Solved BSOD Random, error 0xf4

[TechieComputers]

Hey there SevenForums users! Long time lurker, first time post. I am currently working on a customers desktop computer right now. The customer has stated that computer is randomly shutting down while viewing emails (web based), typing up documents (Word), and viewing web pages in general. I have already ran Dell Diagnostics along with another diagnostics tool we use in shop. Everything has passed. The computer is also malware/virus free. I'm wondering if anyone can help using their magic and find the cause of these BSOD. My bet is on a driver/Windows update. Thank you for your help and let me know if you need anything!

System Specs:
Dell Optiplex 3020
Windows 7 Pro 64bit
Intel i3-4160 @ 3.6 GHz
4 GB Ram

Memory Dump:
View attachment 372649

 

[Laith]

Welcome back, mate!

BugCheck F4, {3, fffffa8003702950, fffffa8003702c30, fffff80003395e70}

Probably caused by : csrss.exe

Since this an 0xF4 it could mean that there's a virus, a failing harddrive, failing RAM stick/s. Run SeaTools(DO NOT RUN FOR SSDS) http://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html Also run MemTest86+ for 8 passes. It must be MemTest86+. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html Scan your computer for viruses using Malwarebytes. http://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html

 

[TechieComputers]

Thanks for the quick reply Laith!

I have checked both running processes of "csrss.exe" and their file locations, which is under system32, so I'm assuming they are legitimate and not viruses. Unless you are saying they commonly crash systems.

I have run multiple virus/malware scanners including SuperAntiSpyware, Malwarebytes, and Panda AV so I'm going to rule out viruses.

I have ran the built in Dell Diagnostics which includes a RAM and Hard Drive test. I also ran a hard drive test out of the system. I will try running MemTest86 tomorrow morning but I'm not banking on it.

One other possibility I'm thinking about it is the customer's power supply. In our shop it has yet to crash but if they are randomly shutting down at their business it could be possible that there's a bad power strip or outlet on their end.

 

[Laith]

You must run SeaTools and MemTest86+, the ones that come with the system are inefficient.

It is possible aswell, but first let us rule out the RAM, HDD and if there is any viruses.

 

[TechieComputers]

MemTest86 - 30 passes. I think were good there. Also passed the SeaTools diag. The computer is clean of viruses. Still has yet to crash while in shop.

 

[Laith]

Did you run MemTest86+ or MemTest86?

 

[TechieComputers]

MemTest86+

 

[Laith]

Hmm, have you installed the latest updates from Windows Update?

 

[TechieComputers]

Yes, every important update and optional update is currently up to date.

 

[Laith]

Hmm, can you do a fresh install on the clients computer? I just want to check off the system from the list.

 

[axe0]

Since the processes are all from Windows, I would suggest to make sure that the system files are intact.

Please do the following:

• Open an admin command prompt
• Copy/paste "sfc/scannow" (without quotes) and press enter
• When it finished reboot your system
• Open again an admin command prompt
• Enter sfc/scannow again

If sfc/scannow does NOT say "Windows Resource Protection did not find any integrity violation", please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.

 

[TechieComputers]

I could, but it would take time I can't afford for the backing up data, fresh install, windows updates, then data placement. I would like to use this as a last resort if possible. The computer is still running perfectly with no random shutdowns.

 

[Laith]

Hmm, then we'll just wait, for now run sfc /scannow as axe0 said.

 

[TechieComputers]

Since the processes are all from Windows, I would suggest to make sure that the system files are intact.

Please do the following:

• Open an admin command prompt
• Copy/paste "sfc/scannow" (without quotes) and press enter
• When it finished reboot your system
• Open again an admin command prompt
• Enter sfc/scannow again

If sfc/scannow does NOT say "Windows Resource Protection did not find any integrity violation", please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.

Here are the sfc results: View attachment 372729

Are the main areas you're looking for at the bottom of the log? For example: the corrupted files such as usb. I'm just curious because I have never really went through these logs to determine the causes. Thanks!

Also, another factor is the customer has a printer hooked up via usb. I've known bad usb ports to crash a computer. Just another thought.

 

[axe0]

Here are the sfc results: View attachment 372729

Are the main areas you're looking for at the bottom of the log? For example: the corrupted files such as usb. I'm just curious because I have never really went through these logs to determine the causes. Thanks!

Also, another factor is the customer has a printer hooked up via usb. I've known bad usb ports to crash a computer. Just another thought.

Usually I search for 'summary', or 'cannot'.
'Cannot repair file member' is one I see a lot, it says what file is corrupted / missing, but because the part 'repair file member' is not always there I search only for 'cannot'
If a file is corrupted, then you need to check if the source is also corrupted. If the source is corrupted, then it is usually mentioned 1 line below the 'cannot repair file member' part and you need to use the command 'DISM /Online /Cleanup-image /RestoreHealth' to restore the source corruption.
'Summary' is of course a summary of what files are corrupted / missing and if it has been solved or not.

In this case, none of the 2 are in the log, meaning you have to look a little through the file.
I also look for 'Reboot mark refs incremented to' meaning you have to reboot or not.
If 'Reboot mark refs incremented to: 1' you have to reboot
If 'Reboot mark refs incremented to: 0' you do not have to reboot.

