BlueScreen Probably caused by : csrss.exe


(Pablik) #1

Witam co jakiś czas wyskakuje mi BlueScreen na windows 7 x64 .

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [C]

Mini Kernel Dump File: Only registers and stack trace are available


Symbol search path is: ***Invalid***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is: 

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows 7 Kernel Version 7600 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7600.16385.amd64fre.win7_rtm.090713-1255

Machine Name:

Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e8ee50

Debug session time: Tue Mar 29 17:53:01.354 2011 (UTC + 2:00)

System Uptime: 0 days 2:43:15.180

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

................................................................

................................................

Loading User Symbols

Loading unloaded module list

.......

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck F4, {3, fffffa8008209b30, fffffa8008209e10, fffff80002fcb240}


***** Kernel symbols are WRONG. Please fix symbols to do analysis.


unable to get nt!KiCurrentEtwBufferOffset

unable to get nt!KiCurrentEtwBufferBase

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

Probably caused by : csrss.exe


Followup: MachineOwner

---------


1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


CRITICAL_OBJECT_TERMINATION (f4)

A process or thread crucial to system operation has unexpectedly exited or been

terminated.

Several processes and threads are necessary for the operation of the

system; when they are terminated (for any reason), the system can no

longer function.

Arguments:

Arg1: 0000000000000003, Process

Arg2: fffffa8008209b30, Terminating object

Arg3: fffffa8008209e10, Process image file name

Arg4: fffff80002fcb240, Explanatory message (ascii)


Debugging Details:

------------------


***** Kernel symbols are WRONG. Please fix symbols to do analysis.


unable to get nt!KiCurrentEtwBufferOffset

unable to get nt!KiCurrentEtwBufferBase

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************


ADDITIONAL_DEBUG_TEXT:  

Use '!findthebuild' command to search for the target build information.

If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.


MODULE_NAME: csrss


FAULTING_MODULE: 0000000000000000 


DEBUG_FLR_IMAGE_TIMESTAMP: 0


PROCESS_OBJECT: fffffa8008209b30


IMAGE_NAME: csrss.exe


CUSTOMER_CRASH_COUNT: 1


DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT


BUGCHECK_STR: 0xF4


CURRENT_IRQL: 0


STACK_TEXT:  

fffff880`07ad70e8 fffff800`0304e142 : 00000000`000000f4 00000000`00000003 fffffa80`08209b30 fffffa80`08209e10 : nt+0x71f00

fffff880`07ad70f0 00000000`000000f4 : 00000000`00000003 fffffa80`08209b30 fffffa80`08209e10 fffff800`02fcb240 : nt+0x3fd142

fffff880`07ad70f8 00000000`00000003 : fffffa80`08209b30 fffffa80`08209e10 fffff800`02fcb240 00000000`00000246 : 0xf4

fffff880`07ad7100 fffffa80`08209b30 : fffffa80`08209e10 fffff800`02fcb240 00000000`00000246 fffffa80`08209b30 : 0x3

fffff880`07ad7108 fffffa80`08209e10 : fffff800`02fcb240 00000000`00000246 fffffa80`08209b30 fffff800`02ffa269 : 0xfffffa80`08209b30

fffff880`07ad7110 fffff800`02fcb240 : 00000000`00000246 fffffa80`08209b30 fffff800`02ffa269 ffffffff`ffffffff : 0xfffffa80`08209e10

fffff880`07ad7118 00000000`00000246 : fffffa80`08209b30 fffff800`02ffa269 ffffffff`ffffffff fffffa80`080ab060 : nt+0x37a240

fffff880`07ad7120 fffffa80`08209b30 : fffff800`02ffa269 ffffffff`ffffffff fffffa80`080ab060 fffffa80`08209b30 : 0x246

fffff880`07ad7128 fffff800`02ffa269 : ffffffff`ffffffff fffffa80`080ab060 fffffa80`08209b30 fffffa80`08209b30 : 0xfffffa80`08209b30

fffff880`07ad7130 ffffffff`ffffffff : fffffa80`080ab060 fffffa80`08209b30 fffffa80`08209b30 ffffffff`ffffffff : nt+0x3a9269

fffff880`07ad7138 fffffa80`080ab060 : fffffa80`08209b30 fffffa80`08209b30 ffffffff`ffffffff 00000000`00000008 : 0xffffffff`ffffffff

fffff880`07ad7140 fffffa80`08209b30 : fffffa80`08209b30 ffffffff`ffffffff 00000000`00000008 fffffa80`08209b30 : 0xfffffa80`080ab060

