CRITICAL_PROCESS_DIED No dump files

[whiskymac]

Hi all,

Looking for some help with a BSOD on a new laptop, manufacturer don't seem to be able to solve very easily!

50% of the time, when waking from sleep the laptop has BSOD with critical_process_died the only message. If I disable automatic reboot the blue screen page never goes beyond 0% on it gathering information process and there are no dump files despite checking they are enabled correctly.

Manufacturer sent drivers to try, requested event log files etc before eventually taking the machine back and swapping for a new one.

New one does exactly the same thing!

completed sfc /scannow, memory tests, everything that i can think of/have been suggested.

Thank you in advance!!

• System Manufacturer? PC Specialist
• Laptop or Desktop? Laptop
• Exact model number (if laptop, check label on bottom) Lafite 15.6
• OS ? (Windows 10, 8.1, 8, 7, Vista) Win 11
• x86 (32bit) or x64 (64bit)? x64
• What was original installed OS on system? 10 (for testing apparently) but they sell it with both
• Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? Pre-intsalled and updated via windows update
• Age of system? (hardware) 1 week
• Age of OS installation? 1 week
• Have you re-installed the OS? No - but did this on the original machine with no resolution
• Is driver verifier enabled or disabled? Currently enabled
• What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth) Windows security (have run a malwarebytes scan, but since uninstalled)
• Are you using proxy, vpn, ipfilters or similar software? No
• Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software) No
• Are you currently under/overclocking? Are there overclocking software installed on your system? No

Speccy link - http://speccy.piriform.com/results/0rBUK1mhnpa7YFmHuN1TEyY

Minitoolbox output:

Spoiler: Minitoolbox

MiniToolBox by Farbar Version: 13-05-2022
Ran by vicky (administrator) on 26-10-2022 at 21:11:39
Running from "C:\Users\vicky\Downloads"
Microsoft Windows 11 Home (X64)
Model: TN1-156M Manufacturer: PCSpecialist
Boot Mode: Normal
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================
Error: (10/26/2022 08:57:55 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/26/2022 08:55:54 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007139F
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/26/2022 08:55:54 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x8007139F
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/26/2022 08:45:10 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/26/2022 08:45:10 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/26/2022 08:45:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/26/2022 08:34:59 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/26/2022 08:34:58 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/26/2022 08:34:58 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: License Activation (slui.exe) failed with the following error code:
hr=0x803F7001
Command-line arguments:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2b1f36bb-c1cd-4306-bf5c-a0367c2d97d8;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/26/2022 08:27:05 PM) (Source: Microsoft-Windows-Perflib) (EventID: 1017) (User: NT AUTHORITY)
Description: Disabled performance counter data collection from the "Lsa" service because the performance counter library for that service has generated one or more errors. The errors that forced this action have been written to the application event log. Correct the errors before enabling the performance counters for this service.


System errors:
=============
Error: (10/26/2022 09:08:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%2153972227 = Unable to access a key.

Error: (10/26/2022 09:08:27 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: Event-ID 102

Error: (10/26/2022 08:55:03 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x8024001e9PLFNLNT3G5G-AppUp.IntelGraphicsExperience{c74ae4be-5db9-4120-8b45-43cbbf1b45c3}1{855e8a7c-ecb4-4ca3-b045-1dfa50104289}

Error: (10/26/2022 08:44:40 PM) (Source: volmgr) (EventID: 161) (User: )
Description: Dump file creation failed due to error during dump creation.

Error: (10/26/2022 08:44:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 20:34:46 on ‎26/‎10/‎2022 was unexpected.

Error: (10/26/2022 08:26:51 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error:
%%2153972227 = Unable to access a key.

Error: (10/26/2022 08:26:51 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: Event-ID 102

Error: (10/26/2022 07:47:00 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-J5KQJS5)
Description: Event-ID 10010

Error: (10/26/2022 07:27:34 PM) (Source: volmgr) (EventID: 161) (User: )
Description: Dump file creation failed due to error during dump creation.

Error: (10/26/2022 07:27:59 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 19:09:09 on ‎26/‎10/‎2022 was unexpected.


Windows Defender:
================Event[0]

Date: 2022-10-26 18:40:42
Description:
Microsoft Defender Antivirus has encountered an error trying to update security intelligence.
New security intelligence Version:
Previous security intelligence Version: 1.377.833.0
Update Source: Microsoft Update Server
Security intelligence Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.19700.3
Error code: 0x80240438
Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

CodeIntegrity Errors:
====================
Date: 2022-10-26 21:06:24
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2209.7-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_f04693f7250e7bbf\igd10iumd64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2022-10-26 20:35:01
Description:
Code Integrity determined that a process (\Device\HarddiskVolume4\ProgramData\Microsoft\Windows Defender\Platform\4.18.2209.7-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_c23c441e9ac49b14\igd10iumd64.dll that did not meet the Custom 3 / Antimalware signing level requirements.


