blue screen f4 error

  • Thread starter Thread starter mahj
  • Start date Start date
M

mahj

hi

i am having a blue screen almost 2 times a day and it gives me the
following error 0x000000f4(0x00000003, 0x885255f0, 0x88525764, 0x805c8c88)
can anyone decode this error or find a way to know what is the infected
hardware?
 
mahj

The Stop Error report for this error is less helpful than most:
http://msdn2.microsoft.com/en-us/library/ms797140.aspx

You may get an answer by running the Windows Debugger on the memory dump
but it is a challenging task for a typical user:
http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Another way to investigate your hard drive is to use HD Tune.

Try HD Tune only gives information and does not fix any
problems.

Download and run it and see what it turns up. You want HD Tune
(freeware) version 2.55 not HD Tune Pro (not Freeware) version 3.00.
http://www.hdtune.com/

Select the Info tabs and place the cursor on the drive under Drive
letter and then double click the two page icon ( copy to Clipboard )
and copy into a further message.

Select the Health tab and then double click the two page icon ( copy to
Clipboard ) and copy into a further message. Make sure you do a full
surface scan with HD Tune.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
mahj said:
hi

i am having a blue screen almost 2 times a day and it gives me the
following error 0x000000f4(0x00000003, 0x885255f0, 0x88525764, 0x805c8c88)
can anyone decode this error or find a way to know what is the infected
hardware?
Click to expand...

The STOP errors are listed here.

http://aumha.org/a/stop.php#0xf4

http://web.archive.org/web/20051204..._1a708a96-14bf-41c7-8881-cec536b95c57.xml.asp

Parameters

The following parameters are displayed on the blue screen.
Parameter Description
1 The terminating object type:
0x3: Process <--------------- Your case.
0x6: Thread
2 The terminating object
3 The process image file name
4 Pointer to an ASCII string containing an explanatory message

http://support.microsoft.com/default.aspx?scid=kb;en-us;330100

So the question would be, what is causing a critical process in the OS
to suddenly halt ? If the actual code crashed, you'd expect the
bad code itself to be reported. This error appears to be
a side effect of an earlier problem. (Problem happens first,
then a few moments later, the OS notices something important
to its operation, is dead. Then it report F4.)

Someone got an F4 here, and it was bad RAM.

http://www.geekstogo.com/forum/STOP-0x000000F4-t96373.html

Try a memory test. This test will run forever, if you let it. It
should be error free for at least two full test passes. The
counter on the screen tells you which test is running, and
how many passes have been completed. Memtest does not use an
OS - you boot the computer with the test. I have a floppy
here with memtest on it, as well as a CD.

http://www.memtest.org/

A second test I like, is Prime95 from mersenne.org . The following
version is suitable for stress testing single or multiple core
processors. No errors are acceptable during this test. This
test will run for a long time too. Select "Stop" and "Exit" from
the menu, when you're finished testing. Prime95 runs while
you're in Windows, so there is no messy preparation for the
testing. I run this for four hours on a new system.

http://majorgeeks.com/Prime95_d4363.html

"For overclockers, Prime95 has a feature called "Torture Test"
that allows maximum stress testing on the CPU and RAM. There
are several options allowing the stress test to focus on the
memory, processor, or a balance of both."

HTH,
Paul
 
0x000000F4: CRITICAL_OBJECT_TERMINATION
One of the many processes or threads crucial to system operation has unexpectedly
exited or been terminated. As a result, the system can no longer function. Specific
causes are many, and often best resolved by a careful history of the problem and the
circumstances of the error message. One user, who experienced this on return from
Standby mode on Win XP SP2, found the cause was that Windows was installed on a
slave drive

http://support.microsoft.com/default.aspx?scid=kb;en-us;330100

-
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
 
this is the result of the hd tuner


HD Tune: FUJITSU MHV2060AH Information

Firmware version : 00830096
Serial number : NT29T5A2B5B7
Capacity : 55.9 GB (~60.0 GB)
Buffer size : 8192 KB
Standard : ATA/ATAPI-0
Supported mode : UDMA Mode 5 (Ultra ATA/100)
Current mode : UDMA Mode 5 (Ultra ATA/100)

