• Pardon our dust as we work on some regularly scheduled forum maintenance. You may notice some missing features during this time. Thank you for your patience!

Question WINDOWS 10 BSOD SYSTEM SERVICE EXCEPTION ERROR WHEN USING BLUESTACKS CAUSED BY NTOSKRNL.EXE

Jul 7, 2019
5
0
10
0
070719-11750-01.dmp 7/7/2019 3:40:14 PM SYSTEM_SERVICE_EXCEPTION 0x0000003b 0000000080000004 fffff802642ad390 ffffa18450226fd0 0000000000000000 ntoskrnl.exe ntoskrnl.exe+1bc8a0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 10.0.18362.30 (WinBuild.160101.0800) x64 ntoskrnl.exe+1bc8a0 C:\WINDOWS\Minidump\070719-11750-01.dmp 8 15 18362 807,684 7/7/2019 3:41:57 PM
I have been using Bluestacks forever with no hangups at all until just a few days back when it started BSODing my rig.
I was having this problem with 8.1 and finally fixed it by doing a windows 10 upgrade. That worked for 1 day and now it is doing it again. Is it an update or??? I have posted crash analysis which, again, points to ntoskrnl.exe but with a "+1bc8a0" tag.
 

Colif

Win 10 Master
Moderator
can you go to C:\WINDOWS\Minidump\
copy the files to another location.
upload copies from new location to a file sharing website and show link here

ntoskrnl = windows kernel. It got blamed but its only what crashed, it was likely pushed by a driver. Dumps should show us what else was running at the time.
 

gardenman

Admirable
Herald
Hi, I ran the dump files through the debugger and got the following information: https://pste.eu/p/Q6Kh.html
File information:070819-15703-01.dmp (Jul 8 2019 - 09:26:29)
Bugcheck:SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:memory_corruption (Process: csrss.exe)
Uptime:0 Day(s), 0 Hour(s), 46 Min(s), and 44 Sec(s)

File information:070819-9640-01.dmp (Jul 8 2019 - 09:37:36)
Bugcheck:SYSTEM_SERVICE_EXCEPTION (3B)
Driver warnings:*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Probably caused by:Unknown_Image (Process: https://www.google.com/search?q=)
Uptime:0 Day(s), 0 Hour(s), 10 Min(s), and 00 Sec(s)
Comment: 2 or more types of RAM are installed.

Have you made any recent changes to your RAM or other hardware?

Possible Motherboard page: https://www.asus.com/us/Motherboards/M5A99FX_PRO_R20/
There is a BIOS update available for your system (version 2501). You are using version 2005. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.
 
Jul 7, 2019
5
0
10
0
Hi, I ran the dump files through the debugger and got the following information: https://pste.eu/p/Q6Kh.html
File information:070819-15703-01.dmp (Jul 8 2019 - 09:26:29)
Bugcheck:SYSTEM_SERVICE_EXCEPTION (3B)
Probably caused by:memory_corruption (Process: csrss.exe)
Uptime:0 Day(s), 0 Hour(s), 46 Min(s), and 44 Sec(s)

File information:070819-9640-01.dmp (Jul 8 2019 - 09:37:36)
Bugcheck:SYSTEM_SERVICE_EXCEPTION (3B)
Driver warnings:*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Probably caused by:Unknown_Image (Process: https://www.google.com/search?q=)
Uptime:0 Day(s), 0 Hour(s), 10 Min(s), and 00 Sec(s)
Comment: 2 or more types of RAM are installed.

Have you made any recent changes to your RAM or other hardware?

Possible Motherboard page: https://www.asus.com/us/Motherboards/M5A99FX_PRO_R20/
There is a BIOS update available for your system (version 2501). You are using version 2005. Wait for additional information before deciding to update or not. Important: Verify that I have linked to the correct motherboard. Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. I can't help you with this. Someone else will post with more information. Please wait for additional answers. Good luck.

yes, MOBO is : M5A99FX-PRO-R20-ASUS-2501
No recent changes

RAM: CORSAIR XMS3 TW3X4G1333C9A 1333MHZ 4GB (2X2) 9-9-9-24 1.50V ver8.11
CORSAIR XMS3 CMX8GX3M2A1333C9 1333 MHZ 8GB (2X4) 9-9-9-24 1.50V ver5.11
 

Colif

Win 10 Master
Moderator
how long you used ram sticks together? if its a long time, they might not be the problem

Try updating LAN driver, currently installed one from 2013, latest on motherboard website from 2016 - https://www.asus.com/au/Motherboards/M5A99FX_PRO_R20/HelpDesk_Download/
update Droidcam as its from 2015
update wifi driver
Radeon drivers a re a little old too.

