每次關機必產生藍屏，顯示critical process die

進入C:\Windows\System32\zh-hk 建立子目錄 zh-hk

copy

C:\Windows\System32\zh-hk\ ChtAP.sdc

C:\Windows\System32\zh-hk \chtzhy.spd

to

C:\WINDOWS\System32\zh-hk\zh-hk\ChtAP.sdc

C:\WINDOWS\System32\zh-hk\zh-hk\chtzhy.spd

進入C:\Windows\System32\zh-tw 建立子目錄 zh-tw

Copy

C:\Windows\System32\zh-tw\ ChtAP.sdc

C:\Windows\System32\zh-tw \chtzhy.spd

to

C:\WINDOWS\System32\zh-tw\zh-tw\ChtAP.sdc

C:\WINDOWS\System32\zh-tw\zh-tw\chtzhy.spd

檔案位置不對但多了一個 zh-tw\ & zh-hk  增加兩個目錄都加進缺的檔案就好了!

目前發現新的藍屏現象似乎是照你的指示在目錄加入檔案後進行

sfc /scannow 所產生，請問是否該把資料復原?

你確定你的Windows 10 版本是 1709 版?

確認建立的目錄沒錯? 複製的檔案沒錯?

如果沒加入這兩個子目錄與各兩的檔案就不會藍屏嗎?

那你把它刪除看看! 再執行sfc /scannow 看有甚麼情況?

沒聽說有人這樣哩!

你可試試刪除兩個子目錄就還原了!

進入C:\Windows\System32\zh-hk 建立子目錄 zh-hk

copy

C:\Windows\System32\zh-hk\ ChtAP.sdc

C:\Windows\System32\zh-hk \chtzhy.spd

to

C:\WINDOWS\System32\zh-hk\zh-hk\ChtAP.sdc

C:\WINDOWS\System32\zh-hk\zh-hk\chtzhy.spd

進入C:\Windows\System32\zh-tw 建立子目錄 zh-tw

Copy

C:\Windows\System32\zh-tw\ ChtAP.sdc

C:\Windows\System32\zh-tw \chtzhy.spd

to

C:\WINDOWS\System32\zh-tw\zh-tw\ChtAP.sdc

C:\WINDOWS\System32\zh-tw\zh-tw\chtzhy.spd

檔案位置不對但多了一個 zh-tw\ & zh-hk  增加兩個目錄都加進缺的檔案就好了!

目前發現新的藍屏現象似乎是照你的指示在目錄加入檔案後進行

sfc /scannow 所產生，請問是否該把資料復原?

Dear Raveny-Yin 

十分感謝你的回覆，但除了Win10內建的Windows Defender外，並未安裝任何防毒軟體，目前測試後發現藍屏現象發生在除了選擇關機動作時，平時操作有低機率發生此現象

以下是Program list中所安裝的軟體還有最近一次memory dump分析

Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\o-lin\Desktop\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*

Executable search path is: 

Windows 10 Kernel Version 16299 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 16299.15.amd64fre.rs3_release.170928-1534

Machine Name:

Kernel base = 0xfffff802a0287000 PsLoadedModuleList = 0xfffff802a05ee130

Debug session time: Sun Apr  8 18:43:13.902 2018 (UTC + 8:00)

System Uptime: 0 days 0:32:40.776

Loading Kernel Symbols

...............................................................

................................................................

................................................................

............

Loading User Symbols

.....

Loading unloaded module list

............

Loading Wow64 Symbols

............................

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck EF, {ffff938394445580, 0, 0, 0}

Page 41ea not present in the dump file. Type ".hh dbgerr004" for details

Page 41ea not present in the dump file. Type ".hh dbgerr004" for details

Page 56d14 not present in the dump file. Type ".hh dbgerr004" for details

Page 56d14 not present in the dump file. Type ".hh dbgerr004" for details

Page 13f36f not present in the dump file. Type ".hh dbgerr004" for details

Page 13f36f not present in the dump file. Type ".hh dbgerr004" for details

CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.

"C:\WINDOWS\System32\KERNELBASE.dll" was not found in the image list.

Debugger will attempt to load "C:\WINDOWS\System32\KERNELBASE.dll" at given base 00000000`00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)

for more reliable results.Base address and size overrides can be given as

.reload <image.ext>=<base>,<size>.

