Solved BSOD at random intervals arthr.sys?

[jtkm]

Specified COMMAND search directory bad
Microsoft(R) Windows DOS
(C)Copyright Microsoft Corp 1990-2001.

C>DIR C:\Windows\CMD.EXE /s
Volume in drive C has no label.
Volume Serial Number is 2600-6E21

Directory of C:\Windows\System32

11/20/2010 05:17 AM 302,592 cmd.exe
1 File(s) 302,592 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-commandprompt_31bf3856ad36
4e35_6.1.7600.16385_none_8ae31ce07bb01ee0

07/13/2009 06:14 PM 301,568 cmd.exe
1 File(s) 301,568 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-commandprompt_31bf3856ad36
4e35_6.1.7601.17514_none_8d1430a8789ea27a

11/20/2010 05:17 AM 302,592 cmd.exe
1 File(s) 302,592 bytes

Total Files Listed:
3 File(s) 906,752 bytes
0 Dir(s) 8,034,160,640 bytes free

-------------------------------------------------
WHICH file do you want properties of? the command prompt?
if it is this: x86_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7600.16385_none_8ae31ce07bb01ee0

when I click properties I have a choice of general/sharing/security/versions/bladdity blah. I dont' see anything that says 'details'.

 

[NoelDP]

You definitely have something VERY strange going on in that system.
I think you would be best advised to go to the specialist malware forum - the date and size of the CMD.EXE file is correct for SP1, but the file you are running when using a Command Prompt is definitely not Windows 7, let alone SP1 (it looks more like an Win9x one)

 

[jtkm]

Wow, that's very odd. I truly thank you for all your help.

When I open a thread over at the malware forum, how would you suggest I state the problem?

 

[NoelDP]

in addition to whatever their stickies request by way of data, add a link to this thread, and a brief note of any other odd symptom you may be getting.

 

[Anak]

Update to jtkm's System Security forum thread: http://www.sevenforums.com/system-s...nd-prompt-cannot-run-scannow.html#post2355530

OP has link to this thread.

 

[jtkm]

OK I was redirected to some help with malware, which has been removed

I still get random BSOD with athr.sys (the original problem remains).

any other ideas?

 

[x BlueRobot]

http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[jtkm]

Here it is.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1000007E[/COLOR], {[COLOR="SeaGreen"]c0000005[/COLOR], 8725e038, 922efc34, 922ef810}

Probably caused by : [COLOR="red"]athur.sys[/COLOR] ( athur+26038 )

Usual causes:  Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control

An error occurred within a thread which couldn't be handled.

0: kd> [COLOR="seagreen"]!error c0000005[/COLOR]
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s

This seems to be either a corrupted driver referencing invalid memory addresses, or these addresses have been corrupted, for example bad RAM or failing hard-drive.

0: kd> [COLOR="SeaGreen"]lmvm athur[/COLOR]
start    end        module name
87238000 873bc000   athur    T (no symbols)           
    Loaded symbol image file: athur.sys
    Image path: athur.sys
    Image name: athur.sys
    Timestamp:        [COLOR="Red"]Wed Apr 20 11:05:59 2011[/COLOR] (4DAEB007)
    CheckSum:         0018C064
    ImageSize:        00184000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

This is part of the driver package for your Atheros Wireless NIC driver, it seems you updated it earlier (http://www.sevenforums.com/bsod-help-support/283233-bsod-random-intervals-arthr-sys.html#post2332987), let's see what the System Security Guru's have to say, since they seem to what to test for possible driver corruption.

0: kd> [COLOR="SeaGreen"]lmvm igdkmd32[/COLOR]
start    end        module name
8ca10000 8cf19000   igdkmd32 T (no symbols)           
    Loaded symbol image file: igdkmd32.sys
    Image path: igdkmd32.sys
    Image name: igdkmd32.sys
    Timestamp:        [COLOR="Red"]Wed Sep 23 20:18:09 2009[/COLOR] (4ABA7471)
    CheckSum:         004A45D4
    ImageSize:        00509000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your onboard Intel graphics driver is rather outdated and causing a few problems, please update the driver from here:

• Intel Support Page

 

[jtkm]

OK I had updated the Intel graphics driver after I ran the scan last night so
hopefully it's all good. new zipfile attached.

I also re-installed athr.sys last night
but will run scan (as suggested on the other thread http://www.sevenforums.com/system-s...-prompt-cannot-run-scannow-3.html#post2365027
and post results there.

 

[x BlueRobot]

Okay good, and the folder is exactly the same as the 14th folder, did we do a hard-drive test and memory test?

 

[jtkm]

Nope.

 

[jtkm]

both Windows Mem Diagnostic and Windows check disk come out clean.

 

[VistaKing]

Jtkm

Use the memtest instead of Windows Memory test

:ar: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[x BlueRobot]

Use this procedure for the hard-drive to be tested throughly, as well as, MemTest86+ as suggested by VistaKing.

Run some hard-drive diagnostics and follow these steps:

• Hard Drive Diagnostic Procedure

Find your hard-drive manufacturer and run their tests.

Additional Tests:

• SeaTools for DOS | Seagate
• CrystalDiskInfo - Software - Crystal Dew World

Post a screenshot of Crystal Disk Info summary:

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

If you have an SSD, make sure the following are up to date:

• SSD firmware
• BIOS Version
• Chipset Drivers
• Hard disk controller drivers/SATA drivers
• If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Check for any file system errors and bad sectors using Option #2 of:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Use this command with Disk Check:

chkdsk C: /f /r

 

[jtkm]

1) "Run some hard-drive diagnostics and follow these steps: Hard Drive Diagnostic Procedure"

I don't have an external CD/DVD drive. I don't have an internal one either.
Can I run this off a USB stick or no?


2) Check for any file system errors and bad sectors using Option #2 of:
I checked these options from the windows screen before I ran chkdisk.
Running them from the command prompt is different?


3) Ran MEMtest overnight. 6 passess and change. All clear.

 

[x BlueRobot]

It's best to run Memtest86+ for 7-8 passes, and you could try this http://www.sevenforums.com/tutorials/31541-windows-7-usb-dvd-download-tool.html, download the .ISO file for the selected test.

For the Seagate SeaTools - boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

 

[jtkm]

Sorry, BlueRobot, But the page of tools is all gobbledegook to me.
I don't have a SSD drive. It's a Western Digital WDC WD1600BEVT=60zct1.

I can't identify a correct WD HDD on this page: WD Support / Downloads / SATA & SAS

I don't understand which thing I am supposed to DL for the tools when I read this: can you or someone be specific and cut out the direct link and include it in your reply? Or is there more than one tool I'm supposed to try? (see below)

Western Digital - I've had issues with running this from a CD/DVD - try the Hitachi DFT (on older/IDE systems) or the Seagate SeaTools (on newer/SATA systems) - WD Support / Downloads / SATA & SAS Download the Diag504fCD.iso file on this page: WD Support / Downloads / Legacy Internal / WD Raptor
I have hosted a zipped copy of the ISO that I use (at work) here: http://www.box.net/shared/gl0fifqgj4
http://cid-5a5378e587a744c3.skydrive.live.com/self.aspx/.Public/W-D%5E_DLG%5E_504f.zip

Seagate - http://knowledge.seagate.com/articles/en_US/FAQ/201271en (using the Graphical Interface of Seatools for DOS). Download the Seatools for DOS ISO CD-ROM Image from this link: http://www.seagate.com/support/internal-hard-drives/consumer-electronics/ld25-series/seatools-dos-master/
​

(Direct download here:

http://www.seagate.com/staticfiles/support/seatools/SeaToolsDOS223ALL.ISO​

)

 

[x BlueRobot]

Western Digital (should be correct): WD Support / Downloads / Mobile & AV-25 / WD Blue

WD1600BEVT-60ZCT1 should be your model number. Download and run the Data Lifeguard Diagnostic.

Seagate Tools (select Windows - more simple): SeaTools | Seagate

The guide for the Seagate Tools is on the right hand side of the page, it's a .PDF document which can just read or print off.

 

[jtkm]

Ran Wdig and Seagate tools and passed all tests. Will try to remember to start memtest tonight so it can run all night but it did complete 6+ passes and was clear.