S.M.A.R.T : yes
48-bit Address : no
Read Look-Ahead : yes
Write Cache : yes
Host Protected Area : no
Device Configuration Overlay : yes
Automatic Acoustic Management: no
Power Management : yes
Advanced Power Management : yes
Power-up in Standby : no
Security Mode : yes
Firmware Upgradable : yes

Partition : 1
Drive letter : C:\
Label :
Capacity : 57231 MB
Usage : 61.80%
Type : NTFS
Bootable : Yes

..........................................................................................................................


HD Tune: FUJITSU MHV2060AH Health

ID Current Worst ThresholdData
Status
(01) Raw Read Error Rate 100 100 46 211463 Ok

(02) Throughput Performance 100 100 30 14745826 Ok

(03) Spin Up Time 100 100 25 1 Ok

(04) Start/Stop Count 99 99 0 2761 Ok

(05) Reallocated Sector Count 100 100 24 65537 Ok

(07) Seek Error Rate 100 100 47 1037 Ok

(08) Seek Time Performance 100 100 19 0 Ok

(09) Power On Hours Count 97 97 0 6782680 Ok

(0A) Spin Retry Count 100 100 20 0 Ok

(0C) Power Cycle Count 100 100 0 1361 Ok

(C0) Power Off Retract Count 100 100 0 37 Ok

(C1) Load Cycle Count 99 99 0 20231 Ok

(C2) Temperature 100 100 0 524321 Ok

(C3) Hardware ECC Recovered 100 100 0 979 Ok

(C4) Reallocated Event Count 100 100 0 456261633 Ok

(C5) Current Pending Sector 100 100 0 0 Ok

(C6) Offline Uncorrectable 100 100 0 1 Ok

(C7) Ultra DMA CRC Error Count 200 179 0 554 Ok

(C8) Write Error Rate 100 100 60 20882 Ok

(CB) Run Out Cancel 100 100 0 42992153 Ok


Power On Time : 6782680
Health Status : Ok

..........................................................................................................................

and this is the result of the dump debbuging:

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or
been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 885255f0, Terminating object
Arg3: 88525764, Process image file name
Arg4: 805c8c88, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 885255f0

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The required data was not placed into memory
because of an I/O error status of "0x%08lx".

BUGCHECK_STR: 0xF4_IOERR

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

STACK_TEXT:
f26e849c 805c7d75 000000f4 00000003 885255f0 nt!KeBugCheckEx+0x1b
f26e84c0 805c8d33 805c8c88 885255f0 88525764 nt!PspCatchCriticalBreak+0x75
f26e84f0 f2570359 88525838 c0000006 890c0830 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be
wrong.
f26e8574 8053d648 ffffffff c0000006 f26e89b0 SYMEVENT+0x14359
f26e8574 f26e89d8 ffffffff c0000006 f26e89b0 nt!KiFastCallEntry+0xf8
00000030 00000000 00000000 00000000 00000000 0xf26e89d8


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe

BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe

Followup: MachineOwner
---------
 
mahj

What are your anti-virus and anti-spyware arrangements? Have you had any
recent malware infestations?

Is your computer a laptop or desktop? What is your computer make and model?

What are your Power Scheme Settings? Select Start, Control Panel. Power
Options?

Are you using Hibernate or Standby?

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
i have norton antivirus antispyware, and yes i had lately viruses, trojans
and worms

my computer is a laptop it is hp compaq nx8220 and the power settings is
hibernate
 
mahj


I suggest you download and run Spybot S & D (freeware version). There
is a freeware version buried in this link:
http://www.safer-networking.org/en/spybotsd/index.html

Malwarebytes' Anti-Malware
1.32 -freeware (if you upgrade you pay).
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

Run Malwarebytes' in safe mode and turn off your current anti-virus
before you do to avoid a conflict. Disregard the invitation on the web
site regarding the Registry Optimiser -a Registry Optimiser is not a
helpful utility.

