Hello, recently my Windows 10 stopped loading on my PC.
I tried all the standard methods, for example, uninstalling the update, restoring the image did not help.
In addition, after rolling back to a restore point, when the system was working, a BSOD appears at boot indicating CRITICAL_PROCESS_DIE
This error appears when loading windows, as well as when loading in other modes, such as safe mode
Therefore, I no longer have access to the system itself, I cannot use DISM
Also, SFC (sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows) does not work, no matter what parameters I specify, it writes:
Windows Resource Protection could not perform the requested operation.
P.S. Disk D contain trouble windows, I connect this disk to healthy pc, for analyze memory dump. But on the main computer its letter C
Also I was able to get MEMORY.dmp
Here is its content, please help:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffab881daac080, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000, The process object that initiated the termination.
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6328
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 10168
Key : Analysis.Init.CPU.mSec
Value: 5905
Key : Analysis.Init.Elapsed.mSec
Value: 126043
Key : Analysis.Memory.CommitPeak.Mb
Value: 97
Key : CriticalProcessDied.ExceptionCode
Value: 1b7db140
Key : CriticalProcessDied.Process
Value: csrss.exe
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: MEMORY.DMP
BUGCHECK_CODE: ef
BUGCHECK_P1: ffffab881daac080
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: csrss.exe
CRITICAL_PROCESS: csrss.exe
ERROR_CODE: (NTSTATUS) 0x1b7db140 - <Unable to get error code text>
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
STACK_TEXT:
ffff858f`242f2838 fffff802`7530e402 : 00000000`000000ef ffffab88`1daac080 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffff858f`242f2840 fffff802`75215e3d : 00000000`00000000 fffff802`74ccd1f1 00000000`00000002 fffff802`74ccd11b : nt!PspCatchCriticalBreak+0x10e
ffff858f`242f28e0 fffff802`75081680 : ffffab88`00000000 00000000`00000000 ffffab88`1daac080 ffffab88`1daac4b8 : nt!PspTerminateAllThreads+0x15e82d
ffff858f`242f2950 fffff802`7508147c : ffffab88`1daac080 00000000`00000000 00000196`f5204c35 ffff858f`242f29e8 : nt!PspTerminateProcess+0xe0
ffff858f`242f2990 fffff802`74e104f5 : ffffab88`1daac080 ffffab88`1b7db140 ffff858f`242f2a80 ffffab88`00000000 : nt!NtTerminateProcess+0x9c
ffff858f`242f2a00 00007ffd`c89ed594 : 00007ff6`97ae17e2 00000196`f5204a50 00000196`f5204c35 00000000`00000078 : nt!KiSystemServiceCopyEnd+0x25
0000005d`252afaa8 00007ff6`97ae17e2 : 00000196`f5204a50 00000196`f5204c35 00000000`00000078 00000196`f5204c35 : ntdll!NtTerminateProcess+0x14
0000005d`252afab0 00007ff6`97ae1347 : 00000196`f5204c35 00000000`0000000b 00000000`00000001 00000000`0000000d : csrss!main+0x462
0000005d`252afaf0 00007ff6`97ae1026 : 00000000`00000000 00000000`0000000a 00000000`00000000 00000000`00000000 : csrss!NtProcessStartup_AfterSecurityCookieInitialized+0x317
0000005d`252afb80 00007ffd`c89a26bf : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : csrss!NtProcessStartup+0x16
0000005d`252afbb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2f
SYMBOL_NAME: ntdll!NtTerminateProcess+14
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 14
FAILURE_BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_1b7db140_ntdll!NtTerminateProcess
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5f8721a7-ed7d-89ab-acec-f4bca94cfd2e}
Followup: MachineOwner
---------
2: kd> lmvm ntdll
Browse full module list
start end module name
00007ffd`c8950000 00007ffd`c8b48000 ntdll (pdb symbols) c:\symbol_cache\ntdll.pdb\58AEFA7324FBDABAC35C72BBE3794AE51\ntdll.pdb
Loaded symbol image file: ntdll.dll
Mapped memory image file: c:\symbol_cache\ntdll.dll\DA4A9F631f8000\ntdll.dll
Image path: C:\Windows\SYSTEM32\ntdll.dll
Image name: ntdll.dll
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: DA4A9F63 (This is a reproducible build file hash, not a timestamp)
CheckSum: 001FD7B7
ImageSize: 001F8000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables: