Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Friday, April 1, 2016 8:42 AM
Could this be a bug in windows 10?
I have not seen any hardware or driver problem from following minidump analysis.
: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffe000765fe440, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
Page 8e2d not present in the dump file. Type ".hh dbgerr004" for details
Page ec0 not present in the dump file. Type ".hh dbgerr004" for details
Page ec0 not present in the dump file. Type ".hh dbgerr004" for details
Page ec0 not present in the dump file. Type ".hh dbgerr004" for details
Page ec0 not present in the dump file. Type ".hh dbgerr004" for details
Page ec0 not present in the dump file. Type ".hh dbgerr004" for details
Page ec0 not present in the dump file. Type ".hh dbgerr004" for details
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 10586.162.amd64fre.th4_release_sec.160223-1728
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20F6A00SCD
SYSTEM_SKU: LENOVO_MT_20F6_BU_Think_FM_ThinkPad X260
SYSTEM_VERSION: ThinkPad X260
BIOS_VENDOR: LENOVO
BIOS_VERSION: R02ET44W (1.17 )
BIOS_DATE: 01/25/2016
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20F6A00SCD
BASEBOARD_VERSION: Not Defined
DUMP_TYPE: 1
BUGCHECK_P1: ffffe000765fe440
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: csrss.exe
CRITICAL_PROCESS: csrss.exe
EXCEPTION_RECORD: ffffc001058f8780 -- (.exr 0xffffc001058f8780)
ExceptionAddress: ffffe00075bd5a50
ExceptionCode: 02480705
ExceptionFlags: 30020260
NumberParameters: 200704
Parameter[0]: 0000000000030600
Parameter[1]: 0000000000030600
Parameter[2]: ffffe00075bd5968
Parameter[3]: ffffc001058f87b8
Parameter[4]: ffffc001058f87b8
Parameter[5]: 0000000000000000
Parameter[6]: ffffc001058f8770
Parameter[7]: 0000000000000000
Parameter[8]: ffffe00075d92c78
Parameter[9]: 0000000000000000
Parameter[10]: ffffc001058f87f0
Parameter[11]: ffffc001058f87f0
Parameter[12]: ffffc001058f8780
Parameter[13]: 0000000000000000
Parameter[14]: 000000000000000e
EXCEPTION_CODE: (Win32) 0x2480705 (38274821) - <Unable to get error code text>
ERROR_CODE: (NTSTATUS) 0x2480705 - <Unable to get error code text>
CPU_COUNT: 4
CPU_MHZ: 960
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 4e
CPU_STEPPING: 3
CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: 74'00000000 (cache) 74'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xEF
CURRENT_IRQL: 0
EXCEPTION_CODE_STR: 2480705
EXCEPTION_PARAMETER1: 0000000000030600
EXCEPTION_PARAMETER2: 0000000000030600
EXCEPTION_PARAMETER3: ffffe00075bd5968
EXCEPTION_PARAMETER4: 0
ANALYSIS_SESSION_HOST: ZHOUJUN-TP
ANALYSIS_SESSION_TIME: 04-01-2016 16:37:29.0200
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
LAST_CONTROL_TRANSFER: from fffff8031585ccfc to fffff8031535e760
STACK_COMMAND: kb
THREAD_SHA1_HASH_MOD_FUNC: 3ba609c3f77ecc69d7c282cc839e3cc888ad1522
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 979bab93456014069e55a120442be60c8a66f0bc
THREAD_SHA1_HASH_MOD: ba859c97bbb2891aa147c0c6decd2dda82e43783
FOLLOWUP_IP:
ntdll!RtlDispatchException+3e
00007ffc`58e54c7e 488955a0 mov qword ptr [rbp-60h],rdx
FAULT_INSTR_CODE: a0558948
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: ntdll!RtlDispatchException+3e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 56cbf9dd
BUCKET_ID_FUNC_OFFSET: 3e
FAILURE_BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_77b78080_ntdll!RtlDispatchException
BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_77b78080_ntdll!RtlDispatchException
PRIMARY_PROBLEM_CLASS: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_77b78080_ntdll!RtlDispatchException
TARGET_TIME: 2016-04-01T08:26:37.000Z
OSBUILD: 10586
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-02-24 13:48:00
BUILDDATESTAMP_STR: 160223-1728
BUILDLAB_STR: th4_release_sec
BUILDOSVER_STR: 10.0.10586.162.amd64fre.th4_release_sec.160223-1728
ANALYSIS_SESSION_ELAPSED_TIME: fdd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xef_csrss.exe_bugcheck_critical_process_77b78080_ntdll!rtldispatchexception
FAILURE_ID_HASH: {422815b7-5332-6a52-9cec-0d6c1892a019}
Followup: MachineOwner
All replies (5)
Saturday, April 2, 2016 11:17 AM ✅Answered
**These crashes were related to memory corruption (probably caused by a driver).
**Please run these two tests to verify your memory and find which driver is causing the problem. Please run verifier first. You do not need to run memtest yet unless verifier does not find the cause, or you want to.
If you are over-clocking anything reset to default before running these tests.
In other words STOP!!! If you do not know what this means you probably are not
**
**
**
**
1-Driver verifier (for complete directions see our wiki here)
2-Memtest. (You can read more about running memtest here)
Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)
Monday, April 4, 2016 6:00 AM ✅Answered
Hi,
First, please let me know when this error happened, if it happened recently, the System restore could be the efficient way for you to fix this issue.
Based on current information, this issue could be caused by 3rd part conflict or corrupted system files, please try Clean boot to see if this issue still persists.
How to perform a clean boot
http://support.microsoft.com/kb/929135
If the issue doesn’t appear, you can determine which one can be the cause by using dichotomy in MSconfig. Checking on half of Non-Microsoft service and restart, determining which half of the services cause the issue and repeating to check half of the problematic half services.
Otherwise, I recommend you run following commands to repair:
Dism /Online /Cleanup-Image /RestoreHealth
SFC /scannow
For further troubleshooting, please post back the dism.log and cbs.log for our research.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected].
Friday, April 1, 2016 10:45 AM
We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
If you have any questions about the procedure please ask
Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)
Saturday, April 2, 2016 9:08 AM
Thanks for reply.
memory.rar uploaded
Wednesday, June 29, 2016 11:02 AM
Jun, have you solved your issue?
I've your exact behavior on Win10, in the last 2 weeks the system went to BSOD 5 times without doing particular action, memory dump shows the same information as your.
MB