Windows 10: Windows 10 BSOD: critical process stopped

Hi everyone,

I have a BSOD, critical process stopped, it happened a few weeks ago, I think after Windows Update, updated my video drivers or Microsoft Office 2013 those were the only things that updates on that day. After that it started to crash usually 30 mins after boot and mostly random after that.

Things I've tried:

sfc /scannow
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /CheckHealth
Dism /online /cleanup-image /restorehealth
Check Memory
Update all Drivers
Update Windows
Clean and Uninstall Video Drivers/Re-Install
Can't Restore / No Restore Points


For some reason the Dump Collector won't save to Desktop, so I had to copy and paste it manually.

Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\Minidump\030717-10328-01.dmp]Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: srv*Executable search path is: Windows 10 Kernel Version 14393 MP (8 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 14393.693.amd64fre.rs1_release.161220-1747Machine Name:Kernel base = 0xfffff802`ed486000 PsLoadedModuleList = 0xfffff802`ed78b060Debug session time: Tue Mar 7 20:38:43.218 2017 (UTC - 7:00)System Uptime: 0 days 0:08:59.118Loading Kernel Symbols..Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.Run !sym noisy before .reload to track down problems loading symbols............................................................................................. .................................................................................................... ..........Loading User SymbolsLoading unloaded module list..........******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************Use !analyze -v to get detailed debugging information.BugCheck EF, {ffff888d6ee47800, 0, 0, 0}ETW minidump data unavailableProbably caused by : ntkrnlmp.exe ( nt!PspCatchCriticalBreak+d6 )Followup: MachineOwner---------6: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************CRITICAL_PROCESS_DIE D (ef) A critical system process diedArguments:Arg1: ffff888d6ee47800, Process object or thread objectArg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.Arg3: 0000000000000000Arg4: 0000000000000000Debugging Details:------------------ETW minidump data unavailableDUMP_CLASS: 1DUMP_QUALIFIER: 400BUILD_VERSION_STRING: 10.0.14393.693 (rs1_release.161220-1747)SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.SYSTEM_PRODUCT_NAME: To be filled by O.E.M.SYSTEM_SKU: To be filled by O.E.M.SYSTEM_VERSION: To be filled by O.E.M.BIOS_VENDOR: American Megatrends Inc.BIOS_VERSION: F16BIOS_DATE: 08/20/2013BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.BASEBOARD_PRODUCT: Z77X-UD5HBASEBOARD_VERSION: x.xDUMP_TYPE: 2DUMP_FILE_ATTRIBUTES: 0xc Insufficient Dumpfile Size Kernel Generated Triage DumpBUGCHECK_P1: ffff888d6ee47800BUGCHECK_P2: 0BUGCHECK_P3: 0BUGCHECK_P4: 0PROCESS_NAME: svchost.exeCRITICAL_PROCESS: svchost.exeEXCEPTION_CODE: (NTSTATUS) 0x71791080 - <Unable to get error code text>ERROR_CODE: (NTSTATUS) 0x71791080 - <Unable to get error code text>CRITICAL_PROCESS_REPORTGUID: {2fb01cd0-0099-4fdd-a1a1-93ba436aa1b6}CPU_COUNT: 8CPU_MHZ: dadCPU_VENDOR: GenuineIntelCPU_FAMILY: 6CPU_MODEL: 3aCPU_STEPPING: 9CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 1B'00000000 (cache) 1B'00000000 (init)CUSTOMER_CRASH_COUNT: 1DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULTBUGCHECK_STR: 0xEFCURRENT_IRQL: 0ANALYSIS_SESSION_HOST: I73770KANALYSIS_SESSION_TIME: 03-07-2017 23:34:30.0869ANALYSIS_VERSION: 10.0.14321.1024 amd64freLAST_CONTROL_TRANSFER: from fffff802edb07c0a to fffff802ed5d06f0STACK_TEXT: ffffb101`67693978 fffff802`edb07c0a : 00000000`000000ef ffff888d`6ee47800 00000000`00000000 00000000`00000000 : nt!KeBugCheckExffffb101`67693980 fffff802`eda5b6eb : ffff888d`6ee47800 ffff888d`717913a0 00000000`00000000 ffff888d`71791080 : nt!PspCatchCriticalBreak+0xd6ffffb101`676939e0 fffff802`ed89a1a9 : ffff888d`00000000 ffff888d`6ee47800 ffff888d`717913a0 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x5b4abffffb101`67693a50 fffff802`ed899f60 : ffff888d`66f2b800 00000000`c0000005 ffff888d`6ee47800 ffff888d`71791080 : nt!PspTerminateProcess+0x101ffffb101`67693a90 fffff802`ed5db393 : ffff888d`6ee47800 ffff888d`71791080 ffffb101`67693b80 00000000`80070000 : nt!NtTerminateProcess+0x9cffffb101`67693b00 00007ffb`025001a1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x1300000059`5da7e308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`025001a1STACK_COMMAND: kbTHREAD_SHA1_HASH_MOD_FUNC: 87c4a57b08db2499156fb80767122c5fe8c2351eTHREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9bb7a827ca975c03a54dfd4da0ba84fbc257aff1THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693FOLLOWUP_IP: nt!PspCatchCriticalBreak+d6fffff802`edb07c0a cc int 3FAULT_INSTR_CODE: ff8440ccSYMBOL_STACK_INDEX: 1SYMBOL_NAME: nt!PspCatchCriticalBreak+d6FOLLOWUP_NAME: MachineOwnerMODULE_NAME: ntIMAGE_NAME: ntkrnlmp.exeDEBUG_FLR_IMAGE_TIMESTAMP: 585a2651IMAGE_VERSION: 10.0.14393.693BUCKET_ID_FUNC_OFFSET: d6FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_71791080_SppExtComObjHook.dll_unloaded!unknown_nt!PspCatc hCriticalBreakBUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_71791080_SppExtComObjHook.dll_unloaded!unknown_nt!PspCatc hCriticalBreakPRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_71791080_SppExtComObjHook.dll_unloaded!unknown_nt!PspCatc hCriticalBreakTARGET_TIME: 2017-03-08T03:38:43.000ZOSBUILD: 14393OSSERVICEPACK: 693SERVICEPACK_NUMBER: 0OS_REVISION: 0SUITE_MASK: 272PRODUCT_TYPE: 1OSPLATFORM_TYPE: x64OSNAME: Windows 10OSEDITION: Windows 10 WinNt TerminalServer SingleUserTSOS_LOCALE: USER_LCID: 0OSBUILD_TIMESTAMP: 2016-12-20 23:50:57BUILDDATESTAMP_STR: 161220-1747BUILDLAB_STR: rs1_releaseBUILDOSVER_STR: 10.0.14393.693ANALYSIS_SESSION_ELAPSED_TIME: 5edANALYSIS_SOURCE: KMFAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_71791080_sppextcomobjhook.dll_unloaded!unknown_nt!pspc atchcriticalbreakFAILURE_ID_HASH: {890f8150-e6a1-9fe2-b176-0b21959b1847}Followup: MachineOwner---------