Research on your problem revealed that, where indicated the computer type
was indicated it tended to be a laptop and not a desktop. This information
on csrss.exe brought me to this:

Windows errors related to csrss.exe?

The Microsoft Client Server Runtime Server subsystem utilizes the process
csrss.exe for managing the majority of the graphical instruction sets under
the Microsoft Windows operating system. As such Csrss.exe provides the
critical functions of the operating system, and its termination can result
in the Blue Screen of Death being displayed.

Csrss.exe controls threading and Win32 console window features. Threading is
where the application splits itself into multiple simultaneous running
tasks. Threads supported by csrss.exe are different from processes in that
threads are commonly contained within the process, with various threads
sharing resources within the same process. The Win32 console is the plain
text window in the Windows API system (programs can use the console without
the need for image display).

In mobile devices such as notebooks and laptops, the process csrss.exe is
closely dependent on power management schemes implemented by the system as
defined under the Control Panel option.
Source:
http://www.liutilities.com/products/wintaskspro/processlibrary/csrss/

Please note I would not recommend using a Registry Cleaner as suggested in
the link to fix your problem. I am wondering whether your problem lies in
your power settings. Can you relate the incidence of the errors to attempts
to go into hibernation? Are attempts to hibernate ever successful?

http://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface
--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
as i run the malwarebytes in safe mode i got the following in the log file:

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Firewall
auto setup (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\shell31.dll (Trojan.Agent) -> Quarantined and deleted
successfully.
.......................................................................................................................................

and as you can see i allowed malwarebytes to delete them,
as for the spybot s&d it gave me the following infected items:

(SBI $C57A14B8) settings
HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\ Services\SharedAccess\Parameters\
FierwallPolicy\StandardProfile\GloballyOpenPorts\List\443:TCP


(SBI $2E459982) settings
HKEY_LOCAL_MACHINE\SYSTEM\Controlset003\ Services\SharedAccess\Parameters\
FierwallPolicy\StandardProfile\GloballyOpenPorts\List\443:TCP

.......................................................................................................................................

and i also allowed the spybot to remove them.

as for the hibernation it does hibernate normally plus when the blue screen
comes almost always it has the power battery on.

i still have something in mind, actually lately i downloaded the Microsoft
software malicious removal tool and it detected something like LDPINCH and at
the same time norton detected a trojan horse wich means that this trojan was
already before norton was installed on my pc and it only detected it after
running the micrososft malicious removal tool.

the point is that some researches show a relation between LDPINCH trojan and
csrss.exe.

so what do you suggest and do you think the logs of spybot and malwarebytes
are related to that issue,

anyway thanks a lot for the help
 
mahj

These are the removal instructions for LDPINCH
http://www.symantec.com/security_response/writeup.jsp?docid=2003-110315-5340-99&tabid=3

I cannot say whether the infections removed by Malwarebytes and Spybot S & D
relate to LDPINCH.

You should turn of System Restore and turn it back on to remove existing
restore points to ensure all infections are removed..
http://bertk.mvps.org/html/disablesr.html

Run Malwarebytes and Spybot S & D again to make sure aa hidden infestation
is not still there.

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
"turn off system restore" is disabled by group policy and i have xp home
edition so i don't have access to gpedit to turn it off.

do you advice me in format, and do you think a virus can stay after a format
because the bluescreen was also showing before the last format of the laptop
 
mahj

"turn off system restore is disabled by group policy". This is not something
one would expect with Home Edition!"

Is the computer a home or office computer?

What happened when you ran Malwarebytes and Spybot S & D a second time? Did
they report no infections?


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
my laptop is a home computer and it is not joined to any domain.
malwarebytes and spybot gave no infections the second time i run them
 
mahj

I would disable hibernate and see if the BSOD errors stop.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
Back
Top