0

I recently started experiencing BSODs every time I allow my computer to go idle. The specific Bug Check error codes I'm receiving (0x139 with parameter 1 = 3) are, according to this Microsoft support page, particularly difficult to diagnose.

Without going into details, some process is being initiated which causes Windows to crash and I want to know what that process is.

Using Process Monitor and Process Explorer, I can see that various processes are being initiated just before the crash occurs - but, even when using various filters to reduce the output volume, I just can't read as fast as my computer can update the display.

Assuming I don't have time to manually save before the crash happens, what techniques could I use to automatically log the output to disk? Is there any way to auto-log from Process Monitor (or Explorer, for that matter)? Alternatively, are there any alternative tools that can tell me this information which do support auto-logging?

If not, is there a screen capture tool that can write direct to a video file that won't be corrupted if the write process is interrupted by a crash?

I guess, if worst comes to worst, I could film my screen from a cellphone - but I expect that will be a fairly painful method to use.

Thanks in advance for any help offered.

Cheers, Zac

Improve this question
10
  • You should be looking at crash dump for more detailed information. Crash Dump can be found at C:\Windows\Minidump\ and you can use freely available windbg.exe (a microsoft tool) to analyse the dumps.
    – clhy
    Jul 20, 2015 at 14:05
  • Thanks, I'm already reading the minidump logs via BlueScreenView. It's telling me the process running when the crash occurred is ntoskrnl.exe - however it's not actually the cause of the problem. The actual problem (LIST_ENTRY corruption) occurs at an earlier time than the crash occurs and the minidump can't be used to identify that (explained in the page I linked in the question, above). Hence why I'm trying to log processes in the time leading up to the crash.
    – Zac
    Jul 20, 2015 at 14:31
  • that's why i never use bluescreenview or whocrash etc. whatever be the reason of crash, it is always(if not for otherwise) logged in crashdump. It is nowhere mentioned that List_entry corruption cannot be analysed using windbg
    – clhy
    Jul 20, 2015 at 14:35
  • Well, that's true - I'm reading now as to how to use windbg (never had to do this type of investigation before).
    – Zac
    Jul 20, 2015 at 14:49
  • Does it always happen when you leave it idle for some time ? Like before the computer is about to go to sleep or standby etc...cos i have seen many devices(with old/corrupted drivers) enabled to change computers power management cause the crash
    – clhy
    Jul 20, 2015 at 15:01

1 Answer 1

Reset to default
1

Your crash dump shows this:

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd0002054c2b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd0002054c208, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


SYSTEM_SKU:  P09ABE.012.CP

SYSTEM_VERSION:  P09ABE.012.CP

BIOS_DATE:  07/04/2013

BASEBOARD_PRODUCT:  NP350V5C-A0EUK

BASEBOARD_VERSION:  BOARD REVISION 00

BUGCHECK_P1: 3

BUGCHECK_P2: ffffd0002054c2b0

BUGCHECK_P3: ffffd0002054c208

BUGCHECK_P4: 0

TRAP_FRAME:  ffffd0002054c2b0 -- (.trap 0xffffd0002054c2b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe000a9a204e0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe000aa8e64e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801476dd699 rsp=ffffd0002054c440 rbp=ffffd0002054c4d9
 r8=0000000000000000  r9=0000000000000002 r10=ffffe000acd2e620
r11=ffffe000ae13333c r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
ndis!ndisNsiGetAllInterfaceInformation+0x25819:
fffff801`476dd699 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffd0002054c208 -- (.exr 0xffffd0002054c208)
ExceptionAddress: fffff801476dd699 (ndis!ndisNsiGetAllInterfaceInformation+0x0000000000025819)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 4

CPU_MHZ: 9be

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3a

CPU_STEPPING: 9

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  LIST_ENTRY_CORRUPT

BUGCHECK_STR:  0x139

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den  berlauf eines stapelbasierten Puffers ermittelt. Dieser  berlauf k nnte einem b sartigen Benutzer erm glichen, die Steuerung der Anwendung zu  bernehmen.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den  berlauf eines stapelbasierten Puffers ermittelt. Dieser  berlauf k nnte einem b sartigen Benutzer erm glichen, die Steuerung der Anwendung zu  bernehmen.

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_VERSION: 10.0.10240.9 amd64fre

LAST_CONTROL_TRANSFER:  from fffff802843ce7e9 to fffff802843c2ca0

STACK_TEXT:  
00 nt!KeBugCheckEx
01 nt!KiBugCheckDispatch
02 nt!KiFastFailDispatch
03 nt!KiRaiseSecurityCheckFailure
04 ndis!ndisNsiGetAllInterfaceInformation
05 NETIO!NsiGetAllParametersEx
06 nsiproxy!NsippGetAllParameters
07 nsiproxy!NsippDispatch
08 nt!IopXxxControlFile
09 nt!NtDeviceIoControlFile
0a nt!KiSystemServiceCopyEnd
0b 0x0


FOLLOWUP_IP: 
NETIO!NsiGetAllParametersEx+1f8
fffff801`474077d3 8bf0            mov     esi,eax

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  NETIO!NsiGetAllParametersEx+1f8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  546029c5

IMAGE_VERSION:  6.3.9600.17485

BUCKET_ID_FUNC_OFFSET:  1f8

FAILURE_BUCKET_ID:  0x139_3_NETIO!NsiGetAllParametersEx

BUCKET_ID:  0x139_3_NETIO!NsiGetAllParametersEx

PRIMARY_PROBLEM_CLASS:  0x139_3_NETIO!NsiGetAllParametersEx

This crash at NETIO.sys is a known issue that Microsoft already fixed with an the hotfix KB3055343.

Click on Hotfix Download Available, enter your email to request the hotfix. Extract the Exe that is linked in the email and install the hotfix via the Windows8.1-KB3055343-x64.msu file.

Improve this answer
3
  • Tentatively, it appears that the hotfix has done the trick. Thanks again for looking into this for me, the regular crashes have been driving me crazy and interfering with my work, so you really saved me on this one...
    – Zac
    Jul 27, 2015 at 10:43
  • @Zac nice to hear that your issue is now fixed :)
    – magicandre1981
    Jul 27, 2015 at 15:58
  • Microsoft now deploys version 2 of the update over WindowsUpdate to all users.
    – magicandre1981
    Jul 31, 2015 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .