rc91 2 Posted April 24, 2013 Report Share Posted April 24, 2013 Just like the title says, occasionally (about once a week) the second it starts up and shows the lock screen picture or right after moving the picture to get to the login, I get the newly redesigned ( ) Blue Screen, with a message telling me: "To get more information on this error, search later for: KERNEL_SECURITY_CHECK_FAILURE". When I open the dump file, it implicates the file oanet.sys. This has been going on for about 2 months now, and its finally getting aggravating. So, any ideas? Quote Link to post Share on other sites
GT500 853 Posted April 25, 2013 Report Share Posted April 25, 2013 Would it be possible for you to send us a copy of the memory dump? Note that it is possible that the memory dump won't contain the information necessary to determine what went wrong unless it is a full memory dump (I think by default Windows only dumps the kernel's memory). You can find instructions on how to change those settings at this link. Quote Link to post Share on other sites
rc91 2 Posted April 25, 2013 Author Report Share Posted April 25, 2013 Here's the 2 minidump files from the 2 most recent BSODs (any older than these two have mysteriously disappeared). I also have in C:\Windows a file named MEMORY.dmp that's 346 MB and may be the full dump you're looking for, if you want it. Quote Link to post Share on other sites
GT500 853 Posted April 26, 2013 Report Share Posted April 26, 2013 Yes, that MEMORY.DMP file will be the important one. At 346MB it probably does not contain anything more than the Kernel memory, so it probably won't contain the information that is necessary for our developers to determine the cause of the issue. If you want to go ahead and send it to me, then right-click on the file, go to "Send To", and click on "Compressed (zipped) Folder" to see if you can get it down below the file size limit for attachment. Quote Link to post Share on other sites
rc91 2 Posted April 26, 2013 Author Report Share Posted April 26, 2013 I went ahead and switched the dump mode to full. I'm also going to need an alternate way to get the file to you, cause I've tried 3 times (twice with the regular uploader, got "Upload Skipped (Error IO)", once with the basic uploader, the uploader section changed to an unable to display webpage message). Quote Link to post Share on other sites
GT500 853 Posted April 26, 2013 Report Share Posted April 26, 2013 You can upload it to a website such as RapidShare/DepositFiles/BayFiles/etc (which one you use is up to you), and then copy and paste the link to download the file into a reply (or you can send it to me in a Private Message if you don't want the link posted publicly on the forums). Note that RapidShare and BayFiles have been having issues lately, and we may not be able to download the files from them. If you have DropBox, Google Cloud Storage, or Microsoft SkyDrive then those services would be more reliable. If you have 7-Zip or WinRar, and compressing the file as a 7z archive or a RAR archive reduces the size more than ZIP, then feel free to use those formats. Most of us use software that can decompress most popular formats (including things such as gzip and bzip2). Quote Link to post Share on other sites
rc91 2 Posted April 26, 2013 Author Report Share Posted April 26, 2013 I'll get the file to skydrive and PM you a link asap. Quote Link to post Share on other sites
GT500 853 Posted April 26, 2013 Report Share Posted April 26, 2013 OK. Quote Link to post Share on other sites
rc91 2 Posted May 2, 2013 Author Report Share Posted May 2, 2013 Um, did the developers ever find anything or was there not enough info? Quote Link to post Share on other sites
GT500 853 Posted May 4, 2013 Report Share Posted May 4, 2013 I haven't received a reply yet. I'll send Andrey an e-mail and see if he has had a chance to take a look at it. Quote Link to post Share on other sites
rc91 2 Posted May 6, 2013 Author Report Share Posted May 6, 2013 Ok, hadn't heard a reply in almost a week, so I thought I'd ask. Quote Link to post Share on other sites
GT500 853 Posted May 8, 2013 Report Share Posted May 8, 2013 It looks like our developers didn't get the first message with the link to the dump. Not sure if that was a Skype issue or if it was something else. The minidumps say the BSoD originated in ntkrnlmp.exe, however it may just not contain enough information to trace the issue further than that. They are just minidumps, and don't necessarily contain all of the information about what happened. As for the memory.dmp file, it was corrupted, and we were not able to learn anything from it. Quote Link to post Share on other sites
