每次關機必產生藍屏，顯示critical process die

匿名

目前遇到的狀況:只要進行關機動作，均會產生藍屏顯示critical process die

使用Window debug tool分析Memory Dump得到以下結果

請協助分析原因

已在最高權限管理命令提示元輸入以下指令修復檔案但無效

DISM.exe /Online /Cleanup-image /Restorehealth

sfc /scannow

Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64

Loading Dump File [H:\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 16299 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 16299.15.amd64fre.rs3_release.170928-1534

Machine Name:

Kernel base = 0xfffff800ab20d000 PsLoadedModuleList = 0xfffff800ab574130

Debug session time: Fri Apr 6 09:21:52.345 2018 (UTC + 8:00)

System Uptime: 0 days 0:19:52.226

Loading Kernel Symbols

...............................................................

...Page 34d366 not present in the dump file. Type ".hh dbgerr004" for details

.............................................................

...........................................Page 11d559 not present in the dump file. Type ".hh dbgerr004" for details

...............

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.

Run !sym noisy before .reload to track down problems loading symbols.

......

........................

Loading User Symbols

.....

Loading unloaded module list

...............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck EF, {ffffe08fca7a9580, 0, 0, 0}

Page 370401 not present in the dump file. Type ".hh dbgerr004" for details

Page 11d559 not present in the dump file. Type ".hh dbgerr004" for details

Page 372286 not present in the dump file. Type ".hh dbgerr004" for details

Page 34d366 not present in the dump file. Type ".hh dbgerr004" for details

Probably caused by : ntdll.dll ( ntdll!NtTerminateProcess+14 )

Followup: MachineOwner

2: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

CRITICAL_PROCESS_DIED (ef)

A critical system process died

Arguments:

Arg1: ffffe08fca7a9580, Process object or thread object

Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_MANUFACTURER: LENOVO

SYSTEM_PRODUCT_NAME: 80XK

SYSTEM_SKU: LENOVO_MT_80XK_BU_idea_FM_ideapad 320-14IKB

SYSTEM_VERSION: Lenovo ideapad 320-14IKB

BIOS_VENDOR: LENOVO

BIOS_VERSION: 4WCN38WW

BIOS_DATE: 12/25/2017

BASEBOARD_MANUFACTURER: LENOVO

BASEBOARD_PRODUCT: LNVNB161216

BASEBOARD_VERSION: SDK0J40700 WIN

DUMP_TYPE: 1

BUGCHECK_P1: ffffe08fca7a9580

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: svchost.exe

CRITICAL_PROCESS: svchost.exe

EXCEPTION_CODE: (NTSTATUS) 0xc3c87080 - <Unable to get error code text>

ERROR_CODE: (NTSTATUS) 0xc3c87080 - <Unable to get error code text>

CPU_COUNT: 4

CPU_MHZ: b58

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 8e

CPU_STEPPING: 9

CPU_MICROCODE: 6,8e,9,0 (F,M,S,R) SIG: 7C'00000000 (cache) 7C'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xEF

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: LAPTOP-5327MES9

ANALYSIS_SESSION_TIME: 04-07-2018 13:22:01.0442

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER: from fffff800ab92126f to fffff800ab382510

STACK_TEXT:

ffff9302d9576838 fffff800ab92126f : 00000000000000ef ffffe08fca7a9580 0000000000000000 0000000000000000 : nt!KeBugCheckEx

ffff9302d9576840 fffff800ab857bfd : ffffe08fca7a95c0 ffffe08fca7a9580 ffffe08fca7a9580 0000000040010004 : nt!PspCatchCriticalBreak+0xff

ffff9302d95768e0 fffff800ab66c0a8 : ffffe08f00000000 ffffe08fca7a9580 ffffe08fca7a9858 ffffe08fca7a9580 : nt!PspTerminateAllThreads+0x113421

ffff9302d9576950 fffff800ab66be91 : ffffffffffffffff ffff9302d9576a80 ffffe08fc6e42580 0000000000000001 : nt!PspTerminateProcess+0xe0

ffff9302d9576990 fffff800ab395003 : ffffe08f000030d4 ffffe08fc3c87080 ffffe08fca7a9580 0000020a7c841980 : nt!NtTerminateProcess+0xa9

ffff9302d9576a00 00007ffd3f7e0404 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13

