BSOS - Results From WinDbg...

osaddict

My PC just blue screened, not sure why so on reboot I got the minidump and used WinDbg to see what was going on:

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffffc, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 834bae34, address which referenced memory

Debugging Details:

---

READ_ADDRESS: GetPointerFromAddress: unable to read from 83546868
Unable to read MiSystemVaType memory at 83526420
fffffffc

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiInsertTimerTable+7e
834bae34 3b51fc cmp edx,dword ptr [ecx-4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: csrss.exe

TRAP_FRAME: 942e5be4 -- (.trap 0xffffffff942e5be4)
ErrCode = 00000000
eax=8cd5fa30 ebx=00000000 ecx=00000000 edx=0000022c esi=896c7a10 edi=841186f0
eip=834bae34 esp=942e5c58 ebp=942e5c78 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!KiInsertTimerTable+0x7e:
834bae34 3b51fc cmp edx,dword ptr [ecx-4] ds:0023:fffffffc=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 834bae34 to 8345cfd9

STACK_TEXT:
942e5be4 834bae34 badb0d00 0000022c 837d6493 nt!KiTrap0E+0x2e1
942e5c78 834bad87 88f8da08 00000034 a08b3310 nt!KiInsertTimerTable+0x7e
942e5ca4 834babdc 88f8da08 ffff8ad0 ffffffff nt!KeSetTimerEx+0x1a0
942e5cc4 a07993fa 88f8da08 ffff8ad0 ffffffff nt!KeSetTimer+0x1b
942e5cf8 a06dad5b 00000004 0254fe04 a0796cab win32k!TimersProc+0x17f
942e5d34 a06db25b 00000004 00000002 8e923450 win32k!RawInputThread+0x615
942e5d48 a0796cc6 00000004 0254fe04 942e5d64 win32k!xxxCreateSystemThreads+0x4a
942e5d58 83459c7a 00000004 0254fe44 76ff5e74 win32k!NtUserCallNoParam+0x1b
942e5d58 76ff5e74 00000004 0254fe44 76ff5e74 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0254fe44 00000000 00000000 00000000 00000000 0x76ff5e74


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!TimersProc+17f
a07993fa 5f pop edi

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: win32k!TimersProc+17f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a856629

FAILURE_BUCKET_ID: 0xA_win32k!TimersProc+17f

BUCKET_ID: 0xA_win32k!TimersProc+17f

Followup: MachineOwner

This gives more information than the event log etc and should help me diagnose the problem but I'm not sure where to go from here...

It looks like PROCESS_NAME: csrss.exe caused the blue screen, but I'm not sure if that's a correct interpretation and if it is what I can do to further troubleshoot... bit of help people... ?!

Thanks in advance!

kryyst

csrss.exe is a key windows function not a driver, it's likely not the actual culprit. It's the cut, not the knife that caused it if you follow what I'm saying.

I'd suggest running a memtest if you haven't done that yet to first rule out any possible hardware memory problems.

After that if you can keep your system on and stable do a software update and check for any drivers that need to be updated. It's been my experience that video card drivers are the most common driver that cause memory errors.

osaddict

Thanks Kryyst. I did a quick search on csrss.exe and could see it was a pretty key exe but I couldn't see a way to determine other issues. I've not run a memory scan yet but I'll do so when I leave this evening.

I've not had a blue screen on this PC to my knowledge so that's about 4 years. I'm not sure if it's coincidental but I installed Epson Scan and MFP Manager - both software required to use our new Epson network scanner...

kryyst

It could be a coincidence or could be the problem. Printer drives can be a pain in the butt also. Though never had one cause bsod's for me yet. Just lots of other issues. I'd run the memtest for sure. But also if it keeps up try uninstalling the epson software and see if that solves it.

Also depending on what kind of support you need to that printer you may be able to use them through generic drivers. For printing for example you should be able to print to it using the windows based hp laserjet 1100 print drivers as that printer will probably support the pcl 5 language. For scanning windows built in scan engine should connect to it also.

osaddict

The scanner is a little bit*h to be honest, it's supposed to be network enabled but it used some Edimax device that seems to convert USB to cat5. This means everyone wanting to use the scanner needs this MFP Manager program installed and needs to manually connect to the scaner through it, not quite what I expected from a £500 document scanner aimed at offices!

kryyst

To late to send it back and get a real scanner?

osaddict

We thought for 500 quid we would be getting a real scanner lol. It seems not. It doesn't get especially heavy usage but it's a bit quirky :/

On a side note, or getting back on topic perhaps, I attempted to run memtest on my machine, it ran for about 7 seconds then the PC rebooted... not encouraging. When I get a chance I'll run it again with one of the sticks removed and see what happens, see if I can isolate it to a faulty module or socket on the mobo.

kryyst

Yeah not good. Though I've honestly never seen memtest crash and reboot before - lockup yes, but never reboot. Which leads me to think that it may not be the ram, but possibly a dimm socket, the cpu or the mobo itself.

However definitely try and run it again with various memory configs to narrow it down.