[SOLVED] BSOD after Windows Update KB5015807 ?

Jul 24, 2022
11
1
15
0
Hi, every night my PC is forced to restart due to this mandatory update and after it proceeds to 30% it restarts once more but I get a BSOD shortly afterwards. I have tried searching this problem up and tried a lot of the fixes suggested but I'm currently stuck as they haven't really solved the problem. I have seen someone have a similar problem to mine in the forums where they got it fixed by having their minidump analysed so I'm hoping I get lucky and that's all I need.

Here's my minidump:
https://www.mediafire.com/file/fgooyk164nn9dwo/072422-41515-01.dmp/file
 
Reactions: muhammadafzal

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
If the suggestions in the above post don't help, you might need to do a repair install
All it does is replaces windows, if its anything like the one I did last weekend, you won't notice any difference (apart from windows update actually working) when its reinstalled again. It doesn't touch anything other than windows.
It takes windows back to base build on 21H2 and then once you back on desktop it downloads all the updates again. Well, only one cumulative update but probably .net and a few others as well.
https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

It should fix your update problem as well.
 
Reactions: Lichii
Jul 24, 2022
11
1
15
0
every night?

what are specs of PC?
What error code are you getting? I have to ask a friend to convert dumps and he will be asleep for a while.
Yep, every night because I have to system restore it daily to get my pc working. Which specs would you like to know? I'm getting 'CRITICAL_PROCESS_DIED' and WinDbg is saying 'ntkrnlmp.exe' is the cause.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter


Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

Critical Process Died is an error that can only happen if system files crash. There are a number of files that if they don't work, windows can't either. The file mentioned is part of windows kernel so it might have been cause or just what was reported as cause. I often see kernel blamed for errors but its only as its involved in almost every action on PC.

How long you had problems with the update?
 
Reactions: PEnns
Jul 24, 2022
11
1
15
0
right click start button

choose powershell (admin)

copy/paste this command into window:

Repair-WindowsImage -Online -RestoreHealth

and press enter

Then type SFC /scannow

and press enter


Restart PC if SFC fixes any files as some fixes require a restart to be implemented

First command repairs the files SFC uses to clean files, and SFC fixes system files

SFC = System File Checker. First command runs DISM - https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11

Critical Process Died is an error that can only happen if system files crash. There are a number of files that if they don't work, windows can't either. The file mentioned is part of windows kernel so it might have been cause or just what was reported as cause. I often see kernel blamed for errors but its only as its involved in almost every action on PC.

How long you had problems with the update?
I've done the 'SFC /scannow' with cmd prompt before which has fixed some files previously but hasn't solved the issue. Is the 'Repair-WindowsImage -Online -RestoreHealth' similar to 'DISM /Online /Cleanup-Image /RestoreHealth'? If so, I've ran that on cmd prompt also. I've had this problem for quite a while now, I think it might have started since June but I managed to pause the windows update for like a month.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
Is the 'Repair-WindowsImage -Online -RestoreHealth' similar to 'DISM /Online /Cleanup-Image /RestoreHealth'?
its the same command, just in powershell

although not same error, some of the fixes in this might help. Don't do the reset he suggests at end. I have other ideas.
edit: nvm, video was win 11

tried the Update troubleshooter?

Right-click start button and select Command prompt (Admin) or type cmd in search and right-click Command Prompt, and then select Run as administrator.
Now type these commands.

  • Type: netsh winsock reset and press Enter.
  • Type: netsh int ip reset and press Enter.
  • Type: ipconfig /release and press Enter.
  • Type: ipconfig /renew and press Enter.
  • Type: ipconfig /flushdns and press Enter.
When you receive a Windows Update error first try these solutions to fix common Windows Update errors. Fix Windows Update Errors
http://www.briteccomputers.co.uk/forum/showthread.php?tid=2994


which version of win 10?

