Windows 10 BSOD: critical process stopped


  1. Posts : 5
    Windows 10 Pro 10.0.14393.693
       #1

    Windows 10 BSOD: critical process stopped


    Hi everyone,

    I have a BSOD, critical process stopped, it happened a few weeks ago, I think after Windows Update, updated my video drivers or Microsoft Office 2013 those were the only things that updates on that day. After that it started to crash usually 30 mins after boot and mostly random after that.

    Things I've tried:

    sfc /scannow
    Dism /Online /Cleanup-Image /ScanHealth
    Dism /Online /Cleanup-Image /CheckHealth
    Dism /online /cleanup-image /restorehealth
    Check Memory
    Update all Drivers
    Update Windows
    Clean and Uninstall Video Drivers/Re-Install
    Can't Restore / No Restore Points


    For some reason the Dump Collector won't save to Desktop, so I had to copy and paste it manually.

    Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\Minidump\030717-10328-01.dmp]Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: srv*Executable search path is: Windows 10 Kernel Version 14393 MP (8 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 14393.693.amd64fre.rs1_release.161220-1747Machine Name:Kernel base = 0xfffff802`ed486000 PsLoadedModuleList = 0xfffff802`ed78b060Debug session time: Tue Mar 7 20:38:43.218 2017 (UTC - 7:00)System Uptime: 0 days 0:08:59.118Loading Kernel Symbols..Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.Run !sym noisy before .reload to track down problems loading symbols............................................................................................. .................................................................................................... ..........Loading User SymbolsLoading unloaded module list..........******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************Use !analyze -v to get detailed debugging information.BugCheck EF, {ffff888d6ee47800, 0, 0, 0}ETW minidump data unavailableProbably caused by : ntkrnlmp.exe ( nt!PspCatchCriticalBreak+d6 )Followup: MachineOwner---------6: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************CRITICAL_PROCESS_DIE D (ef) A critical system process diedArguments:Arg1: ffff888d6ee47800, Process object or thread objectArg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.Arg3: 0000000000000000Arg4: 0000000000000000Debugging Details:------------------ETW minidump data unavailableDUMP_CLASS: 1DUMP_QUALIFIER: 400BUILD_VERSION_STRING: 10.0.14393.693 (rs1_release.161220-1747)SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.SYSTEM_PRODUCT_NAME: To be filled by O.E.M.SYSTEM_SKU: To be filled by O.E.M.SYSTEM_VERSION: To be filled by O.E.M.BIOS_VENDOR: American Megatrends Inc.BIOS_VERSION: F16BIOS_DATE: 08/20/2013BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.BASEBOARD_PRODUCT: Z77X-UD5HBASEBOARD_VERSION: x.xDUMP_TYPE: 2DUMP_FILE_ATTRIBUTES: 0xc Insufficient Dumpfile Size Kernel Generated Triage DumpBUGCHECK_P1: ffff888d6ee47800BUGCHECK_P2: 0BUGCHECK_P3: 0BUGCHECK_P4: 0PROCESS_NAME: svchost.exeCRITICAL_PROCESS: svchost.exeEXCEPTION_CODE: (NTSTATUS) 0x71791080 - <Unable to get error code text>ERROR_CODE: (NTSTATUS) 0x71791080 - <Unable to get error code text>CRITICAL_PROCESS_REPORTGUID: {2fb01cd0-0099-4fdd-a1a1-93ba436aa1b6}CPU_COUNT: 8CPU_MHZ: dadCPU_VENDOR: GenuineIntelCPU_FAMILY: 6CPU_MODEL: 3aCPU_STEPPING: 9CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 1B'00000000 (cache) 1B'00000000 (init)CUSTOMER_CRASH_COUNT: 1DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULTBUGCHECK_STR: 0xEFCURRENT_IRQL: 0ANALYSIS_SESSION_HOST: I73770KANALYSIS_SESSION_TIME: 03-07-2017 23:34:30.0869ANALYSIS_VERSION: 10.0.14321.1024 amd64freLAST_CONTROL_TRANSFER: from fffff802edb07c0a to fffff802ed5d06f0STACK_TEXT: ffffb101`67693978 fffff802`edb07c0a : 00000000`000000ef ffff888d`6ee47800 00000000`00000000 00000000`00000000 : nt!KeBugCheckExffffb101`67693980 fffff802`eda5b6eb : ffff888d`6ee47800 ffff888d`717913a0 00000000`00000000 ffff888d`71791080 : nt!PspCatchCriticalBreak+0xd6ffffb101`676939e0 fffff802`ed89a1a9 : ffff888d`00000000 ffff888d`6ee47800 ffff888d`717913a0 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x5b4abffffb101`67693a50 fffff802`ed899f60 : ffff888d`66f2b800 00000000`c0000005 ffff888d`6ee47800 ffff888d`71791080 : nt!PspTerminateProcess+0x101ffffb101`67693a90 fffff802`ed5db393 : ffff888d`6ee47800 ffff888d`71791080 ffffb101`67693b80 00000000`80070000 : nt!NtTerminateProcess+0x9cffffb101`67693b00 00007ffb`025001a1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x1300000059`5da7e308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`025001a1STACK_COMMAND: kbTHREAD_SHA1_HASH_MOD_FUNC: 87c4a57b08db2499156fb80767122c5fe8c2351eTHREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9bb7a827ca975c03a54dfd4da0ba84fbc257aff1THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693FOLLOWUP_IP: nt!PspCatchCriticalBreak+d6fffff802`edb07c0a cc int 3FAULT_INSTR_CODE: ff8440ccSYMBOL_STACK_INDEX: 1SYMBOL_NAME: nt!PspCatchCriticalBreak+d6FOLLOWUP_NAME: MachineOwnerMODULE_NAME: ntIMAGE_NAME: ntkrnlmp.exeDEBUG_FLR_IMAGE_TIMESTAMP: 585a2651IMAGE_VERSION: 10.0.14393.693BUCKET_ID_FUNC_OFFSET: d6FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_71791080_SppExtComObjHook.dll_unloaded!unknown_nt!PspCatc hCriticalBreakBUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_71791080_SppExtComObjHook.dll_unloaded!unknown_nt!PspCatc hCriticalBreakPRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_71791080_SppExtComObjHook.dll_unloaded!unknown_nt!PspCatc hCriticalBreakTARGET_TIME: 2017-03-08T03:38:43.000ZOSBUILD: 14393OSSERVICEPACK: 693SERVICEPACK_NUMBER: 0OS_REVISION: 0SUITE_MASK: 272PRODUCT_TYPE: 1OSPLATFORM_TYPE: x64OSNAME: Windows 10OSEDITION: Windows 10 WinNt TerminalServer SingleUserTSOS_LOCALE: USER_LCID: 0OSBUILD_TIMESTAMP: 2016-12-20 23:50:57BUILDDATESTAMP_STR: 161220-1747BUILDLAB_STR: rs1_releaseBUILDOSVER_STR: 10.0.14393.693ANALYSIS_SESSION_ELAPSED_TIME: 5edANALYSIS_SOURCE: KMFAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_71791080_sppextcomobjhook.dll_unloaded!unknown_nt!pspc atchcriticalbreakFAILURE_ID_HASH: {890f8150-e6a1-9fe2-b176-0b21959b1847}Followup: MachineOwner---------
      My Computer