Android emulator might have fallen over due to old Lan/wifi drivers

new bios could help, might add support for product, might not. Given its from 2014, it might not help
 
Jul 7, 2019
5
0
10
0
i believe radeon drivers are the most recent version for r7 250 via catalyst control. RAM has been in that configuration for 2 years = now.
wifi is asus PCE-AC88_v2.8.0.7
 
Jul 7, 2019
5
0
10
0
okay, I am no longer getting BSOD's which means that I am no longer getting crash dump files, either. BUT,... I am getting freezes and system restarts with the same 6 events written in the event viewer over and over:







Log Name: System



Source: EventLog

Date: 7/10/2019 7:53:05 AM

Event ID: 6008

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: GOLIATH

Description:

The previous system shutdown at 7:49:50 AM on ‎7/‎10/‎2019 was unexpected.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="EventLog" />

<EventID Qualifiers="32768">6008</EventID>

<Level>2</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2019-07-10T14:53:05.590302900Z" />

<EventRecordID>796</EventRecordID>

<Channel>System</Channel>

<Computer>GOLIATH</Computer>

<Security />

</System>

<EventData>

<Data>7:49:50 AM</Data>

<Data>‎7/‎10/‎2019</Data>

<Data>

</Data>

<Data>

</Data>

<Data>15</Data>

<Data>

</Data>

<Data>

</Data>

<Binary>E307070003000A000700310032009C02E307070003000A000E00310032009C023C0000003C000000000000000000000000000000000000000000000000000000</Binary>

</EventData>

</Event>



--------------------------------------------------------------------------------------------------



Log Name: System

Source: Microsoft-Windows-Kernel-Power

Date: 7/10/2019 7:52:59 AM

Event ID: 41

Task Category: (63)

Level: Critical

Keywords: (70368744177664),(2)

User: SYSTEM

Computer: GOLIATH

Description:

The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331c3b3a-2005-44c2-ac5e-77220c37d6b4}" />

<EventID>41</EventID>

<Version>6</Version>

<Level>1</Level>

<Task>63</Task>

<Opcode>0</Opcode>

<Keywords>0x8000400000000002</Keywords>

<TimeCreated SystemTime="2019-07-10T14:52:59.609452000Z" />

<EventRecordID>810</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="8" />

<Channel>System</Channel>

<Computer>GOLIATH</Computer>

<Security UserID="S-1-5-18" />

</System>

<EventData>

<Data Name="BugcheckCode">0</Data>

<Data Name="BugcheckParameter1">0x0</Data>

<Data Name="BugcheckParameter2">0x0</Data>

<Data Name="BugcheckParameter3">0x0</Data>

<Data Name="BugcheckParameter4">0x0</Data>

<Data Name="SleepInProgress">0</Data>

<Data Name="PowerButtonTimestamp">0</Data>

<Data Name="BootAppStatus">0</Data>

<Data Name="Checkpoint">0</Data>

<Data Name="ConnectedStandbyInProgress">false</Data>

<Data Name="SystemSleepTransitionsToOn">0</Data>

<Data Name="CsEntryScenarioInstanceId">0</Data>

<Data Name="BugcheckInfoFromEFI">false</Data>

<Data Name="CheckpointStatus">0</Data>

</EventData>

</Event>



-------------------------------------------------------------------------------------------------------------------------------



Log Name: Security

Source: Microsoft-Windows-Eventlog

Date: 7/10/2019 7:53:05 AM

Event ID: 1101

Task Category: Event processing

Level: Error

Keywords: Audit Success

User: N/A

Computer: GOLIATH

Description:

Audit events have been dropped by the transport. 0

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />

<EventID>1101</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>101</Task>

<Opcode>0</Opcode>

<Keywords>0x4020000000000000</Keywords>

<TimeCreated SystemTime="2019-07-10T14:53:05.715302500Z" />

<EventRecordID>1940</EventRecordID>

<Correlation />

<Execution ProcessID="1684" ThreadID="1872" />

<Channel>Security</Channel>

<Computer>GOLIATH</Computer>

<Security />

</System>

<UserData>

<AuditEventsDropped xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">

<Reason>0</Reason>

</AuditEventsDropped>

</UserData>

</Event>



------------------------------------------------------------------------------------------------------



Log Name: System

Source: Service Control Manager

Date: 7/10/2019 7:53:13 AM

Event ID: 7023

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: GOLIATH

Description:

The WMPNetworkSvc service terminated with the following error:

An attempt was made to reference a token that does not exist.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

<EventID Qualifiers="49152">7023</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8080000000000000</Keywords>

