BSOD Win7 0x1E ntoskrnl.exe with dmp

[Joystik]

This has been annoying me for awhile. I thought it was because my computer was overheating, my chipset would get to 85 Celsius so i installed another fan. That is obviously not the issue because it is still blue screening.

Report from "WhoCrashed" v 4.01
--------------------------------------------------------------------------------------------------------
On Tue 3/26/2013 12:37:30 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\032613-11200-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFFA80064935B2, 0x0, 0x0)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
--------------------------------------------------------------------------------------------------------

I downloaded the debugging tool for windows to open the dmp file but I couldnt make much use of it.
Please look at my attached dmp file. I would greatly appreciate if someone could assist me with this, the computer I use is for business so it is becoming a real issue. Thank you greatly for your time

EDIT: Ran the SF Diagnostics Tools and included the zipped results.

 

[koolkat77]

http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[Joystik]

Thanks koolkat77, newb alert here. pardon my ignorance.

Ran the SF diagnostics and uploaded the zipped results folder, editing OP.

 

[koolkat77]

Please post the following report before we proceed:

• Windows Genuine and Activation Issue Posting Instructions

 

[Joystik]

My computer crashed within a minute of running the windows genuine activation diagnostic tool, interesting.


Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-GJY49-VJBQ7-HYRR2
Windows Product Key Hash: W5/6nm6F2UPXrCkY5xUhXb/+21g=
Windows Product ID: 00426-OEM-8992662-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {803D5AC0-05A2-49D9-9645-DEFBB96170BE}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_rtm.101119-1850
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{803D5AC0-05A2-49D9-9645-DEFBB96170BE}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-HYRR2</PKey><PID>00426-OEM-8992662-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-2910941206-1291919903-2596469352</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>EP45T-UD3LR</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F5</Version><SMBIOSVersion major="2" minor="4"/><Date>20090224000000.000000+000</Date></BIOS><HWID>11123007018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>GBT </OEMID><OEMTableID>GBTUACPI</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00178-926-600006-02-1033-7601.0000-0112013
Installation ID: 009932079061616540469613496941497606821696193825070562
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: HYRR2
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 3/26/2013 3:54:52 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEAonYWvEwKRrwMNYQ05L/iX5iyihyw9ZqIZPNJjHCaJo6Oiswx

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
EUDS GBT
SSDT PmRef CpuPm
SLIC GBT GBTUACPI

 

[Joystik]

Computer lagged, accidental double post.

 

[tom982]

Are you aware that your license is counterfeit?

 

[Joystik]

Eh go figure. A friend helped me put it together, I let him do the install at his place.
As long as it works I suppose, but I would really like to get this machine fully functional. I work with web design in Dreamweaver and I have web conferences, I can't afford to have that business process interrupted. Would you please help me in fixing it?

 

[tom982]

We can't offer assistance to people with that attitude towards piracy, as per the forum rules, so you will have to reinstall with genuine media before we can help you.

http://www.sevenforums.com/general-discussion/8-forum-rules-info-please-read.html

Tom

 

[Joystik]

I did not pirate it, I explained that a buddy of mine did the install process. I just talked to him and he did verify he had a pirated disk but I did not originally know that. If anything this has reinforced that pirated material can harm you.

 

[tom982]

Hi Joystik,

I would highly recommend that you purchase a genuine Windows 7, or 8, disc and do a clean install with that. It is impossible for your friend to have done this with just a disc, your friend has given you an Acer product key and a Gigabyte SLIC table which can only be held together with a loader - this is a BIOS mod that is something that has to be done from within the OS, he's done more than just put a dodgy Windows 7 disc in. But, as you said, this isn't your fault so I can hardly penalise you for that! What is of concern though, is that we have no way of telling what else this loader has installed on the system and your computer could be wide open to infection in this state.

These BSOD dumps are way above my level (it isn't really my speciality) so they're best left for the BSOD analysts. Fixing this is only a short term solution though as who knows what could go wrong when your OS is in the state that it is. If you want a reliable work machine, you have to go genuine

Tom

 

[Joystik]

Oh shoot a bios mod? I'm not super technical but I know that's pretty serious... I have no idea what a Gigabyte SLIC table is though lol. I know Gigabyte is my motherboard brand but thats about it.

