none
BSOD cause by csrss.exe

    Question

  • Cant find exactly what is causing the blue screen. this is was i got from the memory dump. 

    CRITICAL_OBJECT_TERMINATION (f4)
    A process or thread crucial to system operation has unexpectedly exited or been
    terminated.
    Several processes and threads are necessary for the operation of the
    system; when they are terminated (for any reason), the system can no
    longer function.
    Arguments:
    Arg1: 0000000000000003, Process
    Arg2: fffffa8006a51b30, Terminating object
    Arg3: fffffa8006a51e10, Process image file name
    Arg4: fffff80002dcd350, Explanatory message (ascii)

    Debugging Details:
    ------------------


    KERNEL_LOG_FAILING_PROCESS:  (null)

    PROCESS_OBJECT: fffffa8006a51b30

    IMAGE_NAME:  csrss.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    MODULE_NAME: csrss

    FAULTING_MODULE: 0000000000000000 

    PROCESS_NAME:  csrss.exe

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    BUGCHECK_STR:  0xF4_c0000005

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

    CURRENT_IRQL:  0

    STACK_TEXT:  
    fffff880`07568ac8 fffff800`02e54d22 : 00000000`000000f4 00000000`00000003 fffffa80`06a51b30 fffffa80`06a51e10 : nt!KeBugCheckEx
    fffff880`07568ad0 fffff800`02e0108b : ffffffff`ffffffff fffffa80`06a80a50 fffffa80`06a51b30 fffffa80`06a51b30 : nt!PspCatchCriticalBreak+0x92
    fffff880`07568b10 fffff800`02d81144 : ffffffff`ffffffff 00000000`00000001 fffffa80`06a51b30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17486
    fffff880`07568b60 fffff800`02ac5e93 : fffffa80`06a51b30 fffff880`c0000005 fffffa80`06a80a50 fffffa80`056f2060 : nt!NtTerminateProcess+0xf4
    fffff880`07568be0 00000000`779815da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`017cd818 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779815da


    STACK_COMMAND:  kb

    FOLLOWUP_NAME:  MachineOwner

    FAILURE_BUCKET_ID:  X64_0xF4_c0000005_IMAGE_csrss.exe

    BUCKET_ID:  X64_0xF4_c0000005_IMAGE_csrss.exe

    Followup: MachineOwner
    ---------

    Friday, May 31, 2013 7:09 PM

Answers

  • Hi,


    According to the error code 0xF4 was received, you can refer to Bug Check 0xF4: CRITICAL_OBJECT_TERMINATION.


    The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe provides the critical functions of the operating system, and its termination can result in the Blue Screen of Death being displayed Csrss.exe controls threading and Win32 console window features.


    I suggest you update drivers first, then scan your full system and remove the malware or virus in time.  If the issue persists, you may restore your system.


    Hope this helps


    Vincent Wang
    TechNet Community Support

    Tuesday, June 04, 2013 2:51 AM
    Moderator
  • We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.
    If you are overclocking stop.  (chances are if you dont know if you are, you are not)a
    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.  We need at least 2 DMP FILES to diagnose and confirm


    The procedure:

    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on  your site, MS doesnt have this)
     *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply.
    Link for how to  upload below.
    http://www.wikihow.com/Use-SkyDrive

    To ensure minidumps are enabled:

    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.

    Please also run MSinfo32 and upload the output as well.
    To run MSinfo32 please go to start>run>MSinfo32
    Go to "file" "save" and upload the saved file with the DMPS
    System specs are extremely useful so please include whatever you know.

    Wanikiya & Dyami--Team Zigzag

    Tuesday, June 04, 2013 2:54 AM
    Moderator

All replies

  • Hi,


    According to the error code 0xF4 was received, you can refer to Bug Check 0xF4: CRITICAL_OBJECT_TERMINATION.


    The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe provides the critical functions of the operating system, and its termination can result in the Blue Screen of Death being displayed Csrss.exe controls threading and Win32 console window features.


    I suggest you update drivers first, then scan your full system and remove the malware or virus in time.  If the issue persists, you may restore your system.


    Hope this helps


    Vincent Wang
    TechNet Community Support

    Tuesday, June 04, 2013 2:51 AM
    Moderator
  • We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.
    If you are overclocking stop.  (chances are if you dont know if you are, you are not)a
    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.  We need at least 2 DMP FILES to diagnose and confirm


    The procedure:

    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on  your site, MS doesnt have this)
     *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply.
    Link for how to  upload below.
    http://www.wikihow.com/Use-SkyDrive

    To ensure minidumps are enabled:

    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.

    Please also run MSinfo32 and upload the output as well.
    To run MSinfo32 please go to start>run>MSinfo32
    Go to "file" "save" and upload the saved file with the DMPS
    System specs are extremely useful so please include whatever you know.

    Wanikiya & Dyami--Team Zigzag

    Tuesday, June 04, 2013 2:54 AM
    Moderator