Windows 10 BSOD Critical Process Died

Ntx710i

Distinguished
Dec 5, 2011
14
0
18,510
Hi,

I turned on my PC this morning and got a BSOD with the message Critical Process Died. Naturally I ran BlueScreenView which generated a handy text file that showed me what driver was causing the problem. However, I can't quite understand what it says. It seems to be related to a certain nt kernel file but I am not too sure. The dump file contents are as below, and it would be lovely if anyone could help with decoding the contents.

I ran sfc/scannow but there were no integrity violations.
I also ran my Norton 360 AV but it detected no severe viruses.

==================================================
Dump File : 072716-19375-01.dmp
Crash Time : 7/27/2016 9:09:23 AM
Bug Check String : CRITICAL_PROCESS_DIED
Bug Check Code : 0x000000ef
Parameter 1 : ffffe000`c4b5b840
Parameter 2 : 00000000`00000000
Parameter 3 : 00000000`00000000
Parameter 4 : 00000000`00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+142940
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 10.0.10586.494 (th2_release_sec.160630-1736)
Processor : x64
Crash Address : ntoskrnl.exe+142940
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\072716-19375-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 10586
Dump File Size : 304,964
Dump File Time : 7/27/2016 9:10:19 AM
==================================================

As well as running BlueScreenView, I decided to run WinDbg in order to get more details. This was what it generated. Hopefully it will be helpful.

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck EF, {ffffe000c4b5b840, 0, 0, 0}

ETW minidump data unavailable
Probably caused by : ntkrnlmp.exe ( nt!PspCatchCriticalBreak+a4 )

********************************************************************************
I also ran the !analyze -v to get more details. Should you require them, do tell me. It seems a bit of an eye sore to post it in a single post that's already long enough.

Thanks!

My PC Specs:

PSU: Corsair 750W
MB: ASUS Z97-Pro
CPU: Intel i5-4690K @ 3.50Ghz (no overclock)
GPU: Palit GTX 1080
Memory: 2x Kingston HyperX DDR3 1600Mhz 4GB (Total of 8GB)
Windows 10 x64
Hard Drives: SSD - Samsung EVO 850, 250GB
HDD - Western Digital 1TB







 
Solution
I was unable to identify the critical process error from your dump file apart from svchost.exe. This is a services host initiator and could be related to the Windows update service, however there are quite a few other services.

I will check for other possibilities.

As sfc /scannow showed no file faults.
Run "chkdsk /f /r". to check your disk for errors, without the quotation marks.

Sometimes Event Viewer can give a clue, Check see if any log files for any critical errors are found that are an indicator.

You mentioned a memory check within Windows.
This is not the best test for you DIMMs. Run MemTest86+ from a USB stick on all your modules. This is a more conclusive test.

Also it has been noted in some posts that Norton 360 AV can...
ntoskrnl.exe is the kernel (core) of the Windows operating system and in most cases this file is blamed because another file (typically a 3rd party driver) has corrupted the memory space that ntoskrnl.exe considers as it's own.

You would need a full dump analysis done if the problems continues.
Very often this is driver related so check in Device Manager for any yellow triangles in any categories.
Also check in Event Viewer logs that may give a clue as to the problem.
If a DIMM is failing due to memory leak this too can cause this issue. Run Memtest86+ from a USB stick to test your DIMMs.
 

Ntx710i

Distinguished
Dec 5, 2011
14
0
18,510


Thanks for your reply. I checked Device Manager but did not see any yellow triangles in any of the categories. It's rather odd that it could be a driver related issue as I had not installed any new components recently, nor install any new drivers lately.

I decided to run Windows Memory Diagnostics to check my memory but:

The Windows Memory Diagnostic tested the computer's memory and detected no errors

and the details tab shows:
UserData

- Results

LaunchType Manual

CompletionType Pass

MemorySize 8133

TestType 10

TestDuration 279

TestCount 12

NumPagesTested 2080872

NumPagesUnTested 1238

NumBadPages 0

T1NumBadPages 0

T2NumBadPages 0

T3NumBadPages 0

T4NumBadPages 0

T5NumBadPages 0

T6NumBadPages 0

T7NumBadPages 0

T8NumBadPages 0

T9NumBadPages 0

T10NumBadPages 0

T11NumBadPages 0

T12NumBadPages 0

T13NumBadPages 0

T14NumBadPages 0

T15NumBadPages 0

T16NumBadPages 0

I have posted the full bugcheck report generated after pressing the !analyze -v link by WinDbg as below. Not sure if this constitutes a full dump analysis but if it is of any help, here goes:

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffe000c4b5b840, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

ETW minidump data unavailable

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 10586.494.amd64fre.th2_release_sec.160630-1736

