Regular Kernal Security Check Failures

I got my PC back in November and have been having regular kernal security check failure BSODs. The company I purchased the PC from just tell me to re install windows which I have done 3 times and it makes no difference. If anybody could help with this I would be really grateful. My results from WhoCrashed are below.

On Sat 21/02/2015 13:52:51 GMT your computer crashed
crash dump file: C:\Windows\Minidump\022115-37421-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1509A0) 
Bugcheck code: 0x139 (0x3, 0xFFFFD00135EB74A0, 0xFFFFD00135EB73F8, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft Windows Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 

On Sat 21/02/2015 13:52:51 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x2073E) 
Bugcheck code: 0x139 (0x3, 0xFFFFD00135EB74A0, 0xFFFFD00135EB73F8, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft Windows Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time. 

On Sun 15/02/2015 19:39:21 GMT your computer crashed
crash dump file: C:\Windows\Minidump\021515-21437-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x1509A0) 
Bugcheck code: 0x139 (0x3, 0xFFFFD001F8F3C700, 0xFFFFD001F8F3C658, 0x0)
Error: KERNEL_SECURITY_CHECK_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft Windows Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: The kernel has detected the corruption of a critical data structure.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

February 21st, 2015 9:15pm

We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  

Please follow our instructions for finding and uploading the files we need to help you fix your computer.

They can be found here

If you have any questions about the procedure please ask
Free Windows Admin Tool Kit Click here and download it now
February 21st, 2015 9:38pm

I've uploaded my dmp files to skydrive

https://onedrive.live.com/?cid=F3D7DCFB17BFC2CD&id=F3D7DCFB17BFC2CD%211603

February 22nd, 2015 8:29am

DA

These were Related to Rt630x64.sys 8101E/8168/8169 NDIS 6.30 64-bit Driver from Realtek.  I would remove the current driver and install the newest driver available.

Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ken\Desktop\New folder\022215-29093-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at start of path element
WARNING: Whitespace at end of path element
Error: Empty Path.
Symbol search path is: 
SRV*e:\symbols*http://msdl.microsoft.com/download/symbols 
Executable search path is: 
Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17630.amd64fre.winblue_r7.150109-2022
Machine Name:
Kernel base = 0xfffff800`c4870000 PsLoadedModuleList = 0xfffff800`c4b49250
Debug session time: Sun Feb 22 08:00:53.784 2015 (UTC - 5:00)
System Uptime: 0 days 23:07:30.478
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {110339f0, 2, 0, fffff8015852e704}

*** WARNING: Unable to verify timestamp for Rt630x64.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt630x64.sys
Probably caused by : Rt630x64.sys ( Rt630x64+7d704 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000110339f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8015852e704, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800c4bd3138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 00000000110339f0 

CURRENT_IRQL:  2

FAULTING_IP: 
Rt630x64+7d704
fffff801`5852e704 f781f039000000080000 test dword ptr [rcx+39F0h],800h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

TRAP_FRAME:  ffffd00068e4e190 -- (.trap 0xffffd00068e4e190)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000011030000
rdx=000000000000f8dc rsi=0000000000000000 rdi=0000000000000000
rip=fffff8015852e704 rsp=ffffd00068e4e320 rbp=000000000000be00
 r8=000000000000c305  r9=0000000000000000 r10=ffffe00111030000
r11=ffffd00068e4e328 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
Rt630x64+0x7d704:
fffff801`5852e704 f781f039000000080000 test dword ptr [rcx+39F0h],800h ds:00000000`110339f0=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800c49cc4e9 to fffff800c49c09a0

