Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Spontaneous reboot


  • Please log in to reply
1 reply to this topic

#1 JSmith0187

JSmith0187

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 22 February 2011 - 09:56 AM

Hi everyone, this is my first post here so excuse any errors!

I am hoping someone can shed some insight on what is going on here. We have a mass amount of PCs (Dell Optiplex 740s) that are having an issue rebooting. It seems intermittent, and we have no real pattern as to why it's happening. It seems to be after patches, but our other machines seem to be fine. I've run Memtest and chkdsk which have come back with no errors.

I have gotten quite a few dump files from the various pcs and this seems to be the common one amongst them. Just wondering if anyone has seen this before. Any help would be muchly appreciated :) Jaclyn

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini022211-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at start of path element
WARNING: Whitespace at start of path element
WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\System32; c:\windows\system\System32; http://www.alexander.com/SymServe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100427-1636
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Tue Feb 22 06:51:01.086 2011 (UTC - 4:00)
System Uptime: 0 days 0:10:50.438
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 8a320868, 8a3209dc, 805fb146}

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : csrss.exe

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 8a320868, Terminating object
Arg3: 8a3209dc, Process image file name
Arg4: 805fb146, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 8a320868

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: CClientSvc.exe

BUGCHECK_STR: 0xF4_CClientSvc.exe

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8062e279 to 80533846

STACK_TEXT:
a570fd00 8062e279 000000f4 00000003 8a320868 nt!KeBugCheckEx+0x1b
a570fd24 805fb104 805fb146 8a320868 8a3209dc nt!PspCatchCriticalBreak+0x75
a570fd54 804de7ec 8a320ab0 00000000 00a5ff30 nt!NtTerminateProcess+0x7d
a570fd54 7c90e514 8a320ab0 00000000 00a5ff30 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00a5ff30 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_CClientSvc.exe_IMAGE_csrss.exe

BUCKET_ID: 0xF4_CClientSvc.exe_IMAGE_csrss.exe

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:28 PM

Posted 22 February 2011 - 11:04 AM

Well...I think you are making a big mistake...by trying to treat all system problems...as if there is one common element.

Individual systems reboot for any number of reasons...defective hardware, overheating, and malware would be my top 3 picks.

Csrss.exe...if valid, is a critical Windows file. Maybe that's why you get F4 STOP errors, but I would not expect it to be the cause...but rather, the scene of the crime.

A standard definiton for this error, per the Aumha website: "One of the many processes or threads crucial to system operation has unexpectedly exited or been terminated. As a result, the system can no longer function. Specific causes are many, and often best resolved by a careful history of the problem and the circumstances of the error message."

A common element...would mean some app that runs on all systems..or some malware infection (if the systems are networked), IMO.

Generic Info On CClientSvc.exe

If that's applicable to all systems...the finger points that way, IMO.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users