BSOD ntoskrnl.exe and ntkrnlmp.exe

Discussion in 'Windows 7 Blue Screen of Death (BSOD)' started by Caranor, Oct 20, 2012.

  1. Caranor

    Caranor New Member

    Joined:
    Oct 20, 2012
    Messages:
    6
    Likes Received:
    0
    Hi I have been having BSOD's at random times, my pc keeps crashing I have formatted three times still same problem....
    I found out how to use minidump and such but dont know what these things mean I will put my minidump in here as detachment though.
    Please help me :(.
     

    Attached Files:

  2. GeneralHiningII

    GeneralHiningII Honorable Member

    Joined:
    Sep 21, 2012
    Messages:
    745
    Likes Received:
    7
    Please follow these instructions on http://windows7forums.com/blue-screen-death-bsod/38837-how-ask-help-bsod-problem.html

    Analysis:
    Code:
    BSOD Dump File Analyzer - MSZ
    
    
    Debug session time: Sun Oct 21 06:49:15.071 2012 (UTC + 11:00)
    Loading Dump File [C:\Users\MZ\SysnativeBSODApps\102012-31449-01.dmp]
    Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
    System Uptime: 0 days 0:42:34.024
    BugCheck F4, {3, fffffa8006d8cb30, fffffa8006d8ce10, fffff8000318a510}
    Probably caused by : csrss.exe
    Bugcheck code 000000f4
    
    PROCESS_NAME:  csrss.exe
    BUGCHECK_STR:  0xF4_IOERR
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    FAILURE_BUCKET_ID:  X64_0xF4_IOERR_IMAGE_csrss.exe
    MaxSpeed:     2200
    CurrentSpeed: 2195
    BiosVersion = A14
    BiosReleaseDate = 11/11/2011
    SystemManufacturer = Dell Inc.         
    SystemProductName = Dell System XPS L702X
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    
    
    
    BSOD Dump File Analyzer - MSZ
    
    
    Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
    Debug session time: Sun Oct 21 06:49:15.071 2012 (UTC + 11:00)
    System Uptime: 0 days 0:42:34.024
    BugCheck F4, {3, fffffa8006d8cb30, fffffa8006d8ce10, fffff8000318a510}
    Probably caused by : csrss.exe
    BUGCHECK_STR:  0xF4_IOERR
    PROCESS_NAME:  csrss.exe
    ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
    
    
    BugCheck F4, {3, fffffa8006d8cb30, fffffa8006d8ce10, fffff8000318a510}
    
    
    Probably caused by : csrss.exe
    
    
    Followup: MachineOwner
    ---------
    STACK_COMMAND:  kb
    
    
    FOLLOWUP_NAME:  MachineOwner
    
    
    FAILURE_BUCKET_ID:  X64_0xF4_IOERR_IMAGE_csrss.exe
    
    
    BUCKET_ID:  X64_0xF4_IOERR_IMAGE_csrss.exe
    
    
    Followup: MachineOwner
    ---------
    
    
    Looking at the .dmp file however, it seems the problem is caused by csrss.exe, which is the Microsoft Client Server Runtime Server - it controls the graphical instructions being sent through your computer.

    csrss.exe is found in C:\Windows\System32\csrss.exe
    Note: Some viruses disguise themselves as csrss.exe.

    CTRL+ALT+DEL and select "Start Task Manager".
    Select the processes tab and locate "csrss.exe".
    Normally it should be taking about ~3000K of memory, any more and it probably is a trojan.
    If you find it hogs more than ~3000K, run an antivirus "full system scan" (all reputable antivirus softwares should have this option). If the antivirus finds a problem, follow the steps to repair it.

    3rd Party Drivers:
    All red drivers should be removed or updated.
    Code:
    [B][COLOR=#ff0000]intelppm.sys                Tue Jul 14 09:19:25 2009 (4A5BC0FD)[/COLOR][/B][B][COLOR=#ff0000]amdxata.sys                 Sat Mar 20 03:18:18 2010 (4BA3A3CA)[/COLOR][/B]
    [B][COLOR=#ff0000]qicflt.sys                  Fri Jul  2 11:46:34 2010 (4C2D44FA)[/COLOR][/B]
    [B][COLOR=#ff0000]SynTP.sys                   Fri Sep 24 09:49:07 2010 (4C9BE773)[/COLOR][/B]
    [B][COLOR=#ff0000]HECIx64.sys                 Wed Oct 20 10:33:43 2010 (4CBE2AD7)[/COLOR][/B]
    [B][COLOR=#ff0000]Rt64win7.sys                Tue Nov 30 17:01:28 2010 (4CF49338)[/COLOR][/B]
    nvstusb.sys                 Wed Oct  3 04:11:53 2012 (506B2E69)
    nvlddmkm.sys                Wed Oct  3 04:21:13 2012 (506B3099)
    
    intelppm.sys Tue Jul 14 09:19:25 2009 (4A5BC0FD)
    Intel Processor driver
    http://www.carrona.org/drivers/driver.php?id=intelppm.sys

    amdxata.sys Sat Mar 20 03:18:18 2010 (4BA3A3CA)
    AMD storage controller driver - usually from the Windows 7 DVD
    http://www.carrona.org/drivers/driver.php?id=amdxata.sys

    qicflt.sys Fri Jul 2 11:46:34 2010 (4C2D44FA)
    QicFilterDriver-64Bits from Quanta Computer/Dell Webcam Driver
    http://www.carrona.org/drivers/driver.php?id=qicflt.sys

