BSOD - Help!

Hello! So I first started seeing BSOD only when gaming (World of Warcraft) but now it is appearing while browsing the web as well. I recently reformatted my PC, as I had planned to do in the near future to delete my other OS on the system I no longer used. I thought maybe if I just went ahead and reformatted it may have fixed the issue.

Apparently it did not. The issue is reoccurring; I was able to attach the dmp files. View attachment

Just a little info on my PC:

AMD Athlon II X2 240 Processor 2.80 GHz
3.00 GB RAM
Windows 7 64 Bit
NVIDIA GeForce 9800 GT graphics card

Any assistance would greatly be appreciated!

I opened my dumps in WinDbg, and found something is causing csrss.exe to close;
not sure how to identify which driver could be the culprit, any assistance would be greatly appreciated!

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0280a000 PsLoadedModuleList = 0xfffff800`02a4f670
Debug session time: Sat Nov 5 01:27:55.397 2011 (GMT-5)
System Uptime: 0 days 1:48:03.020
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* *
* Bugcheck Analysis *
* *

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8004fe9280, fffffa8004fe9560, fffff80002b8a8b0}

Probably caused by : csrss.exe

Followup: MachineOwner

0: kd> !analyze -v
* *
* Bugcheck Analysis *
* *

A process or thread crucial to system operation has unexpectedly exited or been
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arg1: 0000000000000003, Process
Arg2: fffffa8004fe9280, Terminating object
Arg3: fffffa8004fe9560, Process image file name
Arg4: fffff80002b8a8b0, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: fffffa8004fe9280

IMAGE_NAME: csrss.exe



FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR: 0xF4_C0000005




fffff880`043d00e8 fffff800`02c115e2 : 00000000`000000f4 00000000`00000003 fffffa80`04fe9280 fffffa80`04fe9560 : nt!KeBugCheckEx
fffff880`043d00f0 fffff800`02bbe99b : ffffffff`ffffffff fffffa80`0562fa00 fffffa80`04fe9280 fffffa80`04fe9280 : nt!PspCatchCriticalBreak+0x92
fffff880`043d0130 fffff800`02b3e448 : ffffffff`ffffffff 00000000`00000001 fffffa80`04fe9280 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`043d0180 fffff800`02885ed3 : fffffa80`04fe9280 fffff800`c0000005 fffffa80`0562fa00 00000000`02370a40 : nt!NtTerminateProcess+0xf4
fffff880`043d0200 fffff800`02882470 : fffff800`028d267f fffff880`043d0b78 fffff880`043d08d0 fffff880`043d0c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`043d0398 fffff800`028d267f : fffff880`043d0b78 fffff880`043d08d0 fffff880`043d0c20 00000000`023715f0 : nt!KiServiceLinkage
fffff880`043d03a0 fffff800`028862c2 : fffff880`043d0b78 00000000`77229c12 fffff880`043d0c20 00000000`023710c8 : nt! ?? ::FNODOBFM::`string'+0x49874
fffff880`043d0a40 fffff800`02884e3a : 00000000`00000001 00000000`02370ff8 00000000`0238e001 00000000`77229c12 : nt!KiExceptionDispatch+0xc2
fffff880`043d0c20 00000000`77229a9b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`02371000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77229a9b



FAILURE_BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner

0: kd> !analyze -show D1
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory


Noob Whisperer
Hello and welcome to the forum.
First determine your motherboard Rev. Number then go here (note at the top the various Rev.#s available make sure you are working with the correct one, should be a label on the Motherboard itself or the box it came in.)GIGABYTE - Motherboard - Socket AM2+ - GA-MA785GM-US2H (rev. 3.3)
Check and confirm that you have the most recent drivers available from there installed on your computer (Make sure you plug in your version of Windows 7 (32 or 64 bit)). Pay particular attention to the chipset drivers available and also check for a BIOS update while you are there.
Then update the following older drivers
Rt64win7.sys 2/26/2009 Realtek LAN Driver from here Realtek
athrx.sys 7/8/2009 (Presumably a D-Link 2320, using an Atheros chipset) ATHEROS PCI VENDOR for D-Link (D-Link)

i need help to but every time i post a thread i dont get replied back to i just need verification of what the issue is b.c i just bought my computer three months ago and built it my self and im pretty sure its the ram but would like someone to help me verify it if someone could tell me how to attach my dump files that would be awesome thx!


Extraordinary Member
Hi Spade and Welcome to The Forum,

Run the SF Diagnostics tool found under method 2 here: This will collect the dmps and other info which will help us to help you.


Download and run CPU-Z. Take screenshots**/snips of the Mainboard tab, Memory tab and all the slot #'s under the SPD tab.
Go to Post Reply, click on the Go Advanced button and attach the screenshots**/snips to your post for all the RAM experts to see by using the paper clip you will find on the top toolbar. Do not zip them up.
**If screenshots, please crop.

Finally start your own thread in the bsod forum.

Oh, how to attach dmps!!

Go to your C:\Windows\Minidump folder. Copy the .dmp files to a new folder on your desktop. Zip up that folder and attach to a post.

As mentioned the SF Diag tool will find and collect the data for you though.

This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.