[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now


BSOF - Error plz HELP

Posted on 2009-02-16
Medium Priority
Last Modified: 2012-05-06
Hi Experts,

I am getting the BSOD all of a sudden and then my computers turns off after 1 mins. I looked on event viewer and I get the following error:

Error code 00000019, parameter1 00000020, parameter2 e1ad5a48, parameter3 e1ad5ee8, parameter4 0c94040a.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The signs before the BSOD appears is when the mouse stops responding and then screen flickers and then error is displayed.

Any idea how to resolve this, it has happened over 3 times in the space of 3-4 hours!

Any help will be appreciated.


Question by:introlux
  • 3
  • 2
LVL 59

Expert Comment

ID: 23650820
Go to this web page and click on the link for STOP error 19, and you will see the following paragraph (see the actual page in order to click on the embedded links):


0x00000019: BAD_POOL_HEADER
(Click to consult the online MSDN article.)
A pool header issue is a problem with Windows memory allocation. Device driver issues are probably the msot common, but this can have diverse causes including bad sectors or other disk write issues, and problems with some routers. (By theory, RAM problems would be suspect for memory pool issues, but I havent been able to confirm this as a cause.)
STOP: 0x00000019 error message on Windows Server 2003 {KB 892260} Server 2003 (NTFS problem corrected in current Service Pack)
Error message when a Delayed Write Failure event is reported in Windows Server 2003: Stop 0x00000019 - BAD_POOL_HEADER or Stop 0xCD PAGE_FAULT_BEYOND_END_OF_ALLOCATION {KB 925259} Server 2003 (driver issue; hotfix available)
When backing up to Clarion storage in a SAN environment, Windows Server 2003 may stop responding after restart {KB 884585} Server 2003 (caused by adding more than 20 mount points during the backup; hotfix available)
When trying to control a Systems Management Server 2003 client from a remote location, Stop error on SMS 2003 client {KB 905795} SMS 2003 (driver issue)
LVL 35

Expert Comment

ID: 23652996
Please check your c:\windows\ folder for a subfolder \minidumps. Are there any *.dmp files in there dating from the time that these BSODs occurred? Then rename them to *.txt and upload them here as attachments (3-4 should suffice).

If you can't find any *.dmp files, you must configure your system to save them on crashing.
Right-click on My Computer > Properties > Advanced > Startup and Recovery > Settings > Write debugging information > Minidump.
Then let it crash again, and go for the dump file.

Author Comment

ID: 23657594

I have followed what you have advised me. I have attached the files. There are 4 files in total.

I have renamed them to .txt as you have requested.

Thanks in advance for the help.


Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 35

Accepted Solution

torimar earned 2000 total points
ID: 23658400
Looking at the first dump file I thought there was a quick and easy fix, but then the other dump files displayed a different STOP error and bug check code (which is the one that you reported).

I appended the analysis.

As you can see, an unspecific DRIVER_FAULT error is detected - while running the MSN messenger, it seems. Comparing the results of the first dump file analysis, I have reason to suspect that the faulty device driver could be your graphics driver.

Hence here's what you could do:

1. Disable the MSN Messenger
(Start > Run > type: msconfig.exe > Startup) or even uninstall it (Control Panel > Add/Remove programs > Windows Components).
Use Pidgin (http://www.pidgin.im) or Trillian Basic (http://www.ceruleanstudios.com) instead.
This may give you less BSODs, but fight the symptoms only, not the cause.

2. Update your Nvidia drivers
Some versions of the Nvidia drivers are notorious for causing all sorts of havoc. Not always newest is best. If you already run the current version, or updating does not stop the BSODs, consider rolling back to an older but stable version that was working well with your system (maybe even the version of the drivers that came together with it).
Use DriverSweeper to get rid of your current drivers before rolling back:

3. Configure Microsoft's Watchdog system driver to not issue a bug check
In the following registry key:
create a REG_DWORD entry called 'DisableDebugCheck' and set its value to 1.

