Intermittent BSODs almost daily

XRuecian · 27 Oct 2016

For a few months now, my computer has been BSODing almost everyday. It seems to be worse when gaming, and almost all heavy games will either crash after a random amount of time, or cause my computer to BSOD.
I was here a few months ago with this same issue but it never got resolved.

My computer also often fails to boot from a cold boot several times (sometimes i have to turn my computer on over 30+ times before it will boot.) And i get the beep error that: Video Could Not Be Initialized.

However, i have removed my video card and attempted to boot with the onboard video instead, and the boot problem still persists, so i have reason to believe it is not my video card causing this problem.

I also installed a new Power supply about a month ago, the BSODs continued.

I have already installed new drivers for almost everything including video, bios, network card.

None of the bluescreen errors seem to point at anything suspect, every bluescreen error is different and nothing stands out as what could be causing it.

I have ran several HD tests and all of them came back good.

Unless there is some driver causing this that i cannot put my finger on, the only two suspects left is either a failing motherboard, or memory. Though i have tried booting my computer with each of my ram sticks and each in a different slot, and the problem persisted.

torchwood · 27 Oct 2016

Hi Vincent,
Did this start after you (tried to) removed malware.

I can see numerous entries in your event log that point to the fact it has either left remnants, or is still present.

please run this tool, copy/paste the output, as you appear to be using an OEM key on a retail motherboard
http://go.microsoft.com/fwlink/?LinkID=52012

Roy

XRuecian · 27 Oct 2016

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-Y8YYF-QW76D-P7WWW
Windows Product Key Hash: dOCo0wklOjGk4pDF/6OROr+KsaU=
Windows Product ID: 00359-OEM-8703737-07229
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {471E6BAA-4B42-44DB-AFFD-349FACF81EBD}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_ldr.160930-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{471E6BAA-4B42-44DB-AFFD-349FACF81EBD}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-P7WWW</PKey><PID>00359-OEM-8703737-07229</PID><PIDType>3</PIDType><SID>S-1-5-21-3781841701-2807359987-157192960</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7697</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.2</Version><SMBIOSVersion major="2" minor="7"/><Date>20110927000000.000000+000</Date></BIOS><HWID>5D463907018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-037-307229-02-1033-7601.0000-0132012
Installation ID: 013946198422083272751741107504945300814813743854613030
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: P7WWW
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 10/27/2016 9:23:52 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:4:2016 09:02
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MgAAAAEABAABAAEAAAACAAAAAQABAAEAln2KSt6ygphu1kg37vvmi6X93miDJiMVAGo=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            A M I         GMCH945.
  SSDT            AMD           POWERNOW
  SSDT            AMD           POWERNOW
  BGRT            ALASKA        A M I

There is the results.
I haven't had to remove any malware in quite a while. I do scans fairly often and haven't seen any of the most common indicators of malware on my computer.

As for the OEM Key, i would love to understand that myself, as i built my own computer and installed a copy of windows myself onto it.

I just checked the Windows Product Key from the sticker from the copy of windows i purchased and it matches the same key in those results.

If i can recall correctly, i did get an error once telling me that my copy of windows was not genuine (It is genuine). But the error went away after i restarted my computer.

torchwood · 28 Oct 2016

Hi Vincent,
Thats OK, its system builder.

From event log 27/10
the following.

Event[61683]:
Log Name: System
Source: Microsoft Antimalware
Date: 2016-10-27T11:17:59.000
Event ID: 1013
Task: N/A
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: Vincent
Description:
Microsoft Antimalware has removed history of malware and other potentially unwanted software.
Time: ?10/?12/?2016 11:17:58 AM
User: NT AUTHORITY\SYSTEM

The LMIGuardianSvc service failed to start due to the following error:
The system cannot find the file specified.

The NetBalancerService service failed to start due to the following error:
The system cannot find the file specified.

The server service was unable to recreate the share My Apps because the directory C:\ProgramData\BlueStacks\UserData\Library\My Apps no longer exists. Please run "net share My Apps /delete" to delete the share, or recreate the directory C:\ProgramData\BlueStacks\UserData\Library\My Apps.

