Windows 10 Frequent BSOD related to services.exe (ntdll.dll)

[Alice J_123]

Hi


I am experiencing frequent BSODs on windows 10 and clean install seems to be unable to solve it completely. I reinstall many times and sometimes it is fine. But later it comes up like now. Now BSOD happens everytime I start the computer and then it triggers restart automatically. The laptop can perform normally after this restart.


Please can you advise what is the problem? I've been bothered by this over a month. Below is the debugging file. Many thanks...


Loading Dump File [C:\Windows\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.



Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 18362 MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

18362.1.amd64fre.19h1_release.190318-1202

Machine Name:

Kernel base = 0xfffff806`4b000000 PsLoadedModuleList = 0xfffff806`4b448190

Debug session time: Thu Jun 18 21:10:04.297 2020 (UTC + 1:00)

System Uptime: 0 days 7:34:50.430

Loading Kernel Symbols

...............................................................

................................................................

....................................Page 2487 not present in the dump file. Type ".hh dbgerr004" for details

............................

........................

Loading User Symbols

.......................................

Loading unloaded module list

....................................

For analysis of this file, run !analyze -v

nt!KeBugCheckEx:

fffff806`4b1c23a0 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffd701`6226ec20=00000000000000ef

2: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



CRITICAL_PROCESS_DIED (ef)

A critical system process died

Arguments:

Arg1: ffff8009dad09140, Process object or thread object

Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.

Arg3: 0000000000000000

Arg4: 0000000000000000



Debugging Details:

------------------



Page 3d236a not present in the dump file. Type ".hh dbgerr004" for details



KEY_VALUES_STRING: 1



Key : Analysis.CPU.Sec

Value: 4



Key : Analysis.DebugAnalysisProvider.CPP

Value: Create: 8007007e on DESKTOP-TBH6GKP



Key : Analysis.DebugData

Value: CreateObject



Key : Analysis.DebugModel

Value: CreateObject



Key : Analysis.Elapsed.Sec

Value: 19



Key : Analysis.Memory.CommitPeak.Mb

Value: 77



Key : Analysis.System

Value: CreateObject





ADDITIONAL_XML: 1



BUGCHECK_CODE: ef



BUGCHECK_P1: ffff8009dad09140



BUGCHECK_P2: 0



BUGCHECK_P3: 0



BUGCHECK_P4: 0



PROCESS_NAME: services.exe



CRITICAL_PROCESS: services.exe



EXCEPTION_RECORD: ffff8009dad09700 -- (.exr 0xffff8009dad09700)

ExceptionAddress: 0000000000000000

ExceptionCode: 00000000

ExceptionFlags: 00000000

NumberParameters: 0



ERROR_CODE: (NTSTATUS) 0xe1137500 - <Unable to get error code text>



CRITICAL_PROCESS_REPORTGUID: {90e5a65d-55e6-42ff-be46-5c9ab1532b99}



IMAGE_NAME: ntdll.dll



MODULE_NAME: ntdll



FAULTING_MODULE: 00007ffc76380000 ntdll



BLACKBOXBSD: 1 (!blackboxbsd)





BLACKBOXNTFS: 1 (!blackboxntfs)





BLACKBOXPNP: 1 (!blackboxpnp)





BLACKBOXWINLOGON: 1



EXCEPTION_STR: 0x0



SYMBOL_NAME: ntdll!RtlLookupFunctionEntry+82



STACK_COMMAND: .thread ; .cxr ; kb



BUCKET_ID_FUNC_OFFSET: 82



FAILURE_BUCKET_ID: 0xEF_services.exe_BUGCHECK_CRITICAL_PROCESS_e1137500_ntdll.dll!RtlLookupFunctionEntry_ntdll!RtlLookupFunctionEntry



OS_VERSION: 10.0.18362.1



BUILDLAB_STR: 19h1_release



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



FAILURE_ID_HASH: {784c847b-0d9b-c8e9-9daf-1a689de3b31a}



Followup: MachineOwner

---------

Continue reading...