Initial BSOD after powering down during Windows Update

Hi theimagineer, welcome to 7F! :)

All of your dumps point to a problem with the csrss.exe (Client Server Runtime Process)

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c1c15000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff96000102344, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800022b2100
 fffff900c1c15000 

FAULTING_IP: 
win32k+22344
fffff960`00102344 44891e          mov     dword ptr [rsi],r11d

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8801fb9ac20 -- (.trap 0xfffff8801fb9ac20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000002f79ae6
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000102344 rsp=fffff8801fb9adb0 rbp=0000000000000c47
 r8=0000000002f79bde  r9=0000000002f79af2 r10=0000000000000c47
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
win32k+0x22344:
fffff960`00102344 44891e          mov     dword ptr [rsi],r11d ds:04d0:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800020f8be0 to fffff8000207ac00

STACK_TEXT:  
fffff880`1fb9aab8 fffff800`020f8be0 : 00000000`00000050 fffff900`c1c15000 00000000`00000001 fffff880`1fb9ac20 : nt!KeBugCheckEx
fffff880`1fb9aac0 fffff800`02078d2e : 00000000`00000001 fffff900`c1c15000 00000000`00000000 00000000`000018f9 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`1fb9ac20 fffff960`00102344 : 00000000`000018f9 fffff900`c1c15000 00000000`0000ffff fffff960`00101ca8 : nt!KiPageFault+0x16e
fffff880`1fb9adb0 00000000`000018f9 : fffff900`c1c15000 00000000`0000ffff fffff960`00101ca8 00000000`00000000 : win32k+0x22344
fffff880`1fb9adb8 fffff900`c1c15000 : 00000000`0000ffff fffff960`00101ca8 00000000`00000000 00000000`000000b7 : 0x18f9
fffff880`1fb9adc0 00000000`0000ffff : fffff960`00101ca8 00000000`00000000 00000000`000000b7 fffff880`1fb9aff0 : 0xfffff900`c1c15000
fffff880`1fb9adc8 fffff960`00101ca8 : 00000000`00000000 00000000`000000b7 fffff880`1fb9aff0 00000000`00000000 : 0xffff
fffff880`1fb9add0 00000000`00000000 : 00000000`000000b7 fffff880`1fb9aff0 00000000`00000000 fffff880`1fb9b1a0 : win32k+0x21ca8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k+22344
fffff960`00102344 44891e          mov     dword ptr [rsi],r11d

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k+22344

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5164dccc

FAILURE_BUCKET_ID:  X64_0x50_win32k+22344

BUCKET_ID:  X64_0x50_win32k+22344

Followup: MachineOwner
---------

But before we get too involved, restart your machine and tap F8 while your machine restarts, then choose the "Last Known Good Configuration" option and allow it to finish its startup.

If that doesn't help:
Try running a Disk Check Option one, Step 8, and please read the note at the beginning it will take some time.

Then run another SFC /SCANNOW Command - System File Checker at least twice with re-boots in between, even if the sfc scan doesn't find any problems on the first run.

You could also try a System Restore to right before your unfortunate shutdown, say, from the 16th of the month.

Any of these three can be ran either in normal or safe mode.

theimagineer

Do you know or can you check what updates were downloaded ?

Download SystemLook below .

SystemLookX64

Drag it to your desktop . Right-click on SystemLook_x64.exe and choose

Inside SystemLook copy and paste the highlighted text below


:filefind
Wdf01000.mof


Click on the Look button . It will create a log called SystemLook.txt upload that log with your reply .

The attachment is all boxes .

Your welcome Ross, and thank you VistaKing for coming aboard. It open okay for me, here it is:

Code:

SystemLook 30.07.11 by jpshortstuff
Log created at 19:45 on 22/06/2013 by Ross
Administrator - Elevation successful

========== filefind ==========

Searching for "Wdf01000.mof"
C:\Windows\System32\wbem\Wdf01000.mof    --a---- 8202 bytes    [10:46 23/11/2012]    [23:22 13/07/2009] C6BB46C163C1488DE03FB4A09DDD6A60
C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7600.16385_none_d24809e1379d1f91\Wdf01000.mof    --a---- 8202 bytes    [23:22 13/07/2009]    [23:22 13/07/2009] C6BB46C163C1488DE03FB4A09DDD6A60
C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7601.17803_none_d482f2fd34846558\Wdf01000.mof    --a---- 8202 bytes    [10:46 23/11/2012]    [23:22 13/07/2009] C6BB46C163C1488DE03FB4A09DDD6A60
C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7601.22004_none_d50d68344da151bb\Wdf01000.mof    --a---- 4495 bytes    [10:46 23/11/2012]    [14:35 02/06/2012] 309C7A9116344458026272DF77259E91

-= EOF =-

Not a problem, bugged update. MS will fix it eventually but until then it can be safely ignored :)

Gotta dash! Flight leaves in 8 hours and I need some sleep!


Tom

Thank You Tom . Have fun on your vacation .