Did the thing I was told to do only to keep getting BSOD

[torchwood]

Hi
Follow this tutorial it will show you how to upload the details i need.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

Roy

 

[noegh555]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 51
Cached Online Validation Code: N/A, hr = 0x8007043c
Windows Product Key: *****-*****-V9488-FGM44-2C9T3
Windows Product Key Hash: rmk1OjF0iZq7gQoRmEcpnJHr0oc=
Windows Product ID: 00426-OEM-8992662-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.k01
ID: {4604DEB9-10A6-4C36-85E4-B80A7E10B532}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.151019-1254
TTS Error: T:20160121140622446-
Validation Diagnostic: FCEE394C-69-8007007e_1BC0EFCD-167-8007007e_1BC0EFCD-142-8007007e_78155E4D-138-8007007e
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: N/A, hr=0x80070002
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\systemcpl.dll[Hr = 0x80070002]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{4604DEB9-10A6-4C36-85E4-B80A7E10B532}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.k01</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-2C9T3</PKey><PID>00426-OEM-8992662-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-1160648790-1161686888-1700727312</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion g6 Notebook PC      </Model></SYSTEM><BIOS><Manufacturer>Insyde</Manufacturer><Version>F.63</Version><SMBIOSVersion major="2" minor="7"/><Date>20120322000000.000000+000</Date></BIOS><HWID>C4893E07018400FE</HWID><UserLCID>0C09</UserLCID><SystemLCID>0412</SystemLCID><TimeZone>오스트레일리아 동부 표준시(GMT+10:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
오류 텍스트를 표시하려면 Microsoft Windows 7 비코어 버전을 실행하는 컴퓨터에서 'slui.exe 0x2a 0x8007007E'을(를) 실행하십시오.
오류: 0x8007007E 

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAIAAgABAAIAAAAAAAAAAgABAAEAeqh6NncWXtQ2eSitANgQSIQJErU4Ui5z

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            HP            1670    
  FACP            HPQOEM        SLIC-MPC
  HPET            HP            1670    
  BOOT            HP            1670    
  MCFG            HP            1670    
  ASF!            HP            1670    
  SLIC            HPQOEM        SLIC-MPC
  SSDT            HP            1670    
  ASPT            HP            1670    
  SSDT            HP            1670    
  SSDT            HP            1670    
  SSDT            HP            1670

 

[noegh555]

오류 텍스트를 표시하려면 Microsoft Windows 7 비코어 버전을 실행하는 컴퓨터에서 'slui.exe 0x2a 0x8007007E'을(를) 실행하십시오. 오류: 0x8007007E
It means "To display the error text on the computer that runs the non-core version of Windows 7 and run that slui.exe...thing

 

[DonnaB]

Ah ha! I think I may have found what is causing the BSOD. You have 2 anti-viruses running. See below:

These service files belong to AVG
S3 AvgAMPS; C:\Program Files\AVG\Av\avgamps.exe [636312 2016-06-09] (AVG Technologies CZ, s.r.o.)
S2 avgfws; C:\Program Files\AVG\Av\avgfws.exe [1622040 2016-06-09] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files\AVG\Av\avgidsagent.exe [4036128 2016-06-09] (AVG Technologies CZ, s.r.o.)
S2 avgsvc; C:\Program Files\AVG\Framework\Common\avgsvcx.exe [890128 2016-05-18] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\Av\avgwdsvcx.exe [592856 2016-06-09] (AVG Technologies CZ, s.r.o.)

The following service files belong to AhnLab Online Security

S2 V3 Service; C:\Program Files\AhnLab\V3Lite30\ASDSvc.exe [589280 2016-01-12] (AhnLab, Inc.)

The real-time protection of two or more antivirus programs may conflict with each other and cause the following:

• False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
• Conflicts: Your system may lock up due to both products attempting to access the same file at the same time.
• Performance: More that one antivirus will cause your PC to become slow and it may even crash or blue screen.
• Less protection: Two antivirus trying to scan the same file may interfere with the process and allow a malicious file onto the computer without notice to you.

The problem is, I don't see AVG in the Installed Programs list in the Addition.txt log. I am assuming that you uninstalled it then installed AhnLab Online Security.

If you plan on keeping AhnLab Online Security, please follow the instructions here. You will need to scroll down to C) to download the AVG Remover tool to remove all the residual files left behind by AVG after uninstall. The instructions on how to use the tools are right there under step C).

Let me know if you have any problems with the tool. I have another way we can remove those files if need be...

 

[noegh555]

Thanks for clarifying.

Is there any further investigation after that?

 

[noegh555]

I have uninstalled AhnLab (which was installed since the start)

 

[DonnaB]

Thanks for clarifying.

Is there any further investigation after that?

