Jump to content

Recommended Posts

I got Windows 10 BSoD generated by: kneps.sys / klim6.sys - Anyone have the same issues ?

 

Strange behawioru - after crash report dump files are gone from OS.... :blink:

 

Update: BSoD happened after power on laptop from hibernate

 

Kernel base = 0xfffff803`cdc86000 PsLoadedModuleList = 0xfffff803`cdf63cf0
Debug session time: Sun Jul 31 04:47:07.402 2016 (UTC - 4:00)
System Uptime: 0 days 0:15:11.269
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000000d0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803cdd0734c, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
00000000000000d0 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeAcquireSpinLockRaiseToDpc+1c
fffff803`cdd0734c f0480fba2900    lock bts qword ptr [rcx],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

TRAP_FRAME:  fffff803cffc3d80 -- (.trap 0xfffff803cffc3d80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=00000000000000d0
rdx=ffffe001c85082b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803cdd0734c rsp=fffff803cffc3f10 rbp=fffff803cffc4020
r8=fffff803cffc4000  r9=0000000000000002 r10=0000000000ffffff
r11=fffff803cffc3fb8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeAcquireSpinLockRaiseToDpc+0x1c:
fffff803`cdd0734c f0480fba2900    lock bts qword ptr [rcx],0 ds:00000000`000000d0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff803cddd34e9 to fffff803cddc8940

