Windows 8 crashes and with the error "kernel_security_check_failure" after installing Boot Camp drivers.

Question

Level 1

0 points

Windows 8 crashes and with the error "kernel_security_check_failure" after installing Boot Camp drivers.

Hi!

I've got a new 27" iMac (late 2013), and I was going to install Windows 8.1 (64-bit) to be able to play a few games.

Everything went smoothly (installed normally via Boot Camp Assistant), and after the Windows setup, the Boot Camp drivers needed to be installed. After this, the computer rebooted, but crashed at a blue screen with the error called "kernel_security_check_failure".

It rebooted a few times on its own, but after a few times, I got some options, and I chose to "refresh" the Windows 8 install, meaning it would reset the install while keeping my files (even though I didn't have any, as I never got to use it). This took some time, but it worked, and it booted into W8.

The Boot Camp drivers had been removed though, so I had to reinstall them. After they had reinstalled, the computer rebooted and the same blue screen with the same error hit me. 😟

Something tells me that some of the BC drivers are messing things up. I can't find any information on this elsewhere.

Would it be possible to install only selected drivers, to eventually find out which driver is causing the problem?

All help is greatly appreciated! 🙂

iMac, OS X Mavericks (10.9), 27" iMac (Late 2013)

Posted on Nov 26, 2013 12:51 PM

Reply

Answer 1

Best reply

simgust Author

Level 1

0 points

Dec 9, 2013 12:18 AM in response to simgust

To anyone who is having this problem, I found the issue. Well, my issue at least. Whenever my WD external harddrive was connected, I got the BSOD. Very weird, but well, well!

Reply

Answer 2

Feb 21, 2014 2:58 AM in response to simgust

Thank you Simgust!!!!!!

I was looking for the solutions for 3 nights! Didn't think to unplug the WD drive....

Strange bug by the way...

Reply

Answer 3

Gmouse1

Level 1

19 points

Jun 15, 2014 1:56 AM in response to Prophet_rs

I am getting the same error, with Win 8.1 and Mavericks 10.9.3 on new 27" iMac (Late 2013). Have the 1 TB internal SSD, and three G-Drives connected externally, one RAID-0 4 GB (external Mac disk), 1 single disk 4 TB partitioned 1 TB NTFS for backup/3 TB for Time Machine, 1 single disk 4 TB for external Windows disk. All connected via Thunderbolt.

Was your WD connected with USB or Thunderbolt?

Seems to be something with external drives...I had to remove all of them to get Windows to load in Boot Camp, kept giving me errors. Any idea of a fix? I belong to Microsoft Premier and searched for this error or issues with Boot Camp, and got VERY few hits...none recent or helpful.

Thanks.

Reply

Answer 4

Gmouse1

Level 1

19 points

Jun 17, 2014 12:51 AM in response to Gmouse1

I finally gave up, reloaded everything, this time, using WIn 8.1 Pro, not Enterprise. After I did the updates, patches, Norton 360, shut computer down and connected the external drives, and booted up...and got the BSOD. This time, I went to Microsoft and downloaded the Windows Debugger, and think I may have found the problem...NORTON!

Probably caused by : SYMDS64.SYS ( SYMDS64+71be6 )

Am conrtacting them, but, here's the Debugger output:

Loading Dump File [C:\Dump\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
Machine Name:
Kernel base = 0xfffff802`0f87e000 PsLoadedModuleList = 0xfffff802`0fb482d0
Debug session time: Tue Jun 17 00:48:52.131 2014 (UTC - 6:00)
System Uptime: 0 days 0:03:09.864
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols

Loading unloaded module list
.....................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, ffffd0002852d3e0, ffffd0002852d338, 0}

*** ERROR: Module load completed but symbols could not be loaded for SYMDS64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS
Probably caused by : SYMDS64.SYS ( SYMDS64+71be6 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd0002852d3e0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd0002852d338, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

TRAP_FRAME: ffffd0002852d3e0 -- (.trap 0xffffd0002852d3e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe00059c129f0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe0005718d2a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8020f9e8cdb rsp=ffffd0002852d570 rbp=0000000000000000
r8=0000000000005aa0 r9=00000000000007ff r10=ffffd00066cc8000
r11=ffffe00059963040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt! ?? ::FNODOBFM::`string'+0x682b:
fffff802`0f9e8cdb cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: ffffd0002852d338 -- (.exr 0xffffd0002852d338)
ExceptionAddress: fffff8020f9e8cdb (nt! ?? ::FNODOBFM::`string'+0x000000000000682b)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003

DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT

BUGCHECK_STR: 0x139

PROCESS_NAME: System

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

LAST_CONTROL_TRANSFER: from fffff8020f9ddae9 to fffff8020f9d1fa0

STACK_TEXT:
ffffd000`2852d0b8 fffff802`0f9ddae9 : 00000000`00000139 00000000`00000003 ffffd000`2852d3e0 ffffd000`2852d338 : nt!KeBugCheckEx
ffffd000`2852d0c0 fffff802`0f9dde10 : ffffe000`59c8cc40 00000000`00000000 ffffe000`54b71040 fffff800`1d6d40b6 : nt!KiBugCheckDispatch+0x69
ffffd000`2852d200 fffff802`0f9dd034 : 00000000`00000000 00000000`00000000 ffff6d2d`50094127 fffff802`0f81458f : nt!KiFastFailDispatch+0xd0
ffffd000`2852d3e0 fffff802`0f9e8cdb : ffffc000`061df4e0 ffffc000`061df4e0 ffffc000`061dfbf8 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf4
ffffd000`2852d570 fffff800`1d7a0be6 : ffffe000`59e10120 fffff800`1d794388 ffffe000`54dfe9c8 fffff800`1d735f7c : nt! ?? ::FNODOBFM::`string'+0x682b
ffffd000`2852d5a0 fffff800`1d7a54e2 : ffffc000`061df4e0 ffffc000`061dfbf8 ffffc000`061df550 fffff800`1d7367ea : SYMDS64+0x71be6
ffffd000`2852d5d0 fffff800`1d737f20 : ffffc000`061df378 ffffc000`061dfbf8 00000000`00000000 ffffc000`05a9bf18 : SYMDS64+0x764e2
ffffd000`2852d620 fffff800`1d73e171 : ffffc000`051e6a88 ffffc000`05a9bf18 ffffc000`05a9bf18 ffffe000`5988cb00 : SYMDS64+0x8f20
ffffd000`2852d650 fffff800`1d782027 : ffffc000`061ea018 00000000`00000000 ffffe000`58409008 fffff800`1d794388 : SYMDS64+0xf171
ffffd000`2852d680 fffff800`1d79af21 : ffffc000`061ea018 ffffd000`2852d8c9 ffffe000`58409008 00000000`10000004 : SYMDS64+0x53027
ffffd000`2852d6c0 fffff800`1d9a3bb3 : ffffe000`58409078 fffff800`1d98b3e8 ffffe000`58409008 ffffd000`2852d8c9 : SYMDS64+0x6bf21
ffffd000`2852d6f0 fffff800`1d9a91fa : ffffe000`5840a1a8 ffffe000`58409008 00000000`00000000 ffffe000`00000000 : SYMEFA64+0xe9bb3
ffffd000`2852d720 fffff800`1d9ae015 : 00000000`00000000 00000000`00000000 ffffd000`2852d8c9 ffffe000`58a10e60 : SYMEFA64+0xef1fa
ffffd000`2852d760 fffff800`1d9adf4c : 00000000`01820201 ffffe000`58a10e60 ffffe000`58a10e60 ffffe000`58a10be0 : SYMEFA64+0xf4015
ffffd000`2852d790 fffff800`1d9b294c : ffffe000`59e0a150 ffffe000`58a10e60 ffffe000`5988ca80 ffffe000`58a10e60 : SYMEFA64+0xf3f4c
ffffd000`2852d7c0 fffff800`1d9a2435 : ffffd000`2852d8a0 ffffe000`599a4010 ffffd000`00000000 ffffe000`59e0a010 : SYMEFA64+0xf894c
ffffd000`2852d7f0 fffff800`1d6d528a : 00000000`00000000 ffffe000`59e0a070 ffffe000`5604e300 ffffe000`58a10e60 : SYMEFA64+0xe8435
ffffd000`2852d820 fffff800`1d71bf76 : ffffd000`2852d960 00000000`00000000 ffffe000`5604f900 ffffe000`571dab10 : fltmgr!FltpPerformPreCallbacks+0x31a
ffffd000`2852d930 fffff800`1d6d413a : ffffe000`57170dd0 ffffe000`571dabd0 ffffe000`59cf18c0 fffff802`0fd411a7 : fltmgr!FltpProcessShutdownRequest+0x122
ffffd000`2852d9b0 fffff802`0fbf7518 : ffffe000`57170dd0 00000000`00000001 ffffe000`571dabd0 fffff802`0fb54a90 : fltmgr!FltpDispatch+0x13a
ffffd000`2852da10 fffff802`0fbf7273 : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000000 : nt!IopShutdownBaseFileSystems+0xb8
ffffd000`2852da90 fffff802`0fbfb722 : fffff802`0fbfb4b0 00000000`00000000 ffffe000`59963040 ffffe000`59963040 : nt!IoShutdownSystem+0x127
ffffd000`2852db10 fffff802`0f8d1adb : fffff802`0fbfb4b0 ffffd000`2852dbd0 00000000`00000000 ffffe000`59963040 : nt!PopGracefulShutdown+0x272
ffffd000`2852db50 fffff802`0f94d794 : ffffe000`59965800 ffffe000`59963040 ffffe000`59963040 ffffe000`54b71040 : nt!ExpWorkerThread+0x293
ffffd000`2852dc00 fffff802`0f9d85c6 : ffffd000`66c40180 ffffe000`59963040 ffffe000`59965800 00000000`00000000 : nt!PspSystemThreadStartup+0x58
ffffd000`2852dc60 00000000`00000000 : ffffd000`2852e000 ffffd000`28528000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
SYMDS64+71be6
fffff800`1d7a0be6 33d2 xor edx,edx

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: SYMDS64+71be6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMDS64

IMAGE_NAME: SYMDS64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 51f84c44

FAILURE_BUCKET_ID: 0x139_3_SYMDS64+71be6

BUCKET_ID: 0x139_3_SYMDS64+71be6

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_symds64+71be6

FAILURE_ID_HASH: {bf9be68b-5f04-08d4-3152-3d420dc362f6}

Followup: MachineOwner
---------

Reply

Answer 5

Jun 17, 2014 11:55 AM in response to Gmouse1

Hello Gmouse1,

Sorry for the inconvenience! I've replied to your post in Norton forums. I'll check the details with the concerned team & get back to you. Please be patient with me.

Thanks!

Harry

Norton Support

Reply