x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,195 Location %systemroot% May 12, 2022 #101 It seems that your %systemroot%\system32\drivers\filecrypt.sys file is either corrupt or missing. Are you able to boot into Safe Mode at all with the problematic drive?
It seems that your %systemroot%\system32\drivers\filecrypt.sys file is either corrupt or missing. Are you able to boot into Safe Mode at all with the problematic drive?
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 12, 2022 #102 Hi BlueRobot, %systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same. Something else must be causing problem for BSOD. It says Critical Service Failed, which service is failed , how can we find it?
Hi BlueRobot, %systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same. Something else must be causing problem for BSOD. It says Critical Service Failed, which service is failed , how can we find it?
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 12, 2022 #103 I also can not boot to safe mode with graphics or network, only to command prompt. When trying to boot to safe mode , it gives Stop code 0xc00002 Also surprisingly I can see the ssd in command prompt mode from the problematic os on the hdd.!
I also can not boot to safe mode with graphics or network, only to command prompt. When trying to boot to safe mode , it gives Stop code 0xc00002 Also surprisingly I can see the ssd in command prompt mode from the problematic os on the hdd.!
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,195 Location %systemroot% May 12, 2022 #104 burzek said: %systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same. Something else must be causing problem for BSOD. Click to expand... It's not, that is the problematic file. It's failing to load that driver for some reason. How did you compare them? Only because they "look" the same, it doesn't mean that the hashes haven't changed. Rich (BB code): CRITICAL_SERVICE_FAILED (5a) Arguments: Arg1: 0000000000000001 << Start type of service? Arg2: ffffa089773759a0 << Symbolic link to file system directory Arg3: ffffc9007d447300 << File path to the driver we're trying to load Arg4: ffffffffc0000103 << Exception being thrown Rich (BB code): 0: kd> du ffffa089773759a0 ffffa089`773759a0 "\FileSystem\FileCrypt" Rich (BB code): 0: kd> !du ffffc9007d447300 \SystemRoot\system32\drivers\filecrypt.sys Rich (BB code): 0: kd> knL # Child-SP RetAddr Call Site 00 ffffeb87`ff406a78 fffff801`43c16d58 nt!KeBugCheckEx 01 ffffeb87`ff406a80 fffff801`43e4efa3 nt!IopLoadDriver+0xebd58 << Dynamically load filecrypt.sys 02 ffffeb87`ff406c50 fffff801`43e4392a nt!IopInitializeSystemDrivers+0x157 03 ffffeb87`ff406cf0 fffff801`43b87fcb nt!IoInitSystem+0x2e 04 ffffeb87`ff406d20 fffff801`43755a15 nt!Phase1Initialization+0x3b 05 ffffeb87`ff406d50 fffff801`437feef8 nt!PspSystemThreadStartup+0x55 06 ffffeb87`ff406da0 00000000`00000000 nt!KiStartSystemThread+0x28 Interestingly, the symbolic link doesn't appear to exist, which would explain the reason for the exception code. It should exist under /FileSystem as a driver type. The driver itself is responsible for creating the symbolic link. Rich (BB code): 0: kd> !object \FileSystem\ Object: ffffc9007d5375e0 Type: (ffffa08975890220) Directory ObjectHeader: ffffc9007d5375b0 (new version) HandleCount: 0 PointerCount: 18 Directory Object: ffffc9007d41e740 Name: FileSystem Hash Address Type Name ---- ------- ---- ---- 04 ffffa08977265ac0 Driver Wof 11 ffffa089771e8060 Device CdfsRecognizer 12 ffffa08977283060 Device UdfsDiskRecognizer ffffa089772677f0 Driver Fs_Rec 19 ffffc9007d537b20 Directory Filters 21 ffffa089771c3390 Driver FltMgr 22 ffffa089772832a0 Device FatCdRomRecognizer 23 ffffa089771bf100 Driver Ntfs 24 ffffa089773a6c40 Driver Mup ffffa0897719fde0 Driver RAW 25 ffffa08977269a70 Device ReFSRecognizer ffffa08977267310 Driver WdFilter 28 ffffa089771c3e50 Driver FileInfo 31 ffffa0897726ba70 Device FatDiskRecognizer 32 ffffa08977269cb0 Device ReFSv1Recognizer 33 ffffa0897726bcb0 Device ExFatRecognizer 35 ffffa089772834e0 Device UdfsCdRomRecognizer The exception in question: Rich (BB code): 0: kd> !error c0000103 Error code: (NTSTATUS) 0xc0000103 (3221225731) - A requested opened file is not a directory. Could you please boot into Safe Mode with Command Prompt and then enter the following command: Rich (BB code): reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FileCrypt /s Please provide a screenshot of the output.