Yes. Since I did not see AVG in the Installed Programs list and you uninstalled AhnLab, I would like to see another FRST log to verify that no residual files are left ebhind and that you do have an active AV installed.

You can boot to normal mode now without any BSOD's, right? If not, you can do this in Safe Mode:

• Right click on the FRST.exe and choose Run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Under Optional Scan place a checkmark in the box for Addition.txt to ensure it creates that 2nd log.
• Press Scan button.
• Please attach both logs in your next reply.

Make sure to include both the FRST.txt and the Addition.txt logs...

 

[noegh555]

I may need to redo it as I need to restart to make it work

 

[noegh555]

Is there still a way left to go? This is unfinished right?

Updated files are attached

Still on safe mode as the BSOD still occurs

 

[DonnaB]

Is there still a way left to go? This is unfinished right?

Updated files are attached

Still on safe mode as the BSOD still occurs

Yes. We still have some work to do here. It appears that both AV's are still causing issues:

From the Addidition.txt below:

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: V3 Lite (Enabled - Up to date) {245BED03-C71D-8636-4445-5E4BF720084E}
AV: AVG Internet Security (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: V3 Lite (Enabled - Up to date) {9F3A0CE7-E127-89B8-7EF5-65398CA742F3}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
FW: AVG Internet Security (Disabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}

It is going to take some time to go through the logs to see what the problem is so I can provide instructions.

We need to get your computer stablized to determine if the multiple AV's is the soile cause of the BSOD's. It would be fruitless to try anything else till the AV situation is corrected.

I know it is getting late in your part of the world, so if you don't mind, while you are resting I can prepare a proper fix without feeling rushed.

Are you ok with that?

 

[DonnaB]

I may need to redo it as I need to restart to make it work

Did you reboot the computer after you uninstalled AhnLab? That could be why it is still showing in the log..

 

[noegh555]

Yes and I reuploaded the txt files

 

[torchwood]

The Mgadiag report is confirming that it is indeed the Korean version
- Highly unlikely to have been shipped with that computer-.
Now there are a couple of other Non standard replies in it
The major ones

Tampered Time Stamp, from a file installed 21 jan 2016
A file mismatch in the file data section - systemcpl
Activex and the associated Admin file is not Registered
(to clear the above KB971033 needs to be installed)
The SLIC table is not showing the Bios Type

Install KB971033
rerun the report, (in normal mode)

Roy

 

[torchwood]

Can you also confirm
Where the install media came from.
Was the original OS W8.

Roy

 

[noegh555]

Look I cannot access normal mode at all

 

[noegh555]

And for what I can remember it never had W8

 

[torchwood]

Easy enough to check if its W7, theres a sticker on the bottom, or in the battery compartment
It will state HP OEM W7 Ultimate and also a back-up key.
If its W8 there will be a small MS logo sticker.

Roy
2016-06-18 12:14 - 2009-07-14 12:37 - 00000000 ____D C:\Windows\registration
This indicates first use(Vista)

 

[noegh555]

But what can I do when I cannot access normal mode? I know there is a key under the laptop but can't do anything about it

 

[noegh555]

Let me ask again - What can I do now?

Do I need normal mode to get me back

---

Hello,

I have asked about my BSOD before, and thankfully people are politely helping me by asking for files that display all the processes on this laptop.
But, here are my conditions right now - As my condition seem like the only one.

- I CANNOT boot normal mode AT ALL - Most instructions avaliable seem to talk about things I CANNOT do right now
- No search functions - Cannot use start to search up files
- What happened was I was using a virus infected lapton with no way to download MBAM, So I did in safe mode plus disk cleanup and after that I cannot boot it into normal mode
- WINDOWS 7 is unlicenced plus the loss of functions - So even if I find my code I cannot do anything about it - And I cannot find a way to reactivate using safe mode
- As said, this problem has occured after using safe mode to resolve malwares

So I feel like the only option is to reinstall - If I cannot find sources outside that meet my criteria, it feels toast.

 

[torchwood]

Safe mode is not for daily usage, as not all drivers are loaded.

As you have been infected and we CANNOT determine exactly what type of malware it is, the SAFEST and recommended solution is a clean re-install.

Make a copy of your personal files first, but scan the recovery media BEFORE you re-install it.

You do have a couple of options, a factory reset from the recovery drive, If you have a set of recovery discs use them, or contact HP for a new set, or lastly purchase a new W7 ultimate
(note W7 ultimate is the most pirated OS and quite hard to come by, if you do purchase a set check the vendor first).
For the first 2 options you will have to use the back-up key on the bottom of your laptop.
This key may well be Korean version specific, and as part of the initial validation it will look for a geographical identifyer in your system, so you may have to complete activation by phone.

Roy