New
#1
BSOD - Please Analyze
My Windows 7 x64 crashes following a sleep session. I have uploaded the mini dump file so if anyone can help that would be amazing.
My Windows 7 x64 crashes following a sleep session. I have uploaded the mini dump file so if anyone can help that would be amazing.
Welcome, I have done a quick analsysis of your file. Since it is late, I did not go into much detail. A cursory examination indicates that the cause may be a virus.
Run an antiviru scan and downlaod and run malwarebytes. Post your results. If you are clean, I will do further work tomorrow. If not clean remove them as soon as possible.
http://www.malwarebytes.org/mbam.php
The virus involved should be removed, they can cause more problems than just BSOD
Code:CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa80096a5060, Terminating object Arg3: fffffa80096a5340, Process image file name Arg4: fffff8000338c540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa80096a5060 IMAGE_NAME: csrss.exe DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: csrss FAULTING_MODULE: 0000000000000000 PROCESS_NAME: csrss.exe EXCEPTION_RECORD: fffff88005567b78 -- (.exr 0xfffff88005567b78) ExceptionAddress: 00000000778959ad ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 0000000002530ef8 Attempt to write to address 0000000002530ef8 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 0000000002530ef8 WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b80e0 0000000002530ef8 FOLLOWUP_IP: +0 00000000`778959ad ?? ??? FAULTING_IP: +0 00000000`778959ad ?? ??? FAILED_INSTRUCTION_ADDRESS: +0 00000000`778959ad ?? ??? BUGCHECK_STR: 0xF4_C0000005 STACK_TEXT: fffff880`055670f8 fffff800`0340cc72 : 00000000`000000f4 00000000`00000003 fffffa80`096a5060 fffffa80`096a5340 : nt!KeBugCheckEx fffff880`05567100 fffff800`033ba0a3 : ffffffff`ffffffff fffffa80`0a33c990 fffffa80`096a5060 fffffa80`096a5060 : nt!PspCatchCriticalBreak+0x92 fffff880`05567140 fffff800`0333e69c : ffffffff`ffffffff 00000000`00000001 fffffa80`096a5060 fffff6fb`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`05567190 fffff800`0307f853 : fffffa80`096a5060 fffff800`c0000005 ffffd844`014efa70 fffffa80`0a33c990 : nt!NtTerminateProcess+0x20c fffff880`05567210 fffff800`0307bdf0 : fffff800`030bacac fffff880`05567b78 fffff880`055678e0 fffff880`05567c20 : nt!KiSystemServiceCopyEnd+0x13 fffff880`055673a8 fffff800`030bacac : fffff880`05567b78 fffff880`055678e0 fffff880`05567c20 00000000`02532180 : nt!KiServiceLinkage fffff880`055673b0 fffff800`0307fc42 : fffff880`05567b78 00000000`000116e4 fffff880`05567c20 00000000`02531c58 : nt!KiDispatchException+0x53b fffff880`05567a40 fffff800`0307e7ba : 00000000`00000001 00000000`000116e4 00000000`0253d401 00000000`77895a84 : nt!KiExceptionDispatch+0xc2 fffff880`05567c20 00000000`778959ad : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a 00000000`02530f00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778959ad STACK_COMMAND: kb FOLLOWUP_NAME: MachineOwner FAILURE_BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa80096a5060, Terminating object Arg3: fffffa80096a5340, Process image file name Arg4: fffff8000338c540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa80096a5060 IMAGE_NAME: csrss.exe DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: csrss FAULTING_MODULE: 0000000000000000 PROCESS_NAME: csrss.exe EXCEPTION_RECORD: fffff88005567b78 -- (.exr 0xfffff88005567b78) ExceptionAddress: 00000000778959ad ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 0000000002530ef8 Attempt to write to address 0000000002530ef8 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 0000000002530ef8 WRITE_ADDRESS: 0000000002530ef8 FOLLOWUP_IP: +0 00000000`778959ad ?? ??? FAULTING_IP: +0 00000000`778959ad ?? ??? FAILED_INSTRUCTION_ADDRESS: +0 00000000`778959ad ?? ??? BUGCHECK_STR: 0xF4_C0000005 STACK_TEXT: fffff880`055670f8 fffff800`0340cc72 : 00000000`000000f4 00000000`00000003 fffffa80`096a5060 fffffa80`096a5340 : nt!KeBugCheckEx fffff880`05567100 fffff800`033ba0a3 : ffffffff`ffffffff fffffa80`0a33c990 fffffa80`096a5060 fffffa80`096a5060 : nt!PspCatchCriticalBreak+0x92 fffff880`05567140 fffff800`0333e69c : ffffffff`ffffffff 00000000`00000001 fffffa80`096a5060 fffff6fb`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`05567190 fffff800`0307f853 : fffffa80`096a5060 fffff800`c0000005 ffffd844`014efa70 fffffa80`0a33c990 : nt!NtTerminateProcess+0x20c fffff880`05567210 fffff800`0307bdf0 : fffff800`030bacac fffff880`05567b78 fffff880`055678e0 fffff880`05567c20 : nt!KiSystemServiceCopyEnd+0x13 fffff880`055673a8 fffff800`030bacac : fffff880`05567b78 fffff880`055678e0 fffff880`05567c20 00000000`02532180 : nt!KiServiceLinkage fffff880`055673b0 fffff800`0307fc42 : fffff880`05567b78 00000000`000116e4 fffff880`05567c20 00000000`02531c58 : nt!KiDispatchException+0x53b fffff880`05567a40 fffff800`0307e7ba : 00000000`00000001 00000000`000116e4 00000000`0253d401 00000000`77895a84 : nt!KiExceptionDispatch+0xc2 fffff880`05567c20 00000000`778959ad : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a 00000000`02530f00 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778959ad STACK_COMMAND: kb FOLLOWUP_NAME: MachineOwner FAILURE_BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe Followup: MachineOwner --------- 0: kd> lmvm csrss start end module name
Weird, my computer is clean on several different scanners.
I've used Malwarebytes and AVG, both came back clean for viruses. I have done a chkdsk, registry repair, system file check, the whole works really.
Do you have any more DMP files for us to examine? We may need to get more aggressive and use driver verifier. Before you do that you should have: A working win 7 dvd, a restore point, and a backup. Dreover verifier will make your system crash but it should give you what driver is responsible. read about it here. Using Driver Verifier to identify issues with Drivers
Let us know if you need help.
Ken