  1. right click start
  2. choose run...
  3. type winver and press enter
  4. current version is 21H2
 
Last edited:

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
If the suggestions in the above post don't help, you might need to do a repair install
All it does is replaces windows, if its anything like the one I did last weekend, you won't notice any difference (apart from windows update actually working) when its reinstalled again. It doesn't touch anything other than windows.
It takes windows back to base build on 21H2 and then once you back on desktop it downloads all the updates again. Well, only one cumulative update but probably .net and a few others as well.
https://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

It should fix your update problem as well.
 
Reactions: Lichii
Jul 24, 2022
11
1
15
0
I have tried the Update troubleshooter but no luck. Those commands didn't help either, I'm assuming I have something conflicting with the update itself like in this thread:


If all else fails, I think I'll try the repair install that you suggested as a last resort.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
You can wait if you want, my friend will post a file I can look through, it might offer some hints. Very least show what drivers are installed.

Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

it doesn't delete anything, just removes non microsoft prpograms from startup. Easy to reverse.

if clean boot fixes it, it shows its likely a startup program getting in the way

try running update in clean boot. shame you can't update windows in safe mode

What Anti virus program do you use?
 
What do I need to do though?
there are so many service host processes running in windows and they all show the same name on a minidump. maybe change the memory dump type to kernel and I can see what .exe the service host is spawning.

my version of window has 71 different service host processes each hosting different .exes
 
Last edited:
Jul 24, 2022
11
1
15
0
there are so many service host processes running in windows and they all show the same name on a minidump. maybe change the memory dump type to kernel and I can see what .exe the service host is spawning.

my version of window has 71 different service host processes each hosting different .exes
Hopefully I did it correctly.

edit: I found the true memory dump file, just need to relink after uploading.

https://www.mediafire.com/file/vr4sh2hu3pcu9pz/MEMORY.zip/file
 
Last edited:

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
Every version of win 10 since about 1709 has had a service host for every service. It is meant to make identifying them easier... went from about 6 service hosts to about 71. Would be easier to identify at some level I expect, but not just by its name.

John wasn't the person I was waiting for but he knows what he is doing.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
Just looking at could be's since I can't see any more than John can.
I am just looking at the results of minidumps, not latest upload
these are all maybe's

try taking your wifi card out when you run update
Jan 21 2016bcbtums.sysBroadcom Bluetooth Firmware Download Filter driver
Dec 25 2017A6100.sysNetgear A6100 Wifi Adapter driver

vpn could use an update

probably don't need this
Apr 11 2018ndextlag.sys ExitLag Game Booster driver
should be new version of Virtualbox
Icue probably has an update. given its from 2020 and I got a new version this month

I seen this cause BSOD
Nov 29 2019BstkDrv_bgp.sysBluestacks Support driver

none of those should trip over windows update though..
It shouldn't be
Jan 21 2020secnvme.sysSamsung NVM Express Controller Storport Miniport Driver


I will wait and see what John finds I guess.
 
I am guessing you will need to find out about this:
c:\windows\system32\svchost.exe -k localserviceNoNetworkFirewall -p
and find out why the client did not have the rights to access it. Reset firewall ?
(got to go do some work, maybe I can look later today)

-------------
you have a service running out of the windows 32 bit subsystem and it is calling terminate process and causing the bugcheck.

best thing to do is to download process explorer from microsoft from here:
Process Explorer - Windows Sysinternals | Microsoft Docs

run it and you will need to look at all of the svchost.exe that are running on your system.
i would left mouse click on the process column so it sorts by the process name, then go to othe svchost.exe name and you are looking for a process that should not be there.
on my machine I only see ones with a company name of microsoft and a few from intel.
hopefully you can find another vendors name. you can move the mouse over each entry and it will show details of the command line that was use to start the process.
you have to find the one that should not be there: hopefully it will not have a company name of microsoft and you only have to look at the intel or any other company name entries.

if it is malware or someone being a jerk, it might have a microsoft company name.

when you find the service name and how it is invoked you then have to go to the service and disable it.

looks like all svchost.exe are listed as microsoft since microsoft wrote the tool.
that spawns out the 3rd party service. this makes it harder to find the one that should not be there.

looking at the memory dump.
the service that terminated the process got the error
0xc0000061 A required privilege is not held by the client before the termination.

