BSOD on Windows 7 Beta

The system scan passed ok.

now the WMC sharing service has a history of causing random crashes. do you share media off that computer? its wmpntwk.exe.

If not you can go into services and change it to disabled. (type services.msc in search)


if you do share media you can change it to manual (so it only starts when called)

hope this helps

ken

xtratime said:

As I have said before though it only seems to do it after the computer has been in sleep mode. If I dont sleep it then I dont seem to get the BSOD.

I remembered Sassa posted this link and it seemed to apply to another OP, as no more problems have been reported.

Article - Adapt the Windows 7 Hibernation File...

Hope the info applies here?

Cheers!

Robert

Thanks I will try both of these suggestions and tell you how I get on.

No luck

Got this latest dump

XT

this one was caused by csrss, which is part of the 64 bit system that gives 32bit user interface. read abt it here Client/Server Runtime Subsystem - Wikipedia, the free encyclopedia


Again it was a memory double fault. How much memory are you running? have you run a memory test on it?



Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\092509-26270-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7100 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7100.0.amd64fre.winmain_win7rc.090421-1700
Machine Name:
Kernel base = 0xfffff800`02a5a000 PsLoadedModuleList = 0xfffff800`02c93e90
Debug session time: Fri Sep 25 15:30:38.889 2009 (GMT-4)
System Uptime: 0 days 0:38:39.653
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8004236b30, fffffa8004236e10, fffff80002dce670}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8004236b30, Terminating object
Arg3: fffffa8004236e10, Process image file name
Arg4: fffff80002dce670, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa8004236b30

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff880`0614fb18 fffff800`02e56052 : 00000000`000000f4 00000000`00000003 fffffa80`04236b30 fffffa80`04236e10 : nt!KeBugCheckEx
fffff880`0614fb20 fffff800`02df4ad9 : ffffffff`ffffffff fffffa80`04e3ba10 fffffa80`04236b30 00000000`00000001 : nt!PspCatchCriticalBreak+0x92
fffff880`0614fb60 fffff800`02d9c28b : ffffffff`ffffffff 00000000`00000001 fffffa80`04236b30 fffff800`00000008 : nt! ?? ::NNGAKEGL::`string'+0x18096
fffff880`0614fbb0 fffff800`02ad81d3 : fffffa80`04236b30 fffff880`c0000005 00000000`0344f680 fffffa80`04e3ba10 : nt!NtTerminateProcess+0x1fb
fffff880`0614fc20 00000000`7743e79a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0344d3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7743e79a


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------


ken

zigzag3143 said:

XT

this one was caused by csrss, which is part of the 64 bit system that gives 32bit user interface. read abt it here Client/Server Runtime Subsystem - Wikipedia, the free encyclopedia


Again it was a memory double fault. How much memory are you running? have you run a memory test on it?

2GB and yes the memory test was fine

xtratime said:

zigzag3143 said:

XT

this one was caused by csrss, which is part of the 64 bit system that gives 32bit user interface. read abt it here Client/Server Runtime Subsystem - Wikipedia, the free encyclopedia


Again it was a memory double fault. How much memory are you running? have you run a memory test on it?

2GB and yes the memory test was fine

2 gigs on 64bit is the absolute minimum. You probably are going to run into these double faults.

ken

xtratime said:

zigzag3143 said:

XT

this one was caused by csrss, which is part of the 64 bit system that gives 32bit user interface. read abt it here Client/Server Runtime Subsystem - Wikipedia, the free encyclopedia


Again it was a memory double fault. How much memory are you running? have you run a memory test on it?

2GB and yes the memory test was fine

It is possible that your crashes are caused by one or more errant drivers which are corrupting memory which does not belong to them. That's especially true if you've bypassed driver signing to install "unsigned" drivers on your system.

There's a way of getting the OS to pay closer attention to the actions of drivers (they're usually unsupervised, for performance reasons). It's called "driver verifier" and you can enable that mode in the following way:

- Start an elevated command prompt by right-clicking the CMD shortcut and selecting "run as admin".
- Execute this command: verifier /standard /all

It's best to reboot afterwards. The next crash may happen precisely at the point where a driver corrupts memory, instead of a long time later when the corrupted memory is encountered and "used".

To deactivate driver verifier (you don't want to be running in that mode forever): verifier /reset

H2SO4 said:

xtratime said:

zigzag3143 said:

XT

this one was caused by csrss, which is part of the 64 bit system that gives 32bit user interface. read abt it here Client/Server Runtime Subsystem - Wikipedia, the free encyclopedia


Again it was a memory double fault. How much memory are you running? have you run a memory test on it?

2GB and yes the memory test was fine

It is possible that your crashes are caused by one or more errant drivers which are corrupting memory which does not belong to them. That's especially true if you've bypassed driver signing to install "unsigned" drivers on your system.

There's a way of getting the OS to pay closer attention to the actions of drivers (they're usually unsupervised, for performance reasons). It's called "driver verifier" and you can enable that mode in the following way:

- Start an elevated command prompt by right-clicking the CMD shortcut and selecting "run as admin".
- Execute this command: verifier /standard /all

It's best to reboot afterwards. The next crash may happen precisely at the point where a driver corrupts memory, instead of a long time later when the corrupted memory is encountered and "used".

To deactivate driver verifier (you don't want to be running in that mode forever): verifier /reset

I have done this and the latest dump is available. It sure makes the system run slow after setting this on doesnt it.