Windows 10 32-bit BSOD crash, CRITICAL_PROCESS_DIED, sfc /scannow not running

Telenochek

Member
Joined
May 15, 2018
Posts
10
Hi guys,

My desktop PC with 32-bit Windows 10 has crashed version 10.0.17134.0. Not sure what happened - It worked fine for a few days after the upgrade to version 10.0.17134.0, and I was not using the PC at the time of the crash. It now starts up "attempting automatic repair", "diagnosing your PC" and ending with "Automatic Repair couldn't repair your PC".

My windows 10 installed on C: drive used to be version 10.0.17134.0 but is now 10.0.16299.15, after I tried going back to a previous version to try and fix the problem.
I also have a 10.0.17134.1 version bootable USB drive, which is 0.1 newer than win 10.0.17134.0

Things I've tried so far:
1) Running ESET and Kaspersky anti-virus and anti-rootkit scanners from separate bootable USB drives. No problems found
2) Standard windows Automatic repair from the C: drive, no luck
3) Standard windows Automatic repair from a bootable USB drive, which has the latest edition of windows 10, no luck

4) chkdsk /f /r from the system C: drive
refuses to run due to
"Windows cannot run disk checking on this volume because it is write protected"
I assume it is because I'm running recovery on it?

5) chkdsk c: /f /r from the bootable USB drive
“Windows has scanned the file system and found no problems”

6) sfc /scannow from C:\windows\system32 - this fails with the message
"Windows Resource Protection could not perform the requested operation" without even trying to scan.

Went into regedit, found that the ProgramFilesDir was pointing to X:\Program Files, not C:\Program Files
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]

sfc /scannow now completes 100% (instead of reporting the error right away), however at the end it still shows the error below:
"Windows Resource Protection could not perform the requested operation" after the 100% completion.

I looked through the cbs.log and it looks like there are some hash errors found in dlls, but the dll fixes not applied due to permissions?
On second, third, fourth SFC scans the same errors are found - hence confirmed not fixed.


7) sfc /scannow /offbootdir=c:\ /offwindir=c:\windows
from USB bootable image
got error:
"Windows Resource Protection could not perform the requested operation"

I was not able to get around the error, even though sfc /scannow at least executes to 100% completion from C: drive, but not from bootable usb.

tried:
ICACLS C:\Windows\winsxs , this completed fine,
but SFC still reports
"Windows Resource Protection could not perform the requested operation"

8) from C:\windows\system32
dism /online /cleanup-image /RestoreHealth

This initially fails with error 50
‘Error 50 DISM does not support servicing Windows PE with the /online option’
I'm able to get around this error by following instructions here, via regedit and WinNT key
Fix: Error 50 DISM does not support servicing Windows PE with the /online option - Appuals.com

However, once I get past error 50, I get another error after DISM completes with 100%
DISM Error: 1, incorrect function
I googled a variety of issues for errors inside the DISM .log , but didn't find anything actionable.

Since the standard fixes don't seem to work, I thought it would be a good idea to get professional help here on the forums.

It seems like fixing SFC /scannow would be the first priority.
cbs.txt is attached from the sfc /scannow executed from C: drive

Any help would be greatly appreciated!
I don't want to do a clean reinstall at this time.

Thank you,
Tele
 

Attachments

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 32-bit Version so please ensure you download that one.

2. Copy it to your USB drive.
3. Boot to recovery environment.
4. Launch CMD and launch FRST.exe from the USB.
5. Press Scan button.
6. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the USB)
7. Please attach the log back here.


Please note that there is no guarantee that I will be able to help you, but I will try.
 
Have you read my original post in detail?
I did not see any responses that were specifically targeted towards my original post and symptoms.

system response is identical to 6) in original post.

I have already attached the original cbs.txt in my original post.

Is there a reason you could not use the original cbs posted?

I'm attaching cbs2.txt obtained today - but it would be ideal if we could utilize data already obtained.
 

Attachments

Hello - my windows installation is on SSD, not HDD.
The link above does not provide any SSD analysis tools - they are for HDDs.
 
ok so I downloaded the files from here:
UUP dump
This is the version 1709 (16299.371)x86 and created an install.wim image from these files.


I then copied the install.wim to D:\sources2\install.wim and tried the following in offline mode from a bootable USB. THe bootable USB has a newer Win 10 Pro version than the files we're trying to fix.
I made sure to use the correct install.wim 16299.371


X:\Sources>DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:d:\sources2\install.wim:1 /ScratchDir:C:\Scratch


After reaching approximately 9%, there was an error 87 with the DISM.log
"An error occurred while processing the command.
Ensure that the command line arguments are valid. For more information, review the log file"
Log file is attached as dism3.txt


There are lots of CBS_E_XML_PARSER_FAILURE errors and a few other errors.
Not sure where to go from here.


I've also verified that the mounted c:\windows image is the same version:
Note I copied the config software file from the affected machine, copied it to USB and loaded / unloaded the registry hive under a key named PKTEST which was then unloaded.






[HKEY_LOCAL_MACHINE\PKTEST\Microsoft\Windows NT\CurrentVersion]
"SystemRoot"="C:\\WINDOWS"
"BuildBranch"="rs3_release"
"BuildGUID"="ffffffff-ffff-ffff-ffff-ffffffffffff"
"BuildLab"="16299.rs3_release.170928-1534"
"BuildLabEx"="16299.15.x86fre.rs3_release.170928-1534"
"CompositionEditionID"="Professional"
"CurrentBuild"="16299"
"CurrentBuildNumber"="16299"
"CurrentMajorVersionNumber"=dword:0000000a
"CurrentMinorVersionNumber"=dword:00000000
"CurrentType"="Multiprocessor Free"
"CurrentVersion"="6.3"
"EditionID"="Professional"
"EditionSubstring"=""
"InstallationType"="Client"
"InstallDate"=dword:5a27b399
"ProductName"="Windows 10 Pro"
"ReleaseId"="1709"
"SoftwareType"="System"
"UBR"=dword:00000173
"PathName"="C:\\WINDOWS"
"ProductId"="00330-80000-00000-AA828"


//note:
(173)hex = (371)decimal
 

Attachments

Can you, please, clarify how you determined that the image we're trying to fix is newer than the install.wim I'm trying to use.

image trying to use:
UUP dump
This is the version 1709 (16299.371)x86 and created an install.wim image from these files.

Image installed on c:\ is also
1709 (16299.371)x86


 
Hi - can you recommend a reliable SSD scanner that can be run from a bootable USB.
Samsung tools are windows only, and I'm a little worried about using Seatools from Seagate as there are a number of reports online where using Seatools with Samsung SSD drives screws up the SSD drive.
 
I checked SSD health using GParted with smartmontools included.
Both the short offline and long offline tests reported that they completed without errors.
sudo smartctl -t short -a /dev/sda and
sudo smartctl -t long -a /dev/sda
Wear_leveling_cnt is at 97%, so this is practically a new drive.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top