looks like the service was started like this:
c:\windows\system32\svchost.exe -k localserviceNoNetworkFirewall -p

google localserviceNoNetworkFirewall
to find out about this and find out why the client did not have rights to run.
note: debugger reported many subsystem files have been modified

note: you can run cmd.exe as an admin and run
tasklist /SVC /FI "IMAGENAME eq svchost.exe"
to see just the list of running tasks that are svchost.exe
 
Last edited:
Jul 24, 2022
11
1
15
0
I am guessing you will need to find out about this:
c:\windows\system32\svchost.exe -k localserviceNoNetworkFirewall -p
and find out why the client did not have the rights to access it. Reset firewall ?
(got to go do some work, maybe I can look later today)

-------------
you have a service running out of the windows 32 bit subsystem and it is calling terminate process and causing the bugcheck.

best thing to do is to download process explorer from microsoft from here:
Process Explorer - Windows Sysinternals | Microsoft Docs

run it and you will need to look at all of the svchost.exe that are running on your system.
i would left mouse click on the process column so it sorts by the process name, then go to othe svchost.exe name and you are looking for a process that should not be there.
on my machine I only see ones with a company name of microsoft and a few from intel.
hopefully you can find another vendors name. you can move the mouse over each entry and it will show details of the command line that was use to start the process.
you have to find the one that should not be there: hopefully it will not have a company name of microsoft and you only have to look at the intel or any other company name entries.

if it is malware or someone being a jerk, it might have a microsoft company name.

when you find the service name and how it is invoked you then have to go to the service and disable it.

looks like all svchost.exe are listed as microsoft since microsoft wrote the tool.
that spawns out the 3rd party service. this makes it harder to find the one that should not be there.

looking at the memory dump.
the service that terminated the process got the error
0xc0000061 A required privilege is not held by the client before the termination.

looks like the service was started like this:
c:\windows\system32\svchost.exe -k localserviceNoNetworkFirewall -p

google localserviceNoNetworkFirewall
to find out about this and find out why the client did not have rights to run.
note: debugger reported many subsystem files have been modified

note: you can run cmd.exe as an admin and run
tasklist /SVC /FI "IMAGENAME eq svchost.exe"
to see just the list of running tasks that are svchost.exe
After using the Process Explorer, and hovering over each entry, all my svchost.exe are under Microsoft and nothing seems out of the ordinary.
 

Colif

Win 11 Master
Moderator
Jun 12, 2015
58,386
4,740
161,190
10,354
LocalserviceNoNetworkFirewall is a part of Windows security and is used by Windows Defender (or by other Windows API-based firewalls) in their operations.

he is using Defender, I asked about that already.
I don't think I see any other AV or anything... 2 VPN, not sure if they would play a part.

i wonder if its malware or something, try running the trial version of this - https://www.hitmanpro.com/en-us
 
Jul 24, 2022
11
1
15
0
Just looking at could be's since I can't see any more than John can.
I am just looking at the results of minidumps, not latest upload
these are all maybe's

try taking your wifi card out when you run update
Jan 21 2016bcbtums.sysBroadcom Bluetooth Firmware Download Filter driver
Dec 25 2017A6100.sysNetgear A6100 Wifi Adapter driver

vpn could use an update

probably don't need this
Apr 11 2018ndextlag.sysExitLag Game Booster driver
should be new version of Virtualbox
Icue probably has an update. given its from 2020 and I got a new version this month

I seen this cause BSOD
Nov 29 2019BstkDrv_bgp.sysBluestacks Support driver

none of those should trip over windows update though..
It shouldn't be
Jan 21 2020secnvme.sysSamsung NVM Express Controller Storport Miniport Driver


I will wait and see what John finds I guess.
Currently in the process of removing all the programs above since I don't really need them at the moment. Then I'll try the windows update and see how it goes from there.
 
Jul 24, 2022
11
1
15
0
i doubt its the nvme drivers.
Well, that took me a while. I ended up in a BSOD loop after every system restore so I just did a PC reset (whilst keeping personal files) from the Advanced Options. This fixed the problem but I ultimately didn't want to do this. Thanks for the help guys.
 

ASK THE COMMUNITY