Windows files broken after a series of unsolicited shutdowns

Steve06 · 03 May 2013

Dear all,
My setup is the following:
CPU:Intel Core i7-3770, 4x 3.40GHz
VGA:Integrated (Intel HD 4000)
HDD:Intel SSD 520 120GB + WD AV-25 1TB
MB:ASRock Z77E-ITX, Z77
RAM:GeIL Black Dragon 16GB PC3-12800U
Case:Lian Li PC-Q11B, Mini-ITX
PSU:be quiet! Straight Power E9 400W
Windows 7 Professional 64-bit

During the last ten days, the PC has experienced occasional but sudden, harsh shutdowns, and by shutdown I mean that the next time I booted the computer up Windows would propose me to start in safe mode because the computer had not been shut down correctly. The first times it appears that no harm was done, but today, after it happened again, my Windows was left damaged with many corrupted system files that even "sfc /scannow" in the admin command prompt could not resolve. chkdsk /f, which was at some point initiated automatically by Windows confirmed a lot (partly non-repairable) broken files. As the system is now, it is unusable and will have to be properly repaired or freshly installed.

However, before doing that, Iwant to make sure that I identify the cause. At this point, I cannot even tell if it is a software or hardware issue, although the fact that the shutdowns were so abrupt and destructive (and not just in a controlled manner, as by some windows process) makes me think that it is a hardware issue. But can a Windows fault be ruled out?

I welcome your help and support - Here's what I have checked yet:
- Anti-virus check using: MSE, AVG Free, Bitdefender Rescue CD
- Checked the SSD using the Intel SSD Toolbox - all fine
- Temperatures had always been ok but I will try a stress test using Prime95 and see if the computer remains stable. UPDATE: Core temperatures get as high as 79°C after 1 hour of running, but the system never crashes.
- I looked up the Event log in the system preferences: There are a couple of events with id 1074 and reason code 0x500ff which according to Google have been linked to exactly this kind of behaviour. The full text of the event reads as follows:
"The process C:\Windows\system32\winlogon.exe (COMPUTER NAME) has initiated the power off of computer COMPUTER NAME on behalf of user USER NAME for the following reason: No title for this reason could be found
Reason Code: 0x500ff
Shutdown Type: restart
Comment: "
While at first sight it seems to match with what previous users in other forums encountered, my circumstances are a bit different: 1) The shutdown type with them is rather "power off" than "restart", as in my case, and the shutdown seems to happen in a controlled manner, i.e., I have not seen anyone report harm was done.
- Around the same time that this series of events began, I switched from Wifi to a wired ethernet connection. But I don't see how this could be connected.

I appreciate anyone's sincere efforts to help me resolve this puzzle.

Best,
Steve

Golden · 03 May 2013

Please follow steps outlined here to get BSOD help:

https://www.sevenforums.com/crashes-d...tructions.html

Steve06 · 03 May 2013

Ok, here comes the zip file. However, bear in mind that it is not from exactly the same user account as I cannot use my main account properly anymore (there's only the mouse cursor and a black screen and I cannot click on anything; I can only start the task manager with the Ctrl-Alt-Del keystroke). The dumps were hence made when I was logged onto another (admin) account of mine.

Golden · 03 May 2013

I noticed a swathe of Adobe activation blocks in your HOSTS file. Do you use any registry or other tune-up software on the computer?

Please also complete these steps:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click Copy - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the tool here in your next reply

More detail: Windows Genuine and Activation Issue Posting Instructions

Steve06 · 03 May 2013

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: N/A, hr=0x800700d8
Windows Product Key Hash: N/A, hr=0x800700d8
Windows Product ID: 55041-149-1201593-86739
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {1D3FA611-E330-49AB-89BE-AFF7309964C5}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130318-1533
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Fred\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{1D3FA611-E330-49AB-89BE-AFF7309964C5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-BBBBB</PKey><PID>55041-149-1201593-86739</PID><PIDType>6</PIDType><SID>S-1-5-21-1885944704-3828479486-362539010</SID><SYSTEM><Manufacturer>To Be Filled By O.E.M.</Manufacturer><Model>To Be Filled By O.E.M.</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P1.60</Version><SMBIOSVersion major="2" minor="7"/><Date>20121204000000.000000+000</Date></BIOS><HWID>57C93D07018400FE</HWID><UserLCID>0407</UserLCID><SystemLCID>0407</SystemLCID><TimeZone>Westeuropäische Zeit(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Führen Sie auf einem Computer unter Microsoft Windows (keine Core Edition) "slui.exe 0x2a 0x800700D8" aus, um den Fehlertext anzuzeigen.
Fehler: 0x800700D8 

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 3:2:2013 16:27
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NAAAAAEAAQABAAEAAQACAAAABAABAAEAHKImUQTp6O2Wl0xlsvtKOvxF0Y6yOEimLmWWYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			ALASKA		A M I
  FACP			ALASKA		A M I
  HPET			ALASKA		A M I
  MCFG			ALASKA		A M I
  FPDT			ALASKA		A M I
  SSDT			Intel_		AoacTabl
  AAFT			ALASKA		OEMAAFT 
  SSDT			Intel_		AoacTabl
  SSDT			Intel_		AoacTabl
  SSDT			Intel_		AoacTabl

The computer runs Tuneup Utilities in the background and CCleaner from time to time.

Steve06 · 03 May 2013

UPDATE: The stress test using Prime95 get core temperatures as high as 79°C after 1 hour of running, but the system never crashes.

Golden · 03 May 2013

How was this installation installed?

Steve06 · 03 May 2013

I'm not sure where this is going, but just using the installation disc, from scratch on a brand new system (not as an upgrade).

Golden · 03 May 2013

Please uninstall the Tune-Up utilities --they cause more harm than good -- and check to see if your system is stable.

NoelDP · 04 May 2013

Windows Product Key: N/A, hr=0x800700d8
Windows Product Key Hash: N/A, hr=0x800700d8

That's an error I don't recall ever seeing in an MGADiag before!

The error implies version incompatibility, so the best approach is to use SFC and see what it tells us.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.

Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply

Post a new MGADiag report with details of any error messages encountered.