BSOD at boot (0xC0000135) - How to collect BSOD data if system can't boot into GUI?

[pvivekm]

The dism log in your other thread shows kernel32.dll, atl.dll and other dlls as corrupted.
But the copies of those files are not present in the indicated folders.

Read More:

2020-10-08 14:47:28, Info                  CBS    (p)    CSI Payload Corrupt    (n)          
2020-10-08 14:47:28, Info                  CBS    Repair failed: Missing replacement payload.

amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.423_none_ef43a2884ee1438c\NewWindowIcon.scale-150_contrast-black.png

amd64_microsoft-windows-d2d_31bf3856ad364e35_10.0.19041.329_none_85aecaaebaad5d7e\d2d1.dll

amd64_microsoft-windows-nfcmediaprovider_31bf3856ad364e35_10.0.19041.329_none_74c6eac1407919e6\NfcRadioMedia.dll

amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.19041.329_none_6bf870392fda3529\atlthunk.dll

amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.292_none_717d15cbb5470209\kernel32.dll

amd64_microsoft-windows-atl_31bf3856ad364e35_10.0.19041.329_none_893223b0b86ed133\atl.dll

amd64_microsoft-windows-d..ctoryclient-onecore_31bf3856ad364e35_10.0.19041.329_none_e21f36410cd796ce\DeviceDirectoryClient.dll

I think the guys in the windows update forum could help you to replace those files; therefore, my advice is to open a new thread there.

In fact I have already copied those files from my other working machine and DISM works fine now. But still I get BSOD with error 0xC0000135 at boot time itself. That is why I started this thread here.
Some observations:

1. I see a DUMPxxxx.tmp file in root directory. But there is no dump file in MiniDumps folder. As per article on BSOD on sysinternals, this file is created as a part of process of creating dump. My guess is that this process itself might not be completing.

2. When BSOD appears, I have seen usually system reboots after data collection reaches 100% . But in this case the machine just hangs with a continued high CPU usage. ( I can tell this from the cooling fan noise)

 

[xilolee]

But had those files the same versions than missing ones?

 

[pvivekm]

Yes, I took it from my other laptop that has same Windows build

 

[xilolee]

Then, check those file permissions and owner against the ones of other DLL files in their folder.
If different, change them.




Edit 17 Oct 20 - 14:08:

Using cmd.exe, command prompt, my kernel32.dll has got this administrator: "NT SERVICE\TrustedInstaller".
The command I used is dir /q kernel32.dll

And these "permissions":

• NT SERVICE\TrustedInstaller:(F)
• BUILTIN\Administrators:(RX)
• NT AUTHORITY\SYSTEM:(RX)
• BUILTIN\Users:(RX)
• APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
• APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)

The command I used is icacls kernel32.dll




Using windows explorer.exe GUI: (F) is "full control", (RX) is "read & execute", BUILTIN is my PC's name.

The other 5 DLL files give the same results.
The PNG file gives the same result, but it is in "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets".

 

[pvivekm]

Then, check those file permissions and owner against the ones of other DLL files in their folder.
If different, change them.

Good catch .... missed it before.
Will do it and see.

 

[FreeBooter]

Please boot your computer with Windows Setup Media and from Windows Recovery Environment start the Command Prompt.

Please type below command into Command Prompt and press Enter key.

The following commands scans integrity of all protected Windows system files and repairs files with problems when possible.

Dism  /image:D:  /Cleanup-Image  /RestoreHealth  /Source:esd:E:\sources\install.esd:1  /LimitAccess

Sfc  /Scannow   /OFFBOOTDIR=D:\   /OFFWINDIR=D:\Windows

Please replace partition letter D: with Windows installed partition letter. When computer boots into Windows Recovery Environment (WinRE) environment the drive letter assign to Windows partition may not be C: drive letter because Windows 7, 8 , 8.1 and 10 creates a separate system partition when it's installed from scratch. The system partition contains boot files WinRE assigns the system partition the C: drive letter and the Windows installed partition will be assign any other drive letter usually D: drive letter is assign to Windows installed partition. The Bcdedit /enum | find "osdevice" command can be use to find out the drive letter of the Windows installed partition the output of the Bcdedit command is similar to this osdevice partition=D:. The drive letter after partition= is the drive letter of the Windows partition.

Please replace E: drive letter with Windows 10 Setup Media drive letter. The following commands list all the drive letters detected by Windows 10:

Diskpart
List volume

The 1 index number tells DISM utility to retrieve the corrupted or missing files from which edition of Windows OS. The Install.wim file can contain more than one edition of the Windows OS. You can execute following command to found out index number of your Windows OS edition that you want to repair.

Dism  /Get-WimInfo  /Wimfile:"L:\sources\install.wim"

Replace the L:\sources with directory path where Install.wim stored. As you can see there is two editions of Windows 10 and all have index number.