This will address the cause of the crash in the first minidump you uploaded.
LVL 35

Expert Comment

ID: 23658413
Here's the analysis of dump 2 to 4:

Symbol search path is: SRV*f:\tmpsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805535a0
Debug session time: Mon Feb 16 16:32:19.105 2009 (GMT+1)
System Uptime: 0 days 0:54:41.816
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, e7b4a8d8, e7b4aa60, c310207}
Probably caused by : win32k.sys ( win32k!HeavyFreePool+bb )
Followup: MachineOwner
kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e7b4a8d8, The pool entry we were looking for within the page.
Arg3: e7b4aa60, The next pool entry.
Arg4: 0c310207, (reserved)
Debugging Details:
BUGCHECK_STR:  0x19_20
POOL_ADDRESS:  e7b4a8d8 
PROCESS_NAME:  msnmsgr.exe
LAST_CONTROL_TRANSFER:  from 80544086 to 804f8c3f
9d978440 80544086 00000019 00000020 e7b4a8d8 nt!KeBugCheckEx+0x1b
9d978490 bf802b13 e7b4a8e0 00000000 9d9784cc nt!ExFreePoolWithTag+0x2a0
9d9784a0 bf8b9dfd e7b4a8e0 9d97851c 077b3460 win32k!HeavyFreePool+0xbb
9d9784cc bf8ba316 07791860 e7b4a8e0 fffffa60 win32k!AlphaScanLineBlend+0x194
9d978700 bf83bb8e e1937ad0 e1d94348 9d978730 win32k!EngAlphaBlend+0x313
9d9788fc 8053cbc8 3b011dd1 00000000 e1840f30 win32k!NtGdiAlphaBlend+0xb5b
9d9788fc 7c90eb94 3b011dd1 00000000 e1840f30 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006edc0 00000000 00000000 00000000 00000000 0x7c90eb94
bf802b13 5d              pop     ebp
SYMBOL_NAME:  win32k!HeavyFreePool+bb
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  win32k.sys
FAILURE_BUCKET_ID:  0x19_20_win32k!HeavyFreePool+bb
BUCKET_ID:  0x19_20_win32k!HeavyFreePool+bb
Followup: MachineOwner
kd> lmvm win32k
start    end        module name
bf800000 bf9c2a80   win32k     (pdb symbols)          f:\tmpsymbols\win32k.pdb\4B552356D04C4CBEA3026787EA4AEC192\win32k.pdb
    Loaded symbol image file: win32k.sys
    Mapped memory image file: f:\tmpsymbols\win32k.sys\47E0DF7D1c2a80\win32k.sys
    Image path: win32k.sys
    Image name: win32k.sys
    Timestamp:        Wed Mar 19 10:40:13 2008 (47E0DF7D)
    CheckSum:         001C3B31
    ImageSize:        001C2A80
    File version:     5.1.2600.3335
    Product version:  5.1.2600.3335
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0405.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Opera
ní systém Microsoft® Windows®
    InternalName:     win32k.sys
    OriginalFilename: win32k.sys
    ProductVersion:   5.1.2600.3335
    FileVersion:      5.1.2600.3335 (xpsp_sp2_qfe.080319-1242)
    FileDescription:  Multi-User Win32 Driver
    LegalCopyright:   © Microsoft Corporation. Vaechna práva vyhrazena.
kd> r
eax=ffdff13c ebx=e7b4a8d8 ecx=00000000 edx=00000031 esi=e7b4a8d8 edi=00000060
eip=804f8c3f esp=9d978428 ebp=9d978440 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
804f8c3f 5d              pop     ebp
kd> !pool e7b4a8d8
Pool page e7b4a8d8 region is Unknown
 e7b4a000 size:  290 previous size:    0  (Allocated)  Gla:
 e7b4a290 size:    8 previous size:  290  (Free)       b.e.
 e7b4a298 size:   18 previous size:    8  (Allocated)  Ntf0
 e7b4a2b0 size:   60 previous size:   18  (Allocated) Process: 89169b98