Unable to add module at 00000000`00000000

Probably caused by : wow64cpu.dll ( wow64cpu!CpupSyscallStub+c )

Followup:     MachineOwner

1: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

CRITICAL_PROCESS_DIED (ef)

        A critical system process died

Arguments:

Arg1: ffff938394445580, Process object or thread object

Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  16299.15.amd64fre.rs3_release.170928-1534

SYSTEM_MANUFACTURER:  LENOVO

SYSTEM_PRODUCT_NAME:  80XK

SYSTEM_SKU:  LENOVO_MT_80XK_BU_idea_FM_ideapad 320-14IKB

SYSTEM_VERSION:  Lenovo ideapad 320-14IKB

BIOS_VENDOR:  LENOVO

BIOS_VERSION:  4WCN38WW

BIOS_DATE:  12/25/2017

BASEBOARD_MANUFACTURER:  LENOVO

BASEBOARD_PRODUCT:  LNVNB161216

BASEBOARD_VERSION:  SDK0J40700 WIN

DUMP_TYPE:  1

BUGCHECK_P1: ffff938394445580

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME:  svchost.exe

CRITICAL_PROCESS:  svchost.exe

EXCEPTION_CODE: (HRESULT) 0x84e88080 (2229829760) - <Unable to get error code text>

ERROR_CODE: (NTSTATUS) 0x84e88080 - <Unable to get error code text>

CPU_COUNT: 4

CPU_MHZ: b58

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 8e

CPU_STEPPING: 9

CPU_MICROCODE: 6,8e,9,0 (F,M,S,R)  SIG: 7C'00000000 (cache) 7C'00000000 (init)

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0xEF

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  LAPTOP-5327MES9

ANALYSIS_SESSION_TIME:  04-08-2018 18:49:35.0486

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

LAST_CONTROL_TRANSFER:  from fffff802a099b26f to fffff802a03fc510

STACK_TEXT:  

ffffb88839c2f878 fffff802a099b26f : 00000000000000ef ffff938394445580 0000000000000000 0000000000000000 : nt!KeBugCheckEx

ffffb88839c2f880 fffff802a08d1bfd : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PspCatchCriticalBreak+0xff

ffffb88839c2f920 fffff802a06e5f85 : ffffffff00000000 0000000000000000 ffff938394445580 0000000000000000 : nt!PspTerminateAllThreads+0x113421

ffffb88839c2f990 fffff802a040f003 : ffff938384e88080 ffff938384e88080 ffff938394445580 0000000000000001 : nt!NtTerminateProcess+0x19d

ffffb88839c2fa00 000000005b9d1e5c : 000000005b9d1e1b 000000237784e7ec 000000005b9e0023 00000000056160a0 : nt!KiSystemServiceCopyEnd+0x13

00000000008cec38 000000005b9d1e1b : 000000237784e7ec 000000005b9e0023 00000000056160a0 000000000090fde4 : wow64cpu!CpupSyscallStub+0xc

00000000008cec40 000000005b9fac86 : 0000000000b60000 0000000000de00e0 0000000000000000 00000000008cf510 : wow64cpu!Thunk0Arg+0x5

00000000008cecf0 000000005b9ebea0 : 0000000000000000 00000000008ced50 0000000004e03b18 0000000000000000 : wow64!RunCpuSimulation+0xecd6

00000000008ced20 00007ffaf5be5c1d : 0000000000de00e0 0000000000000010 0000000000b5f000 0000000000000003 : wow64!Wow64LdrpInitialize+0x120

00000000008cefd0 00007ffaf5bd761b : 0000000000000000 0000000000000000 0000000000000000 0000000000000001 : ntdll!LdrpInitializeProcess+0x18a1

00000000008cf410 00007ffaf5b8923b : 00007ffaf5b10000 0000000000000000 0000000000000000 0000000000b5f050 : ntdll!_LdrpInitialize+0x4e3cb

00000000008cf490 00007ffaf5b891ee : 00000000008cf510 0000000000000000 0000000000000000 0000000000000000 : ntdll!LdrpInitialize+0x3b

00000000008cf4c0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!LdrInitializeThunk+0xe

STACK_COMMAND:  kb

THREAD_SHA1_HASH_MOD_FUNC:  e167cece8d19a0cb8772921eddc3cb18f270a343

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  1447844349de89da43e7a8ac62d6a8d4bde64966

THREAD_SHA1_HASH_MOD:  dd512ffc1f36f2777629d41b4b8c3e0a72698ccc

FOLLOWUP_IP: 

wow64cpu!CpupSyscallStub+c

00000000`5b9d1e5c c3              ret

FAULT_INSTR_CODE:  c32ecdc3

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  wow64cpu!CpupSyscallStub+c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: wow64cpu

IMAGE_NAME:  wow64cpu.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5e2e7e70