rc91 2 Posted May 8, 2013 Author Report Share Posted May 8, 2013 Corrupted? I mean I still have the original copy and it seems to work fine (except that it complains that it can't load symbols for OAnet.sys). Is there any chance that it could have been corrupted due to the compression? I'm only asking that because Microsoft seems to have lowered the limit on file uploads on Skydrive to 100 MB and I had to pull some serious tricks in 7-Zip to get it under that size. Quote Link to post Share on other sites
rc91 2 Posted May 8, 2013 Author Report Share Posted May 8, 2013 Ok, forget that last post, and that dump file. That BSoD just happened again. I do have a new dump file. However, whatever is going on seems to have killed off my internet connection so I'm having to post this from my smartphone. I'm going to need help getting it back. Quote Link to post Share on other sites
rc91 2 Posted May 8, 2013 Author Report Share Posted May 8, 2013 However, whatever is going on seems to have killed off my internet connection so I'm having to post this from my smartphone. I'm going to need help getting it back. Yeah, forget that part as well please. My router decided to go nuts on me and I didn't realize it till just now (This has been a bad day ). Here's the newest addition to the minidump folder, assuming you need it. Also the new memory.dmp is going to be a challenge too, because the new one has a size of 3.8 GB. Quote Link to post Share on other sites
GT500 853 Posted May 9, 2013 Report Share Posted May 9, 2013 The minidumps probably won't contain enough information to debug the issue, however I have passed the link on to Andrey so that he can take a look. Now that the BSoD has happened again, the MEMORY.DMP file should contain a full memory dump. It's going to be large, and you won't be able to compress it below 100MB, so you may need to look for a service with more storage space. Quote Link to post Share on other sites
rc91 2 Posted May 9, 2013 Author Report Share Posted May 9, 2013 Ok, I'll have to see about it tomorrow. It might be a little while before you get a link since my upstream internet speeds are really slow. Quote Link to post Share on other sites
GT500 853 Posted May 10, 2013 Report Share Posted May 10, 2013 ... It might be a little while before you get a link since my upstream internet speeds are really slow. That's OK. As for the latest minidump, it didn't contain any further information. Just the same data as the previous two. Quote Link to post Share on other sites
rc91 2 Posted May 10, 2013 Author Report Share Posted May 10, 2013 Well that didn't take as long as I thought it would. http://rapidshare.com/files/3088222667/MEMORY.7z Quote Link to post Share on other sites
GT500 853 Posted May 10, 2013 Report Share Posted May 10, 2013 Andrey beat me to it, and has already downloaded the memory dump. He'll take a look at it as soon as he can, and see if the memory dump shows the information he needs. Quote Link to post Share on other sites
GT500 853 Posted May 11, 2013 Report Share Posted May 11, 2013 Andrey is saying the the memory dump is corrupt. He is also asking what version of 7-Zip you used when compressing it? Quote Link to post Share on other sites
rc91 2 Posted May 11, 2013 Author Report Share Posted May 11, 2013 9.20. Its the latest that I can find. Quote Link to post Share on other sites
GT500 853 Posted May 11, 2013 Report Share Posted May 11, 2013 Technically there's newer than that, but they are alpha/beta versions. 9.20 is the last stable release from the 7-Zip project. May I ask what settings you are using to compress the memory dumps? Quote Link to post Share on other sites
rc91 2 Posted May 11, 2013 Author Report Share Posted May 11, 2013 Lets see... Compression level: Ultra Compression method: LZMA Dictionary size: 64MB Word size: 64 Solid Block size: 4GB CPU threads: 2 Update mode: Add and replace files In general, what initially shows when the add dialog box pops up Quote Link to post Share on other sites
GT500 853 Posted May 11, 2013 Report Share Posted May 11, 2013 The Dictionary size defaults to 32MB for me, but that's the only difference, and it may be because the file I tested on is small. I don't think that would make a difference. We're checking to see if the download is corrupt for me as well, but my download is going really slow. Quote Link to post Share on other sites