 e7b4a310 size:   28 previous size:   60  (Allocated)  NtFs
 e7b4a338 size:   80 previous size:   28  (Allocated)  FSim
 e7b4a3b8 size:    8 previous size:   80  (Free)       Ttfd
 e7b4a3c0 size:   18 previous size:    8  (Allocated)  Ntf0
 e7b4a3d8 size:  100 previous size:   18  (Allocated)  IoNm
 e7b4a4d8 size:    8 previous size:  100  (Free)       Gfnt
 e7b4a4e0 size:   d8 previous size:    8  (Allocated)  SrSC
 e7b4a5b8 size:   68 previous size:   d8  (Allocated)  Key  (Protected)
 e7b4a620 size:    8 previous size:   68  (Free)       CMVa
 e7b4a628 size:   28 previous size:    8  (Allocated)  CMNb (Protected)
 e7b4a650 size:  188 previous size:   28  (Allocated)  Gla5
 e7b4a7d8 size:    8 previous size:  188  (Free)       MmSt
 e7b4a7e0 size:   30 previous size:    8  (Allocated)  CMVa
 e7b4a810 size:   10 previous size:   30  (Free)       Toke
 e7b4a820 size:   80 previous size:   10  (Allocated)  FSim
 e7b4a8a0 size:   38 previous size:   80  (Free)       ObSq
*e7b4a8d8 size:  188 previous size:   38  (Allocated) *Galp
		Owning component : Unknown (update pooltag.txt)
 e7b4aa60 size:   80 previous size:  188  (Allocated)  FSim
 e7b4aae0 size:   28 previous size:   80  (Free)       Ttfd
 e7b4ab08 size:   30 previous size:   28  (Allocated)  CMVa
 e7b4ab38 size:   80 previous size:   30  (Allocated)  FSim
 e7b4abb8 size:    8 previous size:   80  (Free)       Ttfd
 e7b4abc0 size:   40 previous size:    8  (Allocated)  CMNb (Protected)
 e7b4ac00 size:   80 previous size:   40  (Allocated)  IoNm
 e7b4ac80 size:   40 previous size:   80  (Allocated)  CMDa
 e7b4acc0 size:  340 previous size:   40  (Allocated)  Ntff
kd> lmnt
start    end        module name
804d7000 806cdc80   nt       ntkrnlpa.exe Wed Feb 28 10:15:53 2007 (45E54849)
806ce000 806ee280   hal      hal.dll      Tue Nov 16 02:37:02 2004 (419959BE)
9d979000 9d9b9200   HTTP     HTTP.sys     Fri Mar 17 02:08:09 2006 (441A0BF9)
9d9ba000 9d9dc080   RDPWD    RDPWD.SYS    Fri Jun 10 01:43:42 2005 (42A8D42E)
9dc13000 9dc27400   wdmaud   wdmaud.sys   Wed Jun 14 11:17:03 2006 (448FD40F)
9dc60000 9dc6ed80   sysaudio sysaudio.sys Wed Aug 04 08:15:54 2004 (41107F1A)
9e038000 9e089480   srv      srv.sys      Mon Aug 14 14:00:40 2006 (44E065E8)
9e186000 9e188300   uphcleanhlp uphcleanhlp.sys Wed Apr 27 20:58:56 2005 (426FE0F0)
9e1a2000 9e1cdd80   mrxdav   mrxdav.sys   Tue Dec 18 10:51:33 2007 (47679825)
9ed05000 9ed25000   dump_SI3112r dump_SI3112r.sys Fri Aug 17 04:00:39 2007 (46C50147)
9ed25000 9ededa60   avg7core avg7core.sys Wed Oct 10 18:23:39 2007 (470CFC8B)
9f4a6000 9f4c7480   ipnat    ipnat.sys    Fri Apr 14 02:20:40 2006 (443EEAD8)
9f4c8000 9f537000   mrxsmb   mrxsmb.sys   Tue Jun 20 16:02:37 2006 (4497FFFD)
9f537000 9f561a00   rdbss    rdbss.sys    Thu Jun 15 11:35:00 2006 (449129C4)
9f562000 9f583c80   afd      afd.sys      Fri Jun 20 12:44:07 2008 (485B89F7)
9f584000 9f5abc00   netbt    netbt.sys    Wed Aug 04 08:14:36 2004 (41107ECC)
9f5ac000 9f604200   tcpip    tcpip.sys    Fri Jun 20 12:44:40 2008 (485B8A18)
9f605000 9f617400   ipsec    ipsec.sys    Wed Aug 04 08:14:27 2004 (41107EC3)
