Random and frequent BSODs

[Entombed]

I have a problem with random BSODs that happen both frequently and infrequently. Lastnight I had it happen about 8 times within an hour before I got mad and shut off my computer. But like now, I have been running stable for close to 30 minutes. It seems to happen multiple times even when my computer is idle. It originally started with computer hangs (about 30-45 seconds) that I was not able to figure out. I tried to do Windows updates which is when the BSODs started. Here is a little bit from mini-dumps which I'm not experienced enough to track back yet. Any help is greatly appreciated!

5319
----- ETW minidump data unavailable-----
Probably caused by : csrss.exe
Followup: MachineOwner
---------
3: kd> kL
Child-SP RetAddr Call Site
fffff880`03b4be38 fffff800`03057822 nt!KeBugCheckEx
fffff880`03b4be40 fffff800`03003e0b nt!PspCatchCriticalBreak+0x92
fffff880`03b4be80 fffff800`02f82f04 nt! ?? ::NNGAKEGL::`string'+0x176e6
fffff880`03b4bed0 fffff800`02ccf253 nt!NtTerminateProcess+0xf4
fffff880`03b4bf50 fffff800`02ccb810 nt!KiSystemServiceCopyEnd+0x13
fffff880`03b4c0e8 fffff800`02d1ab7f nt!KiServiceLinkage
fffff880`03b4c0f0 fffff800`02ccf642 nt! ?? ::FNODOBFM::`string'+0x488a4
fffff880`03b4c900 fffff800`02cce1ba nt!KiExceptionDispatch+0xc2
fffff880`03b4cae0 00000000`77618e3d nt!KiPageFault+0x23a
00000000`00a50c60 00000000`00000000 0x77618e3d

5163
----- ETW minidump data unavailable-----
Probably caused by : csrss.exe
Followup: MachineOwner
---------
3: kd> kL
Child-SP RetAddr Call Site
fffff880`03c24e38 fffff800`03068822 nt!KeBugCheckEx
fffff880`03c24e40 fffff800`03014e0b nt!PspCatchCriticalBreak+0x92
fffff880`03c24e80 fffff800`02f93f04 nt! ?? ::NNGAKEGL::`string'+0x176e6
fffff880`03c24ed0 fffff800`02ce0253 nt!NtTerminateProcess+0xf4
fffff880`03c24f50 fffff800`02cdc810 nt!KiSystemServiceCopyEnd+0x13
fffff880`03c250e8 fffff800`02d2bb7f nt!KiServiceLinkage
fffff880`03c250f0 fffff800`02ce0642 nt! ?? ::FNODOBFM::`string'+0x488a4
fffff880`03c25900 fffff800`02cdf1ba nt!KiExceptionDispatch+0xc2
fffff880`03c25ae0 00000000`77328e3d nt!KiPageFault+0x23a
00000000`005e0ba0 00000000`00000000 0x77328e3d

 

[Arc]

Hi Entombed.

you are getting all stop 0xF4, and it is storage related.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa80061adb30, fffffa80061ade10, fffff80002f94460}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

Followup: MachineOwner

► Do check the Storage Devices.

1. Update your SSD's Firmware
2. Reseat the sata and power.
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

But I am suspecting some other things there, too.

► Scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

BTW, dont you use any antivirus?

 

[Entombed]

Thank you for the response Arc. I was thinking it could be a storage issue, but couldn't see anything specifically pointing to that, but I'm not an expert by any means.
I also do normally run antivirus but really have not had any issues over several years so I was lazy re-installing after I got my SSD. Windows defender shows it's on for me, at least now. I will get my antivirus installed and updated then proceed with your instructions. I will post back probably tomomrrow night. Thanks again for the help!

 

[Entombed]

Hi Entombed.

you are getting all stop 0xF4, and it is storage related.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck F4, {3, fffffa80061adb30, fffffa80061ade10, fffff80002f94460}
 
----- ETW minidump data unavailable-----
Probably caused by : csrss.exe
 
Followup: MachineOwner

► Do check the Storage Devices.

1. Update your SSD's Firmware
2. Reseat the sata and power.
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

But I am suspecting some other things there, too.

► Scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

BTW, dont you use any antivirus?

1. Update your SSD's Firmware: Done - Now on R211 (release date: Oct 17, 2012)
2. Reseat the sata and power: Done
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check: Done - No errrors found.
6. To Only Scan and Attempt Recovery of Bad Sectors
NOTE: This scan attempts to find and repair physical errors on the hard disk itself, and it can take much longer to complete.
A) uncheck the Automatically fix file system errors box. (see screenshot below step 4)
B) Check the Scan for and attempt recovery of bad sectors box.

