rc91

BSOD error on Windows 8

Recommended Posts

Just like the title says, occasionally (about once a week) the second it starts up and shows the lock screen picture or right after moving the picture to get to the login, I get the newly redesigned ( :lol:) Blue Screen, with a message telling me: "To get more information on this error, search later for: KERNEL_SECURITY_CHECK_FAILURE". When I open the dump file, it implicates the file oanet.sys. This has been going on for about 2 months now, and its finally getting aggravating. So, any ideas?

Share this post


Link to post
Share on other sites

Would it be possible for you to send us a copy of the memory dump?

Note that it is possible that the memory dump won't contain the information necessary to determine what went wrong unless it is a full memory dump (I think by default Windows only dumps the kernel's memory). You can find instructions on how to change those settings at this link.

Share this post


Link to post
Share on other sites

Here's the 2 minidump files from the 2 most recent BSODs (any older than these two have mysteriously disappeared). I also have in C:\Windows a file named MEMORY.dmp that's 346 MB and may be the full dump you're looking for, if you want it.

Share this post


Link to post
Share on other sites

Yes, that MEMORY.DMP file will be the important one. At 346MB it probably does not contain anything more than the Kernel memory, so it probably won't contain the information that is necessary for our developers to determine the cause of the issue. If you want to go ahead and send it to me, then right-click on the file, go to "Send To", and click on "Compressed (zipped) Folder" to see if you can get it down below the file size limit for attachment.

Share this post


Link to post
Share on other sites

I went ahead and switched the dump mode to full. I'm also going to need an alternate way to get the file to you, cause I've tried 3 times (twice with the regular uploader, got "Upload Skipped (Error IO)", once with the basic uploader, the uploader section changed to an unable to display webpage message).

Share this post


Link to post
Share on other sites

You can upload it to a website such as RapidShare/DepositFiles/BayFiles/etc (which one you use is up to you), and then copy and paste the link to download the file into a reply (or you can send it to me in a Private Message if you don't want the link posted publicly on the forums).

Note that RapidShare and BayFiles have been having issues lately, and we may not be able to download the files from them. If you have DropBox, Google Cloud Storage, or Microsoft SkyDrive then those services would be more reliable.

If you have 7-Zip or WinRar, and compressing the file as a 7z archive or a RAR archive reduces the size more than ZIP, then feel free to use those formats. Most of us use software that can decompress most popular formats (including things such as gzip and bzip2).

Share this post


Link to post
Share on other sites

I haven't received a reply yet. I'll send Andrey an e-mail and see if he has had a chance to take a look at it.

Share this post


Link to post
Share on other sites

It looks like our developers didn't get the first message with the link to the dump. Not sure if that was a Skype issue or if it was something else.

The minidumps say the BSoD originated in ntkrnlmp.exe, however it may just not contain enough information to trace the issue further than that. They are just minidumps, and don't necessarily contain all of the information about what happened. As for the memory.dmp file, it was corrupted, and we were not able to learn anything from it.

Share this post


Link to post
Share on other sites

Corrupted? I mean I still have the original copy and it seems to work fine (except that it complains that it can't load symbols for OAnet.sys). Is there any chance that it could have been corrupted due to the compression? I'm only asking that because Microsoft seems to have lowered the limit on file uploads on Skydrive to 100 MB and I had to pull some serious tricks in 7-Zip to get it under that size.

Share this post


Link to post
Share on other sites

Ok, forget that last post, and that dump file. That BSoD just happened again. I do have a new dump file. However, whatever is going on seems to have killed off my internet connection so I'm having to post this from my smartphone. I'm going to need help getting it back.

Share this post


Link to post
Share on other sites

However, whatever is going on seems to have killed off my internet connection so I'm having to post this from my smartphone. I'm going to need help getting it back.

Yeah, forget that part as well please. My router decided to go nuts on me and I didn't realize it till just now (This has been a bad day :( ). Here's the newest addition to the minidump folder, assuming you need it. Also the new memory.dmp is going to be a challenge too, because the new one has a size of 3.8

GB.

Share this post


Link to post
Share on other sites

The minidumps probably won't contain enough information to debug the issue, however I have passed the link on to Andrey so that he can take a look.