a5217000 a5225780   usbhub   usbhub.sys   Mon Oct 23 13:14:42 2006 (453CA422)
a5a37000 a5a46380   rspndr   rspndr.sys   Wed Nov 08 11:28:09 2006 (4551B139)
a5a67000 a5a76900   Cdfs     Cdfs.SYS     Wed Aug 04 08:14:09 2004 (41107EB1)
a5de4000 a5dec700   wanarp   wanarp.sys   Wed Aug 04 08:04:57 2004 (41107C89)
b10ed000 b10ef900   Dxapi    Dxapi.sys    Fri Aug 17 22:53:19 2001 (3B7D843F)
b10f9000 b10fbf80   mouhid   mouhid.sys   Fri Aug 17 22:47:57 2001 (3B7D82FD)
b15ea000 b15ec580   hidusb   hidusb.sys   Fri Aug 17 23:02:16 2001 (3B7D8658)
b15f6000 b15f9780   dump_scsiport dump_scsiport.sys Wed Aug 04 07:59:51 2004 (41107B57)
b183c000 b183f900   ndisuio  ndisuio.sys  Tue Aug 22 10:53:40 2006 (44EAC614)
b29cd000 b29d1500   watchdog watchdog.sys Wed Aug 04 08:07:32 2004 (41107D24)
b3bba000 b3bc0c80   avg7rsxp avg7rsxp.sys Tue Jan 30 16:08:42 2007 (45BF5F7A)
b5931000 b5933280   rasacd   rasacd.sys   Fri Aug 17 22:55:39 2001 (3B7D84CB)
b5961000 b5966500   TDTCP    TDTCP.SYS    Wed Aug 04 07:58:52 2004 (41107B1C)
b77b6000 b77bd880   Npfs     Npfs.SYS     Wed Aug 04 08:00:38 2004 (41107B86)
b77be000 b77c2a80   Msfs     Msfs.SYS     Wed Aug 04 08:00:37 2004 (41107B85)
b920f000 b9242180   update   update.sys   Thu Sep 02 00:27:22 2004 (41364CCA)
b9243000 b9273100   rdpdr    rdpdr.sys    Wed Aug 04 08:01:10 2004 (41107BA6)
b9274000 b928a680   ndiswan  ndiswan.sys  Wed Aug 04 08:14:30 2004 (41107EC6)
b928b000 b929e900   parport  parport.sys  Wed Aug 04 07:59:04 2004 (41107B28)
b929f000 b92c2a80   portcls  portcls.sys  Wed Jul 12 15:49:59 2006 (44B4FE07)
b92c3000 b94ef580   ALCXWDM  ALCXWDM.SYS  Tue Sep 21 13:53:11 2004 (41501627)
b94f0000 b9512680   ks       ks.sys       Wed Aug 04 08:15:20 2004 (41107EF8)
b9513000 b9536080   USBPORT  USBPORT.SYS  Mon Oct 23 13:14:41 2006 (453CA421)
b9537000 b9557600   b57xp32  b57xp32.sys  Fri Mar 18 01:30:08 2005 (423A2110)
b9558000 b956bf00   VIDEOPRT VIDEOPRT.SYS Thu Aug 03 16:02:07 2006 (44D201DF)
b956c000 b9b3f720   nv4_mini nv4_mini.sys Fri Aug 22 09:30:19 2008 (48AE6B0B)
b9ba0000 b9ba9480   NDProxy  NDProxy.SYS  Fri Aug 17 22:55:30 2001 (3B7D84C2)
ba56e000 ba570580   ndistapi ndistapi.sys Fri Aug 17 22:55:29 2001 (3B7D84C1)
ba576000 ba579c80   serenum  serenum.sys  Wed Aug 04 07:59:06 2004 (41107B2A)
ba57e000 ba580700   GEARAspiWDM GEARAspiWDM.sys Tue Apr 08 21:15:38 2008 (47FBC45A)
ba5b6000 ba5cfa80   Mup      Mup.sys      Fri Sep 23 03:26:18 2005 (433359BA)
ba5d0000 ba5fca80   NDIS     NDIS.sys     Wed Aug 04 08:14:27 2004 (41107EC3)
ba5fd000 ba689400   Ntfs     Ntfs.sys     Fri Feb 09 12:10:31 2007 (45CC56A7)
ba68a000 ba6a0780   KSecDD   KSecDD.sys   Wed Aug 04 07:59:45 2004 (41107B51)
ba6a1000 ba6b2f00   sr       sr.sys       Wed Aug 04 08:06:22 2004 (41107CDE)
ba6b3000 ba6d2700   fltMgr   fltMgr.sys   Mon Aug 21 11:43:31 2006 (44E98043)
ba6d3000 ba6ea800   SCSIPORT SCSIPORT.SYS Wed Aug 04 07:59:39 2004 (41107B4B)
ba6eb000 ba70b000   SI3112r  SI3112r.sys  Fri Aug 17 04:00:39 2007 (46C50147)
ba70b000 ba722480   atapi    atapi.sys    Wed Aug 04 07:59:41 2004 (41107B4D)
ba723000 ba748700   dmio     dmio.sys     Wed Aug 04 08:07:13 2004 (41107D11)
