Windows 7: Random BSODs, when restarting or shutting down windows

Nctolhu · 17 Jun 2017

I've recently updated my computer with a new mob, processor, ram and keep getting random BSODs on shutting down or restarting windows. At first I thought it might be tied to a xmp profile i had set in the bios, reset everything back to default in bios and still getting it. I have run memtest to see if it would find any issues with the ram and it came back with no errors. I'm at my wits end here as to what the cause is, any help would be much appreciated. If you need anymore info just let me know and I will do my best to get it for you.

**axe0** · 21 Jun 2017

Hi Nctolhu,

Sorry for the delay.
Are you still in need of help?

Nctolhu · 21 Jun 2017

Aye, I read some of the other post and adjusted a few things but don't know if it fixed the issue. any input would be greatly appreciated.

**axe0** · 23 Jun 2017

What error codes do you get?
There haven't been error codes recorded in a few months.

Nctolhu · 02 Jul 2017

The error seems to be the "irql_not_less_or_equal". sorry for the long time between replies but the BSOD is really random and didn't want to give miss information. re-uploaded the collection files(gathered right after the crash). Also for some reason windows does not want to save the minidump files after the crash anymore, checked settings and it is set to save.

**axe0** · 02 Jul 2017

Please post the report of Windows Genuine and Activation Issue Posting Instruction

Nctolhu · 03 Jul 2017

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-33D89-JJM87-VT7D9
Windows Product Key Hash: JQq0q1mq650FUOLL/2vIDjTxGGc=
Windows Product ID: 00426-383-5431627-06938
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {269F9F28-E003-44DD-8E7C-119924DF5257}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_ldr.170512-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{269F9F28-E003-44DD-8E7C-119924DF5257}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-VT7D9</PKey><PID>00426-383-5431627-06938</PID><PIDType>5</PIDType><SID>S-1-5-21-941422516-3030154424-3772097482</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>3007</Version><SMBIOSVersion major="3" minor="0"/><Date>20161129000000.000000+000</Date></BIOS><HWID>B38E3B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: c619d61c-c2f2-40c3-ab3f-c5924314b0f3
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00212-383-543162-00-1033-7601.0000-2862016
Installation ID: 020464401636714054799032580930136706282550700755666955
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: VT7D9
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 7/3/2017 11:50:33

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 4:14:2017 10:31
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAEAAQADAAAAAQABAAEAhFHst8xPqMF8547jGoAKQxpqde1QjvRS

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			ALASKA		A M I 
  FACP			ALASKA		A M I 
  DBGP			INTEL 		
  HPET			INTEL 		SKL
  MCFG			ALASKA		A M I 
  FPDT			ALASKA		A M I 
  SSDT			SataRe		SataTabl
  FIDT			ALASKA		A M I
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl
  UEFI			INTEL 		EDK2    
  SSDT			SataRe		SataTabl
  DBG2			INTEL 		
  LPIT			INTEL 		SKL
  WSMT			INTEL 		SKL
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl

**axe0** · 05 Jul 2017

I can't find much more related the below event, I will give you the benefit of doubt in regards to rule #4 which implies that no support is provided with anything related to piracy.

Rules: Windows 7 Help Forums - Forum Rules

I would suggest to run some scans, to be sure there are no similar files that may affect the issue.

Code:

Event[36313]:
  Log Name: System
  Source: Microsoft Antimalware
  Date: 2017-06-18T07:13:17.000
  Event ID: 1117
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Burn-PC
  Description: 
Microsoft Antimalware has taken action to protect this machine from malware or other potentially unwanted software.
 For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:MSIL/Gendows&threatid=2147687558&enterprise=0
 	Name: HackTool:MSIL/Gendows
 	ID: 2147687558
 	Severity: Medium
 	Category: Tool
 	Path: file:_C:\Windows\AutoKMS\AutoKMS.exe
 	Detection Origin: Local machine
 	Detection Type: Concrete
 	Detection Source: Real-Time Protection
 	User: Burn-PC\Burn
 	Process Name: C:\Windows\AutoKMS\AutoKMS.exe
 	Action: Allow
 	Action Status:  No additional actions required
 	Error Code: 0x00000000
 	Error description: The operation completed successfully. 
 	Signature Version: AV: 1.245.1013.0, AS: 1.245.1013.0, NIS: 117.2.0.0
 	Engine Version: AM: 1.1.13804.0, NIS: 2.1.13804.0

Diagnostics Test Random BSODs, when restarting or shutting down windows

Malware scan

Please run a threat scan with Malwarebytes*, a full scan with your AV, scan your system with Adwcleaner, Kaspersky TTDSKiller, ESET Online Scanner and SuperAntiSpyware

Note

*(Uncheck trial version in the installation process)

Please upload all scan logs.

torchwood · 05 Jul 2017

That tool is known to be an activation exploit, for the OS and Office
you have just Whitelisted it, please uninstall it

Then re-install KB971033

Reboot

rerun the WGA tool and a new set of BSOD logs. (note some files were missing)

Roy

Nctolhu · 06 Jul 2017

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-33D89-JJM87-VT7D9
Windows Product Key Hash: JQq0q1mq650FUOLL/2vIDjTxGGc=
Windows Product ID: 00426-383-5431627-06938
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {269F9F28-E003-44DD-8E7C-119924DF5257}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_ldr.170512-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{269F9F28-E003-44DD-8E7C-119924DF5257}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-VT7D9</PKey><PID>00426-383-5431627-06938</PID><PIDType>5</PIDType><SID>S-1-5-21-941422516-3030154424-3772097482</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>3007</Version><SMBIOSVersion major="3" minor="0"/><Date>20161129000000.000000+000</Date></BIOS><HWID>B38E3B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: c619d61c-c2f2-40c3-ab3f-c5924314b0f3
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00212-383-543162-00-1033-7601.0000-2862016
Installation ID: 020464401636714054799032580930136706282550700755666955
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: VT7D9
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 7/6/2017 08:26:21

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 4:14:2017 10:31
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAEAAQACAAAAAQABAAEAhFHst8xPqMF8547jGoAKQxpqUI70Ug==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			ALASKA		A M I 
  FACP			ALASKA		A M I 
  DBGP			INTEL 		
  HPET			INTEL 		SKL
  MCFG			ALASKA		A M I 
  FPDT			ALASKA		A M I 
  SSDT			SataRe		SataTabl
  FIDT			ALASKA		A M I
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl
  UEFI			INTEL 		EDK2    
  SSDT			SataRe		SataTabl
  DBG2			INTEL 		
  LPIT			INTEL 		SKL
  WSMT			INTEL 		SKL
  SSDT			SataRe		SataTabl
  SSDT			SataRe		SataTabl

I believe this is all the log files and everything that was asked for. Couldn't figure out where essentials kept it's logs, however it came up clean after running all the other programs and removing everything that was found. Uninstalled and re-installed the KB971033, didn't notice any changes after doing so. All items that were white listed were unlisted before the scans and deleted/uninstalled once the scans completed. If you need anything else please let me know and thank you for your continued help.