    SynTP.sys Fri Sep 24 09:49:07 2010 (4C9BE773)
    Synaptic Touch Pad Driver
    http://www.carrona.org/drivers/driver.php?id=SynTP.sys

    HECIx64.sys Wed Oct 20 10:33:43 2010 (4CBE2AD7)
    Intel Management Engine Interface
    http://www.carrona.org/drivers/driver.php?id=HECIx64.sys

    Rt64win7.sys Tue Nov 30 17:01:28 2010 (4CF49338)
    Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC
    http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys

    nvstusb.sys Wed Oct 3 04:11:53 2012 (506B2E69)
    NVIDIA Stereoscopic 3D USB driver
    http://www.carrona.org/drivers/driver.php?id=nvstusb.sys

    nvlddmkm.sys Wed Oct 3 04:21:13 2012 (506B3099)
    nVidia Video drivers
    http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
     
  3. usasma

    usasma Fantastic Member
    Microsoft Community Contributor

    Joined:
    Mar 22, 2010
    Messages:
    3,048
    Likes Received:
    83
    Just to add to GeneralHiningII's advice....

    Please note this line in the analysis that they provided:
    An IOERR (I/O Error) is frequently due to an issue with a hard drive or one of the components involved in managing the operation of the hard drive.

    Please run this free hard drive diagnostic procedure: http:Hard Drive Diagnostic Procedure

    Just to be safe, please run a free scan from here: Free Online AntiMalware Resources
    You can also run a free scan on just the csrss.exe file at Jotti's malware scan

    IMO it's not very common to have BSOD issues due to files that are protected by the System File Checker in Windows (usually this is a sign for us to look elsewhere for the problem). But in this case, it's also not very common to see csrss.exe as the blame. So it's advisable to perform a full system scan "just in case"
     
    #3 usasma, Oct 21, 2012
    Last edited: Oct 21, 2012
    1 person likes this.
  4. GeneralHiningII

    GeneralHiningII Honorable Member

    Joined:
    Sep 21, 2012
    Messages:
    745
    Likes Received:
    7
    Would Defragging the hard disk help in anyway?
     
  5. usasma

    usasma Fantastic Member
    Microsoft Community Contributor

    Joined:
    Mar 22, 2010
    Messages:
    3,048
    Likes Received:
    83
    Ideally a defrag wouldn't be related to an I/O Error - but stranger things have happened.

    My primary concern is that there might be a hardware problem - and the only test for that is a hard drive diagnostic

    Defragging used to be a good thing to do (back in the XP days) - but the Windows defragger has become quite capable and I haven't noticed it's use being needed very often.

    Another thing to run is CHKDSK /R /F from an elevated (Run as administrator) Command Prompt
    This will test the file system (NTFS, FAT32, FAT, etc) to see if there's any problem with it.
    If you run it on your C: drive, you'll have to select "Y" in order to tell it to run on a reboot.
    And, FYI, it's not required to run with both the /R and /F parameters - but it doesn't hurt and I've been running it that way for years.
     
  6. GeneralHiningII

    GeneralHiningII Honorable Member

    Joined:
    Sep 21, 2012
    Messages:
    745
    Likes Received:
    7
    Or you could just right-click your windows-based drive, select properties > tools, Check Now.

    Possibly update the drivers for his Hard Disk?
     
  7. Caranor

    Caranor New Member

    Joined:
    Oct 20, 2012
    Messages:
    6
    Likes Received:
    0
    Hey much thanks for the help so far How can I download the drivers from carrona.com or is it just telling what driver it is.
    And when I go to task manager and rightclick on csrss.exe open file location, nothing shows up.
     
  8. GeneralHiningII

    GeneralHiningII Honorable Member

    Joined:
    Sep 21, 2012
    Messages:
    745
    Likes Received:
    7
    carrona.org just tells you the driver's uses, if it's update is from a 3rd party site there would be a link to that site, otherwise carrona.org will tell you it's from Windows Update.

    You don't need to rightclick the csrss.exe process, just check if it's using more than ~3,000K under the "Memory" Column.
     
    #8 GeneralHiningII, Oct 21, 2012
    Last edited: Oct 21, 2012
  9. usasma

    usasma Fantastic Member
    Microsoft Community Contributor

    Joined:
    Mar 22, 2010
    Messages:
    3,048
    Likes Received:
    83
    No drivers for the hard disk - BUT - there are drivers for the hard disk controller that controls the hard disk

    Late for work, gotta run!
     
  10. Caranor

    Caranor New Member

    Joined:
    Oct 20, 2012
    Messages:
    6
    Likes Received:
    0
    Its using 10.588k
     
  11. GeneralHiningII

    GeneralHiningII Honorable Member

    Joined:
    Sep 21, 2012
    Messages:
    745
    Likes Received:
    7
  12. usasma

    usasma Fantastic Member
    Microsoft Community Contributor

    Joined:
    Mar 22, 2010
    Messages:
    3,048
    Likes Received:
    83
    Scan it at Jotti's malware scan
    Most likely it's not infected, but there's no sense in taking chances!
     
  13. GeneralHiningII

    GeneralHiningII Honorable Member

    Joined:
    Sep 21, 2012
    Messages:
    745
    Likes Received:
    7
    Remember. The file can be found in C:\Windows\System32\csrss.exe
    (for scanning with Jotti)
     

Share This Page

Loading...