BUCKET_ID_FUNC_OFFSET:  c

FAILURE_BUCKET_ID:  0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_84e88080_wow64cpu!CpupSyscallStub

BUCKET_ID:  0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_84e88080_wow64cpu!CpupSyscallStub

PRIMARY_PROBLEM_CLASS:  0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_84e88080_wow64cpu!CpupSyscallStub

TARGET_TIME:  2018-04-08T10:43:13.000Z

OSBUILD:  16299

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  784

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2018-03-01 13:36:55

BUILDDATESTAMP_STR:  170928-1534

BUILDLAB_STR:  rs3_release

BUILDOSVER_STR:  10.0.16299.15.amd64fre.rs3_release.170928-1534

ANALYSIS_SESSION_ELAPSED_TIME: 7f0

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0xef_svchost.exe_bugcheck_critical_process_84e88080_wow64cpu!cpupsyscallstub

FAILURE_ID_HASH:  {617dd65e-c61e-ac9c-2865-b1c58af80695}

Followup:     MachineOwner

您好，

ffff9302d9576840 fffff800ab857bfd : ffffe08fca7a95c0 ffffe08fca7a9580 ffffe08fca7a9580 0000000040010004 : nt!PspCatchCriticalBreak+0xff

ffff9302d95768e0 fffff800ab66c0a8 : ffffe08f00000000 ffffe08fca7a9580 ffffe08fca7a9858 ffffe08fca7a9580 : nt!PspTerminateAllThreads+0x113421

ffff9302d9576950 fffff800ab66be91 : ffffffffffffffff ffff9302d9576a80 ffffe08fc6e42580 0000000000000001 : nt!PspTerminateProcess+0xe0

ffff9302d9576990 fffff800ab395003 : ffffe08f000030d4 ffffe08fc3c87080 ffffe08fca7a9580 0000020a7c841980 : nt!NtTerminateProcess+0xa9

看起來是防毒軟體勾連鎖住導致的中斷，

把自己裝的防毒軟體移除掉。

Windows 10 更新1709 後cbs.log 損毀

你的Windows 10 1709 是哪一個區域下載的 ? 台灣版最完整!

SFC /Scannow 檢測修復損毀系統檔，無法修復檔按下面連接進行操作。

Windows 資源保護發現已損毀的檔案，但無法修復其中某些檔案。詳細資料請見

CBS.Log windir\Logs\CBS\CBS.log。例如 C:\Windows\Logs\CBS\CBS.log。

請注意，目前離線服務案例中不支援記錄功能。

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" 

將錯誤儲存到桌面 sfcdetails.txt 再找出問題在哪裡!

在1709 不同雖然 sfc/scannow 錯誤但 市集正常! 但事件檢視器有很多錯誤訊息! 

所以至少要sfc/scannow 正常,

2017-10-21 21:38:21, Info                  CSI    0000550c [SR] Repairing corrupted file ??\C:\WINDOWS\System32\zh-hk\zh-hk\ChtAP.sdc from store

2017-10-21 21:38:21, Info                  CSI    0000550d [SR] Repairing corrupted file ??\C:\WINDOWS\System32\zh-hk\zh-hk\chtzhy.spd from store

2017-10-21 21:38:22, Info                  CSI    00005511 [SR] Repairing corrupted file ??\C:\WINDOWS\System32\zh-tw\zh-tw\ChtAP.sdc from store

2017-10-21 21:38:22, Info                  CSI    00005512 [SR] Repairing corrupted file ??\C:\WINDOWS\System32\zh-tw\zh-tw\chtzhy.spd from store

進入C:\Windows\System32\zh-hk 建立子目錄 zh-hk

copy

C:\Windows\System32\zh-hk\ ChtAP.sdc

C:\Windows\System32\zh-hk \chtzhy.spd

to

C:\WINDOWS\System32\zh-hk\zh-hk\ChtAP.sdc

C:\WINDOWS\System32\zh-hk\zh-hk\chtzhy.spd

進入C:\Windows\System32\zh-tw 建立子目錄 zh-tw

Copy

C:\Windows\System32\zh-tw\ ChtAP.sdc

C:\Windows\System32\zh-tw \chtzhy.spd

to

C:\WINDOWS\System32\zh-tw\zh-tw\ChtAP.sdc

C:\WINDOWS\System32\zh-tw\zh-tw\chtzhy.spd

檔案位置不對但多了一個 zh-tw\ & zh-hk 增加兩個目錄都加進缺的檔案就 好了 !

Critical Process Died' in Windows 10: Fix this Error - Windows Report