Kernel Security Check Failure & Page Fault in Non Paged Area BSOD

[mattinglis]

I built my own computer 6 months ago, but for the past few weeks I've been experiencing crashes, the most common being the Kernel Security Check Failure. I've done everything I can for this error, and for the most part it seems to have gone away. I rolled back my graphics driver, I used Malwarebytes to scan my PC, as well as AVG and CCleaner. It used to only occur during gaming, but now can occur when I'm only browsing on Google Chrome.

But I recently just suffered a Page Fault in Non Paged Area BSOD, which came with "(dxgkrnLsys)" code. I ran Windows Memory Diagnostic and nothing came up. I followed a method which told me to uncheck "Automatically manage paging file size for all drives." but the crash still occured.

I used BlueScreenViewer and it highlights "dxgkrnl.sys" and "ntsokrnl". I'll attach the dmp file.

OS: Windows 10 Home (64-bit)
Processor: AMD FX(tm)-6350 Six-Core Processor (3.90Ghz)
Graphics Driver: NVIDIA GeForce GTX 960
Installed Memory: 8Gb

I'm also using;
Linksys WUSB600N Wireless-N USB Network Adapter with Dual-Band ver. 2

I feel I should point this out because I read somewhere that this may be a cause of either the Kernel Security Check Failure error or the Page Fault in Non Paged Area error.

 

[Trouble]

Can you create a new folder on your desktop, name it "Dumps" or whatever you choose, then.....
Browse to C:\WINDOWS\Minidump
Copy the contents of that folder into the new folder you created, right click the new folder and choose "Send to compressed (zipped) folder"
Attach the zipped file to your next post and we'll try to have a look and see if we can spot any glaring problems.

 

[mattinglis]

Can you create a new folder on your desktop, name it "Dumps" or whatever you choose, then.....
Browse to C:\WINDOWS\Minidump
Copy the contents of that folder into the new folder you created, right click the new folder and choose "Send to compressed (zipped) folder"
Attach the zipped file to your next post and we'll try to have a look and see if we can spot any glaring problems.

Here you go.

 

[mattinglis]

Can you create a new folder on your desktop, name it "Dumps" or whatever you choose, then.....
Browse to C:\WINDOWS\Minidump
Copy the contents of that folder into the new folder you created, right click the new folder and choose "Send to compressed (zipped) folder"
Attach the zipped file to your next post and we'll try to have a look and see if we can spot any glaring problems.

any idea?

 

[Trouble]

Unfortunately, a single memory dump is not a lot to go on and because it is a bit vague while at the same time all over the place suggesting......
Memory Corruption

BugCheck 50, {ffffa0005d78d418, 2, fffff80092f44eb0, 2}
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
GetPointerFromAddress: unable to read from fffff8038aa0d270
Probably caused by : memory_corruption

AND

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffa0005d78d418, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff80092f44eb0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

The first thing I would suggest is that you completely remove AVG and all of its' components, using the Programs and Features applet in the Control Panel and follow that up by using the vendor specific proprietary removal tool located here http://www.avg.com/us-en/utilities
You can always re-install it later assuming it proves not to be at fault.
Continuing on with further possible driver issues, I could only find one that looked to old for your system
GKS16Fltr.sys 12/19/2011 Which looks like a driver for a Gaming Keyboard although the actual info available on that particular file is less than comprehensive.
You need to address that. Try to determine what software installed it and see if you can remove the software and confirm that, that driver is no longer located in C:\Windows\System32\Drivers

Then, see if you can force another BSOD.
IF so, then you probably need to move on to the Memory Corruption / Page Fault concern.
Test your system memory with
Memtest86+ from this location here. Burn the ISO to a CD and boot the computer from the CD from a cold boot after leaving it off for an hour or more.

Ideally let it run for at least 7 passes / 6-8 hours (over night is good too). If errors appear before that you can stop that particular test. Any time Memtest86+ reports errors, it can be either bad RAM or a bad Mobo slot. Perform the test RAM sticks individually as well as all possible combinations. When you find a good one then test it in all slots. Post back with the results.