Attention Axe0
Crash dump initialization failed!

from and for the above,

MSE found malware 12/10 AGAIN,

Please download and run
Malwarebytes free,(untick the trial offer, and in the dashboard enable rootkits)
Can you also run Eset on line, dissble MSE

Prior to scanning can you
Uninstall the 3 other programs they all appear to be having problems.

post results.

Roy

XRuecian · 29 Nov 2016

Sorry it has taken me so long to get back to this problem. I lost internet for a while and was not able to get back on to check the forum for a few weeks.
I will download Malwarebytes and run the scan you requested and post the results soon.

As for the three programs you want me to uninstall, i have already uninstalled those programs weeks ago. I am not sure why my computer is still attempting to run those services when i have already uninstalled them.

Not a single one of those programs shows up in my installed programs list, so i will probably have to find a way to remove the services manually?

XRuecian · 30 Nov 2016

Alright, the results of the Malwarebytes scan found 10 items and removed all 10.

Here is the log:

Code:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/29/2016
Scan Time: 12:39 PM
Logfile: Malwarebytes Scan Results.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.11.29.10
Rootkit Database: v2016.11.20.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Vincent

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 371053
Time Elapsed: 1 hr, 32 min, 32 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 9
Adware.1ClickDownload, HKLM\SOFTWARE\CLASSES\APPID\{C007DADD-132A-624C-088E-59EE6CF0711F}, , [7599a81e3d5d3303b589189017ea2ad6], 
Adware.1ClickDownload, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C007DADD-132A-624C-088E-59EE6CF0711F}, , [7599a81e3d5d3303b589189017ea2ad6], 
Adware.1ClickDownload, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{C007DADD-132A-624C-088E-59EE6CF0711F}, , [7599a81e3d5d3303b589189017ea2ad6], 
PUP.Optional.StormAlerts, HKLM\SOFTWARE\MICROSOFT\TRACING\StormAlerts_RASAPI32, , [a06e299de4b6c67077108c383bc7cc34], 
PUP.Optional.StormAlerts, HKLM\SOFTWARE\MICROSOFT\TRACING\StormAlerts_RASMANCS, , [d5397a4c5743ef47384fd6eefa08a35d], 
PUP.Optional.MyFreeze, HKLM\SOFTWARE\WOW6432NODE\Freeze.com, , [46c813b3d3c74fe7b6a21e75fd054bb5], 
PUP.Optional.1ClickDownload, HKU\S-1-5-21-3781841701-2807359987-157192960-1000\SOFTWARE\1ClickDownload, , [2ee052742278a98de8a2e09de41eee12], 
PUP.Optional.InstallCore, HKU\S-1-5-21-3781841701-2807359987-157192960-1000\SOFTWARE\InstallCore, , [3bd37056e6b43bfbdbf6424b43bf7e82], 
PUP.Optional.Spigot, HKU\S-1-5-21-3781841701-2807359987-157192960-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{66314E16-5ECF-4D60-B1BF-A29BF5D393AA}, , [aa6402c45149fc3a11285b414fb3ad53], 

Registry Values: 1
PUP.Optional.Spigot, HKU\S-1-5-21-3781841701-2807359987-157192960-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{66314E16-5ECF-4D60-B1BF-A29BF5D393AA}|URL, http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=714647&p={searchTerms}, , [aa6402c45149fc3a11285b414fb3ad53]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

And i also ran the ESET scan, and it found no threats.

torchwood · 30 Nov 2016

Hi Vincent,
Spigot was more than likely the MS detected malware, so thats good.

Now Axe0 will need to see a crash dump, the latest one please

Roy

XRuecian · 01 Dec 2016

I haven't had any bluescreens since i removed the malware, however, i do not think enough time has passed for me to be certain that anything is fixed. Sometimes the BSODs happen multiple times in one day, and sometimes it takes 2-3 days before i see one. It really depends on what kinds of stressful gaming i do. The more stressful the game, the more likely it seems to be to cause a BSOD.

I updated my initial post with a renewed log/dump collection.

XRuecian · 03 Dec 2016

had a few bluescreens since, so removing malware alone did not fix

**axe0** · 04 Dec 2016

Run the DM Log collector again and post it in your next reply.