Solved BSOD at random intervals arthr.sys?

[jtkm]

I get random BSOD's indicating a problem with arthr.sys

In addition to the wireless card in the notebook I also use a USB TP Link TL722N antenna. Landlord lets me use her wireless but the signal is weak.

Any help VERY appreciated!

 

[Arc]

It is crashed by the TP-LINK 150Mbps Wireless Lite N Adapter driver.

Unable to load image \SystemRoot\system32\DRIVERS\athur.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for athur.sys
*** ERROR: Module load completed but symbols could not be loaded for athur.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, b164eca8, aa14ac60, aa14a840}

Probably caused by : athur.sys ( athur+24ca8 )

Followup: MachineOwner
---------

And that is very old.

b162a000 b179d000   athur    T (no symbols)           
    Loaded symbol image file: athur.sys
    Image path: \SystemRoot\system32\DRIVERS\athur.sys
    Image name: athur.sys
    Timestamp:        Tue Jan 05 08:50:06 2010 (4B42AFE6)
    CheckSum:         00179489
    ImageSize:        00173000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Download - Welcome to TP-LINK

Also update:

• Network Connect VPN software by Juniper Networks: Support - Juniper Networks
• Broadcom 802.11g WLAN: Search in HP's site.
• Atheros AR8132 PCI-E Fast Ethernet Controller: ATHEROS Network drivers for Windows

Free up the startup.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Uninstaqll Panda Antivirus products, as you are getting network blockage. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Uninstall these crapware:

Start Menu\Programs\Free Registry Cleaner 
Start Menu\Programs\Free Registry Defrag

These may ruin the system beyond repair.

Let us know the results.

@ x BlueRobot : Very nice and thorough analysis, my friend
And, the model is HP Mini 110-1100 I guess

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1000007E[/COLOR], {c0000005, b0a4bca8, 90713c60, 90713840}

Probably caused by : [COLOR="red"]athur.sys[/COLOR] ( athur+24ca8 )

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control

b0a27000 b0b9a000   athur     [COLOR="red"]Tue Jan 05 03:20:06 2010[/COLOR] (4B42AFE6)

A thread raised a exception in which the Windows error handler was not able to catch.

I can't find the model of your netbook on HP's support site, are you sure you have correctly entered the information?

Use this tool to help you:

Update your System Specifications with Speccy, and then copy this information into your System Specifications: Go to your UserCP, and then select Edit System Spec in the left pane. Copy the information from Speccy into the required fields. These System Specifications will then follow your every post.

Remove:

Start Menu\Programs\Free Registry Cleaner
Start Menu\Programs\Free Registry Defrag
Start Menu\Programs\Memory Mechanic

Windows 7 doesn't require any programs which make changes to the operating system and registry, these programs tend to cause problems by modifying and deleting files.

• http://www.sevenforums.com/performa...registry-cleaner-tests-why-not-use-one-2.html

Remove:

Start Menu\Programs\Panda Cloud Antivirus

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

:info: Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system.

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

 

[jtkm]

Thanks ARC and Blue Robot!

I upgraded the drivers, deleted a few programs, ran a quick scan for Anti-Malware Bites and installed MSE.

For some reason I get weird messages saying MSE can't update? And another one saying
that the Firewall is not on the default settings but it won't let me change anything.

and yes - it's a Mini 110-1025NR. It's my 'throw 'n' go' computer.

 

[x BlueRobot]

This may help with restoring Windows Firewall to it's default settings:

• http://www.sevenforums.com/tutorials/525-windows-firewall-restore-default-settings.html

Try updating MSE through Windows Update instead:

Start rb: > Type: Windows Update > Optional > Install Updates

 

[jtkm]

I'll try windows update.

As for the Firewall, I can't (apparently) touch any of the settings dunno why -
I get an error message that 'some settings can't be changed' when I try to put it back to the default.

The error code is 0x80070424 - both for the failed MSE update and when attempting to make any changes to the Firewall.

 

[jtkm]

see above

 

[x BlueRobot]

Scan for any malware:

• http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html
• Anti-rootkit utility TDSSKiller

Use this Support Article created by Microsoft for additional help:

• Error 0x80070424 ocurs when you use Windows Update, Microsoft Update, or Windows Firewall

 

[jtkm]

Well I have scanned for Malware and again, I cannot turn on Windows Firewall and the computer does not appear to have WIndows update. Still get the same error. Is there a way to 'add' Windows update to a computer? Or a folder I can look in to see if it is still installed?

 

[Arc]

Try it: http://www.sevenforums.com/tutorials/91738-windows-update-reset.html

 

[jtkm]

No luck yet

OK, I tried the updates at the links you so kindly suggested. No luck.

the message I get is

"Wupdate cannot check for updates because
the service is not running. Please restart."

Well. Already did that. Sigh.

 

[x BlueRobot]

Scan for any missing, modified or corrupted protected Windows files with:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[jtkm]

I do not have a 'scan as administrator' option although I am, as far as i can tell, logged in as the admin.

 

[Arc]

Post a report following http://www.sevenforums.com/windows-...-update-posting-instructions.html#post2181354

 

[jtkm]

I followed the updating instructions. Installation failed:

"The specified service does not exist as an installed service. 0x80070424"

 

[NoelDP]

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[jtkm]

Here it is.

 

[NoelDP]

You have had a ZeroAccess infection!
Are you sure that it's been cleaned fully??

The following services have gone AWOL....
MPSSVC
BFE
BITS
WUAUSERV
WINDEFEND
SHAREDACCESS
IPHLPSVC

If we're lucky, this will fix them....


Please download http://kb.eset-la.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe and save it to your desktop.
Double-click ServicesRepair.exe
If security notifications appear, click
Continue or Run and then click Yes when asked if you want to proceed.
Once the tool has finished, you will be prompted to restart your computer.
Click Yes to restart.
Then run the FarBar scanner again, and post the new results

 

[jtkm]

Here it is:

Farbar Service Scanner Version: 03-03-2013
Ran by BuddhaT00 (administrator) on 03-04-2013 at 07:12:53
Running from "C:\Users\BuddhaT00\Downloads"
Windows 7 Starter Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

 

[NoelDP]

Great - with any luck things should be working again -
check Windows Update first - does it scan for updates OK?
Does it find any?
UNtick all but the oldest update found, and try installing that one.
what happens?