Home Dashboard Directory Help
Search

Launching a ClickOnce App Causes Blue Screen Related to CSRSS.exe by kschuler


Status: 

Active


6
1
Sign in
to vote
Type: Bug
ID: 786925
Opened: 5/14/2013 12:54:40 PM
Access Restriction: Public
1
Workaround(s)
view
3
User(s) can reproduce this bug

Description

I developed a ClickOnce app for my company. It has been available and used by our customers for over a year now. Suddenly, around January we started get reports that when users clicked on the desktop icon their computer would blue screen. After they rebooted and tried the shortcut again, it worked just fine. I've had it happen a couple of times on my own machine. I still can't figure out what triggers it. I tried to look at the dump file and it suggested that CSRSS.exe was the culprit.

I tried searching for help on the developer forums. It seems I'm not the only one with this issue. But no one is able to figure out just what's going on: http://social.msdn.microsoft.com/Forums/en-US/winformssetup/thread/4b16a58a-ec33-46b7-be9b-c184bcf38b9f/

Here are excerpts from what I could get from the dump file. (had to edit because it's over 5000 chars):
Loading Dump File [C:\dump files\031913-36317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\localsymbols*http://msdl.microsoft.com/download/symbols;C:\Symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
Machine Name:
Kernel base = 0xfffff800`03a19000 PsLoadedModuleList = 0xfffff800`03c5d670
Debug session time: Tue Mar 19 08:55:26.130 2013 (UTC - 5:00)
System Uptime: 2 days 5:05:08.881
Loading Kernel Symbols
..................................
Loading User Symbols
Loading unloaded module list
**************************************************
*                        Bugcheck Analysis                                    *
**************************************************
Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800c93c930, fffffa800c93cc10, fffff80003d96470}

Probably caused by : csrss.exe

Followup: MachineOwner
********************************************
*                        Bugcheck Analysis                            
********************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800c93c930, Terminating object
Arg3: fffffa800c93cc10, Process image file name
Arg4: fffff80003d96470, Explanatory message (ascii)

Debugging Details:
------------------
PROCESS_OBJECT: fffffa800c93c930

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

CURRENT_IRQL: 0
Details
Sign in to post a comment.
Posted by Eric M Evans on 10/22/2013 at 6:45 AM
And also one of my minidumps...

Loading Dump File [C:\Windows\Minidump\101513-55536-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*C:\DebugSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18229.amd64fre.win7sp1_gdr.130801-1533
Machine Name:
Kernel base = 0xfffff800`02e10000 PsLoadedModuleList = 0xfffff800`030536d0
Debug session time: Tue Oct 15 12:40:17.044 2013 (UTC - 5:00)
System Uptime: 6 days 2:43:32.045
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
..................................................
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa80095cfb30, fffffa80095cfe10, fffff8000318c0d0}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

Followup: MachineOwner
---------

3: kd> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa80095cfb30, Terminating object
Arg3: fffffa80095cfe10, Process image file name
Arg4: fffff8000318c0d0, Explanatory message (ascii)

Debugging Details:
------------------

----- ETW minidump data unavailable-----

KERNEL_LOG_FAILING_PROCESS: (null)

PROCESS_OBJECT: fffffa80095cfb30

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR: 0xF4_c0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff880`057c99c8 fffff800`03213d92 : 00000000`000000f4 00000000`00000003 fffffa80`095cfb30 fffffa80`095cfe10 : nt!KeBugCheckEx
fffff880`057c99d0 fffff800`031c01db : ffffffff`ffffffff fffffa80`07c80b50 fffffa80`095cfb30 fffffa80`095cfb30 : nt!PspCatchCriticalBreak+0x92
fffff880`057c9a10 fffff800`0313fec4 : ffffffff`ffffffff 00000000`00000001 fffffa80`095cfb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17476
fffff880`057c9a60 fffff800`02e84e13 : fffffa80`095cfb30 fffff880`c0000005 fffffa80`07c80b50 fffffa80`0decf060 : nt!NtTerminateProcess+0xf4
fffff880`057c9ae0 00000000`779e157a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`023cde78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779e157a


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_c0000005_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_c0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------
Posted by Eric M Evans on 10/22/2013 at 6:43 AM
And here are details from a kernel dump...

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: srv*C:\DebugSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18229.amd64fre.win7sp1_gdr.130801-1533
Machine Name:
Kernel base = 0xfffff800`02e01000 PsLoadedModuleList = 0xfffff800`030446d0
Debug session time: Tue Oct 15 12:56:30.893 2013 (UTC - 5:00)
System Uptime: 0 days 0:13:09.615
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
........
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8009743b30, fffffa8009743e10, fffff8000317d0d0}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

3: kd> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8009743b30, Terminating object
Arg3: fffffa8009743e10, Process image file name
Arg4: fffff8000317d0d0, Explanatory message (ascii)

Debugging Details:
------------------


KERNEL_LOG_FAILING_PROCESS: (null)

PROCESS_OBJECT: fffffa8009743b30

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR: 0xF4_c0000005

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff880`09fbe9c8 fffff800`03204d92 : 00000000`000000f4 00000000`00000003 fffffa80`09743b30 fffffa80`09743e10 : nt!KeBugCheckEx
fffff880`09fbe9d0 fffff800`031b11db : ffffffff`ffffffff fffffa80`06907060 fffffa80`09743b30 fffffa80`09743b30 : nt!PspCatchCriticalBreak+0x92
fffff880`09fbea10 fffff800`03130ec4 : ffffffff`ffffffff 00000000`00000001 fffffa80`09743b30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17476
fffff880`09fbea60 fffff800`02e75e13 : fffffa80`09743b30 fffff880`c0000005 fffffa80`06907060 fffffa80`0be33740 : nt!NtTerminateProcess+0xf4
fffff880`09fbeae0 00000000`770c157a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00d8da78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770c157a


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_c0000005_IMAGE_csrss.exe

BUCKET_ID: X64_0xF4_c0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------
Sign in to post a workaround.
Posted by Keshav Jain on 9/19/2013 at 1:37 PM
In our case it was happening due to time stamping of the certificate. So please try signing your application with a different certificate (may be test).