New
#1
Random BSOD 0x000000F4 - csrss.exe referenced in memory dump
Hello all,
Trying to troubleshoot an issue I'm having on my laptop with a random BSOD 0x000000f4. I pulled up windbg and opened up memory.dmp and ran an !analyze -v. Here's what the memory.dmp says about whats going on. Could you please help point me in the right direction?
Things I've checked:
1. csrss.exe is running twice in task manager, but event ID 0 and 1 respectively. ALso verified both are running from c:\windows\system32 so they are both valid. Sometimes multiples can be malware, but not the case here.
2. GPU temperatures, thought it was a GPU overheating issue at first, but the GPU temps were low last night and it BSOD with another error nvdllkm.
3. Lately I've just been letting my laptop idle playing some music from Chrome via pandora. It hadn't done anything other than turn on and bring up chrome to play music, sat there for a few hours, then crashed with the F4 BSOD as opposed to the nvdllkm error.
4. The minidump from earlier today references ntoskrnl.exe as the culprit.
This makes me think it could be either a HDD or a RAM issue.
I pulled up the full memory.dmp from this morning and here's what I got. Please review and let me know what you think I need to do to resolve.
Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03208000 PsLoadedModuleList = 0xfffff800`0344b890
Debug session time: Wed Sep 17 11:09:43.189 2014 (UTC - 6:00)
System Uptime: 0 days 1:12:03.079
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd5018). Type ".hh dbgerr001" for details
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, fffffa800a80c060, fffffa800a80c340, fffff80003583270}
Probably caused by : csrss.exe
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800a80c060, Terminating object
Arg3: fffffa800a80c340, Process image file name
Arg4: fffff80003583270, Explanatory message (ascii)
Debugging Details:
------------------
KERNEL_LOG_FAILING_PROCESS:
PROCESS_OBJECT: fffffa800a80c060
IMAGE_NAME: csrss.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: csrss
FAULTING_MODULE: 0000000000000000
PROCESS_NAME: csrss.exe
EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.
BUGCHECK_STR: 0xF4_IOERR
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
STACK_TEXT:
fffff880`09961e38 fffff800`0360bab2 : 00000000`000000f4 00000000`00000003 fffffa80`0a80c060 fffffa80`0a80c340 : nt!KeBugCheckEx
fffff880`09961e40 fffff800`035b6abb : ffffffff`ffffffff fffffa80`0abf5b50 fffffa80`0a80c060 fffffa80`0a80c060 : nt!PspCatchCriticalBreak+0x92
fffff880`09961e80 fffff800`03535f04 : ffffffff`ffffffff 00000000`00000001 fffffa80`0a80c060 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17486
fffff880`09961ed0 fffff800`0327ce53 : fffffa80`0a80c060 fffff800`c0000006 fffffa80`0abf5b50 00000000`01d40fc0 : nt!NtTerminateProcess+0xf4
fffff880`09961f50 fffff800`03279410 : fffff800`032c882f fffff880`09962a38 fffff880`09962790 fffff880`09962ae0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`099620e8 fffff800`032c882f : fffff880`09962a38 fffff880`09962790 fffff880`09962ae0 00000000`76ef560c : nt!KiServiceLinkage
fffff880`099620f0 fffff800`0327d242 : fffff880`09962a38 00000000`01d80000 fffff880`09962ae0 00000000`76f014e4 : nt! ?? ::FNODOBFM::`string'+0x488e4
fffff880`09962900 fffff800`0327bdba : 00000000`00000000 00000000`76ef560f 00000000`01d62001 00000000`01d80000 : nt!KiExceptionDispatch+0xc2
fffff880`09962ae0 00000000`77028f56 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`01d416e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77028f56
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
IMAGE_VERSION:
FAILURE_BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe
BUCKET_ID: X64_0xF4_IOERR_IMAGE_csrss.exe
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xf4_ioerr_image_csrss.exe
FAILURE_ID_HASH: {183378f4-a174-8cab-8ad7-e5d860a58439}
Followup: MachineOwner
---------
Appreciate you guys looking into this for me.
Quote