Now that the BSoD has happened again, the MEMORY.DMP file should contain a full memory dump. It's going to be large, and you won't be able to compress it below 100MB, so you may need to look for a service with more storage space.

Share this post


Link to post
Share on other sites

Ok, I'll have to see about it tomorrow. It might be a little while before you get a link since my upstream internet speeds are really slow.

Share this post


Link to post
Share on other sites

... It might be a little while before you get a link since my upstream internet speeds are really slow.

That's OK. ;)

As for the latest minidump, it didn't contain any further information. Just the same data as the previous two.

Share this post


Link to post
Share on other sites

Andrey beat me to it, and has already downloaded the memory dump. ;)

He'll take a look at it as soon as he can, and see if the memory dump shows the information he needs.

Share this post


Link to post
Share on other sites

Andrey is saying the the memory dump is corrupt. He is also asking what version of 7-Zip you used when compressing it?

Share this post


Link to post
Share on other sites

Technically there's newer than that, but they are alpha/beta versions. 9.20 is the last stable release from the 7-Zip project.

May I ask what settings you are using to compress the memory dumps?

Share this post


Link to post
Share on other sites

Lets see...

  • Compression level: Ultra
  • Compression method: LZMA
  • Dictionary size: 64MB
  • Word size: 64
  • Solid Block size: 4GB
  • CPU threads: 2
  • Update mode: Add and replace files

In general, what initially shows when the add dialog box pops up

Share this post


Link to post
Share on other sites

The Dictionary size defaults to 32MB for me, but that's the only difference, and it may be because the file I tested on is small. I don't think that would make a difference. We're checking to see if the download is corrupt for me as well, but my download is going really slow.

Share this post


Link to post
Share on other sites

I checked the compressed copy I still have on my PC, I got the thing open and was able to use the !analyze -v command (which is the extent of what I know how to do).

Share this post


Link to post
Share on other sites

That's very strange. Technically it shouldn't extract if the 7z archive was corrupted.

Any possibility that you could use something such as MultiHasher to generate a SHA1 checksum of the original memory.dmp file and post that for us to compare with?

Share this post


Link to post
Share on other sites

This should be it (file before compression, right?)

A63D61E6887C371E85B83974BBC94D189C2D3047

Share this post


Link to post
Share on other sites

Yes, from before compressing it.

I have the same SHA1, which means that the file should be intact. I'll ask Andrey if he gets the same SHA1 hash that we did.

Share this post


Link to post
Share on other sites

Ok. I'm happy that its not something that I did. That would have made me feel really dumb and bad.

Share this post


Link to post
Share on other sites

OK, Andrey has figure out why he couldn't open the crash dump. He'll take a look at it as soon as he can. ;)

Share this post


Link to post
Share on other sites

Andrey has finished looking over the memory dump, and he believes that he has found the cause of the crash. Hopefully he will be able to get a fix ready for testing soon. ;)

  • Upvote 1

Share this post


Link to post
Share on other sites

Remember that ntkrnlmp.exe file your developers were talking about. Well, it just caused a NTFS_FILE_SYSTEM BSoD while trying to shut down my PC, then, after copying the dump files and trying to restart the PC to try and reproduce what happened, the BSoD that I came here at first about made a reappearance. Also, my version of WinDbg can not access the symbols (telling me the symbol path is wrong even though the path is correct), so I can only tell you what file the dump files are implicating. I can attach the new minidump files, but the main dump files might, again, take a while, and I can't start it this weekend.

 

So, should I be concerned?

Share this post


Link to post
Share on other sites

If the BSoD has the same cause as the one you were experiencing, then Andrey already knows what was causing it, and should be working on a fix as soon as he can. ;)

Share this post


Link to post
Share on other sites

Andrey just told me that the first memory dump contains no information about Online Armor, but points to ntfs.sys as the cause. The second one points to the same issue you were having before with Online Armor.

Share this post


Link to post
Share on other sites

I was expecting the second one to say the same thing. The first one worries me because on my pc, it pointed to ntkrnlmp.exe as the cause, and since it was connected to the issue with OA, I thought that I would come here and ask. However both of them were giving me some weird error messages.

Share this post


Link to post
Share on other sites

It's possible that there is some filesystem damage that caused the issue. Have you checked your hard drive for errors?

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.