[SOLVED] Windows 10 frequent BSODs “KERNEL_SECURITY_CHECK_FAILURE”
- Thread starter Devilmoon
- Start date
Devilmoon
Active member
- Aug 10, 2020
- 30
We're coming up on 12 hours and still no issues to report, the last BSOD could have been an outlier.
@Cknoettg if you have an account on Superuser and want to write an answer to my original question over there describing the issue with the MSI driver I can award you the bounty I had set up, but it expires tomorrow. Let me know!
@Cknoettg if you have an account on Superuser and want to write an answer to my original question over there describing the issue with the MSI driver I can award you the bounty I had set up, but it expires tomorrow. Let me know!
Devilmoon
Active member
- Aug 10, 2020
- 30
I got another BSOD while sleeping, attaching minidump and full dump here.
They do not seem to be Verifier related - at least, I couldn't find anything in the stack related to one of the drivers. Should I stop Verifier or let it continue?
This is the output of /query as of this morning:
The drivers I could find mentioned in the stack are:
They do not seem to be Verifier related - at least, I couldn't find anything in the stack related to one of the drivers. Should I stop Verifier or let it continue?
This is the output of /query as of this morning:
The drivers I could find mentioned in the stack are:
- nt
- ntfs
- hal
- fileinfo
- fltmgr
Devilmoon
Active member
- Aug 10, 2020
- 30
Looking over the previous dump I noticed that it contains a few more drivers than this one, i.e.:
- cldflt
- FLTMGR
- Ntfs
- crashdmp
- dump_dumpstorport
- dump_stornvme
- dxgkrnl
- nvlddmkm
Actually, when we ran lm, we found:
fffff804`74240000 fffff804`74248000 NTIOLib_X64.
Because the Event logs earlier showed that the MSI Afterburner driver was in the MSI Gaming Apps folder, I didn't think to check if it was also located somewhere else.
Is MSI Afterburner listed in your installed Apps by chance?
fffff804`74240000 fffff804`74248000 NTIOLib_X64.
Because the Event logs earlier showed that the MSI Afterburner driver was in the MSI Gaming Apps folder, I didn't think to check if it was also located somewhere else.
Is MSI Afterburner listed in your installed Apps by chance?
Devilmoon
Active member
- Aug 10, 2020
- 30
Also found this blog post: MSI ntiolib.sys/winio.sys local privilege escalation – ReWolf's blog
This is probably why NTIOLib crashes so frequently while trying to access memory locations?
This is probably why NTIOLib crashes so frequently while trying to access memory locations?
Good find.
As much as I hate to have you do it, I would go ahead and uninstall any app that uses it for now, to make sure we root this out.
Devilmoon
Active member
- Aug 10, 2020
- 30
And apparently it doesn't play nice with Valorant and its anti-cheat system Vanguard. Just google for NTIOlib_x64 valorant or valorant msi and you'll find plenty of examples like this one:
I did actually try playing Valorant while it was in beta and uninstalled it specifically because of Vanguard, that might have been the event that started it all?
No problem at all, as I said I never use them and I'd rather get rid of unsecure drivers.
Sysnative Windows Update
Inactive
- Oct 9, 2014
- 741
Hi!
Please do the following:
Step#1 - FRST Scan
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.
Please do the following:
Step#1 - FRST Scan
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.
Devilmoon
Active member
- Aug 10, 2020
- 30
A quick update:
I had a string of BSODs over the past couple of days but I think it was due to a bug in one of the libraries I'm using, see feature_importance causes a BSOD on Windows 10 · Issue #18187 · scikit-learn/scikit-learn.
I had a string of BSODs over the past couple of days but I think it was due to a bug in one of the libraries I'm using, see feature_importance causes a BSOD on Windows 10 · Issue #18187 · scikit-learn/scikit-learn.
Has Sysnative Forums helped you? Please consider donating to help us support the site!