0000003c133ffbb8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!NtTerminateProcess+0x14

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 1ee16e27f2a3bf32487936ba1484cfcaf564e2dc

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: efd501109c2111ca07b61e101773ddd7f430ba82

THREAD_SHA1_HASH_MOD: fce38ccd7b727228240c1b437cae1484437f51f9

FOLLOWUP_IP:

ntdll!NtTerminateProcess+14

00007ffd`3f7e0404 c3 ret

FAULT_INSTR_CODE: c32ecdc3

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: ntdll!NtTerminateProcess+14

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ntdll

IMAGE_NAME: ntdll.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID_FUNC_OFFSET: 14

FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c3c87080_ntdll!NtTerminateProcess

BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c3c87080_ntdll!NtTerminateProcess

PRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c3c87080_ntdll!NtTerminateProcess

TARGET_TIME: 2018-04-06T01:21:52.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-03-01 13:36:55

BUILDDATESTAMP_STR: 170928-1534

BUILDLAB_STR: rs3_release

BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: 7a1

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_c3c87080_ntdll!ntterminateprocess

FAILURE_ID_HASH: {360917f2-1fa3-626d-e8c8-9c2c31c73311}

Followup: MachineOwner

2: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

CRITICAL_PROCESS_DIED (ef)

A critical system process died

Arguments:

Arg1: ffffe08fca7a9580, Process object or thread object

Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_MANUFACTURER: LENOVO

SYSTEM_PRODUCT_NAME: 80XK

SYSTEM_SKU: LENOVO_MT_80XK_BU_idea_FM_ideapad 320-14IKB

SYSTEM_VERSION: Lenovo ideapad 320-14IKB

BIOS_VENDOR: LENOVO

BIOS_VERSION: 4WCN38WW

BIOS_DATE: 12/25/2017

BASEBOARD_MANUFACTURER: LENOVO

BASEBOARD_PRODUCT: LNVNB161216

BASEBOARD_VERSION: SDK0J40700 WIN

DUMP_TYPE: 1

BUGCHECK_P1: ffffe08fca7a9580

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: svchost.exe

CRITICAL_PROCESS: svchost.exe

EXCEPTION_CODE: (NTSTATUS) 0xc3c87080 - <Unable to get error code text>

ERROR_CODE: (NTSTATUS) 0xc3c87080 - <Unable to get error code text>

CPU_COUNT: 4

CPU_MHZ: b58

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 8e

CPU_STEPPING: 9

CPU_MICROCODE: 6,8e,9,0 (F,M,S,R) SIG: 7C'00000000 (cache) 7C'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xEF

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: LAPTOP-5327MES9

ANALYSIS_SESSION_TIME: 04-07-2018 13:22:21.0783

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER: from fffff800ab92126f to fffff800ab382510

STACK_TEXT:

ffff9302d9576838 fffff800ab92126f : 00000000000000ef ffffe08fca7a9580 0000000000000000 0000000000000000 : nt!KeBugCheckEx

ffff9302d9576840 fffff800ab857bfd : ffffe08fca7a95c0 ffffe08fca7a9580 ffffe08fca7a9580 0000000040010004 : nt!PspCatchCriticalBreak+0xff

ffff9302d95768e0 fffff800ab66c0a8 : ffffe08f00000000 ffffe08fca7a9580 ffffe08fca7a9858 ffffe08fca7a9580 : nt!PspTerminateAllThreads+0x113421

ffff9302d9576950 fffff800ab66be91 : ffffffffffffffff ffff9302d9576a80 ffffe08fc6e42580 0000000000000001 : nt!PspTerminateProcess+0xe0

ffff9302d9576990 fffff800ab395003 : ffffe08f000030d4 ffffe08fc3c87080 ffffe08fca7a9580 0000020a7c841980 : nt!NtTerminateProcess+0xa9

ffff9302d9576a00 00007ffd3f7e0404 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13

0000003c133ffbb8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!NtTerminateProcess+0x14

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 1ee16e27f2a3bf32487936ba1484cfcaf564e2dc

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: efd501109c2111ca07b61e101773ddd7f430ba82

THREAD_SHA1_HASH_MOD: fce38ccd7b727228240c1b437cae1484437f51f9

FOLLOWUP_IP:

ntdll!NtTerminateProcess+14

00007ffd`3f7e0404 c3 ret

FAULT_INSTR_CODE: c32ecdc3

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: ntdll!NtTerminateProcess+14

