Click here to Skip to main content
15,851,335 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I have a ClickOnce app that has been published and used by our customers for about a year now. It's an app that can run online and has a desktop shortcut. Everything has been working okay until we started getting reports a couple of months ago that when users try to launch the app they get the blue screen of death. The app had already been installed and worked previously, and after the computer reboots it works just fine. I've even had it occur on my own machine a couple of times. Seems completely random. I kind of suspect that maybe a windows update messed something up, but would appreciate any other ideas that anyone has.

Here is what I could get out of the crash dump file (sorry it's so crazy long):

Loading Dump File [C:\dump files\031913-36317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\localsymbols*;C:\Symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
Machine Name:
Kernel base = 0xfffff800`03a19000 PsLoadedModuleList = 0xfffff800`03c5d670
Debug session time: Tue Mar 19 08:55:26.130 2013 (UTC - 5:00)
System Uptime: 2 days 5:05:08.881
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800c93c930, fffffa800c93cc10, fffff80003d96470}

Probably caused by : csrss.exe

Followup: MachineOwner

4: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

A process or thread crucial to system operation has unexpectedly exited or been
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arg1: 0000000000000003, Process
Arg2: fffffa800c93c930, Terminating object
Arg3: fffffa800c93cc10, Process image file name
Arg4: fffff80003d96470, Explanatory message (ascii)

Debugging Details:

PROCESS_OBJECT: fffffa800c93c930

IMAGE_NAME:  csrss.exe



FAULTING_MODULE: 0000000000000000

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0xF4_C0000005




fffff880`0b5e19c8 fffff800`03e1e5e2 : 00000000`000000f4 00000000`00000003 fffffa80`0c93c930 fffffa80`0c93cc10 : nt!KeBugCheckEx
fffff880`0b5e19d0 fffff800`03dca47b : ffffffff`ffffffff fffffa80`0d4fab50 fffffa80`0c93c930 fffffa80`0c93c930 : nt!PspCatchCriticalBreak+0x92
fffff880`0b5e1a10 fffff800`03d4b4f4 : ffffffff`ffffffff 00000000`00000001 fffffa80`0c93c930 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x174f6
fffff880`0b5e1a60 fffff800`03a8ded3 : fffffa80`0c93c930 fffff880`c0000005 fffffa80`0d4fab50 fffffa80`0bf85060 : nt!NtTerminateProcess+0xf4
fffff880`0b5e1ae0 00000000`76e415da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00aedaf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e415da


FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner

4: kd> !process fffffa800c93c930 3
GetPointerFromAddress: unable to read from fffff80003cc7000
PROCESS fffffa800c93c930
    SessionId: none  Cid: 1878    Peb: 7fffffda000  ParentCid: 1498
    DirBase: 1b1979000  ObjectTable: fffff8a0160915f0  HandleCount: <Data Not Accessible>
    Image: csrss.exe
    VadRoot fffffa800d56e9e0 Vads 139 Clone 0 Private 1864. Modified 31180. Locked 0.
    DeviceMap fffff8a000008d80
    Token                             fffff8a01ad517e0
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         0
    QuotaPoolUsage[NonPagedPool]      0
    Working Set Sizes (now,min,max)  (3582, 50, 345) (14328KB, 200KB, 1380KB)
    PeakWorkingSetSize                5387
    VirtualSize                       181 Mb
    PeakVirtualSize                   203 Mb
    PageFaultCount                    41559
    MemoryPriority                    BACKGROUND
    BasePriority                      13
    CommitCharge                      1968

        *** Error in reading nt!_ETHREAD @ fffffa80079b0060

1 solution

I would be interested in what responses you get to your question. I am having issues as well (we don't blue screen, but hang). We have a vendor provided application that uses ClickOnce accessed in Terminal server mode by several users. We have noticed that sometimes it hangs and after that, the csrss.exe process runs at 50%. As more users try, additional Csrss.exe are started up maxing out our CPU. When I try to re-launch the process, I get a Failure to launch application - lock timeout exception. Which is most likely a result of the previous hang.
Share this answer
Kschuler 28-Mar-13 13:40pm    
Interesting. If I hear anything on it, I will try to reply to you. Here is an MSDN forum question that I have also been on:

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900