4. Seatool for dos: SeaTools | Seagate download: Done. Could not get the bootable CD to identify drives, so I used Windows version - Long term passed.
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

The first time I ran Seatools I left my computer, when I came back I saw that I BSOD'd again (not sure if it was during or after the test). I ran it a second time and it passed. I will let my PC run and see if it BSOD's again.

I also decided to hold off on installing my antivus to avoid crashing in the process. I will unhook my ethernet and do the scan a bit later this afternoon - at which point I will post more results and also another SF diagnostic file if there's another crash.

 

[Entombed]

Installed and updated Eset NOD32...computer scanned clean.
I've had a few BSODs in the process tonight. I've cleared my minidump folder and will upload a new SF diagnostics.

 

[Entombed]

Hi Entombed.

you are getting all stop 0xF4, and it is storage related.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck F4, {3, fffffa80061adb30, fffffa80061ade10, fffff80002f94460}
 
----- ETW minidump data unavailable-----
Probably caused by : csrss.exe
 
Followup: MachineOwner

► Do check the Storage Devices.

1. Update your SSD's Firmware
2. Reseat the sata and power.
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

But I am suspecting some other things there, too.

► Scan the system for possible virus infection.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results.

BTW, dont you use any antivirus?

Just had another BSOD, all of the above steps were completed and checked out fine. Here is my new SF diag log. Thanks in advance for any response.

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc40006e28, ffffffffc000000e, 363a5860, fffff88000dc593c}

GetPointerFromAddress: unable to read from fffff80002efc278
Probably caused by : ataport.SYS ( ataport!IdePortDispatchPnp+22 )

Followup: MachineOwner
---------

Have you done it, for sure?

• Anti-rootkit utility TDSSKiller

Make it sure.

 

[Entombed]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 7A, {fffff6fc40006e28, ffffffffc000000e, 363a5860, fffff88000dc593c}
 
GetPointerFromAddress: unable to read from fffff80002efc278
Probably caused by : ataport.SYS ( ataport!IdePortDispatchPnp+22 )
 
Followup: MachineOwner
---------

Have you done it, for sure?

• Anti-rootkit utility TDSSKiller

Make it sure.

Yes sir, but I didn't run the Defender Offline. Should I use that one too?

 

[Arc]

You do it. If still the problem persists, we will ask for more help. In the best of my findings, it is a virus infection. But I may be wrong.

 

[Entombed]

You do it. If still the problem persists, we will ask for more help. In the best of my findings, it is a virus infection. But I may be wrong.

Well, I was disappointed at first because the defender offline initial quick scan found nothing. Then I did a full scan and BAM! It found 3 threats. Keeping my fingers crossed for no more BSODs. I'll report back tonight if I have any more crashes. If I don't have any more, I'll report back anyways and then again tomorrow. Please keep your fingers crossed too!

 

[Arc]

OK, will keep Best of luck!

 

[Entombed]

Ok, I just got back from a 2nd shift at work and see that I had 2 more BSODs. It does not seem like it is happening as frequently and I'm not getting the system hangs either. Here's the diag.

 

[Arc]

I requested some other person to look at this thread, the best debugger I know, from whom I usually learn how to do it.

I hope he will suggest you the right way, please wait for him

 

[Vir Gnarus]

Either you have a bad drive or your old ESET drivers are flaking out. Update ESET to latest, or remove it altogether. As for the drives, it seems you've done everything aside from checking the SMART values with CrystalDiskInfo. If those all come up clean, then it still may very well be the drive, or some connection issue like a loose data/power cable or motherboard malfunction. I personally would lean on the drive itself (the SSD) being suspect.

Analysts:

For 0xF4 crashes, you often want to look at the raw stack for the crashed thread to see if there's any NTSTATUS error codes lying around inside it. !analyze -v will tell you the overall problem was that this critical Windows thread received a c0000006 NTSTATUS code during its operation, which means an I/O error occurred when attempting to shove something from disk to RAM. This specific NTSTATUS code it gives you will not give you the I/O error it came across, but almost always that can be discovered in the raw stack.

