BSOD. Windbg indicates Csrss.exe. F4 Code. Can't Figure it out.


  1. Posts : 162
    Windows 7 Professional 64 Bit Service Pack 1
       #1

    BSOD. Windbg indicates Csrss.exe. F4 Code. Can't Figure it out.


    Hi all.

    This is my first post here, so I'll try and make it a good one.

    I've built my first Enthusiast PC (detailed specs are in my profile) and have had only 1 issue.

    I've been getting a random BSOD since day 1 of uptime. I've used Windbg, Whocrashed, Memtest, Intelburn Test, Chkdsk /f .. All have turned up nothing useful or out of the ordinary that I can see.

    Whocrashed points to ntoskrnl.exe with no identified driver.
    Windbg likes to suggest Csrss.exe as the culprit.

    I'm running the latest drivers/installs for
    GPU's, BIOS, MARVELL adapters, CD ROM drive, HDD drive, SSD drive.


    • ACHI is enabled.
    • Trim Enabled.
    • I've tried running the drives on both the Marvell adapter and the Intel ATA sockets
    • I've uninstalled and re-installed almost every driver I can think of.
    • BSOD happens with Stock settings (CPU, GPU), and overclocked settings.
    • Doesn't seem to crash as long as I log out and sit on the log in screen
    • will crash at least once every 24 hrs.
    • will crash at idle, gaming, surfing, DVD playback.
    • does not crash at the same time of the day.
    • cannot find any event logs pointing to the crash. no logs are reported at time of crash.
    • superfetch is disabled (by me) through service management.


    The machine has passed IntelBurn with good results. Memtest ran for 8 hours with 3 passes, no errors.

    I'm running out of ideas. I'm posting here as a last ditch before starting over with the install.

    Please... help. I've included every piece of information suggested by the forum. The basic windows info, A paste of the Windbg report, and the ZIP file built just like the sticky suggests at the top of this forum.

    Is Windows 7 . . . - x64 - the original installed OS on the system - Full Retail Version - What is the age of system (hardware) Less than 1 month - What is the age of OS installation (have you re-installed the OS?) Less than 1 month
    WINDBG REPORT:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\092611-31075-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0xfffff800`07067000 PsLoadedModuleList = 0xfffff800`072ac670
    Debug session time: Mon Sep 26 07:49:59.686 2011 (UTC - 7:00)
    System Uptime: 0 days 22:32:12.498
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ............................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck F4, {3, fffffa80120b29d0, fffffa80120b2cb0, fffff800073e78b0}

    Probably caused by : csrss.exe

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    CRITICAL_OBJECT_TERMINATION (f4)
    A process or thread crucial to system operation has unexpectedly exited or been
    terminated.
    Several processes and threads are necessary for the operation of the
    system; when they are terminated (for any reason), the system can no
    longer function.
    Arguments:
    Arg1: 0000000000000003, Process
    Arg2: fffffa80120b29d0, Terminating object
    Arg3: fffffa80120b2cb0, Process image file name
    Arg4: fffff800073e78b0, Explanatory message (ascii)

    Debugging Details:
    ------------------


    PROCESS_OBJECT: fffffa80120b29d0

    IMAGE_NAME: csrss.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MODULE_NAME: csrss

    FAULTING_MODULE: 0000000000000000

    PROCESS_NAME: csrss.exe

    EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

    BUGCHECK_STR: 0xF4_IOERR

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

    CURRENT_IRQL: 0

    STACK_TEXT:
    fffff880`0bff49c8 fffff800`0746e5e2 : 00000000`000000f4 00000000`00000003 fffffa80`120b29d0 fffffa80`120b2cb0 : nt!KeBugCheckEx
    fffff880`0bff49d0 fffff800`0741b99b : ffffffff`ffffffff fffffa80`12637660 fffffa80`120b29d0 fffffa80`120b29d0 : nt!PspCatchCriticalBreak+0x92
    fffff880`0bff4a10 fffff800`0739b448 : ffffffff`ffffffff 00000000`00000001 fffffa80`120b29d0 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
    fffff880`0bff4a60 fffff800`070e2ed3 : fffffa80`120b29d0 fffff880`c0000006 fffffa80`12637660 fffffa80`0f5485f0 : nt!NtTerminateProcess+0xf4
    fffff880`0bff4ae0 00000000`777e15da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0125e518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777e15da