See this Guide to using Memtest 86+

 

[mattinglis]

Unfortunately, a single memory dump is not a lot to go on and because it is a bit vague while at the same time all over the place suggesting......
Memory Corruption

AND

The first thing I would suggest is that you completely remove AVG and all of its' components, using the Programs and Features applet in the Control Panel and follow that up by using the vendor specific proprietary removal tool located here http://www.avg.com/us-en/utilities
You can always re-install it later assuming it proves not to be at fault.
Continuing on with further possible driver issues, I could only find one that looked to old for your system
GKS16Fltr.sys 12/19/2011 Which looks like a driver for a Gaming Keyboard although the actual info available on that particular file is less than comprehensive.
You need to address that. Try to determine what software installed it and see if you can remove the software and confirm that, that driver is no longer located in C:\Windows\System32\Drivers

Then, see if you can force another BSOD.
IF so, then you probably need to move on to the Memory Corruption / Page Fault concern.
Test your system memory with
Memtest86+ from this location here. Burn the ISO to a CD and boot the computer from the CD from a cold boot after leaving it off for an hour or more.

Ideally let it run for at least 7 passes / 6-8 hours (over night is good too). If errors appear before that you can stop that particular test. Any time Memtest86+ reports errors, it can be either bad RAM or a bad Mobo slot. Perform the test RAM sticks individually as well as all possible combinations. When you find a good one then test it in all slots. Post back with the results.

See this Guide to using Memtest 86+

My Gaming Keyboard is actually very old so that may be a possibility. I will uninstall AVG and all it's components, would it be safe to install another anti-virus like Avast or just stick with Windows Defender whilst trying to test if another crash occurs?

 

[Trouble]

My recommendation, at least for now, would be to leave the native Defender and Firewall components of Windows 10 to the task.
The less third party products you have in the mix, the better.
Additionally, there is apparently a BIOS update for that board, you may want to check and confirm.
I can't say with any degree of certainty that a firmware upgrade will impact the problem but it might be something to keep in mind and file away for later.

 

[mattinglis]

My recommendation, at least for now, would be to leave the native Defender and Firewall components of Windows 10 to the task.
The less third party products you have in the mix, the better.
Additionally, there is apparently a BIOS update for that board, you may want to check and confirm.
I can't say with any degree of certainty that a firmware upgrade will impact the problem but it might be something to keep in mind and file away for later.

Two more crashes, both BSOD errors occured.


--

Another Page Fault BSOD occured whilst uninstalling AVG, yet after the automatic restart the computer wouldn't display, but it was definitely on. I had to hold the power button, then turn the computer off at the switch, press the button again, turn the computer on at the switch and then press the power button to turn it on again so it would display.

 

[Trouble]

Both of those reflect that neither AVG nor GKS16Fltry.sys have been removed.

 

[mattinglis]

Both of those reflect that AVG nor GKS16Fltry.sys have been removed.

Those files were before AVG was attempted to be removed, just incase you spotted anything else. No minidump file seems to have been created for the most recent crash :\, nor does it appear in BlueScreenViewer.

 

[Trouble]

One was almost identical to your previous dump file. The other was a 139 while apparently Steam was running and mentions
win32k.sys as well as FLTMGR.sys both of which are native Windows system files and are probably not involved but getting blamed anyway.

BugCheck 139, {3, ffffd00020dcb0f0, ffffd00020dcb048, 0}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

TRAP_FRAME: ffffd00020dcb0f0 -- (.trap 0xffffd00020dcb0f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe000e42b3ea0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe000e42b3e78 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80041389c26 rsp=ffffd00020dcb280 rbp=ffffe000e433e780
r8=0000000000000000 r9=ffffd00020dcb380 r10=fffff800413a5940
r11=ffffd00020dcb250 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
FLTMGR!FltpGetStreamListCtrl+0x346:
fffff800`41389c26 cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffffd00020dcb048 -- (.exr 0xffffd00020dcb048)
ExceptionAddress: fffff80041389c26 (FLTMGR!FltpGetStreamListCtrl+0x0000000000000346)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT
BUGCHECK_STR: 0x139
PROCESS_NAME: Steam.exe

 

[mattinglis]

One was almost identical to your previous dump file. The other was a 139 while apparently Steam was running and mentions
win32k.sys as well as FLTMGR.sys both of which are native Windows system files and are probably not involved but getting blamed anyway.

I suffered another crash, this time the error was "Memory Management". I googled this error and ran the SFC Scanner, which returned with this message;

Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

I can attach the CBS.log if necessary.

 

[Trouble]

You can try using an admin command prompt and running
Dism /Online /Cleanup-Image /RestoreHealth
IF that seems to complete without errors then try rebooting and running
sfc /scannow
again and see if it produces the same errors.

