Win 2k, BSOD after 2011 Free installed, clears after un-installing program

[cj47]

Due to the overly long message (typical M$), I don't remember the exact BSDO, but it was one of those "entry point not found" cryptic messages regarding ntoskrnl.exe. Partial was "ioforward....."

I can boot into safe mode, but as soon as I installed Avast Free 2011, I got the message (with all the stupid question marks at the end). I rebooted and then the BSOD. I can boot into safe mode, but that's it.
Their list of requirements for 2k did not include that rollup pack, which I then added after I found it was needed. I even re-installed that pack after in safe mode, but no difference.

As soon as I un-install the program all is fine.  Any ideas?

[pk]

hmmm, the only driver which uses IoForwardIrpSynchronously function (available from WinXP+) is aswSnx.sys (sandbox), but it shouldn't be installed on Win2k systems

please verify this: in Safemode, run regedit.exe go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\aswSnx (is there "aswSnx" present?)

please look at \Windows\system32\drivers, is there aswsnx.sys driver?

[cj47]

Ok, there were other messages after I re-installed that rollup pack, but that wasn't the original.
Here it is;

System32\Drivers\Fltmgr.sys device driver can't locate entry point IoGetDeviceAttachemnetBaseRfe in driver ntoskrnl.exe

I haven't rebooted the system yet. Does this program modify the "ntoskrnl.exe" and/or the "Fltmgr.sys" files?? Would replacing either solve the problem?

I should add, I have multiple 'ntoskrnl.exe' entries with different bmp's for the splash screen. Might that be it? The only difference is the bitmap image. This was before TuneUp Utilities allowed changing the M$ splash screen in XP. 

[pk]

fltmgr.sys is MS driver and it should be bounded to ntoskrnl.exe correctly (they both have to match the same version) -- please send me your fltmgr.sys + ntoskrnl.exe (packed) to kurtin@avast.com and i'll tell you the version of both files -- it seems, your SP4 (so called rollup update?) wasn't installed correctly...

[cj47]

The Laptop had sp4. After the 1st install failed because it didn't have that rollup pack, I d/l'ed that file and installed it. I then tried again which is when it failed. Also note, this happened with another A/V program that I didn't do anything further with.

According to "Properties"
ntoskrnl.exe version number is 5.00.2195.7045  created 6/19/03   1651KB in size (orginal)
fltmgr.sys version number is 5.00.2195.7039  created 4/13/05  134KB in size


(I edited my last post when you replied)

[pk]

please send me those 2 files to my email, I'll check their internal versions

[cj47]

Is that what you were looking for?
Your 1st reply was the message at boot time (BSOD).

Anyway, I choose the original ntoskrnl.exe to load at boot up and all is fine. For whatever rreason the program doesn't like the modified ntoskrnl files which were done using Resource Hacker. I must of loaded/unloaded dozens of programs with no issue until now using the modified files. I never liked that bright white 2k splash screen from the get go.