Bsod - msahci.sys- kmode exception not handled

[dimitris21]

Hello,

Ive run into this BSOD today and i can't figure out if it is the RAM or one of the disks.
Ive included the DM Log collector zip and also the minidump created, zipped as well.

I run memtest on windows for 3 hours(testing 7GB out of the 8GB total), then ran the default test of memtest on BIOS for an hour and nothing there(though i do plan to let the passmark extended memory test during the night).
Using the Seagate Seatools i checked the related HD;s for errors -used the SANDISK utility for its related disks, and the WD diagnostics for the rest of the disks with no errors.

So, either due to tighter timings on RAM, or a controller error, or bad sectors on disks(didnt run extended tests on the disks yet since most are 1 TB and 2 TB so that would take a few days).

Just thought maybe you could tell from the errors if there is a clear indication of what caused the BSOD.

Thank you,
Dimitris

 

[dimitris21]

Im uploading one more minidump since driver verifier crashed as soon as the desktop appeared so im attaching that file here as well.

 

[axe0]

Your report states that you are using a Non Genuine copy of software
This forum's Rules clearly state that help will not be provided to those using Non genuine Software.

Rule 4
No piracy or discussion of piracy allowed at all. Such as software, music, videos and other intellectual property violations (e.g. downloading youtube videos locally etc) - it is forum policy that no help shall be given to people who knowingly steal software or services.

One of the main reasons for this is that the act of pirating software will inevitably change the working of software and make investigation and repair impossible. Please install a legitimate copy of the software and if you are still experiencing the issue we will be pleased to assist - No further assistance will be provided until we are satisfied that the software is genuine.

 

[dimitris21]

I have sent you a private message regarding the non-legit copy of windows 7 that you mentioned.
So, im reposting the DM log file and a zip of all the minidumps which took place since i enabled the driver verifier.(DM log file cannot collect the minidumps from my pc since i have changed the default location of minidumps)

 

[axe0]

Please post the report of Windows Genuine and Activation Issue Posting Instruction

 

[axe0]

When did you buy the new key? Did you perform a clean install?

The new report shows a different license than the first one..

 

[dimitris21]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JKQ6W-F3RMQ-6HW9Y
Windows Product Key Hash: vEBvVHiwF9akGNjJfnMjOaJLsJs=
Windows Product ID: 00426-OEM-9154385-05268
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {15091A40-5876-428F-B69D-B7151025EA98}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_rtm.101119-1850
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{15091A40-5876-428F-B69D-B7151025EA98}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-6HW9Y</PKey><PID>00426-OEM-9154385-05268</PID><PIDType>3</PIDType><SID>S-1-5-21-419267100-454025937-329535280</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>X48-DQ6</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F8i</Version><SMBIOSVersion major="2" minor="4"/><Date>20100930000000.000000+000</Date></BIOS><HWID>70B93607018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GTB Standard Time(GMT+02:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>GBT   </OEMID><OEMTableID>GBTUACPI</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: cfb3e52c-d707-4861-af51-11b27ee6169c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00182-543-805268-02-1032-7601.0000-0372018
Installation ID: 011463881384363810712063249111730626283296579380832921
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 6HW9Y
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 2/6/2018 4:50:10 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 1:18:2018 01:04
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NAAAAAIABAABAAEAAAABAAAAAgABAAEAln3i+18cnGhC1zrswo8IhS7pXFEAeYDXtNNMWA==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			GBT   		GBTUACPI
  FACP			GBT   		GBTUACPI
  HPET			GBT   		GBTUACPI
  MCFG			GBT   		GBTUACPI
  SLIC			GBT   		GBTUACPI

 

[dimitris21]

i have it since 2013, it's an OEM license for both 32 and 64 bit
- no i did not do a clean install, i had done a reinstallation of W7 prior to posting my first thread
with the hope that since SFC found no corrupt files in my system, a reinstallation would help in the crashes.
I removed also several tweaking programs, like the ones from tweaking.com etc, which may have caused some issues, instead of fixinng them, plus there were some malware which i removed

 

[axe0]

Please don't PM me anymore about the report or anything regarding the Windows license, just post it in this thread.

Update Windows as a first priority.

 

[dimitris21]

yeah sorry for the second message, i had forgotten to send the original message in coded form

 

[axe0]

Could you post the log of the program that removed the malware.

 

[dimitris21]

I used several including malwarebytes antimalware, KVRT,TDSS,superantispyware and amiti antivirus
atm i still have superantispyware,amiti and KVRT so ill see if their logs are still there

 

[dimitris21]

i have all the logs from superantispyware which are in *.sdb form, one report from KVRT in *.klr.enc1 form. The reports from malwarebytes and TDSS are not there because after i finished with the removal process i removed both software as well using REVO uninstaller.

 

[axe0]

SAS logs are very likely cookies.

Could you make screenshot(s) of the items KVRT found and post them.

 

[dimitris21]

Well i am attaching the file of KVRT, because i have tried to read the file but to no success, maybe you know of a way to read that file, or maybe KVRT has another tool for reading those trace files it reports through their software? Though the file is from 2/2/18, and im not sure if it is before or after the removal, but in any case it is the only report from it that remains inside its folder. The resta are after 2/2/18 so surely they are after the reinstallation of W7

 

[axe0]

I looked up how to post the KVRT logs and as it uses a different extension the easiest way to read the logs is by moving the log file into the folder of the tool. Though, I have just done so but can only see when scans were started and finished and nothing more. No other details are shown, any found stuff and what actions were taken are not visible.

If you could make screenshots of the quarantine, or the log itself (more than the start and end time) and post it, that would be appreciated.

 

[dimitris21]

Well one thing i hadnt really checked was the PSU since it was less than 1 month old. Turns out the reading on the +12v rail showed LL using a PSU tester on friday, so i RMA'd EVGA, and surprisingly they immediately dispatched a new one before even sending the faulty one to them so +1 to EVGA . Will let you know as soon as i got the new one installed

 

[axe0]

Keep me posted.

Also, please provide the screenshot(s) requested about KVRT just to see how severe the infections were.