rc91 2 Posted May 11, 2013 Author Report Share Posted May 11, 2013 I'm checking the compressed version on my PC. Quote Link to post Share on other sites
rc91 2 Posted May 11, 2013 Author Report Share Posted May 11, 2013 I checked the compressed copy I still have on my PC, I got the thing open and was able to use the !analyze -v command (which is the extent of what I know how to do). Quote Link to post Share on other sites
GT500 853 Posted May 15, 2013 Report Share Posted May 15, 2013 That's very strange. Technically it shouldn't extract if the 7z archive was corrupted. Any possibility that you could use something such as MultiHasher to generate a SHA1 checksum of the original memory.dmp file and post that for us to compare with? Quote Link to post Share on other sites
rc91 2 Posted May 15, 2013 Author Report Share Posted May 15, 2013 This should be it (file before compression, right?) A63D61E6887C371E85B83974BBC94D189C2D3047 Quote Link to post Share on other sites
GT500 853 Posted May 15, 2013 Report Share Posted May 15, 2013 Yes, from before compressing it. I have the same SHA1, which means that the file should be intact. I'll ask Andrey if he gets the same SHA1 hash that we did. Quote Link to post Share on other sites
rc91 2 Posted May 16, 2013 Author Report Share Posted May 16, 2013 Ok. I'm happy that its not something that I did. That would have made me feel really dumb and bad. Quote Link to post Share on other sites
GT500 853 Posted May 16, 2013 Report Share Posted May 16, 2013 OK, Andrey has figure out why he couldn't open the crash dump. He'll take a look at it as soon as he can. Quote Link to post Share on other sites
GT500 853 Posted May 16, 2013 Report Share Posted May 16, 2013 Andrey has finished looking over the memory dump, and he believes that he has found the cause of the crash. Hopefully he will be able to get a fix ready for testing soon. 1 Quote Link to post Share on other sites
rc91 2 Posted May 16, 2013 Author Report Share Posted May 16, 2013 That's awesome. Thanks so much for the help. Quote Link to post Share on other sites
GT500 853 Posted May 17, 2013 Report Share Posted May 17, 2013 You're quite welcome. Quote Link to post Share on other sites
rc91 2 Posted May 18, 2013 Author Report Share Posted May 18, 2013 Remember that ntkrnlmp.exe file your developers were talking about. Well, it just caused a NTFS_FILE_SYSTEM BSoD while trying to shut down my PC, then, after copying the dump files and trying to restart the PC to try and reproduce what happened, the BSoD that I came here at first about made a reappearance. Also, my version of WinDbg can not access the symbols (telling me the symbol path is wrong even though the path is correct), so I can only tell you what file the dump files are implicating. I can attach the new minidump files, but the main dump files might, again, take a while, and I can't start it this weekend. So, should I be concerned? Quote Link to post Share on other sites
GT500 853 Posted May 22, 2013 Report Share Posted May 22, 2013 If the BSoD has the same cause as the one you were experiencing, then Andrey already knows what was causing it, and should be working on a fix as soon as he can. Quote Link to post Share on other sites
GT500 853 Posted May 22, 2013 Report Share Posted May 22, 2013 Andrey just told me that the first memory dump contains no information about Online Armor, but points to ntfs.sys as the cause. The second one points to the same issue you were having before with Online Armor. Quote Link to post Share on other sites
rc91 2 Posted May 22, 2013 Author Report Share Posted May 22, 2013 I was expecting the second one to say the same thing. The first one worries me because on my pc, it pointed to ntkrnlmp.exe as the cause, and since it was connected to the issue with OA, I thought that I would come here and ask. However both of them were giving me some weird error messages. Quote Link to post Share on other sites
GT500 853 Posted May 23, 2013 Report Share Posted May 23, 2013 It's possible that there is some filesystem damage that caused the issue. Have you checked your hard drive for errors? Quote Link to post Share on other sites
rc91 2 Posted May 23, 2013 Author Report Share Posted May 23, 2013 I ran it, says it found nothing. Quote Link to post Share on other sites
GT500 853 Posted May 24, 2013 Report Share Posted May 24, 2013 Hopefully that means that it was an isolated incident. Quote Link to post Share on other sites
rc91 2 Posted May 24, 2013 Author Report Share Posted May 24, 2013 Hopefully it does. I'm already irritated enough at this computer Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.