burzek said: %systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same. Something else must be causing problem for BSOD. Click to expand... It's not, that is the problematic file. It's failing to load that driver for some reason. How did you compare them? Only because they "look" the same, it doesn't mean that the hashes haven't changed. Rich (BB code): CRITICAL_SERVICE_FAILED (5a) Arguments: Arg1: 0000000000000001 << Start type of service? Arg2: ffffa089773759a0 << Symbolic link to file system directory Arg3: ffffc9007d447300 << File path to the driver we're trying to load Arg4: ffffffffc0000103 << Exception being thrown Rich (BB code): 0: kd> du ffffa089773759a0 ffffa089`773759a0 "\FileSystem\FileCrypt" Rich (BB code): 0: kd> !du ffffc9007d447300 \SystemRoot\system32\drivers\filecrypt.sys Rich (BB code): 0: kd> knL # Child-SP RetAddr Call Site 00 ffffeb87`ff406a78 fffff801`43c16d58 nt!KeBugCheckEx 01 ffffeb87`ff406a80 fffff801`43e4efa3 nt!IopLoadDriver+0xebd58 << Dynamically load filecrypt.sys 02 ffffeb87`ff406c50 fffff801`43e4392a nt!IopInitializeSystemDrivers+0x157 03 ffffeb87`ff406cf0 fffff801`43b87fcb nt!IoInitSystem+0x2e 04 ffffeb87`ff406d20 fffff801`43755a15 nt!Phase1Initialization+0x3b 05 ffffeb87`ff406d50 fffff801`437feef8 nt!PspSystemThreadStartup+0x55 06 ffffeb87`ff406da0 00000000`00000000 nt!KiStartSystemThread+0x28 Interestingly, the symbolic link doesn't appear to exist, which would explain the reason for the exception code. It should exist under /FileSystem as a driver type. The driver itself is responsible for creating the symbolic link. Rich (BB code): 0: kd> !object \FileSystem\ Object: ffffc9007d5375e0 Type: (ffffa08975890220) Directory ObjectHeader: ffffc9007d5375b0 (new version) HandleCount: 0 PointerCount: 18 Directory Object: ffffc9007d41e740 Name: FileSystem Hash Address Type Name ---- ------- ---- ---- 04 ffffa08977265ac0 Driver Wof 11 ffffa089771e8060 Device CdfsRecognizer 12 ffffa08977283060 Device UdfsDiskRecognizer ffffa089772677f0 Driver Fs_Rec 19 ffffc9007d537b20 Directory Filters 21 ffffa089771c3390 Driver FltMgr 22 ffffa089772832a0 Device FatCdRomRecognizer 23 ffffa089771bf100 Driver Ntfs 24 ffffa089773a6c40 Driver Mup ffffa0897719fde0 Driver RAW 25 ffffa08977269a70 Device ReFSRecognizer ffffa08977267310 Driver WdFilter 28 ffffa089771c3e50 Driver FileInfo 31 ffffa0897726ba70 Device FatDiskRecognizer 32 ffffa08977269cb0 Device ReFSv1Recognizer 33 ffffa0897726bcb0 Device ExFatRecognizer 35 ffffa089772834e0 Device UdfsCdRomRecognizer The exception in question: Rich (BB code): 0: kd> !error c0000103 Error code: (NTSTATUS) 0xc0000103 (3221225731) - A requested opened file is not a directory. Could you please boot into Safe Mode with Command Prompt and then enter the following command: Rich (BB code): reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FileCrypt /s Please provide a screenshot of the output.
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 12, 2022 #105 I have mixed Safe mode with command prompt with other command prompt which brings out the drive as X in Winpe mode. I guess I can load the system hive from other windows by attaching it to the regedit , and copy the key you mentioned from it ?
I have mixed Safe mode with command prompt with other command prompt which brings out the drive as X in Winpe mode. I guess I can load the system hive from other windows by attaching it to the regedit , and copy the key you mentioned from it ?
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 12, 2022 #106 This is what I could came up with. I attached the system hive with the name qqq I could only find ControlSet001 , instead of CurrentControlSet Exported as filecrpty.reg.txt , you can find it attached. I hope this helps. Attachments filecrypt.reg.txt 1.8 KB · Views: 1
This is what I could came up with. I attached the system hive with the name qqq I could only find ControlSet001 , instead of CurrentControlSet Exported as filecrpty.reg.txt , you can find it attached. I hope this helps.
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 12, 2022 #107 I think that the memory dump might be old , after sfc /scannow and dism some missing files might be restored. I will try to boot again and submit srt logs and a new memory dump if happens.