Did you boot from the memtest86+ CD and check your system memory.
The most recent dump file is a bit deprecated

BugCheck C000021A, {ffffc00043f1a0a0, ffffffffc0000020, ffffc000389fc910, 0}
----- ETW minidump data unavailable-----
Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+74d )

I noted that
GKS16Fltr.sys 12/19/2011
Is still present on the system. Have you taken steps to at least temporarily uninstall it?
IF nothing else you might find it in C:\Windows\System32\Drivers and rename it from GKS16Fltr.sys to GKS16Fltr.OLD that should break it and keep it from loading (after a reboot). Just to see if it is actually the issue. IF not you can always go back and change the file extension back to .sys from .OLD

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffffc00043f1a0a0, String that identifies the problem.
Arg2: ffffffffc0000020, Error Code.
Arg3: ffffc000389fc910
Arg4: 0000000000000000
da ffffc000389fc910
ffffc000`389fc910 "gdiplus.dll"

GDI Plus or GDI+ is Windows Graphics Device Interface (GDI) the graphics device interface.

I built my own computer 6 months ago, but for the past few weeks I've been experiencing crashes

That might lead one to suspect that every thing was working like a swiss watch up until a "few weeks" ago
Which begs the question.... what happened a "few weeks" ago.
Guess #1
A particular hardware component began to fail
Test your memory with memtest86+ as suggested above
Test the hard drive with the native Check Disk utility and if the hard drive manufacturer provides a utility for testing use that also.
Test your GPU with something like FurMark http://www.majorgeeks.com/files/details/furmark.html
Guess #2
Something happened (software installation or uninstall or update, hardware driver package installation or uninstall or update, failed or corrupt Windows Update, etc.,) that resulted in Operating System files corruption.

You say you built the system 6 months ago. How did Windows 10 come to be installed? Did you perform a custom clean install? Did you install a previous version of Windows and then upgrade to 10?

I haven't seen anything definitive in your dump files as to a particular source pointing to anything specific.
Do your best to eliminate any potential questions about hardware components by performing the tests I suggested above.
Make sure that you have the latest drivers from the board manufacturer regarding chipset and storage controllers along with any other sub-system drivers like USB 3.0, audio, network components, etc., etc.
That won't eliminate possible processor or physical motherboard problems but it'll at least serve to test those components you can readily test.

 

[mattinglis]

You can try using an admin command prompt and running
Dism /Online /Cleanup-Image /RestoreHealth
IF that seems to complete without errors then try rebooting and running
sfc /scannow
again and see if it produces the same errors.

Did you boot from the memtest86+ CD and check your system memory.
The most recent dump file is a bit deprecated

I noted that
GKS16Fltr.sys 12/19/2011
Is still present on the system. Have you taken steps to at least temporarily uninstall it?
IF nothing else you might find it in C:\Windows\System32\Drivers and rename it from GKS16Fltr.sys to GKS16Fltr.OLD that should break it and keep it from loading (after a reboot). Just to see if it is actually the issue. IF not you can always go back and change the file extension back to .sys from .OLD

GDI Plus or GDI+ is Windows Graphics Device Interface (GDI) the graphics device interface.

That might lead one to suspect that every thing was working like a swiss watch up until a "few weeks" ago
Which begs the question.... what happened a "few weeks" ago.
Guess #1
A particular hardware component began to fail
Test your memory with memtest86+ as suggested above
Test the hard drive with the native Check Disk utility and if the hard drive manufacturer provides a utility for testing use that also.
Test your GPU with something like FurMark http://www.majorgeeks.com/files/details/furmark.html
Guess #2
Something happened (software installation or uninstall or update, hardware driver package installation or uninstall or update, failed or corrupt Windows Update, etc.,) that resulted in Operating System files corruption.

You say you built the system 6 months ago. How did Windows 10 come to be installed? Did you perform a custom clean install? Did you install a previous version of Windows and then upgrade to 10?

I haven't seen anything definitive in your dump files as to a particular source pointing to anything specific.
Do your best to eliminate any potential questions about hardware components by performing the tests I suggested above.
Make sure that you have the latest drivers from the board manufacturer regarding chipset and storage controllers along with any other sub-system drivers like USB 3.0, audio, network components, etc., etc.
That won't eliminate possible processor or physical motherboard problems but it'll at least serve to test those components you can readily test.

Thank you very much for all your help, I'll do my best to run through these tests as quick as possible. Also, I installed the OS completely brand new, using a Windows 10 Home installation disc, I didn't upgrade to it.

 

[mattinglis]

You can try using an admin command prompt and running
Dism /Online /Cleanup-Image /RestoreHealth
IF that seems to complete without errors then try rebooting and running
sfc /scannow
again and see if it produces the same errors.

