Crash help

[timmciglobal]

Having random crashes, only two things I did recently was install IE9 (I uninstalled it thinking maybe it was problem) and FRAPS and also uninstalled that.

http://www.timhd.com/crash.zip is the zip of the 2 most recent dumps.

I tried running malware bytes virus scan, avast, eset and it scans for a bit then slows down alot then windows freezes then blue screen of death.

Help!!!

Tim

 

[Maguscreed]

multiple active virus scanners are not a good ideal.
Pick one between avast and eset.
Honestly I would drop them both and use MSE
Virus, Spyware & Malware Protection | Microsoft Security Essentials

eset could very likely be the problem as that would make you about the 30th+ person I've run into in my short time on this site with eset issues with win 7.

 

[timmciglobal]

I ran the virus scanner eset after the crash issues the web version there is no way it's causing it as it was not in use when it crashed or installed.

 

[Maguscreed]

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8009858220, Terminating object
Arg3: fffffa8009858500, Process image file name
Arg4: fffff80002f8ddb0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa8009858220

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0xF4_C0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`023fd0e8 fffff800`03012982 : 00000000`000000f4 00000000`00000003 fffffa80`09858220 fffffa80`09858500 : nt!KeBugCheckEx
fffff880`023fd0f0 fffff800`02fc00ab : ffffffff`ffffffff fffffa80`09bbcb60 fffffa80`09858220 fffffa80`09858220 : nt!PspCatchCriticalBreak+0x92
fffff880`023fd130 fffff800`02f43698 : ffffffff`ffffffff 00000000`00000001 fffffa80`09858220 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17ad6
fffff880`023fd180 fffff800`02c898d3 : fffffa80`09858220 fffff800`c0000005 fffffa80`09bbcb60 00000000`007604b0 : nt!NtTerminateProcess+0xf4
fffff880`023fd200 fffff800`02c85e70 : fffff800`02cd611f fffff880`023fdb78 fffff880`023fd8d0 fffff880`023fdc20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`023fd398 fffff800`02cd611f : fffff880`023fdb78 fffff880`023fd8d0 fffff880`023fdc20 000007fe`fde1a22c : nt!KiServiceLinkage
fffff880`023fd3a0 fffff800`02c89cc2 : fffff880`023fdb78 00000000`007a0000 fffff880`023fdc20 000007fe`fde1efa0 : nt! ?? ::FNODOBFM::`string'+0x49974
fffff880`023fda40 fffff800`02c8883a : 00000000`00000001 00000000`00760a68 00000000`77aa8d01 00000000`007a0000 : nt!KiExceptionDispatch+0xc2
fffff880`023fdc20 00000000`77998e3d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`00760a70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77998e3d


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

File: csrss.exe
This is the user-mode portion of the Win32 subsystem; Win32.sys is the kernel-mode portion. Csrss stands for Client/Server Run-Time Subsystem, and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment.

The client server runtime was the hung app for the crash.
This still indicates either a virus (which you seem to have ruled out)
or an application interfering with a basic windows process.
What is the result of running a secure file check?
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[cluberti]

Well, these aren't random at all. They're both crashes in csrss.exe (which causes an F4 bugcheck for CRITICAL_OBJECT_TERMINATION), and they're both I/O errors. However, since these are just minidumps, it's almost impossible to say if there's a driver at fault here, memory corruption, or if there really is an error retrieving data from disk causing this. If you can, configure your machine for a complete memory dump - at least a kernel dump, but complete if possible. Otherwise, this is all that can really be seen:

1: kd> kb
RetAddr           : Args to Child                                                           : Call Site
fffff800`03012982 : 00000000`000000f4 00000000`00000003 fffffa80`09858220 fffffa80`09858500 : nt!KeBugCheckEx
fffff800`02fc00ab : ffffffff`ffffffff fffffa80`09bbcb60 fffffa80`09858220 fffffa80`09858220 : nt!PspCatchCriticalBreak+0x92
fffff800`02f43698 : ffffffff`ffffffff 00000000`00000001 fffffa80`09858220 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17ad6
fffff800`02c898d3 : fffffa80`09858220 fffff800`c0000005 fffffa80`09bbcb60 00000000`007604b0 : nt!NtTerminateProcess+0xf4
fffff800`02c85e70 : fffff800`02cd611f fffff880`023fdb78 fffff880`023fd8d0 fffff880`023fdc20 : nt!KiSystemServiceCopyEnd+0x13
fffff800`02cd611f : fffff880`023fdb78 fffff880`023fd8d0 fffff880`023fdc20 000007fe`fde1a22c : nt!KiServiceLinkage
fffff800`02c89cc2 : fffff880`023fdb78 00000000`007a0000 fffff880`023fdc20 000007fe`fde1efa0 : nt! ?? ::FNODOBFM::`string'+0x49974
fffff800`02c8883a : 00000000`00000001 00000000`00760a68 00000000`77aa8d01 00000000`007a0000 : nt!KiExceptionDispatch+0xc2
00000000`77998e3d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77998e3d

1: kd> ub fffff800`02c8883a
nt!KiPageFault+0x216:
fffff800`02c88816 ba03000000      mov     edx,3
fffff800`02c8881b 448bd8          mov     r11d,eax
fffff800`02c8881e eb05            jmp     nt!KiPageFault+0x225 (fffff800`02c88825)
fffff800`02c88820 b904000010      mov     ecx,10000004h
fffff800`02c88825 4c8b5550        mov     r10,qword ptr [rbp+50h]
fffff800`02c88829 4c0fb64daa      movzx   r9,byte ptr [rbp-56h]
fffff800`02c8882e 4c8b85e8000000  mov     r8,qword ptr [rbp+0E8h]
fffff800`02c88835 e8c6130000      call    nt!KiExceptionDispatch (fffff800`02c89c00)

1: kd> dc 00000000`77998e3d L1
00000000`77998e3d  ????????                             ????

 

[Maguscreed]

I honestly think it would be a bit more random if memory related, the fact it's the same app dying suggests to me something is interfering with it, while we can't nail it down, it's very possible that his ie9 install went wrong somehow , thus my suggestion of sfc.

 

[cluberti]

Agreed.

 

[timmciglobal]

Well update and thanks for help so far.

I ran memtest86 apparently my 2nd bank of ram was having some random errors (got about 61 in 6 minutes of testing)

So I pulled the chips but still BSOD. I had to "secure erase" the SSD using a linux bootable flash drive to get windows to reinstall.

I reinstalled win7 now and seems to be working but did get 1 BSOD which kinda has me scared that maybe the SSD is corrupt again, could ya look at this minidump and let me know what ya think?

This is totally fresh win7 with just the first set of 2 patches applied by default before first reboot.

http://www.timhd.com/newdump.zip

Tim

 

[Maguscreed]

61 memory errors in 6 minutes, is not random, it's bad ram.

usually it takes several passes to show any error at all even when it is bad.

 

[timmciglobal]

Yea, I pulled the defective two chips already.

Tim