STACK_TEXT:  
fffff803`cffc3c38 fffff803`cddd34e9 : 00000000`0000000a 00000000`000000d0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff803`cffc3c40 fffff803`cddd1cc7 : fffff803`cdf99b80 ffffe001`cd9317f8 fffff803`cffc3e89 fffff800`8b3e2987 : nt!KiBugCheckDispatch+0x69
fffff803`cffc3d80 fffff803`cdd0734c : ffffe001`cd246138 fffff800`8b3e1bc2 ffffe001`ccd6f638 ffffe001`00000000 : nt!KiPageFault+0x247
fffff803`cffc3f10 fffff800`8ad62bf0 : ffffe001`cd604198 fffff800`8b3d2cb6 00000000`00000001 ffffe001`cd909c38 : nt!KeAcquireSpinLockRaiseToDpc+0x1c
fffff803`cffc3f40 ffffe001`cd604198 : fffff800`8b3d2cb6 00000000`00000001 ffffe001`cd909c38 00000000`00000100 : klim6+0x2bf0
fffff803`cffc3f48 fffff800`8b3d2cb6 : 00000000`00000001 ffffe001`cd909c38 00000000`00000100 fffff800`8b3def40 : 0xffffe001`cd604198
fffff803`cffc3f50 00000000`00000001 : ffffe001`cd909c38 00000000`00000100 fffff800`8b3def40 ffffe001`cd21d260 : kneps+0x2cb6
fffff803`cffc3f58 ffffe001`cd909c38 : 00000000`00000100 fffff800`8b3def40 ffffe001`cd21d260 fffff800`8b3d3524 : 0x1
fffff803`cffc3f60 00000000`00000100 : fffff800`8b3def40 ffffe001`cd21d260 fffff800`8b3d3524 ffffe001`c85082b0 : 0xffffe001`cd909c38
fffff803`cffc3f68 fffff800`8b3def40 : ffffe001`cd21d260 fffff800`8b3d3524 ffffe001`c85082b0 ffffe001`cc792330 : 0x100
fffff803`cffc3f70 ffffe001`cd21d260 : fffff800`8b3d3524 ffffe001`c85082b0 ffffe001`cc792330 fffff803`cffc3fe0 : kneps+0xef40
fffff803`cffc3f78 fffff800`8b3d3524 : ffffe001`c85082b0 ffffe001`cc792330 fffff803`cffc3fe0 fffff800`8b3dc84f : 0xffffe001`cd21d260
fffff803`cffc3f80 ffffe001`c85082b0 : ffffe001`cc792330 fffff803`cffc3fe0 fffff800`8b3dc84f fffff800`8b3f1460 : kneps+0x3524
fffff803`cffc3f88 ffffe001`cc792330 : fffff803`cffc3fe0 fffff800`8b3dc84f fffff800`8b3f1460 ffffe001`c85082b0 : 0xffffe001`c85082b0
fffff803`cffc3f90 fffff803`cffc3fe0 : fffff800`8b3dc84f fffff800`8b3f1460 ffffe001`c85082b0 ffffe001`cd21d260 : 0xffffe001`cc792330
fffff803`cffc3f98 fffff800`8b3dc84f : fffff800`8b3f1460 ffffe001`c85082b0 ffffe001`cd21d260 fffff800`8b3d3b3d : 0xfffff803`cffc3fe0
fffff803`cffc3fa0 fffff800`8b3f1460 : ffffe001`c85082b0 ffffe001`cd21d260 fffff800`8b3d3b3d fffff803`cffc3fe0 : kneps+0xc84f
fffff803`cffc3fa8 ffffe001`c85082b0 : ffffe001`cd21d260 fffff800`8b3d3b3d fffff803`cffc3fe0 ffffe001`cd21d270 : kneps+0x21460
fffff803`cffc3fb0 ffffe001`cd21d260 : fffff800`8b3d3b3d fffff803`cffc3fe0 ffffe001`cd21d270 ffffe001`cd21d288 : 0xffffe001`c85082b0
fffff803`cffc3fb8 fffff800`8b3d3b3d : fffff803`cffc3fe0 ffffe001`cd21d270 ffffe001`cd21d288 ffffe001`000005ea : 0xffffe001`cd21d260
fffff803`cffc3fc0 fffff803`cffc3fe0 : ffffe001`cd21d270 ffffe001`cd21d288 ffffe001`000005ea fffff800`8b3f1540 : kneps+0x3b3d
fffff803`cffc3fc8 ffffe001`cd21d270 : ffffe001`cd21d288 ffffe001`000005ea fffff800`8b3f1540 ffffe001`cdc21270 : 0xfffff803`cffc3fe0
fffff803`cffc3fd0 ffffe001`cd21d288 : ffffe001`000005ea fffff800`8b3f1540 ffffe001`cdc21270 fffff800`8b3f1798 : 0xffffe001`cd21d270
fffff803`cffc3fd8 ffffe001`000005ea : fffff800`8b3f1540 ffffe001`cdc21270 fffff800`8b3f1798 ffff0100`00000000 : 0xffffe001`cd21d288
fffff803`cffc3fe0 fffff800`8b3f1540 : ffffe001`cdc21270 fffff800`8b3f1798 ffff0100`00000000 fffff803`cffc4000 : 0xffffe001`000005ea
fffff803`cffc3fe8 ffffe001`cdc21270 : fffff800`8b3f1798 ffff0100`00000000 fffff803`cffc4000 fffff803`cffc4000 : kneps+0x21540
fffff803`cffc3ff0 fffff800`8b3f1798 : ffff0100`00000000 fffff803`cffc4000 fffff803`cffc4000 fffff803`00000030 : 0xffffe001`cdc21270
fffff803`cffc3ff8 ffff0100`00000000 : fffff803`cffc4000 fffff803`cffc4000 fffff803`00000030 ffffe001`c754db88 : kneps+0x21798
fffff803`cffc4000 fffff803`cffc4000 : fffff803`cffc4000 fffff803`00000030 ffffe001`c754db88 ffffe001`cdd9f8c0 : 0xffff0100`00000000
fffff803`cffc4008 fffff803`cffc4000 : fffff803`00000030 ffffe001`c754db88 ffffe001`cdd9f8c0 ffffe001`cd21d260 : 0xfffff803`cffc4000
fffff803`cffc4010 fffff803`00000030 : ffffe001`c754db88 ffffe001`cdd9f8c0 ffffe001`cd21d260 00000000`00000000 : 0xfffff803`cffc4000
fffff803`cffc4018 ffffe001`c754db88 : ffffe001`cdd9f8c0 ffffe001`cd21d260 00000000`00000000 fffff803`cffc41d0 : 0xfffff803`00000030
fffff803`cffc4020 ffffe001`cdd9f8c0 : ffffe001`cd21d260 00000000`00000000 fffff803`cffc41d0 fffff803`cffc4150 : 0xffffe001`c754db88
fffff803`cffc4028 ffffe001`cd21d260 : 00000000`00000000 fffff803`cffc41d0 fffff803`cffc4150 fffff800`8b3d3bec : 0xffffe001`cdd9f8c0
fffff803`cffc4030 00000000`00000000 : fffff803`cffc41d0 fffff803`cffc4150 fffff800`8b3d3bec ffffe001`cd21d260 : 0xffffe001`cd21d260


STACK_COMMAND:  kb

FOLLOWUP_IP: 
klim6+2bf0
fffff800`8ad62bf0 8887d8000000    mov     byte ptr [rdi+0D8h],al

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  klim6+2bf0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: klim6

IMAGE_NAME:  klim6.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5761266d

FAILURE_BUCKET_ID:  X64_AV_klim6+2bf0

BUCKET_ID:  X64_AV_klim6+2bf0

Followup: MachineOwner
---------

Edited by bildos

Share this post


Link to post

Please contact Tech Support: https://center.kaspersky.com/

 

Please attach the following items to your Tech Support request:

 

1. Description of the issue.

 

2. GSI

 

3. Traces Please disable traces when done, or your hard drive will get full.

 

4. _Full_ Dump (MEMORY.DMP) Please, no mini-dumps, kernel dumps etc.

Share this post


Link to post

I have the same issue with Total Security, and it occurs on two different laptops. After resume from sleep. Kaspersky SW sent out several system logs to it's servers from both laptops, after this occurred numerous times (like 4-5 on each machine yesterday). As a point of reference, if I EXIT or PAUSE Kaspersky the issue consistently goes away. So it ONLY occurs when Kaspersky is active/running, and it NEVER occurs otherwise.