fffff880`07ad7148 fffffa80`08209b30 : ffffffff`ffffffff 00000000`00000008 fffffa80`08209b30 00000000`c0000005 : 0xfffffa80`08209b30

fffff880`07ad7150 ffffffff`ffffffff : 00000000`00000008 fffffa80`08209b30 00000000`c0000005 fffffa80`080ab060 : 0xfffffa80`08209b30

fffff880`07ad7158 00000000`00000008 : fffffa80`08209b30 00000000`c0000005 fffffa80`080ab060 fffff800`02f7ec74 : 0xffffffff`ffffffff

fffff880`07ad7160 fffffa80`08209b30 : 00000000`c0000005 fffffa80`080ab060 fffff800`02f7ec74 ffffffff`ffffffff : 0x8

fffff880`07ad7168 00000000`c0000005 : fffffa80`080ab060 fffff800`02f7ec74 ffffffff`ffffffff 00000000`00000001 : 0xfffffa80`08209b30

fffff880`07ad7170 fffffa80`080ab060 : fffff800`02f7ec74 ffffffff`ffffffff 00000000`00000001 fffffa80`08209b30 : 0xc0000005

fffff880`07ad7178 fffff800`02f7ec74 : ffffffff`ffffffff 00000000`00000001 fffffa80`08209b30 fffff6fb`00000008 : 0xfffffa80`080ab060

fffff880`07ad7180 ffffffff`ffffffff : 00000000`00000001 fffffa80`08209b30 fffff6fb`00000008 00000000`746c6644 : nt+0x32dc74

fffff880`07ad7188 00000000`00000001 : fffffa80`08209b30 fffff6fb`00000008 00000000`746c6644 fffff880`07ad7200 : 0xffffffff`ffffffff

fffff880`07ad7190 fffffa80`08209b30 : fffff6fb`00000008 00000000`746c6644 fffff880`07ad7200 00000000`00000000 : 0x1

fffff880`07ad7198 fffff6fb`00000008 : 00000000`746c6644 fffff880`07ad7200 00000000`00000000 00000000`00000000 : 0xfffffa80`08209b30

fffff880`07ad71a0 00000000`746c6644 : fffff880`07ad7200 00000000`00000000 00000000`00000000 00000000`00a80730 : 0xfffff6fb`00000008

fffff880`07ad71a8 fffff880`07ad7200 : 00000000`00000000 00000000`00000000 00000000`00a80730 00000000`00a80cf0 : 0x746c6644

fffff880`07ad71b0 00000000`00000000 : 00000000`00000000 00000000`00a80730 00000000`00a80cf0 00000000`0010001f : 0xfffff880`07ad7200



STACK_COMMAND: kb


FOLLOWUP_NAME: MachineOwner


BUCKET_ID: WRONG_SYMBOLS


Followup: MachineOwner

---------


1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


CRITICAL_OBJECT_TERMINATION (f4)

A process or thread crucial to system operation has unexpectedly exited or been

terminated.

Several processes and threads are necessary for the operation of the

system; when they are terminated (for any reason), the system can no

longer function.

Arguments:

Arg1: 0000000000000003, Process

Arg2: fffffa8008209b30, Terminating object

Arg3: fffffa8008209e10, Process image file name

Arg4: fffff80002fcb240, Explanatory message (ascii)


Debugging Details:

------------------


***** Kernel symbols are WRONG. Please fix symbols to do analysis.


unable to get nt!KiCurrentEtwBufferOffset

unable to get nt!KiCurrentEtwBufferBase

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************


ADDITIONAL_DEBUG_TEXT:  

Use '!findthebuild' command to search for the target build information.

If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.


MODULE_NAME: csrss


FAULTING_MODULE: 0000000000000000 


DEBUG_FLR_IMAGE_TIMESTAMP: 0


PROCESS_OBJECT: fffffa8008209b30


IMAGE_NAME: csrss.exe


CUSTOMER_CRASH_COUNT: 1


DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT


BUGCHECK_STR: 0xF4


CURRENT_IRQL: 0


STACK_TEXT:  

fffff880`07ad70e8 fffff800`0304e142 : 00000000`000000f4 00000000`00000003 fffffa80`08209b30 fffffa80`08209e10 : nt+0x71f00

fffff880`07ad70f0 00000000`000000f4 : 00000000`00000003 fffffa80`08209b30 fffffa80`08209e10 fffff800`02fcb240 : nt+0x3fd142

fffff880`07ad70f8 00000000`00000003 : fffffa80`08209b30 fffffa80`08209e10 fffff800`02fcb240 00000000`00000246 : 0xf4