  2. axe0's Avatar
    Posts : 14,792
    Windows 10 Pro
       #2

    Run this command in an admin command prompt, all files that are created are created on the desktop. Zip these files and upload the zip.
    Code:
    wmic /output:"%USERPROFILE%\Desktop\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\systeminfo.tmp" > "%USERPROFILE%\Desktop\systeminfo.txt"&del "%USERPROFILE%\Desktop\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&licensingdiag.exe -report "%userprofile%\Desktop\Genuine.txt" -log "%userprofile%\Desktop\repfiles.cab"&del "%userprofile%\Desktop\repfiles.cab" /Q&net start > "%USERPROFILE%\Desktop\services.txt"&sc query type= driver state= all > "%USERPROFILE%\Desktop\driver_status.txt"&sc query type= service state= inactive > "%USERPROFILE%\Desktop\inactive_services_status.txt"&sc query type= service state= all > "%USERPROFILE%\Desktop\all_services_status.txt"&REM wmic service list full /format:htable >%USERPROFILE%\Desktop\service.html&REM wmic /output:%USERPROFILE%\Desktop\nics.html nicconfig list /format:hform

    Copy/pasting the output of the dump, as it currently is done, makes it unreadable for everyone
      My Computers


  3. Posts : 5
    Windows 10 Pro 10.0.14393.693
    Thread Starter
       #3

    Sorry your right, I was able to upload the dump file.
      My Computer

  4. axe0's Avatar
    Posts : 14,792
    Windows 10 Pro
       #4

    Please run in an admin command prompt following command
    Code:
    slmgr /dlv
    a pop-up will show within a few moments, please make a screenshot of it and post it.
      My Computers


  5. Posts : 5
    Windows 10 Pro 10.0.14393.693
    Thread Starter
       #5

    Don't see how this helps, Dump points to kernel corruption caused by a driver or to that affect.
      My Computer

  6. axe0's Avatar
    Posts : 14,792
    Windows 10 Pro
       #6

    Why do you blackout so much information?
      My Computers


  7. Posts : 5
    Windows 10 Pro 10.0.14393.693
    Thread Starter
       #7

    Because its private and irrelevant to the problem. Are you going to snoop or help? There is more than enough information in the zip file than you need.
      My Computer

  8. axe0's Avatar
    Posts : 14,792
    Windows 10 Pro
       #8

    I need to confirm that your Windows is genuinely activated, I cannot do that when you blackout all information.
    This is relevant, because we don't provide support when any kind of piracy is active on the system. See forum rule #2
    https://www.tenforums.com/misc.php?do=showrules

    What makes you think there is more information in the zip than needed?
      My Computers


  9. Posts : 5
    Windows 10 Pro 10.0.14393.693
    Thread Starter
       #9

    Its rule #4, and that information is private. I thought it was a community that helps people and likes a challenge. I didn't break any rules. I guess I'll have to figure it out myself.
      My Computer

  10. axe0's Avatar
    Posts : 14,792
    Windows 10 Pro
       #10

    There is evidence of a crack that may cause an activation that is only genuine with a valid KMS server, the information you blacked out is required to confirm if the crack is used for illegally activating Windows.


    You forget that every community has rules, most communities that are like this one will handle similar rules in regards to piracy.
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 00:21.
Find Us




Windows 10 Forums