:)

 

Systems restarts prematurly

Hello,

See if this fix this helps you:

https://www.kapilarya.com/fix-critical-process-...

Let us know if this helps!

 

BSOD - Help

On windows 10 machine, got the BSOD - I can't restart in safe mode. I've run the automatic repair process - which resulted in the BSOD....but did end up with a critical process died error.

The first time I got the BSOD the error message referenced MEMORY_MANAGEMENT.

Any ideas how to proceed?

 

Run this command in an admin command prompt, all files that are created are created on the desktop. Zip these files and upload the zip.
Code: wmic /output:"%USERPROFILE%\Desktop\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\systeminfo.tmp" > "%USERPROFILE%\Desktop\systeminfo.txt"&del "%USERPROFILE%\Desktop\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&licensingdiag.exe -report "%userprofile%\Desktop\Genuine.txt" -log "%userprofile%\Desktop\repfiles.cab"&del "%userprofile%\Desktop\repfiles.cab" /Q&net start > "%USERPROFILE%\Desktop\services.txt"&sc query type= driver state= all > "%USERPROFILE%\Desktop\driver_status.txt"&sc query type= service state= inactive > "%USERPROFILE%\Desktop\inactive_services_status.txt"&sc query type= service state= all > "%USERPROFILE%\Desktop\all_services_status.txt"&REM wmic service list full /format:htable >%USERPROFILE%\Desktop\service.html&REM wmic /output:%USERPROFILE%\Desktop\nics.html nicconfig list /format:hform[/quote]
Copy/pasting the output of the dump, as it currently is done, makes it unreadable for everyone *Sad

 

Sorry your right, I was able to upload the dump file.

 

Please run in an admin command prompt following command
Code: slmgr /dlv[/quote] a pop-up will show within a few moments, please make a screenshot of it and post it.

 

Don't see how this helps, Dump points to kernel corruption caused by a driver or to that affect.

 

Why do you blackout so much information?

 

Because its private and irrelevant to the problem. Are you going to snoop or help? There is more than enough information in the zip file than you need.

 

I need to confirm that your Windows is genuinely activated, I cannot do that when you blackout all information.
This is relevant, because we don't provide support when any kind of piracy is active on the system. See forum rule #2
Forum Rules - Windows 10 Help Forums

What makes you think there is more information in the zip than needed?

 

Its rule #4, and that information is private. I thought it was a community that helps people and likes a challenge. I didn't break any rules. I guess I'll have to figure it out myself.

 

There is evidence of a crack that may cause an activation that is only genuine with a valid KMS server, the information you blacked out is required to confirm if the crack is used for illegally activating Windows.


You forget that every community has rules, most communities that are like this one will handle similar rules in regards to piracy.