Of course, I also look at the bottom, the cbs.log says the following what is pretty clear if you ask me

2015-10-01 11:44:35, Info                  CSI    0000034c [SR] [COLOR="Red"]Repair complete[/COLOR]
2015-10-01 11:44:35, Info                  CSI    0000034d [SR] Committing transaction
2015-10-01 11:44:35, Info                  CSI    0000034e Creating NT transaction (seq 2), objectname [6]"(null)"
2015-10-01 11:44:35, Info                  CSI    0000034f Created NT transaction (seq 2) result 0x00000000, handle @0x1fc8
2015-10-01 11:44:36, Info                  CSI    00000350@2015/10/1:15:44:36.309 CSI perf trace:
CSIPERF:TXCOMMIT;277947
2015-10-01 11:44:36, Info                  CSI    00000351 [SR] [COLOR="red"]Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired[/COLOR]

Shortly, the problems have been solved

 

[TechieComputers]

Thank you for your detailed explanation! I really appreciate it. So you are saying that sfc did repair my issues but how do we know that it fixed my specific problem? I'm guessing the only way to tell is if I return it to the customer and wait to see if this problem persists.

I'm going to ask that they watch their computer carefully and report any unusual activity. I have also replaced their power cord and explained that they need to try using a different power outlet/strip. I downloaded the newest driver for their printer as well just incase.

Thanks again for everyones help! I'll mark it solved for now and I hope that I don't have to come back.
Have a good one!

 

[Laith]

You should update all the drivers to the latest version

No problem! It's my duty to help!

 

[axe0]

Thank you for your detailed explanation! I really appreciate it. So you are saying that sfc did repair my issues but how do we know that it fixed my specific problem? I'm guessing the only way to tell is if I return it to the customer and wait to see if this problem persists.

You're welcome

The only way to find out if a problem is solved is by trying to reproduce it.

 

[axe0]

Just found this somewhere:

2015-09-22 15:55:04, Info                  CSI    0000037b [SR] Cannot repair member file [l:6{3}]"BCD" of Microsoft-Windows-BootEnvironment-DVD-EFI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:04, Info                  CSI    0000037d [SR] Cannot repair member file [l:6{3}]"BCD" of Microsoft-Windows-BootEnvironment-DVD-PCAT, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:04, Info                  CSI    0000037f [SR] Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:04, Info                  CSI    00000381 [SR] Cannot repair member file [l:30{15}]"NlsData002a.dll" of Microsoft-Windows-NaturalLanguage6, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:06, Info                  CSI    00000383 [SR] Cannot repair member file [l:6{3}]"BCD" of Microsoft-Windows-BootEnvironment-DVD-EFI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:06, Info                  CSI    00000384 [SR] This component was referenced by [l:170{85}]"Microsoft-Windows-Backup-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsBackup"
2015-09-22 15:55:06, Info                  CSI    00000385 [SR] This component was referenced by [l:192{96}]"Microsoft-Windows-RecDisc-SDP-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsRecoveryDisc"
2015-09-22 15:55:06, Info                  CSI    00000388 [SR] Could not reproject corrupted file [ml:520{260},l:54{27}]"\??\C:\windows\Boot\DVD\EFI"\[l:6{3}]"BCD"; [COLOR="red"]source file in store is also corrupted[/COLOR]
2015-09-22 15:55:06, Info                  CSI    0000038a [SR] Cannot repair member file [l:6{3}]"BCD" of Microsoft-Windows-BootEnvironment-DVD-PCAT, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:06, Info                  CSI    0000038b [SR] This component was referenced by [l:170{85}]"Microsoft-Windows-Backup-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsBackup"
2015-09-22 15:55:06, Info                  CSI    0000038c [SR] This component was referenced by [l:192{96}]"Microsoft-Windows-RecDisc-SDP-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsRecoveryDisc"
2015-09-22 15:55:06, Info                  CSI    0000038f [SR] Could not reproject corrupted file [ml:520{260},l:56{28}]"\??\C:\windows\Boot\DVD\PCAT"\[l:6{3}]"BCD"; [COLOR="red"]source file in store is also corrupted[/COLOR]
2015-09-22 15:55:06, Info                  CSI    00000391 [SR] Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:06, Info                  CSI    00000392 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2015-09-22 15:55:06, Info                  CSI    00000395 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\windows\System32"\[l:22{11}]"autochk.exe"; [COLOR="red"]source file in store is also corrupted[/COLOR]
2015-09-22 15:55:07, Info                  CSI    00000397 [SR] Cannot repair member file [l:30{15}]"NlsData002a.dll" of Microsoft-Windows-NaturalLanguage6, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-09-22 15:55:07, Info                  CSI    00000398 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2015-09-22 15:55:09, Info                  CSI    0000039b [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\windows\System32"\[l:30{15}]"NlsData002a.dll"; [COLOR="Red"]source file in store is also corrupted[/COLOR]

   Note

DISM /Online /Cleanup-Image /RestoreHealth does NOT work in Windows 7!

It is something I have to keep remind myself on.