGR!FltpExpandShortNames+0x1bc
ffffd000`809e6c40 fffff801`04187922 : ffffe001`0e4e57c0 ffffd000`809e0000 00000000`00000000 00000000`c00000bb : FLTMGR!FltpGetNormalizedFileNameWorker+0x14a
ffffd000`809e6c80 fffff801`04186eb0 : ffffe000`fff7f800 ffffe000`fe888040 ffffe000`fff7f800 fffff801`0415992d : FLTMGR!FltpGetNormalizedFileName+0x1a
ffffd000`809e6cd0 fffff801`0415ae87 : c00000bb`809e6e00 ffffe001`0e4e57c0 ffffe001`0e8040b0 ffffe001`0310e680 : FLTMGR!FltpCreateFileNameInformation+0x340
ffffd000`809e6d20 fffff801`04159457 : ffffe001`0310e010 ffffe001`0e4e57c0 fffff801`04174060 00000000`c00000bb : FLTMGR!HandleStreamListNotSupported+0x113
ffffd000`809e6d60 fffff801`04154a70 : ffffe001`0310fdf0 00000000`00000000 00000000`00000000 fffff800`00000030 : FLTMGR!FltpGetFileNameInformation+0x5e7
ffffd000`809e6e00 fffff801`09a0d41c : 00000000`0000005c ffffe001`0f513710 ffffe001`0310e0b0 ffffd000`809e7b00 : FLTMGR!FltGetFileNameInformation+0x1b0
ffffd000`809e6e80 fffff801`04187b81 : ffffd000`809e6f48 00000000`c00000bb ffffe001`0f513710 fffff800`665d2650 : luafv!LuafvGenerateFileName+0x4c
ffffd000`809e6eb0 fffff801`041879bb : ffffe001`0f513700 ffffe001`0f513710 00000000`00000000 00000000`00000000 : FLTMGR!FltpCallOpenedFileNameHandler+0x79
ffffd000`809e6f00 fffff801`04187922 : ffffe001`0f513710 ffffd000`809e2000 00000000`00000000 00000000`c00000bb : FLTMGR!FltpGetNormalizedFileNameWorker+0x2f
ffffd000`809e6f40 fffff801`04186eb0 : ffffe000`fff7f800 ffffd000`809e70e8 ffffe001`0e8040b0 fffff801`04183f71 : FLTMGR!FltpGetNormalizedFileName+0x1a

4: kd> !irp ffffe0010eaf7900
Irp is active with 12 stacks 5 is current (= 0xffffe0010eaf7af0)
 Mdl=ffffe001006d2f50: No System Buffer: Thread ffffe000fff7f800:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [N/A(0), N/A(0)]
            0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
>[IRP_MJ_READ(3), N/A(34)]
           10 e1 ffffe00102d15060 00000000 fffff80104901220-00000000 Success Error Cancel pending
	       \Driver\disk	partmgr!PmIoCompletion
			Args: 00001000 00000000 a503ec00 00000000
 [IRP_MJ_READ(3), N/A(1)]
           10 e0 ffffe00102d16630 00000000 fffff80104901980-00000000 Success Error Cancel 
	      *** ERROR: Module load completed but symbols could not be loaded for fltsrv.sys
 \Driver\partmgr	partmgr!PartitionIoCompletion
			Args: 7b0aaa24 00000000 a503ec00 00000000
 [IRP_MJ_READ(3), N/A(0)]
           10 e0 ffffe00102d10a60 00000000 fffff801049c1b90-ffffe00102d0e570 Success Error Cancel 
	       \Driver\partmgr	volmgr!VmpReadWriteCompletionRoutine
			Args: 00001000 00000000 964eb000 00000000
 [IRP_MJ_READ(3), N/A(0)]
            0 e0 ffffe00102d0e420 00000000 fffff80106b51ee0-ffffe00102c78180 Success Error Cancel 
	       \Driver\volmgr	fvevol!FvePassThroughCompletionRdpLevel2
			Args: 00001000 00000000 7b0aaa21 00000000
 [IRP_MJ_READ(3), N/A(0)]
            0  0 ffffe00102c78030 00000000 00000000-00000000    
	       \Driver\fvevol
			Args: 00001000 00000000 964eb000 00000000
 [IRP_MJ_READ(3), N/A(0)]
            0 e0 ffffe00102dfb9e0 00000000 fffff80105d7cb00-ffffd000809e53e0 Success Error Cancel 
	       \Driver\rdyboost	NTFS!NtfsMasterIrpSyncCompletionRoutine
			Args: 00001000 000000bd 964eb000 00000000
 [IRP_MJ_READ(3), N/A(0)]
            0 e0 ffffe000fe849030 ffffe0010049cf20 fffff801041555a0-ffffe0010ea354f0 Success Error Cancel 
	       \FileSystem\NTFS	FLTMGR!FltpPassThroughCompletion
			Args: 00001000 00000000 00042000 00000000
 [IRP_MJ_READ(3), N/A(0)]
            0  1 ffffe0010310fdf0 ffffe0010049cf20 00000000-00000000    pending
	       \FileSystem\FltMgr
			Args: 00001000 00000000 00042000 00000000

Irp Extension present at 0xffffe0010eaf7d30:
4: kd> !devstack ffffe00102d15060
  !DevObj           !DrvObj            !DevExt           ObjectName
  ffffe00102d16630  \Driver\partmgr    ffffe00102d16780  
> ffffe00102d15060  \Driver\disk       ffffe00102d151b0  DR0
  ffffe00100993760  \Driver\ACPI       ffffe000ff7f84d0  
  ffffe00100995060 *** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys
 \Driver\iaStorA    ffffe001009951b0  0000003f
!DevNode ffffe0010098bd30 :
  DeviceInst is "SCSI\Disk&Ven_ATA&Prod_HGST_HTS541010A9\4&220ad1&0&000000"
  ServiceName is "disk"

4: kd> lmvm iastora
Browse full module list
start             end                 module name
fffff801`04ab0000 fffff801`04d7b000   iaStorA    (no symbols)           
    Loaded symbol image file: iaStorA.sys
    Image path: \SystemRoot\System32\drivers\iaStorA.sys
    Image name: iaStorA.sys
    Browse all global symbols  functions  data
    Timestamp:        Mon Nov 19 20:09:40 2012 (50AA9204)
    CheckSum:         000A393C
    ImageSize:        002CB000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4


What a surprise, Intel Rapid Storage Technology. I'm pretty certain that is the cause, as it usually is. With it being over three years old, as well.
If you aren't using a RAID setup, just remove it, disable driver verifier and see if it continues.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top