Link to home
Start Free TrialLog in
Avatar of Jsmply
Jsmply

asked on

Windows XP boots to BSOD Physical memory dump in normal mode, safe mode okay

HI All,

We are going to be trying to help with a workstation this afternoon.  We haven't seen it yet and will be on limited time as the client is a charity client.  It apparently throws a BSOD physical memory dump when working in normal mode, but can be worked in safe mode just fine.  

The machine has been scanned via AV and I'm guessing it's probably not hardware (ram, HDD, etc) related as the machine runs fine in safe mode.  

Any obvious drivers or other areas you'd recommend looking if this is only coming up in normal mode?  I will post the exact error soon.

Thanks!
Avatar of Mike Thomas
Mike Thomas
Flag of United Kingdom of Great Britain and Northern Ireland image

Safe mode runs with limited drivers so it is probably a driver, have they installed any new hardware recently?

Avatar of angel_fire2701
angel_fire2701

Find out if they installed any new hardware recently like Mojotech suggested, I personally would check video drivers and/or wireless as they seem to do that alot.
Avatar of Aaron Cumiskey

Here is a link the list of stop error codes (The BSOD number)
It might give you a hint as to whats setting of the error

http://pcsupport.about.com/od/findbyerrormessage/tp/stop_error_list.htm

Avatar of Jsmply

ASKER

Just got the error from the user. It is IRQL_NOT_LESS_OR_EQUAL 0x0000000A. I'm not on a computer right now though (replying via mobile). Will check that list.
Avatar of Jsmply

ASKER

Looks like it might be malware related. I'm on the machine now. Combofix deleted C:\windows\system32\drivers\a08055.sys and now it boots!  Anyone have any idea what that driver pertains too?
ASKER CERTIFIED SOLUTION
Avatar of Aaron Cumiskey
Aaron Cumiskey
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Jsmply

ASKER

Yep, that was it!  Seems to run fine now!  Thanks!
Avatar of Jsmply

ASKER

Thx!