Page fault in non paged area obn48d7.sys

Yes. (See my first paragraph.)

Plus, it passed an extended memory test.

dbrunton: That's just what I did while I was waiting for someone to respond. In C:\Windows\system32\drivers the obn48d7.sys file and a folder named DISDN were both dated 9/6/2009. I gave both of them the prefix "old."

Now when the computer boots, the BSOD is a STOP: 0x0000007b (etc.).

I'm going to restore the DISDN and retry. Same BSOD.

Should I actually move it?

Okay, I moved it, and now I can boot to a desktop with nothing on it but wallpaper. Can bring up Task Manager.

Press Ctrl+Alt+delete to bring task manager got to file->new task (run)->explorer (Press OK)

Also check that shell is set to explorer

Open task manager->new task->regedit
go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

And check that it is set to explorer

when u navigate to on the right side u will see shell double click on it and set it to Explorer.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Pankusareen, I tried explorer.exe in task manager, but nothing happened. I tried regedit and it wouldn't load. I started a book disk and edited the registry, changing the key from

explorer.exe rundll32.exe tapi nfo beforeglav

to

explorer.exe

Still nothing on the desktop

can you try sfc /scannow

can you post the minidump ?   rename it to **.txt
find it in c:\windows\minidumps
you can access it with a live cd, like knoppix or bartPe:
ftp://ftp.kernel.org/pub/dist/knoppix/KNOPPIX_V6.0.1CD-2009-02-08-EN.iso      Knoppix      
www.nu2.nu/pebuilder/                                     BartPe

Thanks for all your suggestions. I haven't had a chance to try them yet, but I wanted to add that a McAfee splash screen comes up before Windows loads to a blank desktop, and I apologize for not mentioning this earlier.

Is there a way to disable McAfee services from a boot disk?

Also, it came to me overnight, that the computer is behaving the way one did when a guy ran Combofix with his antivirus on, and ended up not being able to load his user profile--I remember the fix had something to do with the userinit file.

How do I do sfc scannow from task manager?

Orangutang: I pulled the drive and scanned it with Symantec Endpoint Protection, but I'm trying to create a boot disk that will let me run MBAM from it.

Nobus: I'll post the minidump.

Clarification: Nothing seems to run from task manager, so I'm not sure how to get sfc /scannow to work.

Here's the minidump, dated 9/10/09

impossiblke to open the dump; have you got others?

Orangutang: Seems like the computer needs to be able to boot to see the autoruns.

Here's another dump file.

I got autoruns working through the Boot CD (copied it to the C drive from a USB drive). What an great tool!

Here's the file--and thanks to everyone who has responded.

That's not going to work from your CD because it'll just give you the AutoRuns log for your CD, not the harddrive. Try http://www.freedrweb.com/livecd/

Orangutang: Yep, you're right. (Just tried autoruns on my own computer, though, and really like the jump feature.)

Have been trying, but can't burn today's Dr. Web to CD--yesterday's.iso works, though, so I'm trying it now.

One run with Dr. Web and it still won't load the desktop, but it does load McAfee, which seems to be finding malware.

Will try another Dr. Web scan.

Nobus, I thought of that, but I don't have an XP media center disk, and the owner can find all of his Dell system disks EXCEPT the OS.

Scanned several times with Dr. Web, and no change--still can't get past wallpaper.

Okay, I'm really stuck. The restore partition (Control/F11) doesn't work either.

I'm not sure what else to do. Maybe try:
http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk/

Also, http://www.free-av.com/en/products/12/avira_antivir_rescue_system.html

Orangutang: Thanks, but I bugged the guy again, and he miraculously found his disk. I'm going to try a repair install.

let's see if that helps...

UPDATE: I did the repair install and can now boot to the desktop. A series of DOS windows opened up with desote, and a quick search says the computer is still infected. Since no programs would load, I used fixexe.exe, loaded MBAM, HJT, CCleaner, and used them.

Since I have no confidence that the drive is clean, should I run Combofix?

(Also, IE gives me an error, "rundll32.exe The parameter is incorrect," so I may need to reinstall IE7---IE8 would not install.)

Nobus, thanks again for looking at the dump files.

try spybot also :      http://www.download.com/3000-8022-10122137.html

and yes combofix is good too !

Combo fix seems to have worked. I'm going to let it run for a while and see if anything pops up.

Thanks for all your help.