 

I have Total Security installed on another system (Intel NUC) but that one is never allowed to sleep so the issue does not occur there.

 

I cannot wait for updates, I have uninstalled Kaspersky and installed a competitor product for now.

 

Share this post


Link to post

Welcome. Please contact Tech Support: https://center.kaspersky.com/

 

Please attach the following items to your Tech Support request:

 

1. Description of the issue.

 

2. GSI

 

3. Traces Please disable traces when done, or your hard drive will get full.

 

4. _Full_ Dump (MEMORY.DMP) Please, no mini-dumps, kernel dumps etc.

Share this post


Link to post

I did support request and now it's escalated to Dev Team in Moscow. I hope they will provide fix ASAP.

Share this post


Link to post

One more with this problem, since upgraded from kis 2016 to 2017 i am getting windows 10 bsod every time that i start from hibernate mode.

If i restart the computer i dont get any bsod.

Share this post


Link to post

INC000006507053:

 

"There is no priority level for us. From the moment the case is escalated than it is in the hands of the developpers.

They decide what is priority and what not. "

 

Share this post


Link to post

And what exactly you want us to do with this information? Only KL can address this issue so please carry on with Tech Support.

Share this post


Link to post

Fix has been shared from Dev Team for testing. To get it please refer to my support call number.

Edited by bildos

Share this post


Link to post
Fix has been shared from Dev Team for testing. To get it please refer to my support call number.

 

 

I have the same problem with the new KIS 17. With 16 its working perfectly. Please share the fix.

 

Sorry if i am posted something wrong as i am new to forum.

 

Thank You.

Share this post


Link to post

Welcome. Please contact Tech Support: https://center.kaspersky.com/

 

Please attach the following items to your Tech Support request:

 

1. Description of the issue.

 

2. GSI

 

3. Traces Please disable traces when done, or your hard drive will get full.

 

4. _Full_ Dump (MEMORY.DMP) Please, no mini-dumps, kernel dumps etc.

Share this post


Link to post
I have the same problem with the new KIS 17. With 16 its working perfectly. Please share the fix.

 

Sorry if i am posted something wrong as i am new to forum.

 

Thank You.

 

Contact with support and ask for fix from: INC00006507053

Share this post


Link to post

I would love to contact Support but why is it that every time I try to, I'm told that my request is not been sent and to try again later? I've been trying to contact them for two weeks now on the BSoD issue and frankly, I'm getting a bit upset with how internet filing support is going, and I do not have time to set on the phone... and I do not usually have time to file my report until after midnight eastern standard time.

 

What is there, a limit on when support claims can be filed? If so, could there maybe be a window that could be posted on when to contact support?

Share this post


Link to post

There is no limit you probably hit a maintenance window. Try again and let us know how it goes. If at first you are not successful try again until you get some results.

Share this post


Link to post
There is no limit you probably hit a maintenance window. Try again and let us know how it goes. If at first you are not successful try again until you get some results.

A two week maintenance, though? That sounds a bit off. I just tried again before coming back over here because the BSoD happened again, and I'm still shut out of sending a request online.

 

Might it be possible that someone didn't turn the window off so that requests could be sent?

Share this post


Link to post
A two week maintenance, though? That sounds a bit off. I just tried again before coming back over here because the BSoD happened again, and I'm still shut out of sending a request online.

 

Might it be possible that someone didn't turn the window off so that requests could be sent?

 

Please send me a PM with the e-mail your "My Kaspersky" account is registered to.

Share this post


Link to post

I am having this problem also on Windows 10. I think it might have something to do with the Kaspersky Security Data Escort Adapter. I already contacted support and sent them a memory dump file and a GetSystemInfo report. Did not get a response back yet.

Share this post


Link to post
Contact with support and ask for fix from: INC00006507053

I am told that the patch with this fix will be released Sept. 5.

Share this post


Link to post

I have same problem updating to internet security 17.0.0.611(a) is it best to un-install until its fixed ?

 

post-197328-1472319724_thumb.png

 

 

 

Share this post


Link to post

Best to contact Tech Support.

 

Please contact Tech Support: https://center.kaspersky.com/

 

Please attach the following items to your Tech Support request:

 

1. Description of the issue.

 

2. GSI

 

3. Traces Please disable traces when done, or your hard drive will get full.

 

4. _Full_ Dump (MEMORY.DMP) Please, no mini-dumps, kernel dumps etc.

Share this post


Link to post

dissapointing. i get this bsod to. regularly now. i searched my memory dumps and it says the same kneps.sys. im uninstalling kaspersky for the time being. i would like to see this adressed quickly.

Share this post


Link to post

Three off-topic posts were removed.

 

Please contact Tech Support: https://center.kaspersky.com/

 

Please attach the following items to your Tech Support request:

 

1. Description of the issue.

 

2. GSI

 

3. Traces Please disable traces when done, or your hard drive will get full.

 

4. _Full_ Dump (MEMORY.DMP) Please, no mini-dumps, kernel dumps etc.

Share this post


Link to post
Guest
This topic is now closed to further replies.

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.