Hi,
First off, as mentioned, we have a
CRITICAL_OBJECT_TERMINATION (f4) bug check.
This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.
However, as opposed to your traditional
0xc0000006 which occurs when data cannot be placed into memory due to an I/O error (usually a sign of SSD firmware needing to be updated, faulty HDD / SSD, etc), the string is: BUGCHECK_STR: 0xF4_
C0000005
This indicates an access violation occurred, which generally is caused by a driver causing corruption. Unfortunately, from the *F4 dump, we are getting very little to no information.
FAILURE_BUCKET_ID: X64_0xF4_C0000005_
VRF_IMAGE_wininit.exe
^^ The FBID doesn't tell us anything other than the system had verifier enabled at the time of the crash, and the process that unexpectedly ceased to exist was winnit.exe.
------------------------
THANKFULLY, we have another bug check among the dumps which DOES give us info, and that's
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1).
This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.
If we take a look at the call stack:
Code:
STACK_TEXT:
fffff800`00ba2338 fffff800`03689169 : 00000000`0000000a fffff980`6b50cfe0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00ba2340 fffff800`03687de0 : fffffa80`0980b3c0 fffff800`03b17b92 fffff980`6e7005d0 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba2480 fffff880`066736f0 : fffff880`06674770 00000000`00000000 fffff980`04be0e70 fffff980`334e2fb8 : nt!KiPageFault+0x260
fffff800`00ba2610 fffff880`06674770 : 00000000`00000000 fffff980`04be0e70 fffff980`334e2fb8 fffff980`6e6fef40 : monblanking+0x16f0
fffff800`00ba2618 00000000`00000000 : fffff980`04be0e70 fffff980`334e2fb8 fffff980`6e6fef40 fffff800`03b32d26 : monblanking+0x2770
FAILURE_BUCKET_ID: X64_0xD1_
VRFK_
monblanking+16f0
To my knowledge,
monblanking.sys is a part of GoToMyPC. The reason for monblanking.sys causing the crash is here - PROCESS_NAME:
N360.exe. GoToMyPC's latest version(s) install a system driver as part of the new screen blanking feature. This new screen blanking driver is capable of blanking out multiple monitors. This can cause many conflicts, and it's conflicting with your Norton 360.
Rather than uninstalling the entire software itself, just in case you use it and like it (unless you want to, of course), we can remove the screen blanking and keep the rest of the software intact:
1. Click Start
2. Click Run or click in the start search box
3. Type appwiz.cpl and press Enter
4. The driver will be listed as: Windows Driver Package - Citrix Systems monblanking Citrix Driver
5. Select the driver and click Change/Remove or Uninstall/Change
Regards,
Patrick
