BSOD error on Windows 8

[rc91 2]

Just like the title says, occasionally (about once a week) the second it starts up and shows the lock screen picture or right after moving the picture to get to the login, I get the newly redesigned ( ) Blue Screen, with a message telling me: "To get more information on this error, search later for: KERNEL_SECURITY_CHECK_FAILURE". When I open the dump file, it implicates the file oanet.sys. This has been going on for about 2 months now, and its finally getting aggravating. So, any ideas?

[GT500 813]

Would it be possible for you to send us a copy of the memory dump?

Note that it is possible that the memory dump won't contain the information necessary to determine what went wrong unless it is a full memory dump (I think by default Windows only dumps the kernel's memory). You can find instructions on how to change those settings at this link.

[rc91 2]

Here's the 2 minidump files from the 2 most recent BSODs (any older than these two have mysteriously disappeared). I also have in C:\Windows a file named MEMORY.dmp that's 346 MB and may be the full dump you're looking for, if you want it.

[GT500 813]

Yes, that MEMORY.DMP file will be the important one. At 346MB it probably does not contain anything more than the Kernel memory, so it probably won't contain the information that is necessary for our developers to determine the cause of the issue. If you want to go ahead and send it to me, then right-click on the file, go to "Send To", and click on "Compressed (zipped) Folder" to see if you can get it down below the file size limit for attachment.

[rc91 2]

I went ahead and switched the dump mode to full. I'm also going to need an alternate way to get the file to you, cause I've tried 3 times (twice with the regular uploader, got "Upload Skipped (Error IO)", once with the basic uploader, the uploader section changed to an unable to display webpage message).

[GT500 813]

You can upload it to a website such as RapidShare/DepositFiles/BayFiles/etc (which one you use is up to you), and then copy and paste the link to download the file into a reply (or you can send it to me in a Private Message if you don't want the link posted publicly on the forums).

Note that RapidShare and BayFiles have been having issues lately, and we may not be able to download the files from them. If you have DropBox, Google Cloud Storage, or Microsoft SkyDrive then those services would be more reliable.

If you have 7-Zip or WinRar, and compressing the file as a 7z archive or a RAR archive reduces the size more than ZIP, then feel free to use those formats. Most of us use software that can decompress most popular formats (including things such as gzip and bzip2).

[rc91 2]

I'll get the file to skydrive and PM you a link asap.

[GT500 813]

OK.

[rc91 2]

Um, did the developers ever find anything or was there not enough info?

[GT500 813]

I haven't received a reply yet. I'll send Andrey an e-mail and see if he has had a chance to take a look at it.

[rc91 2]

Ok, hadn't heard a reply in almost a week, so I thought I'd ask.

[GT500 813]

It looks like our developers didn't get the first message with the link to the dump. Not sure if that was a Skype issue or if it was something else.

The minidumps say the BSoD originated in ntkrnlmp.exe, however it may just not contain enough information to trace the issue further than that. They are just minidumps, and don't necessarily contain all of the information about what happened. As for the memory.dmp file, it was corrupted, and we were not able to learn anything from it.

[rc91 2]

Corrupted? I mean I still have the original copy and it seems to work fine (except that it complains that it can't load symbols for OAnet.sys). Is there any chance that it could have been corrupted due to the compression? I'm only asking that because Microsoft seems to have lowered the limit on file uploads on Skydrive to 100 MB and I had to pull some serious tricks in 7-Zip to get it under that size.

[rc91 2]

Ok, forget that last post, and that dump file. That BSoD just happened again. I do have a new dump file. However, whatever is going on seems to have killed off my internet connection so I'm having to post this from my smartphone. I'm going to need help getting it back.

[rc91 2]

However, whatever is going on seems to have killed off my internet connection so I'm having to post this from my smartphone. I'm going to need help getting it back.

Yeah, forget that part as well please. My router decided to go nuts on me and I didn't realize it till just now (This has been a bad day  ). Here's the newest addition to the minidump folder, assuming you need it. Also the new memory.dmp is going to be a challenge too, because the new one has a size of 3.8

GB.

[GT500 813]

The minidumps probably won't contain enough information to debug the issue, however I have passed the link on to Andrey so that he can take a look.

