Code:
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff80098899960, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff800988998b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
This is one of the most difficult types of 0x139 as it indicates a linked list has become corrupted, the reason for this being difficult is that the list doesn't necessarily become corrupt and bugcheck straight away.
Lets first take a look at the callstack.
Code:
fffff800`98899638 fffff800`96d6bae9 : 00000000`00000139 00000000`00000003 fffff800`98899960 fffff800`988998b8 : nt!KeBugCheckEx
fffff800`98899640 fffff800`96d6be10 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`98899780 fffff800`96d6b034 : fffffff6`00000004 00000001`ffffffff 00000008`00000005 00000000`95901080 : nt!KiFastFailDispatch+0xd0
fffff800`98899960 fffff800`96d82205 : 00000000`00000018 00000000`00da7a64 ffffe000`d7a1b330 ffffe000`00000002 : nt!KiRaiseSecurityCheckFailure+0xf4
fffff800`98899af0 fffff800`96d63aea : fffff800`96ef2180 fffff800`96ef2180 fffff800`96f59a00 ffffe000`d8072080 : nt! ?? ::FNODOBFM::`string'+0x11d55
fffff800`98899da0 00000000`00000000 : fffff800`9889a000 fffff800`98894000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a
Not much happening, given it's a minidump there isn't much information saved, the CPU is idle in a loop waiting for instructions, it receives something which raises a Kernel security check failure and inevitably the bugcheck.
Code:
0: kd> .exr 0xfffff800988998b8
ExceptionAddress: fffff80096d82205 (nt! ?? ::FNODOBFM::`string'+0x0000000000011d55)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Here we can see the type of error which appears to be a security check failure as stated before a linked list data structure has been corrupted.
Code:
0: kd> .trap 0xfffff80098899960
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe000d6f3e500 rbx=0000000000000000 rcx=0000000000000003
rdx=fffff80096eaf200 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80096d82205 rsp=fffff80098899af0 rbp=fffff80098899bf0
r8=0000000000000008 r9=fffff80096c0c000 r10=000000000000000f
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt! ?? ::FNODOBFM::`string'+0x11d55:
fffff800`96d82205 cd29 int 29h
This shows us that a software interrupt occurred as indicated by
int.
As stated before, it's a minidump so there's only so much we can see.
This bugcheck occurs again with a very similar situation.
Could we have a Kernel memory dump?
Go the Start
Right click My Computer
Select Properties
Click Advanced system settings
Click on the Advanced tab
Select Settings under Startup and Recovery
Then under Write debugging information select Kernel memory dump.
Once a dump is created go to:
Copy the file to the desktop, zip it up and upload it to a file sharing site like Onedrive. After the upload is done post the download link in your next reply.
Here we have a system service exception.
Code:
BugCheck 3B, {c0000005, fffff800983097d0, ffffd0013013c650, 0}
An exception (more specifically an access violation) occurred during a system service routine.
Code:
ffffd001`3013d080 ffffe000`b30ec440 : ffffd001`3013d1b0 ffffd001`3013da90 00000000`00000000 ffffd001`3013d388 : atikmdag+0x227d0
ffffd001`3013d088 ffffd001`3013d1b0 : ffffd001`3013da90 00000000`00000000 ffffd001`3013d388 fffff800`98308cf6 : 0xffffe000`b30ec440
ffffd001`3013d090 ffffd001`3013da90 : 00000000`00000000 ffffd001`3013d388 fffff800`98308cf6 00000000`00000028 : 0xffffd001`3013d1b0
ffffd001`3013d098 00000000`00000000 : ffffd001`3013d388 fffff800`98308cf6 00000000`00000028 ffffd001`3013dabc : 0xffffd001`3013da90
Code:
3: kd> .cxr 0xffffd0013013c650;r
rax=0000000000000001 rbx=ffffe000b30ec440 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000001 rdi=ffffd0013013da80
rip=fffff800983097d0 rsp=ffffd0013013d080 rbp=ffffd0013013d1b0
r8=ffffc0005133c000 r9=0000000000000001 r10=0000000000000000
r11=fffff800984b44d3 r12=ffffd0013013da90 r13=ffffd0013013da80
r14=ffffd0013013d388 r15=ffffe000b30ec440
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
atikmdag+0x227d0:
fffff800`983097d0 488b01 mov rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
A pointer stored in rax was dereferenced which resulted in a move instruction to try and store it inside the rcx register, this register is invalid so it called the bugcheck.
atikmdag is the AMD graphics driver, I suggest you try rolling back or updating this driver which should resolve that issue.
The last dump file indicates a system thread exception was not handled by the trap handlers, it was probably unexpected which is why it couldn't catch it.
Code:
2: kd> .exr 0xffffd001b2e7f4f8
ExceptionAddress: fffff802ccefa025 (nt!MiEmptyPageAccessLog+0x0000000000000225)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
Again it attempted to read from an invalid address...
Code:
rax=ffffe00205487ef8 rbx=0000000007594000 rcx=0000000000000100
rdx=0000000000000000 rsi=ffffe00205487dc0 rdi=0000000000000400
rip=fffff802ccefa025 rsp=ffffd001b2e7f730 rbp=0000000000000000
r8=ffffe00200756900 r9=ffffe00200756900 r10=0000000000000002
r11=ffffe00200715000 r12=ffffe00205487048 r13=ff362c22ff362c22
r14=fffff6800017dd80 r15=0000000000000020
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MiEmptyPageAccessLog+0x225:
fffff802`ccefa025 418b4d38 mov ecx,dword ptr [r13+38h] ds:002b:ff362c22`ff362c5a=????????
So a pointer was moved from ecx to r13+38 which resulted in the pointer being stored in
ff362c22`ff362c5a
So why did it fail?
Code:
2: kd> !pte ff362c22`ff362c5a
VA ff362c22ff362c5a
PXE at FFFFF6FB7DBED2C0 PPE at FFFFF6FB7DA58458 PDE at FFFFF6FB4B08BFC8 PTE at FFFFF696117F9B10
Unable to get PXE FFFFF6FB7DBED2C0
WARNING: noncanonical VA, accesses will fault !
Here's our problem, anything trying to access it will fail and cause a bugcheck.
It's not very helpful in the cause so it could be lots of things.
But then again, looking at the loaded modules, there's always the Anti Virus to consider.
Code:
2: kd> lm vm eng64
start end module name
fffff800`b4c00000 fffff800`b4c22000 ENG64 (deferred)
Image path: \??\C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\Definitions\VirusDefs\20140808.003\ENG64.SYS
Image name: ENG64.SYS
Timestamp: Thu Aug 22 21:38:20 2013 (521676BC)
CheckSum: 00020BBA
ImageSize: 00022000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
It's old and still running so Norton may well be the cause of this, it's very problematic anyway as it seems to be the worst AV out there.
I recommend you remove it and replace it with Microsoft Security Essentials, I can't make a final judgement on the cause without a Kernel dump but it seems likely that this is the cause.
Microsoft Security Essentials - Microsoft Windows
Go The Power will sort out your SFC issues so I'll leave you in good hands, if you still get BSODs post them as I will keep watching over this thread.
