BSOD at random intervals arthr.sys?

jtkm · 06 Apr 2013

Specified COMMAND search directory bad
Microsoft(R) Windows DOS
(C)Copyright Microsoft Corp 1990-2001.

C>DIR C:\Windows\CMD.EXE /s
Volume in drive C has no label.
Volume Serial Number is 2600-6E21

Directory of C:\Windows\System32

11/20/2010 05:17 AM 302,592 cmd.exe
1 File(s) 302,592 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-commandprompt_31bf3856ad36
4e35_6.1.7600.16385_none_8ae31ce07bb01ee0

07/13/2009 06:14 PM 301,568 cmd.exe
1 File(s) 301,568 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-commandprompt_31bf3856ad36
4e35_6.1.7601.17514_none_8d1430a8789ea27a

11/20/2010 05:17 AM 302,592 cmd.exe
1 File(s) 302,592 bytes

Total Files Listed:
3 File(s) 906,752 bytes
0 Dir(s) 8,034,160,640 bytes free

-------------------------------------------------
WHICH file do you want properties of? the command prompt?
if it is this: x86_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7600.16385_none_8ae31ce07bb01ee0

when I click properties I have a choice of general/sharing/security/versions/bladdity blah. I dont' see anything that says 'details'.

NoelDP · 06 Apr 2013

You definitely have something VERY strange going on in that system.
I think you would be best advised to go to the specialist malware forum - the date and size of the CMD.EXE file is correct for SP1, but the file you are running when using a Command Prompt is definitely not Windows 7, let alone SP1 (it looks more like an Win9x one)

jtkm · 06 Apr 2013

Wow, that's very odd. I truly thank you for all your help.

When I open a thread over at the malware forum, how would you suggest I state the problem?

NoelDP · 07 Apr 2013

in addition to whatever their stickies request by way of data, add a link to this thread, and a brief note of any other odd symptom you may be getting.

Anak · 07 Apr 2013

Update to jtkm's System Security forum thread: Old version of command prompt and cannot run scannow

OP has link to this thread.

jtkm · 14 Apr 2013

OK I was redirected to some help with malware, which has been removed

I still get random BSOD with athr.sys (the original problem remains).

any other ideas?

x BlueRobot · 14 Apr 2013

Blue Screen of Death (BSOD) Posting Instructions

jtkm · 14 Apr 2013

Here it is.

x BlueRobot · 15 Apr 2013

Code:

BugCheck 1000007E, {c0000005, 8725e038, 922efc34, 922ef810}

Probably caused by : athur.sys ( athur+26038 )

Code:

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control

An error occurred within a thread which couldn't be handled.

Code:

0: kd> !error c0000005
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s

This seems to be either a corrupted driver referencing invalid memory addresses, or these addresses have been corrupted, for example bad RAM or failing hard-drive.

Code:

0: kd> lmvm athur
start    end        module name
87238000 873bc000   athur    T (no symbols)           
    Loaded symbol image file: athur.sys
    Image path: athur.sys
    Image name: athur.sys
    Timestamp:        Wed Apr 20 11:05:59 2011 (4DAEB007)
    CheckSum:         0018C064
    ImageSize:        00184000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This is part of the driver package for your Atheros Wireless NIC driver, it seems you updated it earlier (BSOD at random intervals arthr.sys?), let's see what the System Security Guru's have to say, since they seem to what to test for possible driver corruption.

Code:

0: kd> lmvm igdkmd32
start    end        module name
8ca10000 8cf19000   igdkmd32 T (no symbols)           
    Loaded symbol image file: igdkmd32.sys
    Image path: igdkmd32.sys
    Image name: igdkmd32.sys
    Timestamp:        Wed Sep 23 20:18:09 2009 (4ABA7471)
    CheckSum:         004A45D4
    ImageSize:        00509000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your onboard Intel graphics driver is rather outdated and causing a few problems, please update the driver from here:

Intel Support Page

jtkm · 15 Apr 2013

OK I had updated the Intel graphics driver after I ran the scan last night so
hopefully it's all good. new zipfile attached.

I also re-installed athr.sys last night
but will run scan (as suggested on the other thread Old version of command prompt and cannot run scannow
and post results there.