Now that the BSoD has happened again, the MEMORY.DMP file should contain a full memory dump. It's going to be large, and you won't be able to compress it below 100MB, so you may need to look for a service with more storage space.

[rc91 2]

Ok, I'll have to see about it tomorrow. It might be a little while before you get a link since my upstream internet speeds are really slow.

[GT500 813]

... It might be a little while before you get a link since my upstream internet speeds are really slow.

That's OK.

As for the latest minidump, it didn't contain any further information. Just the same data as the previous two.

[rc91 2]

Well that didn't take as long as I thought it would.

 

http://rapidshare.com/files/3088222667/MEMORY.7z

 

[GT500 813]

Andrey beat me to it, and has already downloaded the memory dump.

He'll take a look at it as soon as he can, and see if the memory dump shows the information he needs.

[GT500 813]

Andrey is saying the the memory dump is corrupt. He is also asking what version of 7-Zip you used when compressing it?

[rc91 2]

9.20. Its the latest that I can find.

[GT500 813]

Technically there's newer than that, but they are alpha/beta versions. 9.20 is the last stable release from the 7-Zip project.

May I ask what settings you are using to compress the memory dumps?

[rc91 2]

Lets see...

• Compression level: Ultra
• Compression method: LZMA
• Dictionary size: 64MB
• Word size: 64
• Solid Block size: 4GB
• CPU threads: 2
• Update mode: Add and replace files

In general, what initially shows when the add dialog box pops up

[GT500 813]

The Dictionary size defaults to 32MB for me, but that's the only difference, and it may be because the file I tested on is small. I don't think that would make a difference. We're checking to see if the download is corrupt for me as well, but my download is going really slow.

[rc91 2]

I'm checking the compressed version on my PC.

[rc91 2]

I checked the compressed copy I still have on my PC, I got the thing open and was able to use the !analyze -v command (which is the extent of what I know how to do).

[GT500 813]

That's very strange. Technically it shouldn't extract if the 7z archive was corrupted.

Any possibility that you could use something such as MultiHasher to generate a SHA1 checksum of the original memory.dmp file and post that for us to compare with?

[rc91 2]

This should be it (file before compression, right?)

A63D61E6887C371E85B83974BBC94D189C2D3047

[GT500 813]

Yes, from before compressing it.

I have the same SHA1, which means that the file should be intact. I'll ask Andrey if he gets the same SHA1 hash that we did.

[rc91 2]

Ok. I'm happy that its not something that I did. That would have made me feel really dumb and bad.

[GT500 813]

OK, Andrey has figure out why he couldn't open the crash dump. He'll take a look at it as soon as he can.

[GT500 813]

Andrey has finished looking over the memory dump, and he believes that he has found the cause of the crash. Hopefully he will be able to get a fix ready for testing soon.

[rc91 2]

That's awesome. Thanks so much for the help.

[GT500 813]

You're quite welcome.

[rc91 2]

Remember that ntkrnlmp.exe file your developers were talking about. Well, it just caused a NTFS_FILE_SYSTEM BSoD while trying to shut down my PC, then, after copying the dump files and trying to restart the PC to try and reproduce what happened, the BSoD that I came here at first about made a reappearance. Also, my version of WinDbg can not access the symbols (telling me the symbol path is wrong even though the path is correct), so I can only tell you what file the dump files are implicating. I can attach the new minidump files, but the main dump files might, again, take a while, and I can't start it this weekend.

 

So, should I be concerned?

[GT500 813]

If the BSoD has the same cause as the one you were experiencing, then Andrey already knows what was causing it, and should be working on a fix as soon as he can.

[GT500 813]

Andrey just told me that the first memory dump contains no information about Online Armor, but points to ntfs.sys as the cause. The second one points to the same issue you were having before with Online Armor.

[rc91 2]

I was expecting the second one to say the same thing. The first one worries me because on my pc, it pointed to ntkrnlmp.exe as the cause, and since it was connected to the issue with OA, I thought that I would come here and ask. However both of them were giving me some weird error messages.

[GT500 813]

It's possible that there is some filesystem damage that caused the issue. Have you checked your hard drive for errors?

[rc91 2]

I ran it, says it found nothing.

[GT500 813]

Hopefully that means that it was an isolated incident.

[rc91 2]

Hopefully it does. I'm already irritated enough at this computer