ba749000 ba767880   ftdisk   ftdisk.sys   Fri Aug 17 22:52:41 2001 (3B7D8419)
ba768000 ba778a80   pci      pci.sys      Wed Aug 04 08:07:45 2004 (41107D31)
ba779000 ba7a6d80   ACPI     ACPI.sys     Wed Aug 04 08:07:35 2004 (41107D27)
ba8a8000 ba8b0c00   isapnp   isapnp.sys   Fri Aug 17 22:58:01 2001 (3B7D8559)
ba8b8000 ba8c2500   MountMgr MountMgr.sys Wed Aug 04 07:58:29 2004 (41107B05)
ba8c8000 ba8d4c80   VolSnap  VolSnap.sys  Wed Aug 04 08:00:14 2004 (41107B6E)
ba8d8000 ba8e0e00   disk     disk.sys     Wed Aug 04 07:59:53 2004 (41107B59)
ba8e8000 ba8f4180   CLASSPNP CLASSPNP.SYS Thu Oct 06 01:53:44 2005 (43446788)
ba918000 ba920900   msgpc    msgpc.sys    Wed Aug 04 08:04:11 2004 (41107C5B)
ba928000 ba932000   secdrv   secdrv.sys   Wed Sep 13 15:18:32 2006 (45080528)
ba938000 ba941000   HIDCLASS HIDCLASS.SYS Tue Oct 31 11:26:12 2006 (454724C4)
ba9a8000 ba9b0880   Fips     Fips.SYS     Sat Aug 18 03:31:49 2001 (3B7DC585)
ba9f8000 baa04180   cdrom    cdrom.sys    Wed Aug 04 07:59:52 2004 (41107B58)
baa08000 baa16080   redbook  redbook.sys  Wed Aug 04 07:59:34 2004 (41107B46)
baa28000 baa36b80   drmk     drmk.sys     Wed Aug 04 08:07:54 2004 (41107D3A)
baa38000 baa47d80   serial   serial.sys   Wed Aug 04 08:15:51 2004 (41107F17)
baa48000 baa54e00   i8042prt i8042prt.sys Wed Aug 04 08:14:36 2004 (41107ECC)
baa58000 baa64880   rasl2tp  rasl2tp.sys  Wed Aug 04 08:14:21 2004 (41107EBD)
baa68000 baa72200   raspppoe raspppoe.sys Wed Aug 04 08:05:06 2004 (41107C92)
baa78000 baa85000   AmdPPM   AmdPPM.sys   Mon Apr 16 23:46:33 2007 (4623EEB9)
baa88000 baa93d00   raspptp  raspptp.sys  Wed Aug 04 08:14:26 2004 (41107EC2)
baa98000 baaa1f00   termdd   termdd.sys   Wed Aug 04 07:58:52 2004 (41107B1C)
baae8000 baaf0700   netbios  netbios.sys  Wed Aug 04 08:03:19 2004 (41107C27)
bab28000 bab2e200   PCIIDEX  PCIIDEX.SYS  Wed Aug 04 07:59:40 2004 (41107B4C)
bab30000 bab34900   PartMgr  PartMgr.sys  Sat Aug 18 03:32:23 2001 (3B7DC5A7)
bab98000 bab9d200   vga      vga.sys      Wed Aug 04 08:07:06 2004 (41107D0A)
babd0000 babd6180   HIDPARSE HIDPARSE.SYS Wed Aug 04 08:08:15 2004 (41107D4F)
babe8000 babec300   usbohci  usbohci.sys  Mon Oct 23 13:14:41 2006 (453CA421)
babf0000 babf7600   usbehci  usbehci.sys  Mon Oct 23 13:14:40 2006 (453CA420)
babf8000 babf9000   fdc      fdc.sys      unavailable (00000000)
bac00000 bac05a00   mouclass mouclass.sys Wed Aug 04 07:58:32 2004 (41107B08)
bac08000 bac0e000   kbdclass kbdclass.sys Wed Aug 04 07:58:32 2004 (41107B08)
bac10000 bac14880   TDI      TDI.SYS      Wed Aug 04 08:07:47 2004 (41107D33)
bac18000 bac1c580   ptilink  ptilink.sys  Fri Aug 17 22:49:53 2001 (3B7D8371)
bac20000 bac24080   raspti   raspti.sys   Fri Aug 17 22:55:32 2001 (3B7D84C4)
bacb8000 bacbb000   BOOTVID  BOOTVID.dll  Fri Aug 17 22:49:09 2001 (3B7D8345)
bacbc000 bacbf100   SiWinAcc SiWinAcc.sys Fri Jun 15 02:02:27 2007 (4671D713)
bad70000 bad73c80   mssmbios mssmbios.sys Wed Aug 04 08:07:47 2004 (41107D33)
bada8000 bada9b80   kdcom    kdcom.dll    Fri Aug 17 22:49:10 2001 (3B7D8346)
badaa000 badab100   WMILIB   WMILIB.SYS   Fri Aug 17 23:07:23 2001 (3B7D878B)
