BSOD ndis.sys,0x000000D1, can only work in safe mode

[Fxgator]

Hello:
I operate on Windows 7 home premium 64 bit (desktop computer). I have looked through the forum but I do not see where I can get help if I can only work in safe mode. I was able to save a minidump to a thumbdrive and transfer to my laptop. This is attached. Since I cannot access the internet I can not download the diagnostic tool or update drivers, if this is the problem. Can someone help me with this. While I can work with technology I am by no means a technical expert, so i apologize in advance if i ask more questions or do not understand everything fully. Thank you in advance for your help.
Fernando

 

[Fxgator]

minidump did not attach..

sorry but I don't think I attached the minidump in my last post. Trying again.
Thanks,
fernando

 

[seanpeek]

I may have the same problem

I'm having the same problem that occurs every time during start up. I can access in safe mode, but not in safe mode with networking. This is what is being displayed on the BSOD:

DRIVER_IRQL_NOT_LESS_OR_EQUAL

STOP: 0x000000D1 (0x0000000000000010, 0x0000000000000002, 0x0000000000000000, 0xFFFFF880014E35D6)

ndis.sys - Address FFFF880014E35D6 base at FFFFF880014B5000. DateStamp 4a5bc184

I really appreciate any help.

 

[koolkat77]

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

@ seanpeek, please create a new thread for yourself.

 

[Fxgator]

Koolkat help for BSOD

Kookat do you know of any solution to my problem?
Thank you,
Fernando

 

[koolkat77]

You need to post the files following the instructions link.

 

[Fxgator]

Koolkat77 follow up

Koolkat77
Thanks for the reply. I can not run the diagnostic tool on my desktop because I can not access the Internet in safe mode, which is the only way I can work on it. I tried to follow the instructions but can not run that program. Any other suggestions would be appreciated. Are you able to see the mini dump I posted?
Thanks again,
Fernando

 

[koolkat77]

There are no attachments on any of your posts. Please scroll up and recheck.

 

[Fxgator]

DMP file

KoolKat77:
I see why I have not been able to post the minidump file because it has an extension of .dmp, which is not allowed. Sorry to bother with this but is there a way of getting around this so I can post. Would it ruin the file if I saved as a different extention? I am just not technical enough to know how to solve this upload problem. It seems the system automatically gives the dump this extension.
Thank you again for your quick responses.
fernando

 

[Arc]

Fernando, you zip the .dmp, and then upload it.

And, you may use safe mode with networking. Boot into http://www.sevenforums.com/tutorials/666-advanced-boot-options.html, it is there, the option next to safe mode.

 

[Fxgator]

Thanks Arc - I tried that already and it sends me straight to the BSOD and then reboots again and at that point i just go into safe mode. I managed to save the memory dump in a .rar extension and have attached it below. Hopefully you or someone can help me with this.
I appreciate you and KoolKat77's help.
Thanks,
Fernando

 

[Anthony]

Probably caused by : athrx.sys Atheros network adapter driver Update your network adapter driver:ATHEROS drivers for Microsoft Windows (Atheros?????)

 

[Fxgator]

Anthony - I saved the download to a flash drive from my laptop and then tried to install on my infected desktop. It won't let me do it because I can't access the network. I can only run in safe mode. I try to run in safe mode plus network but the PC goes right into the BSOD and then reboots. Any other suggestions? Were you able to look at the attachment I sent in my previous e-mail.
Thanks again for your help.
Fernando
​

 

[Fxgator]

Hi - Is there anyone out there that can help me with this issue. I attached the minidump in my previous posts. As I stated earlier, I cannot access the internet because safe mode with network just sends me to the same BSOD. Thanks to anyone who can help.
Fernando

 

[Fxgator]

I saved the download of Atheros (see previous post from Anthony) to a flash drive from my laptop and then tried to install on my infected desktop. It won't let me do it because I can't access the network. I can only run in safe mode. I try to run in safe mode plus network but the PC goes right into the BSOD and then reboots. Any other suggestions? Thanks again for your help.
Fernando

 

[Arc]

Fernando, you uninstall all your network adapter drivers from the Device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "Network Adapters" by clicking on the triangle in front of it.
5. Select one item under it, right click, uninstall.
6. Continue the process of step 5 for all items under "Network Adapters"
7. Now restart the computer. At restart, windows will auto configure the appropriate system driver.

Can you use network now? or it is still crashes? let us know.

 

[Fxgator]

Thank you very much Arc. I am now able to work in network mode. Attached is the data dump using your diagnostics tool. Please let me know what you find out.
Thanks again for your help.
Fernando

 

[Arc]

How old the last crash is?

Is it after you have done the driver uninstallation?

If not, dont worry. You are safe now from Atheros network adapter driver caused crashes.
---------------------------------------
For your information .....

fffff880`031bea28  fffff880`03ebd297Unable to load image \SystemRoot\system32\DRIVERS\athrx.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for athrx.sys
*** ERROR: Module load completed but symbols could not be loaded for athrx.sys
 athrx+0x2e297[/COLOR]

lmvm athrx
start             end                 module name
fffff880`03e8f000 fffff880`03ffd000   athrx    T (no symbols)           
    Loaded symbol image file: athrx.sys
    Image path: \SystemRoot\system32\DRIVERS\athrx.sys
   [COLOR=Red] Image name: athrx.sys
    Timestamp:        Sat Jun 06 03:40:06 2009[/COLOR] (4A2997BE)
    CheckSum:         0016EDA1
    ImageSize:        0016E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

So you can easily realize how old it was.
============================================
But, what made your network blocked? I have the answer.
View attachment 239054

fffff880`031be0d8  fffff880`01369857Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
 mfehidk[/COLOR]+0x72857

McAfee

Uninstall McAfee using McAfee removal tool, and install Microsoft Security Essentials - Microsoft Windows.

let us know the results.

 

[Fxgator]

Arc - you are a genius. It seems I am back up and running after I uninstalled the drivers. Also updated them with the latest versions. I will go ahead and delete McAfee. What is the best way to do a complete system backup so I have the latest in case this happens again? Is there a company or site you would recommend.
Once again I appreciate everyone's help with this.
Thank you,
Fernando

 

[Arc]

Fernando, I am no genius... those are very common info actually

For backup, we use either of these two ways ....

• http://www.sevenforums.com/tutorials/663-backup-complete-computer-create-image-backup.html
• http://www.sevenforums.com/tutorials/73828-imaging-free-macrium.html

You choose which one suits you.

And, as far as you are not uninstalling McAfee, you are not safe, ok ?

So, let us know it it troubles again.