New
#11
Yes they are...
@Brink can you help me...
@philc43 posted this : The crash dump file shows the same error when the process Services.exe was running. As you can see the process is terminated. Something must go wrong but I can't work it out. The error code 0xd1b2e080 is not one I can fathom out.
FAILURE_BUCKET_ID: 0xEF_services.exe_BUGCHECK_CRITICAL_PROCESS_d1b2e080_ntdll!NtTerminateProcess
The nice thing is all your Environment Variables are now looking good!
@jmatt So y'see it's not a "Boot Error" it's a "Kernel Error" Can yer help?
@Tekkie Boy Any ideas...
"0xd1b2e080"
This is going to be tricky, googling shows you are the only one with that error, unless it is a typo.
Opp's, edited, already tried Farbar.
[QUOTE=b1gt1m;2177896]@[URL="https://www.tenforums.com [MENTION=128968]jmatt[/MENTION] So y'see it's not a "Boot Error" it's a "Kernel Error" Can yer help?
Uncable D drive & if it doesn't boot, you know the operating system/bootfiles are on the wrong drive.
Wrong answer... When Drive D is Drive C aka 'HXP', it will try to boot, but when windows starts it crashes. So, I put another SSD in as Drive C and installed a fresh - temp Windows Installation. I need to repair 'HXP' installation...
As already indicated I have drawn a blank when trying to debug the BSOD - it happens very early in the boot process and possibly happens when a driver gets loaded.
Forcing it to boot into safemode might be a possibility - just use the HXP drive and try option 6 to get to the advanced Start up menu: Boot to Advanced Startup Options in Windows 10 | Tutorials (tenforums.com)
Then use option 1: to select Safe mode: Boot into Safe Mode on Windows 10 | Tutorials (tenforums.com)
Yea will do, I'll let yer know how I get on...
- - - Updated - - -
Allo! How are we today? OK so, I did as you asked an it crashed again!? So here's copy of the fresh Memory.dmp readout.
Am I right here, it says services.exe crashed because of 'ntdll' which I believe is a driver yes??
Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\MewQ\Desktop\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff803`1c200000 PsLoadedModuleList = 0xfffff803`1ce2a390
Debug session time: Sat Mar 20 14:51:10.218 2021 (UTC + 0:00)
System Uptime: 0 days 0:00:04.895
Loading Kernel Symbols
...............................................................
....Page 102510 not present in the dump file. Type ".hh dbgerr004" for details
............................................................
................
Loading User Symbols
.............
Loading unloaded module list
.....
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffff8806f3ab9080, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-3EBJ5TP
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 5
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: ef
BUGCHECK_P1: ffff8806f3ab9080
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: services.exe
CRITICAL_PROCESS: services.exe
ERROR_CODE: (NTSTATUS) 0xf3aba080 - <Unable to get error code text>
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
STACK_TEXT:
ffff990d`08c22938 fffff803`1cb06962 : 00000000`000000ef ffff8806`f3ab9080 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffff990d`08c22940 fffff803`1ca49f61 : 00000000`00000000 fffff803`1c55971d 00000000`00000002 fffff803`1c558d37 : nt!PspCatchCriticalBreak+0x10e
ffff990d`08c229e0 fffff803`1c909ca4 : ffff8806`00000000 00000000`00000000 ffff8806`f3ab9080 ffff8806`f3ab94b8 : nt!PspTerminateAllThreads+0x1409f5
ffff990d`08c22a50 fffff803`1c909fcc : ffff8806`f3ab9080 00000000`00000000 00000000`00000000 ffff990d`08c22b80 : nt!PspTerminateProcess+0xe0
ffff990d`08c22a90 fffff803`1c6074b8 : ffff8806`f3ab9080 ffff8806`f3aba080 ffff990d`08c22b80 ffff8806`00000000 : nt!NtTerminateProcess+0x9c
ffff990d`08c22b00 00007ffe`fcdccba4 : 00007ffe`fa59c3f0 00000000`00000000 00000000`00000000 ffffffff`ffffffff : nt!KiSystemServiceCopyEnd+0x28
00000075`c667f648 00007ffe`fa59c3f0 : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : ntdll!NtTerminateProcess+0x14
00000075`c667f650 00007ff7`0608c00c : 00000000`00020019 00000000`00000001 00000000`7ffe0384 00000000`00000000 : KERNELBASE!TerminateProcess+0x30
00000075`c667f680 00007ff7`06088899 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : services!SvcctrlMain+0x360
00000075`c667f830 00007ff7`0609438c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : services!wmain+0x5d
00000075`c667f860 00007ffe`fcb47034 : 00000000`00000000 00000075`c667f8a0 00000000`00000000 00000000`00000000 : services!_wmainCRTStartup+0x74
00000075`c667f890 00007ffe`fcd7d241 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
00000075`c667f8c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
SYMBOL_NAME: ntdll!NtTerminateProcess+14
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 14
FAILURE_BUCKET_ID: 0xEF_services.exe_BUGCHECK_CRITICAL_PROCESS_f3aba080_ntdll!NtTerminateProcess
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ce45f2d9-c463-1ece-107f-0ba510f2617d}
Followup: MachineOwner
---------
As far as I understand the services.exe is the critical process which has terminated and does so because of an error code f3aba080 - this does not look like any normal error code so I am at a loss for what it means and I suspect Windbg has mistaken it for an error code. ntdll is the function which issues the terminate process command.
It might be corruption on the system drive but I think you have already looked into fixing file corruption. Sorry I can't help any further.