If you say it is a bios mod would it do good to download the latest bios and install that? I'm all for going genuine at this point but I won't be able to do that for another month or so. Its a hassle to buy a new disk, reformat, and transfer all my data along the way. I have too many hard drives on this bad boy for my own good. What would you recommend doing short term to keep this guy solid for a bit longer?

On a side note, I have a genuine version of Avira Internet Security. I run scans daily with that and with malware bytes. I also keep a close eye on my msconfig to make sure nothing fishy is going on. Security wise I think I'm alright but I do see your concern.

 

[tom982]

Hi Joystik,

Take a look here for more information:

System Locked Pre-installation - Wikipedia, the free encyclopedia

The SLP table they mention is the SLIC table.

Basically, OEM activation relies on two things, an OEM product key and a SLIC table. Together, they contain all of the data your computer needs to activate. The loader that your friend has used has injected a Gigabyte SLIC table into your BIOS and it has also forced Windows to use an Acer product key to form your counterfeit license.

Downloading and installing the latest BIOS will make your system light up with Windows not genuine errors so it's probably best holding off doing that until you have a genuine retail disc to do a clean install with.

I'll get back to you with where to go from here

Tom

 

[koolkat77]

If you are overclocking any hardware, STOP. Reset any changed values back to default.

Avira causes BSOD's on some systems. Please remove it using its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

We recommended Microsoft Security Essentials from a strict BSOD perspective.

• Microsoft Security Essentials, Free antivirus for windows
• Malwarebytes Anti-Malware Free
• Good and Free system security combination

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Use the System File Checker tool (SFC.exe) to determine which file is causing the issue, and then replace the file.

To do this, follow these steps:

1. Open an elevated command prompt. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
2. At the command prompt, type the following command, and then press ENTER: sfc /scannow
   The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Follow this:

If you have an SSD, make sure the following are up to date:

• SSD firmware
• BIOS Version
• Chipset Drivers
• Hard disk controller drivers/SATA drivers
• If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Download and install Revo Uninstaller free from here: Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Start Menu\Programs\GIGABYTE\ET6	Public:Start Menu\Programs\GIGABYTE\ET6	Public

Opt for "Advanced Mode" and uninstall the software (also delete the leftover registry entries) then, reinstall the latest version available from the mfg website or a good source like filehippo.com

Install latest drivers for your video card:

Image name: atikmdag.sys
Timestamp:        Wed Jul 04 11:16:13 2012

Method:

• Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to the software. Uninstall or change a program
• Tutorial: Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program> http://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html
• Download AMD Catalyst Drivers 13.1 Vista 64 - FileHippo.com

Check your hard drive(s) for errors by running chkdsk:

• Check your hard disk for errors
• http://www.sevenforums.com/tutorials/433-disk-check.html

Heat:
- blow out all vents with canned air (DO NOT use a vacuum cleaner or an air compressor, they can damage the components).
- ensure that the fan comes on and is blowing air out of the vent (may not happen at startup, but should happen after using it for a while).

For monitoring heat of the system, use Speccy or HWMonitor:

• Speccy System Information
• HWMonitor

Upload a screenshot of your hard disk using CrystalDiskInfo:

• CrystalDiskInfo Standard Edition
• How to Upload and Post a Screenshot and File in Seven Forums

Make a hard drive test from the hard drive manufacturers website:

• Hard Drive Diagnostic Procedure

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

   Note

Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.

   Information

Errors are sometimes found after 8 passes.

   Warning

Memtest can even take 20 passes to find one error. If you have time continue memtest till 20 passes

   Tip

Do this test overnight, before going to bed.

Let us know the results.

 

[Joystik]

Thank you for the information, I will try the above steps and get back to you.

Happy Easter

 

[Joystik]

I installed the latest ATI Radeon drivers which was the Catalyst control panel 13.1 and ran several passes on sfc /scannow. Sometimes my computer screen would entirely freeze for about 10 seconds but it does not do that anymore. I even provoked my computer by doing strenuous tasks that used to trip it up and it has not even frozen on me. It's been a few hours so lets hope I dont jynx it.

Before posting this thread I made sure my amd overdrive was disabled and my bios was on optimized defaults, so that part was already taken care of. As far as Avira is concerned, I think i'll keep it because i'm already paying and doesnt seem to be causing me issues, knock on wood.

Thank you everyone for your help, I'll post back here if (god forbid) it acts up again.

 

[koolkat77]

Hope it works for you.

Good luck

 

[koolkat77]

Hi..just a follow up

Have the BSODs occurred after your last post?