BSOD Stop Error 0x000000F4

Hi guys,

I've been having BSOD's with stop error 0x000000F4.

It doesn't happen often but I noticed that it crashes whenever I put data DVD's in my drive. It seems like it's trying to read it and then freezes (not responding), thinks around 10 seconds and comes to a blue screen.

I suspected that I could be with the media that I use. So I tested the same DVD that I suspect caused the BSOD and it work fine. (tested it just now)

I'm using AMD2 Athlon X2 with 2 X 2GB DDR2 800 of RAM and Foxconn RS690M2MA mobo. DVD drive is Samsung LightScribe SH-S223. Onboard video ATI Radeon X1200 series.

Details that might help:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: f4
BCP1: 0000000000000003
BCP2: FFFFFA800479AB30
BCP3: FFFFFA800479AE10
BCP4: FFFFF80002D93CE0
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

I've also attached the dump and xml file. TIA :)

PS: Win7 Ultimate 64-bit.

I've already run a CHKDSK and Memtest before using the installation dvd and it was all ok.

anyone? I've reinstalled my OS and still gets the same error every now and then.

hi grandevouz


Some of the other experts on Seven Forums will have a look at your dump file.
Try the basics:

1. Have you updated all your hardware drivers?
2. Have you tried substituting hardware for those that are in your your current system?

Try here for some explanation on the error codes

hope this helps and that your issues are resolved soon

Regards

Got this off the net:

What is csrss.exe?

A Microsoft Windows file stored in the c:\windows\system32 or c:\winnt\system32 directory that has the file description: "Client Server Runtime process."

Is this file a spyware, trojan, or virus?

The csrss.exe file included with Microsoft Windows is not spyware, a trojan, or a virus. However, like any file on your computer it can become corrupted by a virus, worm, or trojan. antivirus programs can detect and clean this file if it has become infected. Because this file is part of Microsoft Windows users should never delete or remove this file if they think it is infected, let the antivirus program handle it.

Is it safe to remove csrss.exe from the Task Manager processes?

No. The csrss.exe is a critical system process that cannot be removed from the Task Manager without causing issues with Windows. When attempting to End Process the csrss.exe you will receive the Unable to Terminate Process window with the error "This is a critical system process. Task Manager cannot end this process." It is normal to receive this error.

The csrss.exe file is using 99%, 100%, or other high abnormal percentage of CPU.

This issue is caused when your Microsoft Windows profile is corrupt. To resolve this issue requires that you delete and recreate the profile. To do this follow the below steps.

Backup all the files in My Documents as they will be lost. It's also recommended you backup any other important files you may be concerned about losing.
Log out of the account that is causing the problem and into a different account. If you do not have another account you can create a new account through the User Accounts icon in the Control Panel.
Once in the other account right-click My Computer icon and click Properties.
In the Properties window click the Advanced tab.
In Advanced click the Settings button under User Profiles.
Finally, in the User Profiles window highlight the name of the profile that is encountering this issue and click the Delete button.
Once the profile has been deleted you can recreate it if you wish to use the same profile name.

+1 Tews - was composing when you posted.

Regards

Tews said:

Your .dmp files show csrss.exe and memory management as the cause for your crashes... Csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated.

However, csrss.exe is also a process which is registered as the W32.Netsky.AB@mm worm, the W32.Webus Trojan, Win32.Ladex.a, and more.

This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open it’s hostile attachment.

The worm has it’s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself.

In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.

I`d advise you to scan your computer for viruses etc. Rerun Memtest86 overnight for at least 5 passes and let us know the outcome..

I already did a full scan on C: drive using ESET Nod32. It detected 2 "infiltrations" and both of the came from keygens so I guess that's pretty normal... I deleted them anyway.

I'm currently scanning the other partition just for the benefit of the doubt.

I DL'd and booted from memtest86. Sorry but it's time consuming so I did only 2 passes and no error at all.

CSRSS being the culprit makes sense. There a few times where in 99% of the RAM is being used during startup, which is absurd.

Oh BTW, I did mention that I already reformatted and reinstall windows 7 right? Unfortunately, I encountered the same stop error once or twice. *will continue to monitor since it's newly installed.

Thanks though :) I'll be back with details within the day.

ickymay said:

not many clues from debugger on this crash as it states

Code:

BugCheck F4, {3, fffffa800479ab30, fffffa800479ae10, fffff80002d93ce0}

Probably caused by : csrss.exe

and 0xF4 CRITICAL_OBJECT_TERMINATION suggests to me possibly hard drive problems IDE config cabling or controller ?

check all your cables in your machine are correctly plugged in then when back into windows run sfc /scannow (observe space) from an elevated command prompt ?

also these drivers are old

SiWinAcc.sys fffff880`012f7000 fffff880`01300000 0x00009000 0x4671d6fa 15/06/2007 01:02:02
SiRemFil.sys fffff880`01a8a000 fffff880`01a92000 0x00008000 0x46798312 20/06/2007 20:42:10
johci.sys fffff880`01aa4000 fffff880`01aad000 0x00009000 0x48eda823 09/10/2008 07:43:47
Rtnic64.sys fffff880`03e0f000 fffff880`03e21000 0x00012000 0x49081f05 29/10/2008 09:29:57
vsmraid.sys fffff880`01000000 fffff880`0102a000 0x0002a000 0x4983a701 31/01/2009 02:18:57
mcdbus.sys fffff880`04ac6000 fffff880`04b02880 0x0003c880 0x49a3cd1f 24/02/2009 11:34:07
Epfwndis.sys fffff880`03e31000 fffff880`03e3c000 0x0000b000 0x49c21e65 19/03/2009 11:28:53

and need replacing, google them and find the device that uses them and update ?

let us know how it goes ?

So I googled for SiWinAcc.sys & SiRemFil.sys and found that they're from Silicon image. Seems like they've got something to do with SATA so I thought of my hard drive. I used "Drive Detect" from Seagate to determine the drive model and serial number. Checked for updates but there aren't any according to their website.

Sorry but I have no idea about these three: johci.sys Rtnic64.sys vsmraid.sys. All I'm certain is that they're in their rightful directories. I also did a full scan on my drive so if they're something malicious, chances are they'll be detected.

On the other hand, mcdbus.sys is for MagicDisc. If it's outdated, I just uninstalled my current magicdisc installation and downloaded the most updated from their site.

Epfwndis.sys is for ESET personal firewall.

I will be working on the physical connection and SFC later today, it's 5am here in the PH and I havent had any sleep since yesterday :))

I'll also be updating my drivers. Just one question though, I'm using a Foxconn RS690M2MA and everything (video and sound) is on board. I tried searching for an updated driver but I only found updates for Vista. Even the disc that came with it only has vista, prolly because win7 came out just recently.

So how do I update the driver for my mobo then? Or do I even have to?