badac000 badad700   dmload   dmload.sys   Fri Aug 17 22:58:15 2001 (3B7D8567)
badba000 badbbf00   Fs_Rec   Fs_Rec.SYS   Fri Aug 17 22:49:37 2001 (3B7D8361)
badf4000 badf5080   avg7rsw  avg7rsw.sys  Tue Jul 26 14:10:51 2005 (42E6284B)
bae0a000 bae0b100   swenum   swenum.sys   Wed Aug 04 07:58:41 2004 (41107B11)
bae32000 bae33a80   ParVdm   ParVdm.SYS   Fri Aug 17 22:49:49 2001 (3B7D836D)
bae46000 bae47280   USBD     USBD.SYS     Fri Aug 17 23:02:58 2001 (3B7D8682)
bae5c000 bae5d080   RDPCDD   RDPCDD.sys   Fri Aug 17 22:46:56 2001 (3B7D82C0)
bae62000 bae63080   Beep     Beep.SYS     Fri Aug 17 22:47:33 2001 (3B7D82E5)
bae64000 bae65080   mnmdd    mnmdd.SYS    Fri Aug 17 22:57:28 2001 (3B7D8538)
bae70000 bae70d00   pciide   pciide.sys   Fri Aug 17 22:51:49 2001 (3B7D83E5)
bae9a000 bae9ac00   audstub  audstub.sys  Fri Aug 17 22:59:40 2001 (3B7D85BC)
baed8000 baed9000   avgclean avgclean.sys Mon Dec 03 13:09:01 2007 (4753F1DD)
baf53000 baf53b80   Null     Null.SYS     Fri Aug 17 22:47:39 2001 (3B7D82EB)
bafda000 bafdad00   dxgthk   dxgthk.sys   Fri Aug 17 22:53:12 2001 (3B7D8438)
bf800000 bf9c2a80   win32k   win32k.sys   Wed Mar 19 10:40:13 2008 (47E0DF7D)
bf9c3000 bf9d4580   dxg      dxg.sys      Wed Aug 04 08:00:51 2004 (41107B93)
bf9d5000 bff9be80   nv4_disp nv4_disp.dll Fri Aug 22 09:25:50 2008 (48AE69FE)
bffa0000 bffe5c00   ATMFD    ATMFD.DLL    Wed Aug 04 09:56:56 2004 (411096C8)
Unloaded modules:
9b141000 9b16c000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9b34c000 9b377000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9b34c000 9b377000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9b34c000 9b377000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9b34c000 9b377000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9dbc5000 9dbf0000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bafcc000 bafcd000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b17a0000 b17ad000   DMusic.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9dc50000 9dc5e000   swmidi.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
9dbf0000 9dc13000   aec.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bae3c000 bae3e000   splitter.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
ba9c8000 ba9d3000   imapi.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bab08000 bab11000   processr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b1973000 b1977000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bab78000 bab7d000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
b6417000 b641a000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
bab80000 bab85000   Flpydisk.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000

Open in new window


Author Closing Comment

ID: 31547366
worked!!! thank you

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

IF you are either unfamiliar with rootkits, or want to know more about them, read on ....
This article is about my experience upgrading my consulting machine to Windows 10 Version 1709 (The Fall 2017 Creator Update)
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Suggested Courses

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question