Home All Groups Group Topic Archive Search About

KMODE_EXCEPTION_NOT_HANDLED

Author
15 Oct 2007 4:35 PM
Rajeev
I am getting the following message after a recent virus attack on an old Dell
Win2000 Professional machine.  I do not have the Windows CDs because I bought
the machine from my previous company when they were going out of business. 
Thanks.

*** STOP: 0x0000001E (0xC0000005), 0xEB6BE9FA, 0x00000000, 0x00000118)
KMODE_EXCEPTION_NOT _HANDLED

*** Address EB6BE9FA base at EB6BE000, DateStamp 46f25279 – ohbush.sys

Beginning dump of physical memory
Physical memory dump complete. Contact your system administrator or
technical support group

Author
15 Oct 2007 6:27 PM
John John
When does this happen?  Does the computer boot at all?  Do you actually
have a file named ohbush.sys on your computer?  Searching in the
registry are there any references to this file anywhere?  Are you sure
you typed the name of the file properly?  I can find no references to
this ohbush.sys file anywhere on the net.

John

Rajeev wrote:

Show quoteHide quote
> I am getting the following message after a recent virus attack on an old Dell
> Win2000 Professional machine.  I do not have the Windows CDs because I bought
> the machine from my previous company when they were going out of business. 
> Thanks.
>
> *** STOP: 0x0000001E (0xC0000005), 0xEB6BE9FA, 0x00000000, 0x00000118)
> KMODE_EXCEPTION_NOT _HANDLED
>
> *** Address EB6BE9FA base at EB6BE000, DateStamp 46f25279 – ohbush.sys
>
> Beginning dump of physical memory
> Physical memory dump complete. Contact your system administrator or
> technical support group
>
Author
16 Oct 2007 3:16 AM
Rajeev
It happens either just before the 'CNTRL-ALT-DEL" login step or right after
it.  The file is ohbusb.sys.  Sorry for the typo.  Appreciate your looking
into this.

Thanks
Rajeev

Show quoteHide quote
"John John" wrote:

> When does this happen?  Does the computer boot at all?  Do you actually
> have a file named ohbush.sys on your computer?  Searching in the
> registry are there any references to this file anywhere?  Are you sure
> you typed the name of the file properly?  I can find no references to
> this ohbush.sys file anywhere on the net.
>
> John
>
> Rajeev wrote:
>
> > I am getting the following message after a recent virus attack on an old Dell
> > Win2000 Professional machine.  I do not have the Windows CDs because I bought
> > the machine from my previous company when they were going out of business. 
> > Thanks.
> >
> > *** STOP: 0x0000001E (0xC0000005), 0xEB6BE9FA, 0x00000000, 0x00000118)
> > KMODE_EXCEPTION_NOT _HANDLED
> >
> > *** Address EB6BE9FA base at EB6BE000, DateStamp 46f25279 – ohbush.sys
> >
> > Beginning dump of physical memory
> > Physical memory dump complete. Contact your system administrator or
> > technical support group
> >
>
>
Author
16 Oct 2007 4:21 AM
John John
Try booting to the Recovery Console and see if you can disable
ohbusb.sys.  You can use the LISTSVC command to display the list of
services and then use the DISABLE command to stop ohbusb.sys from
loading when the computer boots.

Description of the Windows 2000 Recovery Console
http://support.microsoft.com/kb/229716

You don't need to install the Recovery Console, just boot the computer
with your Windows 2000 CD and at the "Welcome to Setup" screen, press
F10, or press R to repair, and then press C (Windows 2000 only) to start
the Windows Recovery Console. Select the appropriate number for the
Windows installation that you want to repair, and then type the
administrator password. If the administrator password does not exist,
just press ENTER.

John

Rajeev wrote:

Show quoteHide quote
> It happens either just before the 'CNTRL-ALT-DEL" login step or right after
> it.  The file is ohbusb.sys.  Sorry for the typo.  Appreciate your looking
> into this.
>
> Thanks
> Rajeev
>
> "John John" wrote:
>
>
>>When does this happen?  Does the computer boot at all?  Do you actually
>>have a file named ohbush.sys on your computer?  Searching in the
>>registry are there any references to this file anywhere?  Are you sure
>>you typed the name of the file properly?  I can find no references to
>>this ohbush.sys file anywhere on the net.
>>
>>John
>>
>>Rajeev wrote:
>>
>>
>>>I am getting the following message after a recent virus attack on an old Dell
>>>Win2000 Professional machine.  I do not have the Windows CDs because I bought
>>>the machine from my previous company when they were going out of business. 
>>>Thanks.
>>>
>>>*** STOP: 0x0000001E (0xC0000005), 0xEB6BE9FA, 0x00000000, 0x00000118)
>>>KMODE_EXCEPTION_NOT _HANDLED
>>>
>>>*** Address EB6BE9FA base at EB6BE000, DateStamp 46f25279 – ohbush.sys
>>>
>>>Beginning dump of physical memory
>>>Physical memory dump complete. Contact your system administrator or
>>>technical support group
>>>
>>
>>