=========================== Installed Programs ============================

3DMark (HKLM\...\{8140D6A0-AC8F-44D8-B716-8FB1D17F53A3}) (Version: 2.23.7457.0 - UL) Hidden
3DMark (HKLM-x32\...\{34b7cf57-c39b-46b2-bce1-743da33db278}) (Version: 2.23.7457.0 - UL)
Futuremark SystemInfo (HKLM-x32\...\{A05A1785-B718-47EF-9EE7-2F82F729D208}) (Version: 5.53.1130.0 - Futuremark)
Intel Driver && Support Assistant (HKLM-x32\...\{B9BD5D9C-F427-4277-89DB-3784197C77CF}) (Version: 22.6.42.2 - Intel) Hidden
Intel(R) Graphics Driver Software (HKLM-x32\...\{1fe0084f-3e2b-4ba9-a4a6-c33f56e7f886}) (Version: 3.11.1.0 - Intel) Hidden
Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{00000170-0220-1033-84C8-B8D95FA3C8C3}) (Version: 22.170.0.2 - Intel Corporation)
Intel® Driver & Support Assistant (HKLM-x32\...\{0e10d82e-ed40-4871-b388-0a3476f48295}) (Version: 22.6.42.2 - Intel)
Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation)
Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform)
Windows PC Health Check (HKLM\...\{6798C408-2636-448C-8AC6-F4E341102D27}) (Version: 3.6.2204.08001 - Microsoft Corporation)

Packages:
=========
Clipchamp -> C:\Program Files\WindowsApps\Clipchamp.Clipchamp_2.5.1.0_neutral__yxz26nhyzhsrt [2022-10-21] (Microsoft Corp.)
Intel® Graphics Command Center -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.3408.0_x64__8j3eq9eme6ctt [2022-10-26] (INTEL CORP) [Startup Task]
Microsoft Family -> C:\Program Files\WindowsApps\MicrosoftCorporationII.MicrosoftFamily_0.2.37.0_x64__8wekyb3d8bbwe [2022-10-26] (Microsoft Corp.)
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.14.9130.0_x64__8wekyb3d8bbwe [2022-10-20] (Microsoft Studios) [MS Ad]
ms-resource:APP_WINDOW_NAME -> C:\Program Files\WindowsApps\MicrosoftCorporationII.QuickAssist_2.0.9.0_x64__8wekyb3d8bbwe [2022-10-21] (Microsoft Corp.)
ms-resource:AppStoreName -> C:\Program Files\WindowsApps\Microsoft.RawImageExtension_2.1.32061.0_x64__8wekyb3d8bbwe [2022-10-21] (Microsoft Corporation)
ms-resource:AppxManifest_DisplayName -> C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy [2022-10-21] (Microsoft Corporation)
ms-resourceACKAGE_DISPLAY_NAME -> C:\Program Files\WindowsApps\AppUp.ThunderboltControlCenter_1.0.36.0_x64__8j3eq9eme6ctt [2022-10-26] (INTEL CORP)
ms-resourceroductPkgDisplayName -> C:\WINDOWS\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy [2022-10-26] (ms-resourceroductPublisherDisplayName)
Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.11.217.0_x64__dt26b99r8h8gj [2022-10-26] (Realtek Semiconductor Corp)

========================= Memory info: ===================================

Percentage of memory in use: 34%
Total physical RAM: 16183.3 MB
Available physical RAM: 10615 MB
Total Virtual: 32567.3 MB
Available Virtual: 26778.07 MB

========================= Partitions: =====================================

1 Drive c: (Windows) (Fixed) (Total:236.7 GB) (Free:153.2 GB) NTFS

========================= Users: ========================================

User accounts for \\DESKTOP-J5KQJS5

Administrator DefaultAccount Guest
vicky WDAGUtilityAccount

========================= Minidump Files ==================================

No minidump file found


**** End of log ****

 

[x BlueRobot]

A new machine should not be experiencing those issues, especially when they've claimed to have provided you a replacement. I've never even heard of PC Specialist yet I find it highly suspicious that Windows 10 was preinstalled for "testing" purposes. It seems possible that these may be refurbished Windows 10 machines which have been upgraded to Windows 11; possibly even on incompatible hardware.

