question

Asger-2992 avatar image
0 Votes"
Asger-2992 asked CarlFan-MSFT edited

BSOD - Continous. Culprit may be: ntdll.dll - csrss.exe - cng.sys

Hi everyone,

I have recently started getting BSOD when starting up my pc. It only happens when I startup the pc after several hours of having it shut off - then it restarts and then there is no problem at all.

I get 2 kinds of BSOD:
CRITICAL_PROCESS_DIED
KERNEL_DATA_INPAGE_ERROR

I have tried alot of different kinds of solutions to no avail. System restore. Reinstalled windwos. Update windows. Cheching individual drivers if they needed update. sfc/scannow. CHKDSK. I also ran a memtest86 a couple of days ago with 0 errors reported.
sfc/scannow reported that there were corrupted files but they were fixed - but I still get BSOD.

I have saved 4 of my latest MINIDUMP files and attached them here: https://we.tl/t-A5jHgKuIfQ

Here is the latest minidump:


8: kd> !analyze -v



  •                      Bugcheck Analysis                                    *
    



CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffb4836ffda4c0, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:




KEY_VALUES_STRING: 1

 Key  : Analysis.CPU.mSec
 Value: 2124

 Key  : Analysis.DebugAnalysisManager
 Value: Create

 Key  : Analysis.Elapsed.mSec
 Value: 2130

 Key  : Analysis.Init.CPU.mSec
 Value: 1093

 Key  : Analysis.Init.Elapsed.mSec
 Value: 10544

 Key  : Analysis.Memory.CommitPeak.Mb
 Value: 73

 Key  : CriticalProcessDied.ExceptionCode
 Value: 5f8c1080

 Key  : CriticalProcessDied.ImageName
 Value: ntdll.dll

 Key  : CriticalProcessDied.ImageOffset
 Value: 1e312

 Key  : CriticalProcessDied.ImageSize
 Value: 1f0000

 Key  : CriticalProcessDied.ImageTimestamp
 Value: 48069cf7

 Key  : CriticalProcessDied.Process
 Value: csrss.exe

 Key  : CriticalProcessDied.Symbol
 Value: ntdll.dll!RtlLookupFunctionEntry

 Key  : CriticalProcessDied.WERReportId
 Value: 10dfb473-939b-4568-8fc0-5879f016851a


DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump

BUGCHECK_CODE: ef

BUGCHECK_P1: ffffb4836ffda4c0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: csrss.exe

CRITICAL_PROCESS: csrss.exe

ERROR_CODE: (NTSTATUS) 0x5f8c1080 - <Unable to get error code text>

CRITICAL_PROCESS_REPORTGUID: {10dfb473-939b-4568-8fc0-5879f016851a}

IMAGE_NAME: ntdll.dll

MODULE_NAME: ntdll

FAULTING_MODULE: 0000000000000000

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

STACK_TEXT:
ffff8404`0377f838 fffff800`25ac9f49 : 00000000`000000ef ffffb483`6ffda4c0 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffff8404`0377f840 fffff800`259a1bcb : ffffb483`6ffda4c0 fffff800`25315635 ffffb483`6ffda4c0 fffff800`252ec288 : nt!PspCatchCriticalBreak+0x115
ffff8404`0377f8e0 fffff800`257b7a0c : ffffb483`00000000 00000000`00000000 ffffb483`6ffda4c0 ffffb483`6ffda4c0 : nt!PspTerminateAllThreads+0x1e7f6f
ffff8404`0377f950 fffff800`258ce4c9 : ffffffff`ffffffff ffff8404`0377fa80 ffffb483`6ffda4c0 ffff8404`0377f901 : nt!PspTerminateProcess+0xe0
ffff8404`0377f990 fffff800`253d5455 : ffffb483`00000f08 ffffb483`5f8c1080 ffffb483`6ffda4c0 00000000`00000000 : nt!NtTerminateProcess+0xa9
ffff8404`0377fa00 00007ffe`5d95d424 : 00007ffe`5a758301 00000000`00000000 00000000`00000000 ffffffff`ee1e5d00 : nt!KiSystemServiceCopyEnd+0x25
00000026`fb73c128 00007ffe`5a758301 : 00000000`00000000 00000000`00000000 ffffffff`ee1e5d00 00000000`0000036c : 0x00007ffe`5d95d424
00000026`fb73c130 00000000`00000000 : 00000000`00000000 ffffffff`ee1e5d00 00000000`0000036c 00000000`00000000 : 0x00007ffe`5a758301


STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_5f8c1080_ntdll.dll!RtlLookupFunctionEntry_IMAGE_ntdll.dll

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {3f218d25-c7d0-038a-d7c9-ff3db378ecb6}

Followup: MachineOwner



Thank you in advance!

windows-server-2019
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

CarlFan-MSFT avatar image
0 Votes"
CarlFan-MSFT answered CarlFan-MSFT edited

Hi,
What's your system version and OS build? Type "winver" in Search Bar to check. The latest version is April 22, 2021—KB5001396 (OS Build 18363.1533). Try to update to check.
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xef--critical-process-died
Also I see you have tried to reinstall system. If this is a brand new system and no other software was installed, did it also be blue screen?
Type "msconfig" in Search Bar. Select "service" option, hide all microsoft service, then disable no microsoft service to check.
Please understand due to security policy, we could not provide dump/log analysis. In addition, if this problem is more urgent for you I still recommend that you open a case to Microsoft for further professional help.
https://support.microsoft.com/en-us/help/4341255/support-for-busines
Hope this helps and please help to accept as Answer if the response is useful.
Best Regards,
Carl

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.