Can't seem to find the answer

Sysyphys · 23 Mar 2011

I had a fatal system error BSOD yesterday, and cannot find any reference to it on the web, so I figured I would ask here. The BSOD read as follows:

STOP: c000021a {Fatal System Error}
The Windows Subsystem system process terminated unexpectedly with a status of 0xc0000006 (0x776d5bd4 0x00b6ef70)

Anyone know what this is or what it means? I ran Prime95 for 8 hours, ran sfc /scannow in elevated command, scanned my HDD with Avast full scan and Windows Security Essentials full scan, ran checkdisk, ran Western Digital diagnostic tool, Windows memory checker, all came back fine. My system is not overheating, and only my cpu is slightly overclocked to run memory at 1600MHz. I have not installed any new hardware since I built the system less than 2 months ago.

Windows 7 Home Premium x64
OEM System Builder Pack
System <2 months old
OS install <2 months old

yowanvista · 23 Mar 2011

No dumps were collected by the jcgriff2 tool, dumps may have been deleted. Did you run any system cleaners(such as Ccleaner) after the crash?
If so wait for the computer to crash and re-upload the file :)

Sysyphys · 23 Mar 2011

I did not run Ccleaner after the crash. The only thing I did after the crash was run sfc /scannow, and then I ran Prime95 when I went to work. The system seemed to be working okay when I got home, but today when I searched for BSOD help in Chrome and clicked on the link for sevenforums.com my computer froze (no BSOD). I did uninstall Avast, as I didn't want it running at the same time as Microsoft Security Essentials, and it wouldn't let me exit the program normally. Hopefully it doesn't happen again, though I would really like to know what happened.

yowanvista · 23 Mar 2011

Sysyphys said:

I did not run Ccleaner after the crash. The only thing I did after the crash was run sfc /scannow, and then I ran Prime95 when I went to work. The system seemed to be working okay when I got home, but today when I searched for BSOD help in Chrome and clicked on the link for sevenforums.com my computer froze (no BSOD). I did uninstall Avast, as I didn't want it running at the same time as Microsoft Security Essentials, and it wouldn't let me exit the program normally. Hopefully it doesn't happen again, though I would really like to know what happened.

Check your Minidump folder(C:\Windows\Minidump) and upload the latest dumps, these files are needed for analysis

Sysyphys · 23 Mar 2011

C:\Windows\Minidump does not exist on my computer

DeanP · 23 Mar 2011

This is a Kernel Memory Dump,

Information

To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kb) in the drop down box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.
Until a .dmp file is generated, the Minidump folder may not exist.

**cluberti** · 23 Mar 2011

Everyone - before we send the thread and it's participants on a wild goose chase, most of the time when a C21A dump occurs, a crash dump *will not be created* because part of creating a crash dump requires processes like csrss.exe and lsass.exe to actually be running when KeBugCheck/KeBugCheckEx is called to crash the system - csrss.exe to start the dump process, and lsass.exe to provide security ACL access to be able to access the disk and it's folder structure and write the .dmp file. If either of these two were the process that crashed (and thus caused the C21A bugcheck - winlogon.exe is the other process that can cause it, but a crash dump should be created in that case), then you are very likely NOT going to have a crash dump.

I'll save you guys the frustration - it's obvious that either csrss.exe or lsass.exe is crashing, and thus a dump file cannot be written.

Party time!

Now comes the fun part - if you can't get a dump file, how do you troubleshoot a C21A crash? Very carefully. We can first deduce that the actual error, the first parameter in the dump (c0000006), is STATUS_IN_PAGE_ERROR (a paging operation to move data into RAM failed with an "access denied" on the data either in the paging file, or to the block in RAM). Given the OP has tested his RAM thoroughly, we can pretty safely assume the error came from the paging file. Here's what I would suggest to try and nail this down:

Stop overclocking the CPU - even a minor overclock can cause timing issues inside the OS if anything fails, either in the OS, or in the hardware. This should be done as the first thing.
Update any and all device drivers, and any software that uses filter drivers (antivirus, antimalware, 3rd party firewalls, etc.) to their latest supported versions for Windows 7. This may take some time and research, but it's important this be done if and when possible.
Use autoruns to disable any non-Microsoft item that is not absolutely critical to boot and run the system. We need to pare the system back to running as little as is necessary for system usage, in the hopes that if the problem resurfaces we can actually get lucky and get dump data.
Run one, and only one, antivirus/antimalware application and firewall (if using a 3rd party one) at any one time - having multiple I/O filter drivers on a system can cause delays, corruption, and even crashes. This is generally unnecessary nowadays anyway, as most of us run very good choices in these applications (as the OP is doing) and these are all basically equivalent in their security stance and footprint.
Disable the paging file (tell windows not to use one), reboot, delete the pagefile.sys left behind (if any), re-enable the paging file (if so desired), and reboot again. Just in case, let's get a new pagefile.sys on the disk.
Run chkdsk /f on the OS volume (usually C: ), which should require a reboot to run. Another "just in case", considering we did have an issue to a file on disk.

Once all of the above are done, honestly, we hope the problem does not come back. If it does, we hope for a crash dump - otherwise, you have to use a live kernel debugger, and that isn't something you just do everyday

.

Sysyphys · 24 Mar 2011

Okay, set write debugging information from Kernel Memory Dump to Small Memory Dump. Uninstalled Avast. As far as pagefile goes, my current page file is 12286MB. This seems like a large amount to me, considering it is exactly how much actual system RAM I have installed. Do I really need a 12GB page file? I will try some of your other suggestions, which I thank you all for providing, and I will post again if I have any further problems.

**cluberti** · 25 Mar 2011

Windows by default will set your paging file to 1x RAM, regardless of how much RAM is installed over 1GB (it'll set it to 1.5x RAM if less than 1GB RAM is installed). Asking how large (or small) your pagefile can be is a loaded question, and even Microsoft gives multiple answers for the same question from different places (an older KB vs a newer KB vs support vs Mark Russinovich, for example). The "newer KB" I linked is the latest answer, and does describe the different suggestions based on OS, so if you want to tweak it and not let Windows manage it, that's the current Microsoft answer to that question.

As for me, I always suggest leaving it to Windows managed unless you have a small drive (64GB or smaller) and/or have a need to save the space, or you're a real tweaker (and if so, there are LOTS of ways to determine your memory footprint and whether or not you need a paging file).