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8006167060, Terminating object
Arg3: fffffa8006167340, Process image file name
Arg4: fffff80002fc8460, Explanatory message (ascii)

Debugging Details:
------------------

----- ETW minidump data unavailable-----
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

PROCESS_OBJECT: fffffa8006167060

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

[COLOR=Red]EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.[/COLOR]

BUGCHECK_STR:  0xF4_IOERR

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`037fbe38 fffff800`03050822 : 00000000`000000f4 00000000`00000003 fffffa80`06167060 fffffa80`06167340 : nt!KeBugCheckEx
fffff880`037fbe40 fffff800`02ffce0b : ffffffff`ffffffff fffffa80`0677e6a0 fffffa80`06167060 fffffa80`06167060 : nt!PspCatchCriticalBreak+0x92
fffff880`037fbe80 fffff800`02f7bf04 : ffffffff`ffffffff 00000000`00000001 fffffa80`06167060 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176e6
fffff880`037fbed0 fffff800`02cc8253 : fffffa80`06167060 fffff800`c0000006 fffffa80`0677e6a0 00000000`00b50c80 : nt!NtTerminateProcess+0xf4
fffff880`037fbf50 fffff800`02cc4810 : fffff800`02d13b7f fffff880`037fca38 fffff880`037fc790 fffff880`037fcae0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`037fc0e8 fffff800`02d13b7f : fffff880`037fca38 fffff880`037fc790 fffff880`037fcae0 00000000`00b51990 : nt!KiServiceLinkage
fffff880`037fc0f0 fffff800`02cc8642 : fffff880`037fca38 00000000`000135e8 fffff880`037fcae0 00000000`00b51468 : nt! ?? ::FNODOBFM::`string'+0x488a4
fffff880`037fc900 fffff800`02cc71ba : 00000000`00000000 000007fe`fd40d8c0 00000000`00000001 00000000`000135e8 : nt!KiExceptionDispatch+0xc2
fffff880`037fcae0 00000000`76f99c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`00b513b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f99c12


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_IOERR_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_IOERR_IMAGE_csrss.exe

Followup: MachineOwner
---------

1: kd> !niemiro.rawstack
dps fffff880037fb000 fffff880037fcc68
fffff880`037fb000  fffff800`02e0cff4 nt!_imp_NtOpenSymbolicLinkObject+0x5aec
fffff880`037fb008  fffff800`02c112ec hal!HalpTscStallExecutionProcessor+0xe8
fffff880`037fb010  fffff880`037fbeb8
fffff880`037fb018  fffff800`02c4a000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`037fb020  fffff880`01247a98 Ntfs!NtfsFsdRead+0x1b8
fffff880`037fb028  fffff880`0123b000 Ntfs!NtfsGetNextChildLcb <PERF> (Ntfs+0x0)
fffff880`037fb030  fffff880`012a1600 Ntfs!__PchSym_ <PERF> (Ntfs+0x66600)
fffff880`037fb038  fffff880`037fc680
fffff880`037fb040  00000000`00000000
fffff880`037fb048  fffff800`02d08a16 nt!iswctype_l+0xc6

...

fffff880`037fc020  00000000`00000000
fffff880`037fc028  000007fe`fd40d8c0
fffff880`037fc030  00000000`[COLOR=Red]c000000e[/COLOR]
fffff880`037fc038  00000000`00000000
fffff880`037fc040  00000000`00000000

...

fffff880`037fc138  00000000`00000000
fffff880`037fc140  00000000`00000000
fffff880`037fc148  fffff880`04922a1eUnable to load image \SystemRoot\system32\DRIVERS\eamonm.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for eamonm.sys
*** ERROR: Module load completed but symbols could not be loaded for eamonm.sys
 eamonm+0x1ca1e[/COLOR]
fffff880`037fc150  00001f80`0010005f
fffff880`037fc158  0053002b`002b0033

...

1: kd> !error c000000e
[COLOR=Red]Error code: (NTSTATUS) 0xc000000e (3221225486) - A device which does not exist was specified.[/COLOR]
1: kd> lmvm eamonm
start             end                 module name
fffff880`04906000 fffff880`049df000   eamonm   T (no symbols)           
    Loaded symbol image file: eamonm.sys
    Image path: \SystemRoot\system32\DRIVERS\eamonm.sys
    Image name: eamonm.sys
    Timestamp:        [COLOR=Red]Thu Dec 09 00:29:20 2010[/COLOR] (4D006930)
    CheckSum:         00037F5C
    ImageSize:        000D9000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Aside from the spattering of c0000006 errors, there's one that mentions a device it tried to access (most likely a storage device) just didn't exist, so this is most likely the I/O error it was talking about - that or a c0000005 (memory referenced was bad) I also found. Either it tried using a bad value that ended up attempting to access a completely nonexistent device, or there was a device, but it disappeared and was subsequently removed prior to this attempt to access it, which often occurs in a very ugly and unexpected manner.

I noticed also that an ESET driver was present here, which from the looks of it is quite old. Perhaps this driver incidentally scrubbed the pointer to the device, which caused it to say device not found (cuz it's a bad value), which ends up giving the c0000006 error.

 

[Entombed]

Oops, just seeing the replies now. I didn't see that this rolled over to a second page. Reading now!!!