I think that the memory dump might be old , after sfc /scannow and dism some missing files might be restored. I will try to boot again and submit srt logs and a new memory dump if happens.
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,195 Location %systemroot% May 12, 2022 #108 Let us know what happens after running SFC and DISM and then attempting to boot.
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 12, 2022 #109 I first deleted memory.dmp and srt logs, then tried to enter safe mode command prompt, received stop error 0xc000021a Please find related memory.dmp and all files in srt logs in following link containing Logs.7z Download logs.7z (19.72 MB) now. Fast and easy at workupload.com Password is Marker47 Then I removed memory.dmp and srt logs again and now I am performing offline sfc and dism restorehealth on the drive. Sfc finished without any violations , dism is working on. I will then try to reboot and send any other dmp and srt logs.
I first deleted memory.dmp and srt logs, then tried to enter safe mode command prompt, received stop error 0xc000021a Please find related memory.dmp and all files in srt logs in following link containing Logs.7z Download logs.7z (19.72 MB) now. Fast and easy at workupload.com Password is Marker47 Then I removed memory.dmp and srt logs again and now I am performing offline sfc and dism restorehealth on the drive. Sfc finished without any violations , dism is working on. I will then try to reboot and send any other dmp and srt logs.
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,195 Location %systemroot% May 12, 2022 #110 Stop 0xC000021A will mean that a system file or a registry setting is corrupt, however, since SFC has returned no issues then it will likely be something related to your registry. It increasingly seems that performing a clean install is the most suitable option.
Stop 0xC000021A will mean that a system file or a registry setting is corrupt, however, since SFC has returned no issues then it will likely be something related to your registry. It increasingly seems that performing a clean install is the most suitable option.
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,195 Location %systemroot% May 12, 2022 #111 The dump file you've uploaded appears to the same one as before?
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 13, 2022 #112 Hi, This is the result of offline sfc and dism. I will boot and submit dump and srt files.
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 13, 2022 #113 After the above sfc and dism , rebooted the pc from the hdd. During booting from hdd , again gave the critical service failed bsod. After rebooting again from hdd automatic repairs began and a disk checking also performed, how can I see the details? Again automatic repair failed. I rebooted from ssd. I could not find any memory.dmp in hdd \windows folder. After booting ssd, the email box were on the hdd and inbox was missing, I restored from a backup but this is getting very strange. I performed chkdsk it seems fine on hdd. Please find the attached logs. I hope we can catch what is happening or I am about to give up. Thanks. Attachments SrtTrail.log 14.3 KB · Views: 2 DumpStack.log 8 KB · Views: 1 DISMRepairLogFile.txt 650.4 KB · Views: 1 disklayout.txt 3.5 KB · Views: 1 bootfailure.txt 4 bytes · Views: 1 bcdinfo.txt 3.7 KB · Views: 1 SrtTrail.txt 7.1 KB · Views: 1
After the above sfc and dism , rebooted the pc from the hdd. During booting from hdd , again gave the critical service failed bsod. After rebooting again from hdd automatic repairs began and a disk checking also performed, how can I see the details? Again automatic repair failed. I rebooted from ssd. I could not find any memory.dmp in hdd \windows folder. After booting ssd, the email box were on the hdd and inbox was missing, I restored from a backup but this is getting very strange. I performed chkdsk it seems fine on hdd. Please find the attached logs. I hope we can catch what is happening or I am about to give up. Thanks.
Maxstar Windows Update Moderator, Security Analyst Staff member Joined Aug 16, 2015 Posts 10,383 Location The Netherlands May 13, 2022 #114 As already sad in post #110, performing a clean install is the only way to fix this problem.
B burzek Well-known member Joined Apr 2, 2022 Posts 109 May 13, 2022 #115 Ok , at least we tried, thank you for all your help. I will continue with the ssd and move everything from hdd to ssd manually. Have a nice weekend...
Ok , at least we tried, thank you for all your help. I will continue with the ssd and move everything from hdd to ssd manually. Have a nice weekend...
Maxstar Windows Update Moderator, Security Analyst Staff member Joined Aug 16, 2015 Posts 10,383 Location The Netherlands May 13, 2022 #116 Have a nice weekend too.
B Bearded Blunder Active member Joined Apr 1, 2022 Posts 28 May 13, 2022 #117 Maxstar said: As already sad in post #110, performing a clean install is the only way to fix this problem. Click to expand... I'd concluded that at post 37...
Maxstar said: As already sad in post #110, performing a clean install is the only way to fix this problem. Click to expand... I'd concluded that at post 37...