SYSTEM_MANUFACTURER: ASUS

SYSTEM_PRODUCT_NAME: All Series

SYSTEM_SKU: All

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 1204

BIOS_DATE: 06/17/2014

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: Z97-PRO

BASEBOARD_VERSION: Rev 1.xx

DUMP_TYPE: 2

BUGCHECK_P1: ffffe000c4b5b840

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

KERNEL_LOG_FAILING_PROCESS: <NULL>

PROCESS_NAME: svchost.exe

CRITICAL_PROCESS: svchost.exe

EXCEPTION_CODE: (NTSTATUS) 0xbfa23080 - <Unable to get error code text>

ERROR_CODE: (NTSTATUS) 0xbfa23080 - <Unable to get error code text>

CPU_COUNT: 4

CPU_MHZ: daa

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: 0xEF

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: VIPER-2002

ANALYSIS_SESSION_TIME: 07-28-2016 13:34:37.0422

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

LAST_CONTROL_TRANSFER: from fffff800ea4b7b5c to fffff800e9fbb940

STACK_TEXT:
ffffd000`234f19a8 fffff800`ea4b7b5c : 00000000`000000ef ffffe000`c4b5b840 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffd000`234f19b0 fffff800`ea2ab17c : 00000000`00000000 ffffe000`bfa233a0 00000000`00000001 fffff800`e9ec431a : nt!PspCatchCriticalBreak+0xa4
ffffd000`234f19f0 fffff800`ea2aa725 : ffffe000`c4b5b840 ffffe000`c4b5b840 ffffe000`bfa233a0 00000000`00000000 : nt!PspTerminateAllThreads+0x74
ffffd000`234f1a50 fffff800`ea2a9444 : ffffe000`c6952080 00000000`c0000005 ffffe000`c4b5b840 ffffe000`bfa23080 : nt!PspTerminateProcess+0x101
ffffd000`234f1a90 fffff800`e9fc61a3 : ffffe000`c4b5b840 ffffe000`bfa23080 ffffd000`234f1b80 ffffd000`234f1b80 : nt!NtTerminateProcess+0x9c
ffffd000`234f1b00 00007ff8`3ee35664 : 00007ff8`3bdae219 00000000`00000000 00007ff8`1922d178 00000000`00000154 : nt!KiSystemServiceCopyEnd+0x13
0000004c`7927e458 00007ff8`3bdae219 : 00000000`00000000 00007ff8`1922d178 00000000`00000154 00007ff8`1922d178 : 0x00007ff8`3ee35664
0000004c`7927e460 00000000`00000000 : 00007ff8`1922d178 00000000`00000154 00007ff8`1922d178 0000021b`0f2d0000 : 0x00007ff8`3bdae219


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 042a2b51772309c39e12d732cc93cacf0af3064e

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: fcfccda5761bc01cae0503f9359610239f85dad7

THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693

FOLLOWUP_IP:
nt!PspCatchCriticalBreak+a4
fffff800`ea4b7b5c cc int 3

FAULT_INSTR_CODE: 5c8b48cc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!PspCatchCriticalBreak+a4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5775e2f5

IMAGE_VERSION: 10.0.10586.494

BUCKET_ID_FUNC_OFFSET: a4

FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_bfa23080_nt!PspCatchCriticalBreak

BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_bfa23080_nt!PspCatchCriticalBreak

PRIMARY_PROBLEM_CLASS: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_bfa23080_nt!PspCatchCriticalBreak

TARGET_TIME: 2016-07-27T01:09:23.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-07-01 11:26:45

BUILDDATESTAMP_STR: 160630-1736

BUILDLAB_STR: th2_release_sec

BUILDOSVER_STR: 10.0.10586.494.amd64fre.th2_release_sec.160630-1736

ANALYSIS_SESSION_ELAPSED_TIME: 16c7

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xef_svchost.exe_bugcheck_critical_process_bfa23080_nt!pspcatchcriticalbreak

FAILURE_ID_HASH: {eb9e3826-3949-03e3-a540-1820af678db7}

Followup: MachineOwner
---------

Thank you again for trying to help me.
 
I was unable to identify the critical process error from your dump file apart from svchost.exe. This is a services host initiator and could be related to the Windows update service, however there are quite a few other services.

I will check for other possibilities.

As sfc /scannow showed no file faults.
Run "chkdsk /f /r". to check your disk for errors, without the quotation marks.

Sometimes Event Viewer can give a clue, Check see if any log files for any critical errors are found that are an indicator.

You mentioned a memory check within Windows.
This is not the best test for you DIMMs. Run MemTest86+ from a USB stick on all your modules. This is a more conclusive test.

Also it has been noted in some posts that Norton 360 AV can cause a Kernel Crash. Can you disable it to try.?
 
Solution