Farbar Service Scanner
1. Download Farbar Service Scanner from here, and move it to the Desktop
2. Right-click on FSS.exe > Run as Administrator
3. Checkmark everything, and click Scan

4. Once it finishes, Notepad will open FSS.txt on your Desktop. Copy and paste everything in it in your next reply

 

[whiskymac]

The laptop is my wife's for her business, she has a really specific keyboard need and PC specialist actually have something that suits her. Her previous machine was also from them and has been really good - unfortunately she split a drink all over it and it died an early death.

The quality of the new machine is disappointing compared to the old one, and clearly the service isn't great so far either!

FSS Output:

Farbar Service Scanner Version: 13-08-2022 01
Ran by vicky (administrator) on 27-10-2022 at 14:48:07
Running from "C:\Users\vicky\Downloads"
Windows 10 Home (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============


Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is unreachable
Attempt to access Google.com returned error: Google.com is unreachable
Attempt to access Yahoo.com returned error: Yahoo.com is unreachable


Windows Firewall:
=============


Firewall Disabled Policy:
==================


System Restore:
============


System Restore Policy:
========================


Windows Security:
============


Windows Update:
============


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\Drivers\netbt.sys => File is digitally signed
C:\Windows\System32\Drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\afd.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\SecurityHealthService.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Windows\System32\usosvc.dll => File is digitally signed
C:\Windows\System32\WaaSMedicSvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

Thank you!

 

[x BlueRobot]

Thanks, what I'm most concerned about is that services with strange names like: Web Threat Defense User Service_d6a8c (webthreatdefusersvc_d6a8c) and a few others of the same name. It's going to be more difficult to diagnose the issue without the dump files - which are failing to be created for some reason - but I have seen security programs kill certain Windows processes before which results in the bugcheck code you're getting. Do you have any idea of what that service may belong to?

Let's try and get more information about the system using FRST:

FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated. Please also attach that along with the FRST.txt in your reply.

 

[whiskymac]

I've no idea what these could relate to unfortunately, the machine has an almost fresh install on it.

I guess my next task would be to do a fresh Win 11 install again, but I doubt it will have much of an effect as I did that on the previous machine.

Both FRST logs attached.

Thank you again!

 

[xilolee]

Hi!

Web Threat Defense Service (webthreatdefsvc) and Web Threat Defense User Service (webthreatdefusersvc) are Windows services (phishing protection).

 

[x BlueRobot]

@xilolee is there any reason why the user's has an odd suffix? My services do not have those appended to them.

Don't worry, it appears that one of them does.

Additionally, there appears to be a number of activation errors, @whiskymac could you please confirm that the system is actually activated correctly? Please open a command prompt window and then enter the following command:

slmgr /xpr

Please provide a screenshot of the dialog box which should open.

 

[whiskymac]

It is not activated - purely because we've had to transfer the digital license back to the old machine so my wife can work.

It was however fully activated on the previous new machine which had the same issues. I can activate Windows on this if you think it will make a difference but I'm pretty confident that shouldn't be an issue.

 

[x BlueRobot]

No that's fine; I would suggest contacting PC Specialist again because a new machine should not be having these issues. It's mostly likely going to be hardware related, typically Stop 0xEF and Stop 0xF4s are.

 

[whiskymac]

I'll get back on to them - was just hoping I could solve this without another return!

Thanks for all your help!

 

[x BlueRobot]

No problem, hopefully they'll give you a working machine!

 

[ubuysa]

I know PC Specialist extremely well, I have them build all my PCs. They are a reliable and trustworthy system integrator, though as with any business sometimes issues fall through the cracks. They allow customers to buy a PC/laptop without an OS installed if they choose (a benefit to those with retail licenses). However, in order to soak test the PC in Q&A, they do install a copy of Windows to run their testing software - customers with a retail license can activate this with their product key if they wish (although we discourage that and recommend a new clean install). I have in the past tried to encourage PC Specialist to remove that copy of Windows before they ship because IMO if you're buying with no-OS you expect empty drives. I think they see that as an extra step (with a cost) that isn't beneficial.

One thing that leaps out at me from the original post is this...

Manufacturer sent drivers to try, requested event log files etc before eventually taking the machine back and swapping for a new one.

This means that two completely different PCs have had exactly the same issue? I don't believe in coincidences and so I'm forced to ask what you installed (hardware and software) after you received it? I don't mean to point fingers but this does look much more like something you have installed/connected...?