Solved BSOD. Windbg indicates Csrss.exe. F4 Code. Can't Figure it out.

[Gromit1710]

Hi all.

This is my first post here, so I'll try and make it a good one.

I've built my first Enthusiast PC (detailed specs are in my profile) and have had only 1 issue.

I've been getting a random BSOD since day 1 of uptime. I've used Windbg, Whocrashed, Memtest, Intelburn Test, Chkdsk /f .. All have turned up nothing useful or out of the ordinary that I can see.

Whocrashed points to ntoskrnl.exe with no identified driver.
Windbg likes to suggest Csrss.exe as the culprit.

I'm running the latest drivers/installs for
GPU's, BIOS, MARVELL adapters, CD ROM drive, HDD drive, SSD drive.

• ACHI is enabled.
• Trim Enabled.
• I've tried running the drives on both the Marvell adapter and the Intel ATA sockets
• I've uninstalled and re-installed almost every driver I can think of.
• BSOD happens with Stock settings (CPU, GPU), and overclocked settings.
• Doesn't seem to crash as long as I log out and sit on the log in screen
• will crash at least once every 24 hrs.
• will crash at idle, gaming, surfing, DVD playback.
• does not crash at the same time of the day.
• cannot find any event logs pointing to the crash. no logs are reported at time of crash.
• superfetch is disabled (by me) through service management.

The machine has passed IntelBurn with good results. Memtest ran for 8 hours with 3 passes, no errors.

I'm running out of ideas. I'm posting here as a last ditch before starting over with the install.

Please... help. I've included every piece of information suggested by the forum. The basic windows info, A paste of the Windbg report, and the ZIP file built just like the sticky suggests at the top of this forum.

Is Windows 7 . . . - x64 - the original installed OS on the system - Full Retail Version - What is the age of system (hardware) Less than 1 month - What is the age of OS installation (have you re-installed the OS?) Less than 1 month
WINDBG REPORT:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\092611-31075-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`07067000 PsLoadedModuleList = 0xfffff800`072ac670
Debug session time: Mon Sep 26 07:49:59.686 2011 (UTC - 7:00)
System Uptime: 0 days 22:32:12.498
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa80120b29d0, fffffa80120b2cb0, fffff800073e78b0}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa80120b29d0, Terminating object
Arg3: fffffa80120b2cb0, Process image file name
Arg4: fffff800073e78b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa80120b29d0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

BUGCHECK_STR: 0xF4_IOERR

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

CURRENT_IRQL: 0

STACK_TEXT:
fffff880`0bff49c8 fffff800`0746e5e2 : 00000000`000000f4 00000000`00000003 fffffa80`120b29d0 fffffa80`120b2cb0 : nt!KeBugCheckEx
fffff880`0bff49d0 fffff800`0741b99b : ffffffff`ffffffff fffffa80`12637660 fffffa80`120b29d0 fffffa80`120b29d0 : nt!PspCatchCriticalBreak+0x92
fffff880`0bff4a10 fffff800`0739b448 : ffffffff`ffffffff 00000000`00000001 fffffa80`120b29d0 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`0bff4a60 fffff800`070e2ed3 : fffffa80`120b29d0 fffff880`c0000006 fffffa80`12637660 fffffa80`0f5485f0 : nt!NtTerminateProcess+0xf4
fffff880`0bff4ae0 00000000`777e15da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0125e518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777e15da


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_IOERR_VRF_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_IOERR_VRF_IMAGE_csrss.exe

Followup: MachineOwner

 

[zigzag3143]

Gromit1710

Just to eliminate a nagging suspicion please download Malwarebytes and run it. I know you have Kaspersky but csrss.exe can be a valid system file of malware dependent on where it is located.

I would also remove Kaspersky and replace with Microsoft Security essentials as it is know it is known to cause BSOD's on some systems.

http://support.kaspersky.com/downloads/utils/kavremover10.zip

Virus, Spyware & Malware Protection | Microsoft Security Essentials


Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!

 

[Gromit1710]

Ok.

I DL'ed and ran Maleware Bytes.

It didn't flag csrss.exe. Instead it flagged and deleted this:

Folders Infected:
c:\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.
c:\ndis.sys\4ce79392f3000 (Trojan.SpyEyes) -> Quarantined and deleted successfully.

Files Infected:
c:\ndis.sys\4ce79392f3000\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.


If that was for real, I'm a bit disappointed in kaspersky... I've now removed both kaspersky and Malewarebytes and installed Windows Security Essentials.

I've never trusted windows security products before, assuming that an aftermarket one would be better. But I'm serious about trying whatever I can to fix this.

I'll let the computer sit for the day and report back later. Thank you.

 

[zigzag3143]

Ok.

I DL'ed and ran Maleware Bytes.

It didn't flag csrss.exe. Instead it flagged and deleted this:

Folders Infected:
c:\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.
c:\ndis.sys\4ce79392f3000 (Trojan.SpyEyes) -> Quarantined and deleted successfully.

Files Infected:
c:\ndis.sys\4ce79392f3000\ndis.sys (Trojan.SpyEyes) -> Quarantined and deleted successfully.


If that was for real, I'm a bit disappointed in kaspersky... I've now removed both kaspersky and Malewarebytes and installed Windows Security Essentials.

I've never trusted windows security products before, assuming that an aftermarket one would be better. But I'm serious about trying whatever I can to fix this.

I'll let the computer sit for the day and report back later. Thank you.

Malwarebytes is great at what it does. MSE is a good lightweight malware app.

Kaspersky, McAffee, and Symantec often miss things.

I am going to go against the grain and say I use AVG on one, and ESET Smart security on another (has built in firewall), but that is personal preference.

I would also re-run malwarebytes daily for a bit. If re-infected we can root it out.

 

[Gromit1710]

Well, I'm at 11 hours of uptime after the reboots from the installations this morning.

So far so good.

so I'm thinking my new plan of AV protection for this computer is:

Windows Security Essentials + regular Malwarebytes scans.

For Firewall protection I have my Router + windows firewall.

 

[zigzag3143]

Well, I'm at 11 hours of uptime after the reboots from the installations this morning.

So far so good.

so I'm thinking my new plan of AV protection for this computer is:

Windows Security Essentials + regular Malwarebytes scans.

For Firewall protection I have my Router + windows firewall.

That is probably the most stable option. I run Eset smart security

 

[Gromit1710]

Zigzag3143...

I think you solved my problem. 24 hrs of uptime with no BSOD.

That's a first.

Although how I got infected the first day of uptime is beyond me. Especially since the AV is always the first program I load on a PC.

Thank you.