STACK_TEXT:  
ffffd000`68e4e048 fffff800`c49cc4e9 : 00000000`0000000a 00000000`110339f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd000`68e4e050 fffff800`c49cad3a : 00000000`00000000 00000000`11030000 fffff800`c4840000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd000`68e4e190 fffff801`5852e704 : ffffe001`11030000 fffff801`58514c35 ffffe001`11030000 00000000`fe173000 : nt!KiPageFault+0x23a
ffffd000`68e4e320 ffffe001`11030000 : fffff801`58514c35 ffffe001`11030000 00000000`fe173000 00000000`0000e434 : Rt630x64+0x7d704
ffffd000`68e4e328 fffff801`58514c35 : ffffe001`11030000 00000000`fe173000 00000000`0000e434 00000000`0000c602 : 0xffffe001`11030000
ffffd000`68e4e330 ffffe001`11030000 : 00000000`fe173000 00000000`0000e434 00000000`0000c602 ffffe001`11030001 : Rt630x64+0x63c35
ffffd000`68e4e338 00000000`fe173000 : 00000000`0000e434 00000000`0000c602 ffffe001`11030001 fffff801`58535c01 : 0xffffe001`11030000
ffffd000`68e4e340 00000000`0000e434 : 00000000`0000c602 ffffe001`11030001 fffff801`58535c01 ffffe001`11030000 : 0xfe173000
ffffd000`68e4e348 00000000`0000c602 : ffffe001`11030001 fffff801`58535c01 ffffe001`11030000 00000000`0000be00 : 0xe434
ffffd000`68e4e350 ffffe001`11030001 : fffff801`58535c01 ffffe001`11030000 00000000`0000be00 00000000`00000000 : 0xc602
ffffd000`68e4e358 fffff801`58535c01 : ffffe001`11030000 00000000`0000be00 00000000`00000000 ffffe001`11030001 : 0xffffe001`11030001
ffffd000`68e4e360 ffffe001`11030000 : 00000000`0000be00 00000000`00000000 ffffe001`11030001 00000000`00000001 : Rt630x64+0x84c01
ffffd000`68e4e368 00000000`0000be00 : 00000000`00000000 ffffe001`11030001 00000000`00000001 00000000`00000000 : 0xffffe001`11030000
ffffd000`68e4e370 00000000`00000000 : ffffe001`11030001 00000000`00000001 00000000`00000000 00000000`00000004 : 0xbe00


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Rt630x64+7d704
fffff801`5852e704 f781f039000000080000 test dword ptr [rcx+39F0h],800h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Rt630x64+7d704

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt630x64

IMAGE_NAME:  Rt630x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51f21ecf

FAILURE_BUCKET_ID:  AV_Rt630x64+7d704

BUCKET_ID:  AV_Rt630x64+7d704

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_rt630x64+7d704

FAILURE_ID_HASH:  {ca4dc231-9a24-c2a6-58f1-7cd27bbc69f4}

Followup: MachineOwner
---------


Free Windows Admin Tool Kit Click here and download it now
February 22nd, 2015 8:55am

I installed a program called driverdoc and it said I had a lot of drivers which are out of date. I don't have the money to pay for the service so I have downloaded SlimDrivers. I'm not entirely sure how to go about deleting drivers or finding new ones. I'm a PC novice you see. I've updated a few using this software but I'm not sure where to go from there.

February 22nd, 2015 3:02pm

DA

You should not use the "driverdoc" type of apps.  They rely on a list which may or may not be current

How To Find Drivers:
Search
 Google for the name of the driver
Compare the Google results with what's installed on your system to figure out which device/program it belongs to
Visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
If there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program

The most common drivers are listed on these pages: 
http://www.carrona.org/dvrref.php
http://sysnative.com/drivers/

Driver manufacturer links are on this page: http://www.carrona.org

Free Windows Admin Tool Kit Click here and download it now
February 23rd, 2015 7:30am

I think I've updated my drivers correctly now but I got another BSOD today :( 

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M

Should I post my files again?

February 25th, 2015 12:35pm

I've uploaded my dmp files to skydrive

https://onedrive.live.com/?cid=F3D7DCFB17BFC2CD&id=F3D7DCFB17BFC2CD%211603

Free Windows Admin Tool Kit Click here and download it now
February 25th, 2015 12:41pm

DTyas

There is a problem with the link  Please try it again.

February 25th, 2015 1:52pm

Here's the link sorry

https://onedrive.live.com/redir?resid=F3D7DCFB17BFC2CD%211655

Free Windows Admin Tool Kit Click here and download it now
February 25th, 2015 2:32pm

DT

of the 5 DMPS there were 3 different error codes.  Please run driver verifier to find the undrlying issue

These crashes were related to memory corruption (probably caused by a driver). 

Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless you want to.

If you are over-clocking anything reset to default before running these tests.
In other words STOP!!! 
 

If you do not know what this means you probably are not


1-Driver verifier (for complete directions see our wiki here)

2-Memtest. (You can read more about running memtest here)


February 25th, 2015 2:56pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics