BSOD - tried lots fixes need help (sorry 4 accidental future date post )

[robm]

I have put in time and really need help.
I think the problem is probably simple and maybe i am just over analyzing.

Problem:
---------
BSOD just after the "starting windows" banner screen disappears and before

the win login popup window appears.

ERROR: stop A (E1441404, FF, 0, 8044E6E9 )
base address 0x80400000 ntoskrnl.exe

started almost suddendly about 1-2 weeks after installing 8 or so updates

plus the new windows updater software from Microsoft update site.

The only other oddity, around time of BSODs was a unwanted toolbar added to

IE6 when i accidentally hit close on one of those ??fake?? "MS: Your
computer

has a security error that needs repair" if you hit any button other close

window at top it pops up another web site advertising some security software

then next time i open IE6 i have a NON IE6 toolbar, i had to un-install some

software to loose it, then 2-3 boots later i get BSODs


Events :
--------
The following Event Logs started at first BSOD.
That is they never appear in Events until just before the BSODs

The browser has forced an election on network

\Device\NetBT_Tcpip_{8EC5923E-EAAF-43AC-B18C-B4E4583D01E0} because a master

browser was stopped.

Application popup: expwnd: exp.exe - Application Error : The instruction at
"0x00000000" referenced memory at "0x00000000". The memory could not be
"read".

Application popup: expwnd: wintask.exe - Application Error : The instruction
at "0x00000000" referenced memory at "0x00000000". The memory could not be
"read".

The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050

(0xa018f000, 0x00000000, 0x819e50fc, 0x00000000). Microsoft Windows 2000

[v15.2195]. A dump was saved in: C:\WINNT\Minidump\Mini092205-01.dmp.

Application popup: SysFader: Explorer.EXE - Application Error : The
instruction at "0x02529522" referenced memory at "0x00000000". The memory
could not be "read".

now this is the error:

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a

(0xe1441410, 0x000000ff, 0x00000000, 0x8044f9b4). Microsoft Windows 2000

[v15.2195]. A full dump was not saved.


Machine:
---------
k7s5a, AMD 2200+, crucial ddr 2x256, fsb 133/133,
BIOS settings no change prior to BSODs for months
have modified to attempt fixes

Fixes tried:
-------------
1. Last known good config (same BSOD)
2. Boots Safe Mode with networking (no BSOD)
3. Run Memtest v3.0 and v3.1 (ran clean through all tests)
4. Try various boot options
e.g. /SOS /bootlog /noguiboot /basevideo

Tried Boot normal mode with /SOS (BSOD in generic btkrnl)

5. Boot safe mode try run Symantec antivirus ( clean )
6. Boot safe mode delete recent Win updates/fixes (same BSOD)
7. Boot safe mode try to find a device problem (no problems)
8. Boot safe mode try to install debugger to get stack trace
(can't install KD windbg in safe mode)
9. run "dumpchk -v memory.dmp" to try and associate driver with
address (out of driver range)
10. tried tips from MS-Q137367 article
delete all Run and RunOnce entries (no luck same BSOD)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

11. tried to do a repair from W2K bootable CD (no change same BSOD)
12. tried to install SP4 in safe mode ( no change same BSOD)


help would be appreciated
R

 

[Dave Patrick]

Both of these are trojans best to blow it all away and start a clean
install. To do a clean install, either boot the Windows 2000 install CD-Rom
or setup disks. The set of four install disks can be created from your
Windows 2000 CD-Rom; change to the \bootdisk directory on the CD-Rom and
execute makeboot.exe (from dos) or makebt32.exe (from 32 bit) and follow the
prompts.

When you get to the point, delete the existing NTFS and or other partitions
found. After you delete the partition(s) abort the install, then again
restart the pc booting the CD-Rom or setup disks to avoid unexpected drive
letter assignments with your new install.

Be sure to apply these to your new install before connecting to any network.

http://download.microsoft.com/download/E/6/A/E6A04295-D2A8-40D0-A0C5-241BFECD095E/W2KSP4_EN.EXE
http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
<snip>
| Application popup: expwnd: exp.exe - Application Error : The instruction
at
| "0x00000000" referenced memory at "0x00000000". The memory could not be
| "read".
|
| Application popup: expwnd: wintask.exe - Application Error : The
instruction
| at "0x00000000" referenced memory at "0x00000000". The memory could not be
| "read".
<snip>

 

[robm]

not what i wanted to read, but thanks for help
at least i can stop wasting time tryng to un-break the computer

Thanks again,
R

Both of these are trojans best to blow it all away and start a clean
install. To do a clean install, either boot the Windows 2000 install CD-Rom
or setup disks. The set of four install disks can be created from your
Windows 2000 CD-Rom; change to the \bootdisk directory on the CD-Rom and
execute makeboot.exe (from dos) or makebt32.exe (from 32 bit) and follow the
prompts.

When you get to the point, delete the existing NTFS and or other partitions
found. After you delete the partition(s) abort the install, then again
restart the pc booting the CD-Rom or setup disks to avoid unexpected drive
letter assignments with your new install.

Be sure to apply these to your new install before connecting to any network.http://download.microsoft.com/download/E/6/A/E6A04295-D2A8-40D0-A0C5-241BFECD095E/W2KSP4_EN.EXE
http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
<snip>
| Application popup: expwnd: exp.exe - Application Error : The instruction
at
| "0x00000000" referenced memory at "0x00000000". The memory could not be
| "read".
|
| Application popup: expwnd: wintask.exe - Application Error : The
instruction
| at "0x00000000" referenced memory at "0x00000000". The memory could not be
| "read".
<snip>

 

[Dave Patrick]

You're welcome.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| not what i wanted to read, but thanks for help
| at least i can stop wasting time tryng to un-break the computer
|
| Thanks again,
| R

 

[robm]

UPDATE on Fix

not really a fix , lucky, Found a BACUP COPY of the drive on the shelf from
5 months prior when having disk drive problems loaded up the new drive and
copied over all the 5 months of new data, installs etc.

so lesson learned backup, backup, backups. So i finnaly setup up an
scheduled incremental backup that sholud reduce the downtime and data loss
down to within a day should (?? when ??) another problem occurs.

so i only re-learned this lesson 3 times before actually doing something
about

HTH somebody
R

I have put in time and really need help.
I think the problem is probably simple and maybe i am just over analyzing.

Problem:

[snip]