BSOD caused by SYSTEM_SERVICE_EXCEPTION ntroskrnl.exe

Gerry,

Thanks a bunch, you know your stuff!

Please find the logs you requested a couple of posts back. Hopefully this will help build an even bigger picture for you.

https://www.dropbox.com/s/zh6iio8tnm9k074/DP\_Events\_Log\_Application.zip?dl=0

https://www.dropbox.com/s/3sz7mbwkhh5yhhg/DP\_Events\_Log\_System.zip?dl=0

Let me know if you need anything further and thank you so much for your help so far.

Dave

Dave

Please try the suggestion below to see if we can restore Event Viewer.

Boot the computer to safe mode and open Windows Explorer (keyboard shortcut Win+E). Follow the file path C>Windows>System32>LogFiles>WMI and delete the RtBackup folder. Restart your computer and check whether the Windows Event Log service is now running. The system automatically recreates a fresh copy of the RtBackup folder.

You can access safe mode from normal mode by selecting Start, Run, type msconfig and press the ENTER key. Click the Boot tab and check the box before Safe boot, click on Apply and OK and restart your computer.

To revert to normal mode you follow the same procedure except that you uncheck the box before Safe boot.

Please change this service setting. Click on the Start button and select Control Panel, Administrative Tools, Services. Locate Windows Event Collector in the list. Check that it has started and that the StartUp type is Automatic (delayed Start). If it is not set to Automatic (Delayed Start), right click and select Properties, General tab. There is a box after StartUp type. The options are available on a drop down by clicking on the arrow down to the right of the box. Make the change and click on Apply and OK. Restart the computer and check whether it has started.

Gerry

Please find attached a link to my System Information

https://www.dropbox.com/s/aok5hq3v7hhobe7/DP\_System\_Information.txt?dl=0

As I wrote in my earlier reply, my event log is not running. When I try and start it, I get a WMI error code 4201.  I'll try and fix this tomorrow. I had a problem with WMI a few months ago where it affected the action centre and I managed to fix it. Looks like I will need to revisit it again. If you have any words of wisdom regarding this, I'm all ears.

Thanks

Dave

Please provide a copy of your System Information file. Type System Information in the Search Box above the start Button and press the ENTER key (alternative is Select Start, All Programs, Accessories, System Tools, System Information). Select File, Export and give the file a name noting where it is located. Do not place the cursor within the body of the report before exporting the file. The system creates a new System Information file each time system information is accessed. You need to allow a minute or two for the file to be fully populated before exporting a copy. Please upload the file to your OneDrive, share with everyone and post a link here. Reports in normal mode preferred. Please say if the report has been obtained in safe mode.

Please upload and share with everyone copies of your System and Application logs from your Event Viewer to your OneDrive and post a link here.

To access the System log select Start, Control Panel, Administrative Tools, Event Viewer, from the list in the left side of the window expand Windows Logs and select System. Place the cursor on System, select Action from the Menu and Save All Events as (the default evtx file type) and give the file a name. Do the same for the Applications log. Do not provide filtered files. Do not place the cursor in the list of reports before selecting Action from the menu. Do not clear logs whilst you have a continuing problem.

For help with OneDrive see paragraph 9.3:

http://www.gerryscomputertips.co.uk/MicrosoftCommunity1.htm

General notes on Event Viewer

http://www.gerryscomputertips.co.uk/syserrors5.htm

Thanks Gerry.

New problem, when I go to click start (it is already set to automatic) I get the following error:

'Windows could not start the Windows Event Log service on Local Computer.

Error 4201: The instance name passed was not recognized as valid by a WMI data provider.'

FYI. I have left the Driver Verifier running and it is causing the computer to restart without prompting irregularly. No pattern as to what is causing it.

UPDATE: After leaving for the screen to timeout again (when the screen goes to standby (after 10mins)), I opened it again. Opened task manage to look for anything unusual then opened IE. Screen went blank and had to physically press the reset button on the computer to get it back. All very odd... I clearly have something wrong with a driver but god only knows which one(s).