Did you boot from the memtest86+ CD and check your system memory.
The most recent dump file is a bit deprecated

I noted that
GKS16Fltr.sys 12/19/2011
Is still present on the system. Have you taken steps to at least temporarily uninstall it?
IF nothing else you might find it in C:\Windows\System32\Drivers and rename it from GKS16Fltr.sys to GKS16Fltr.OLD that should break it and keep it from loading (after a reboot). Just to see if it is actually the issue. IF not you can always go back and change the file extension back to .sys from .OLD

GDI Plus or GDI+ is Windows Graphics Device Interface (GDI) the graphics device interface.

That might lead one to suspect that every thing was working like a swiss watch up until a "few weeks" ago
Which begs the question.... what happened a "few weeks" ago.
Guess #1
A particular hardware component began to fail
Test your memory with memtest86+ as suggested above
Test the hard drive with the native Check Disk utility and if the hard drive manufacturer provides a utility for testing use that also.
Test your GPU with something like FurMark http://www.majorgeeks.com/files/details/furmark.html
Guess #2
Something happened (software installation or uninstall or update, hardware driver package installation or uninstall or update, failed or corrupt Windows Update, etc.,) that resulted in Operating System files corruption.

You say you built the system 6 months ago. How did Windows 10 come to be installed? Did you perform a custom clean install? Did you install a previous version of Windows and then upgrade to 10?

I haven't seen anything definitive in your dump files as to a particular source pointing to anything specific.
Do your best to eliminate any potential questions about hardware components by performing the tests I suggested above.
Make sure that you have the latest drivers from the board manufacturer regarding chipset and storage controllers along with any other sub-system drivers like USB 3.0, audio, network components, etc., etc.
That won't eliminate possible processor or physical motherboard problems but it'll at least serve to test those components you can readily test.

Just to update, my computer has BSOD'd three times in a row, the first error being BAD_POOL_CALLER, then DRIVER_CORRUPTED_EXPOOL and then IRQL NOT LESS OR EQUAL. I've been busy and have not managed to do further troubleshooting, so this has been my only chance to fix it. Sounds like a hardware problem to me, but I'm not an expert. Using the Check Disk Utility by going into Properties on my Local Disk Drive resulted in no errors being found.

Using RestoreHealth etc command in CMD resulted in this:

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.

 

[Trouble]

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature

You'll need to specify the install.wim location in the sources directory of the installation media, such as

Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /limitaccess

Where D:\ is the drive on which your installation media is located.
Afterwards, IF it completes successfully, reboot
Then open another admin command prompt and run
sfc /scannow
again and see if this time it reports that it was in fact able to repair the problem.

 

[dumpchkr]

I built my own computer 6 months ago, but for the past few weeks I've been experiencing crashes, the most common being the Kernel Security Check Failure. I've done everything I can for this error, and for the most part it seems to have gone away. I rolled back my graphics driver, I used Malwarebytes to scan my PC, as well as AVG and CCleaner. It used to only occur during gaming, but now can occur when I'm only browsing on Google Chrome.

But I recently just suffered a Page Fault in Non Paged Area BSOD, which came with "(dxgkrnLsys)" code. I ran Windows Memory Diagnostic and nothing came up. I followed a method which told me to uncheck "Automatically manage paging file size for all drives." but the crash still occured.

I used BlueScreenViewer and it highlights "dxgkrnl.sys" and "ntsokrnl". I'll attach the dmp file.

OS: Windows 10 Home (64-bit)
Processor: AMD FX(tm)-6350 Six-Core Processor (3.90Ghz)
Graphics Driver: NVIDIA GeForce GTX 960
Installed Memory: 8Gb

I'm also using;
Linksys WUSB600N Wireless-N USB Network Adapter with Dual-Band ver. 2

I feel I should point this out because I read somewhere that this may be a cause of either the Kernel Security Check Failure error or the Page Fault in Non Paged Area error.

A couple of things. You should never have more than one AV Programs, with real-time protection installed and running at the same time. This combination almost always results in a conflict scenario, that could potentially lead to file corruption.

In this case, you seem to be running the premium version of MBAM and AVG, and this likely the cause of your issues. Either uninstall AVG completely and keep MBAM, or keep AVG and downgrade MBAM to the free version (without RTP), to use only as a second opinion scanner.

As for the dump, the crash was caused by your NVidia Display driver.......

ffffd000`2ebc6968 fffff800`92e1a2b0 dxgkrnl!ADAPTER_RENDER:diQueryDependentEngineGroup+0x1ac
ffffd000`2ebc6970 fffff800`94c59225Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys

Navigate to "Services", locate and disable nVidia Streaming Kernel service. Reboot. If that does not result in a resolution, upload and share more dumps.