<TimeCreated SystemTime="2019-07-10T14:53:13.454599500Z" />

<EventRecordID>841</EventRecordID>

<Correlation />

<Execution ProcessID="780" ThreadID="976" />

<Channel>System</Channel>

<Computer>GOLIATH</Computer>

<Security />

</System>

<EventData>

<Data Name="param1">WMPNetworkSvc</Data>

<Data Name="param2">%%1008</Data>

<Binary>57004D0050004E006500740077006F0072006B005300760063000000</Binary>

</EventData>

</Event>



-------------------------------------------------------------------------------------------------------------------------------------------



Log Name: Microsoft-Windows-PrintService/Admin

Source: Microsoft-Windows-PrintService

Date: 7/10/2019 7:53:13 AM

Event ID: 232

Task Category: Installing a printer driver

Level: Warning

Keywords: Printer Setup,Print Driver

User: SYSTEM

Computer: GOLIATH

Description:

An attempt was made to upgrade installed printer driver 'Microsoft Software Printer Driver' to an older version of the driver, which is unsupported. If the older version of the driver is required, please delete the current version (via Print Management or Print Server Properties) and try again.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-PrintService" Guid="{747ef6fd-e535-4d16-b510-42c90f6873a1}" />

<EventID>232</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>19</Task>

<Opcode>13</Opcode>

<Keywords>0x8000000000000300</Keywords>

<TimeCreated SystemTime="2019-07-10T14:53:13.757172700Z" />

<EventRecordID>13</EventRecordID>

<Correlation />

<Execution ProcessID="3308" ThreadID="5932" />

<Channel>Microsoft-Windows-PrintService/Admin</Channel>

<Computer>GOLIATH</Computer>

<Security UserID="S-1-5-18" />

</System>

<UserData>

<SetupV4 xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">

<DriverName>Microsoft Software Printer Driver</DriverName>

<InfPath>C:\WINDOWS\System32\DriverStore\FileRepository\prnms011.inf_amd64_abd7305d050d145e\prnms011.inf</InfPath>

<RequiredClassDriver>-</RequiredClassDriver>

<HResult>0x1</HResult>

</SetupV4>

</UserData>

</Event>



-----------------------------------------------------------------------------------------



Log Name: Microsoft-Windows-User Device Registration/Admin

Source: Microsoft-Windows-User Device Registration

Date: 7/10/2019 7:54:22 AM

Event ID: 360

Task Category: None

Level: Warning

Keywords:

User: GOLIATH\D-day

Computer: GOLIATH

Description:

Windows Hello for Business provisioning will not be launched.

Device is AAD joined ( AADJ or DJ++ ): Not Tested

User has logged on with AAD credentials: No

Windows Hello for Business policy is enabled: Not Tested

Windows Hello for Business post-logon provisioning is enabled: Not Tested

Local computer meets Windows hello for business hardware requirements: Not Tested

User is not connected to the machine via Remote Desktop: Yes

User certificate for on premise auth policy is enabled: Not Tested

Machine is governed by none policy.

See https://go.microsoft.com/fwlink/?linkid=832647 for more details.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-User Device Registration" Guid="{23b8d46b-67dd-40a3-b636-d43e50552c6d}" />

<EventID>360</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2019-07-10T14:54:22.471029200Z" />

<EventRecordID>19</EventRecordID>

<Correlation />

<Execution ProcessID="3876" ThreadID="3800" />

<Channel>Microsoft-Windows-User Device Registration/Admin</Channel>

<Computer>GOLIATH</Computer>

<Security UserID="S-1-5-21-1315368951-107084884-1376090125-1001" />

</System>

<EventData>

<Data Name="Message">Windows Hello for Business provisioning will not be launched.</Data>

<Data Name="DeviceIsJoined">Not Tested</Data>

<Data Name="AADPrt">No</Data>

<Data Name="NgcPolicyEnabled">Not Tested</Data>

<Data Name="NgcPostLogonProvisioningEnabled">Not Tested</Data>

<Data Name="NgcHardwarePolicyMet">Not Tested</Data>

<Data Name="UserIsRemote">Yes</Data>

<Data Name="LogonCertRequired">Not Tested</Data>

<Data Name="MachinePolicySource">none</Data>

</EventData>

</Event>
 

Colif

Win 10 Master
Moderator
first 2 happen after a restart, they are reactions to restarts, not causes - event 6008 & event 41
Would be more useful to see the events before these 2 events, not after. Always possible windows doesn't know why it restarted, which could point at a hardware problem.. Drivers can cause freezes too.

Event 232 is trying to install a printer driver that's older than what is currently installed?

I think I get the windows hello event

event 7023 - try this to see if you can fix it
right click start button
choose powershell (admin)
type SFC /scannow and press enter
once its completed, copy/paste this command into same window:
Repair-WindowsImage -Online -RestoreHealth and press enter
SFC fixes system files, second command cleans image files, re run SFC if it failed to fix all files and restart PC
 

ASK THE COMMUNITY

TRENDING THREADS

Latest posts