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ntdll

IMAGE_NAME: ntdll.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID_FUNC_OFFSET: 14

FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c3c87080_ntdll!NtTerminateProcess

BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c3c87080_ntdll!NtTerminateProcess

PRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_c3c87080_ntdll!NtTerminateProcess

TARGET_TIME: 2018-04-06T01:21:52.000Z

OSBUILD: 16299

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2018-03-01 13:36:55

BUILDDATESTAMP_STR: 170928-1534

BUILDLAB_STR: rs3_release

BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: 6b7

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_c3c87080_ntdll!ntterminateprocess

FAILURE_ID_HASH: {360917f2-1fa3-626d-e8c8-9c2c31c73311}

Followup: MachineOwner

鎖定的問題。此問題已從 Microsoft 支援服務社群移轉。您可以對其是否有幫助進行投票，但無法對問題新增註解或回覆，或進行追蹤。

0 則留言

26 個回答

匿名

2018-04-08T15:00:02+00:00

貼你的產品資訊記得將識別碼蓋掉以免資料外洩。

2018 年3 月13 日— KB4088776 (作業系統組建16299.309)

2018 年3 月22 日---KB4089848 (作業系統組建 16299.334)

沒有看到 CPU 規格? AMD ?

https://www.azdll.net/files/wow64cpu-dll.html

感謝提醒，以下是CPU規格
此回答有幫助嗎？

0 則留言沒有留言
温弘隆 13,220 信譽點數志願仲裁者

2018-04-08T14:36:57+00:00

貼你的產品資訊記得將識別碼蓋掉以免資料外洩。

2018 年3 月13 日— KB4088776 (作業系統組建16299.309)

2018 年3 月22 日---KB4089848 (作業系統組建 16299.334)

沒有看到 CPU 規格? AMD ?

https://www.azdll.net/files/wow64cpu-dll.html

無法重新啟動 Windows 10 版本 1709 AMD 裝置狀態
此回答有幫助嗎？

0 則留言沒有留言
匿名

2018-04-08T12:31:49+00:00

感謝你的回覆

以下是確認的資訊，再麻煩你確認一下是否正確
此回答有幫助嗎？

0 則留言沒有留言
温弘隆 13,220 信譽點數志願仲裁者

2018-04-08T12:25:59+00:00

你確定你的Windows 10 版本是 1709 版?

確認建立的目錄沒錯? 複製的檔案沒錯?

你的CPU ?
此回答有幫助嗎？

0 則留言沒有留言
匿名

2018-04-08T12:11:48+00:00

進入C:\Windows\System32\zh-hk 建立子目錄 zh-hk

copy

C:\Windows\System32\zh-hk\ ChtAP.sdc

C:\Windows\System32\zh-hk \chtzhy.spd

to

C:\WINDOWS\System32\zh-hk\zh-hk\ChtAP.sdc

C:\WINDOWS\System32\zh-hk\zh-hk\chtzhy.spd

進入C:\Windows\System32\zh-tw 建立子目錄 zh-tw

Copy

C:\Windows\System32\zh-tw\ ChtAP.sdc

C:\Windows\System32\zh-tw \chtzhy.spd

to

C:\WINDOWS\System32\zh-tw\zh-tw\ChtAP.sdc

C:\WINDOWS\System32\zh-tw\zh-tw\chtzhy.spd

檔案位置不對但多了一個 zh-tw\ & zh-hk 增加兩個目錄都加進缺的檔案就好了!

目前發現新的藍屏現象似乎是照你的指示在目錄加入檔案後進行

sfc /scannow 所產生，請問是否該把資料復原?

如果沒加入這兩個子目錄與各兩的檔案就部會藍屏嗎? 沒加不會嗎?

那你把它刪除看看! 再執行sfc /scannow 看有甚麼情況? 沒聽說有人這樣哩!

刪除兩個子目錄就還原了!

刪除這兩個目錄後再執行sfc /scannow一樣產生藍屏，memory dump和之前一樣是指向wow64cpu

所以現在藍屏的情況有兩種

1.執行sfc scan(指向wow64cpu)

2.執行關機程序(指向ntdll!NtTerminateProcess+14)
此回答有幫助嗎？

0 則留言沒有留言