    STACK_COMMAND: kb

    FOLLOWUP_NAME: MachineOwner

    FAILURE_BUCKET_ID: X64_0xF4_IOERR_VRF_IMAGE_csrss.exe

    BUCKET_ID: X64_0xF4_IOERR_VRF_IMAGE_csrss.exe

    Followup: MachineOwner
      My Computer


  2. Posts : 28,845
    Win 8 Release candidate 8400
       #2

    Gromit1710

    Just to eliminate a nagging suspicion please download Malwarebytes and run it. I know you have Kaspersky but csrss.exe can be a valid system file of malware dependent on where it is located.

    I would also remove Kaspersky and replace with Microsoft Security essentials as it is know it is known to cause BSOD's on some systems.

    http://support.kaspersky.com/downloa...vremover10.zip

    Virus, Spyware & Malware Protection | Microsoft Security Essentials


    Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!

      My Computer


  3. Posts : 162
    Windows 7 Professional 64 Bit Service Pack 1
    Thread Starter
       #3

    Ok.

    I DL'ed and ran Maleware Bytes.

    It didn't flag csrss.exe. Instead it flagged and deleted this:

    Folders Infected:
    c:\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.
    c:\ndis.sys\4ce79392f3000 (Trojan.SpyEyes) -> Quarantined and deleted successfully.

    Files Infected:
    c:\ndis.sys\4ce79392f3000\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.


    If that was for real, I'm a bit disappointed in kaspersky... I've now removed both kaspersky and Malewarebytes and installed Windows Security Essentials.

    I've never trusted windows security products before, assuming that an aftermarket one would be better. But I'm serious about trying whatever I can to fix this.

    I'll let the computer sit for the day and report back later. Thank you.
      My Computer


  4. Posts : 28,845
    Win 8 Release candidate 8400
       #4

    Gromit1710 said:
    Ok.

    I DL'ed and ran Maleware Bytes.

    It didn't flag csrss.exe. Instead it flagged and deleted this:

    Folders Infected:
    c:\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.
    c:\ndis.sys\4ce79392f3000 (Trojan.SpyEyes) -> Quarantined and deleted successfully.

    Files Infected:
    c:\ndis.sys\4ce79392f3000\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.


    If that was for real, I'm a bit disappointed in kaspersky... I've now removed both kaspersky and Malewarebytes and installed Windows Security Essentials.

    I've never trusted windows security products before, assuming that an aftermarket one would be better. But I'm serious about trying whatever I can to fix this.

    I'll let the computer sit for the day and report back later. Thank you.
    Malwarebytes is great at what it does. MSE is a good lightweight malware app.

    Kaspersky, McAffee, and Symantec often miss things.


    I am going to go against the grain and say I use AVG on one, and ESET Smart security on another (has built in firewall), but that is personal preference.

    I would also re-run malwarebytes daily for a bit. If re-infected we can root it out.
      My Computer


  5. Posts : 162
    Windows 7 Professional 64 Bit Service Pack 1
    Thread Starter
       #5

    Well, I'm at 11 hours of uptime after the reboots from the installations this morning.

    So far so good.

    so I'm thinking my new plan of AV protection for this computer is:

    Windows Security Essentials + regular Malwarebytes scans.

    For Firewall protection I have my Router + windows firewall.
      My Computer


  6. Posts : 28,845
    Win 8 Release candidate 8400
       #6

    Gromit1710 said:
    Well, I'm at 11 hours of uptime after the reboots from the installations this morning.

    So far so good.

    so I'm thinking my new plan of AV protection for this computer is:

    Windows Security Essentials + regular Malwarebytes scans.

    For Firewall protection I have my Router + windows firewall.
    That is probably the most stable option. I run Eset smart security
      My Computer


  7. Posts : 162
    Windows 7 Professional 64 Bit Service Pack 1
    Thread Starter
       #7

    Zigzag3143...

    I think you solved my problem. 24 hrs of uptime with no BSOD.

    That's a first.

    Although how I got infected the first day of uptime is beyond me. Especially since the AV is always the first program I load on a PC.

    Thank you.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 19:11.
Find Us