fffff880`07ad7100 fffffa80`08209b30 : fffffa80`08209e10 fffff800`02fcb240 00000000`00000246 fffffa80`08209b30 : 0x3

fffff880`07ad7108 fffffa80`08209e10 : fffff800`02fcb240 00000000`00000246 fffffa80`08209b30 fffff800`02ffa269 : 0xfffffa80`08209b30

fffff880`07ad7110 fffff800`02fcb240 : 00000000`00000246 fffffa80`08209b30 fffff800`02ffa269 ffffffff`ffffffff : 0xfffffa80`08209e10

fffff880`07ad7118 00000000`00000246 : fffffa80`08209b30 fffff800`02ffa269 ffffffff`ffffffff fffffa80`080ab060 : nt+0x37a240

fffff880`07ad7120 fffffa80`08209b30 : fffff800`02ffa269 ffffffff`ffffffff fffffa80`080ab060 fffffa80`08209b30 : 0x246

fffff880`07ad7128 fffff800`02ffa269 : ffffffff`ffffffff fffffa80`080ab060 fffffa80`08209b30 fffffa80`08209b30 : 0xfffffa80`08209b30

fffff880`07ad7130 ffffffff`ffffffff : fffffa80`080ab060 fffffa80`08209b30 fffffa80`08209b30 ffffffff`ffffffff : nt+0x3a9269

fffff880`07ad7138 fffffa80`080ab060 : fffffa80`08209b30 fffffa80`08209b30 ffffffff`ffffffff 00000000`00000008 : 0xffffffff`ffffffff

fffff880`07ad7140 fffffa80`08209b30 : fffffa80`08209b30 ffffffff`ffffffff 00000000`00000008 fffffa80`08209b30 : 0xfffffa80`080ab060

fffff880`07ad7148 fffffa80`08209b30 : ffffffff`ffffffff 00000000`00000008 fffffa80`08209b30 00000000`c0000005 : 0xfffffa80`08209b30

fffff880`07ad7150 ffffffff`ffffffff : 00000000`00000008 fffffa80`08209b30 00000000`c0000005 fffffa80`080ab060 : 0xfffffa80`08209b30

fffff880`07ad7158 00000000`00000008 : fffffa80`08209b30 00000000`c0000005 fffffa80`080ab060 fffff800`02f7ec74 : 0xffffffff`ffffffff

fffff880`07ad7160 fffffa80`08209b30 : 00000000`c0000005 fffffa80`080ab060 fffff800`02f7ec74 ffffffff`ffffffff : 0x8

fffff880`07ad7168 00000000`c0000005 : fffffa80`080ab060 fffff800`02f7ec74 ffffffff`ffffffff 00000000`00000001 : 0xfffffa80`08209b30

fffff880`07ad7170 fffffa80`080ab060 : fffff800`02f7ec74 ffffffff`ffffffff 00000000`00000001 fffffa80`08209b30 : 0xc0000005

fffff880`07ad7178 fffff800`02f7ec74 : ffffffff`ffffffff 00000000`00000001 fffffa80`08209b30 fffff6fb`00000008 : 0xfffffa80`080ab060

fffff880`07ad7180 ffffffff`ffffffff : 00000000`00000001 fffffa80`08209b30 fffff6fb`00000008 00000000`746c6644 : nt+0x32dc74

fffff880`07ad7188 00000000`00000001 : fffffa80`08209b30 fffff6fb`00000008 00000000`746c6644 fffff880`07ad7200 : 0xffffffff`ffffffff

fffff880`07ad7190 fffffa80`08209b30 : fffff6fb`00000008 00000000`746c6644 fffff880`07ad7200 00000000`00000000 : 0x1

fffff880`07ad7198 fffff6fb`00000008 : 00000000`746c6644 fffff880`07ad7200 00000000`00000000 00000000`00000000 : 0xfffffa80`08209b30

fffff880`07ad71a0 00000000`746c6644 : fffff880`07ad7200 00000000`00000000 00000000`00000000 00000000`00a80730 : 0xfffff6fb`00000008

fffff880`07ad71a8 fffff880`07ad7200 : 00000000`00000000 00000000`00000000 00000000`00a80730 00000000`00a80cf0 : 0x746c6644

fffff880`07ad71b0 00000000`00000000 : 00000000`00000000 00000000`00a80730 00000000`00a80cf0 00000000`0010001f : 0xfffff880`07ad7200



STACK_COMMAND: kb


FOLLOWUP_NAME: MachineOwner


BUCKET_ID: WRONG_SYMBOLS


Followup: MachineOwner

---------


1: kd> lmvm csrss

start end module name