crash

Hi
I had a crash. A BSOD.

I have the settings set to give a minidump. I don't know if it should be set to kernel? but I have it set to minidump.

And I ran dm log collector.exe but it opened a cmd prompt that said "Error Admin Rights needed" "please right -click on this .bat file and then click 'run as administrator. Press any key to continue" But there is no bat file. I press any key and it exits.

I ran sf diagonstic tool. clicked grab all. closed it.

At some point it said something about Host copied successfully. Refershing system information and says msinfo32 file copied . and others and made a folder on my desktop. I see that has the .dmp files. I have compressed it and attached it.

I have run a system restore and a repair but no luck. I can get into safe mode but not safe mode with networking. I tried replacing ndis.sys from another machine(though the other machine is 64bit), but the same problem.

Thanks

Are you an administrator on your PC, you must be one to run the tool.
Then right click and run it as administrator.

Do not try to alter drivers manually, especially when you don't know what you are doing! ndis.sys is a built in system driver for your network interface controller. Do not replace it at all, especially when you are running different versions of windows like you (32bit and 64bit)!

The file you uploaded is the DM Log Collector, we don't need it. You need to upload the zip folder created on your desktop when you run the DM Log Collector.

Hi.
I did run it as admin but still got that error. But I tried the BAT file (dm_log_collector.bat) BSOD ntkrlnpa.exe win32k.sysand the bat ran. I will attach the result.
So that's the DM log and in the earlier post is the SF one.

Thanks

Remove your Atheros network driver and re install it from here:

Drivers for Atheros AR9285 and Windows 7

By looking at your System Specs this particular file is for Windows 7 32bit which you say you are using.

I am unable to remove the driver from device manager. I right click it and choose uninstall and the drive manager refreshes and it's still there. I right click and choose disable. Restart, go into safe mode, try uninstalling it again it still won't uninstall.
I'm going into normal mode and still the same BSOD. Back into safe mode with those drivers in device manager. They are associated with virtualbox. But when I try to uninstall virtualbox it crashes explorer, explorer restarts.

solved. I posted the solution posted here though could include it here too if that helps - BSOD - NDIS.sys "driver_irql_not_less_or_equal"

Out of interest Doctor44, how did you know it was Atheros? Can you post the command you did on the minidumps to see that?

Thanks

Windbg found that the Atheros driver was responsible.
You can look at the callstack and see if a driver is making a lot of calls then it looks very suspicious.
Now it was very obvious your atheros driver was responsible but you shouldn't always trust the callstack when this message appears.

Code:

WARNING: Stack unwind information not available. Following frames may be wrong.

Now in the callstack you can see this:

Code:

WARNING: Stack unwind information not available. Following frames may be wrong.
88e2bc38 8cc2263f 855491f8 88e2bc50 8cc27cac athr+0x3a5c1
88e2bc44 8cc27cac 85549028 88e2bc68 8cc27c5f athr+0x1f63f
88e2bc50 8cc27c5f 85549028 c000009a 85549028 athr+0x24cac
88e2bc68 8cc1a13e 84bc4a50 88e2bc7c 00000001 athr+0x24c5f
88e2bc88 8cc1369c 84bc4a50 00000001 88e2bca0 athr+0x1713e
88e2bcc4 8cc13598 84bc4a50 88e4f38c 84bc4a50 athr+0x1069c
88e2bcdc 880282ca 84bc4a50 84b8df08 88e2bd00 athr+0x10598
88e2bcec 81c24460 84aad028 84b8df08 83896930 ndis!ndisDispatchIoWorkItem+0xf (FPO: [Non-Fpo])
88e2bd00 81a8caab 84b8dee0 00000000 83896930 nt!IopProcessWorkItem+0x23
88e2bd50 81c18f5e 00000000 a9b42021 00000000 nt!ExpWorkerThread+0x10d
88e2bd90 81ac0219 81a8c99e 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

If I start to find difficulties finding the driver responsible I ask for a Kernel Memory Dump as it gives us a much more helpful insight as to what was happening in Kernel Mode at the time of the crash.
This dump is normally the most helpful as a bugcheck is caused in kernel mode.

I hope that's answered your question.
Anything else don't hesitate to ask :)

By the way there was little point in posting something there as that thread is 3 years old and every issue is different so one solution for one case doesn't necessarily work for another.
Of course there as basic troubleshooting steps that can help.