XP-SP3 can't get past safe mode following Microsoft update

Viruses and worms
1

BSOD following a set of software updates from Microsoft when I got back from a weeks holiday last night last night. I’ve had a look with Event viewer, which seems to point to the following updates;
KB; 2914368, 890830, 2917500, 2863866, 2837615

System Restore to previous restore points doesn’t cure the problem, although the actual restore function sems to continue correctly.

also I get auto re-start after BSOD, but can’t disable it.
Relevant box in System- Advanced is unchecked, and the relevant registry key seems to be set to 0 as I think it should.

Without being able to read the blue screen I can’t see exactly where it’s crashing.

Anyone any ideas please as I need to get this up and running sharpish as I’m just back in the country for a couple of weeks between holidays.

System config is a bit of a pain at the moment as I’m currently running a 2x 1Tb RAID mirrored array with several partitions. The eventual intention is to get XP off this onto an SSD, but that’s for another day.

2

Please see attached the following text files, as requested last time I had a spot of bother.

an OTL file plus an FRST file, both run from Safe mode; it hasn’t generated an extras file this time.
The OTL scan threw a couple of disk not found errors, but I’m guessing that’s because networking is disabled at the moment, so it can’t see my network drives

Also just run Belarc Advisor, which does not registr any of the aforementioned hotfixes as having been installed. No fixes from 2014 show at all

3

Having managed to get into Safe mode with networking, I ran Malware Bytes, which found and cleaned pup.optional.
Trend housecall showed no infections, so I tried re-booting only to freeze at aswRvrt.sys so I can no longer even get Safe mode :frowning:
Previously it would just pause at this driver for a long time before entering Safe Mode.

Anyone any ideas please as I’m trying to organise a holiday on this infernal machine?

4

Could you download and run a fresh copy of FRST please as the one you have is very old

5

Many Thanks for your reply, I was rather hoping not to have to be corresponding with you again so soon.
this is being posted from the errant PC as I’ve now managed to regain access to Safe Mode with Neworking.
I suspect that’s more by good luck than skill on my part, and may not be repeatable so I’d rather not re-boot until it is strictly necessary.
Disabling most things via MSConfig doesn’t seem to help.
Also tried System Restore to before the MS Updates, I only have 3 points available, but whist the process seems to complete in each attempt, it doesn’t help the situation. Would I be a mile away thinking that it’s probably driver clash rather than registry related?

If it’s of any help, the PC is BSOD on normal bootup, which then auto re-starts, even though the relevant check box is unticked and the registry entry is set to zero. On the second attempt, I then get the message to the effect of “Windows didn’t start correctly last time.” and a selection of safe mode options etc. I then selected Safe Mode with Networking, which is where I am now.
Safe mode eventually does start after hanging on aswrvrt for quite a while

If however I interrupt the boot sequence by pressing F8, then I get a different menu of Safe mode options, but they all seem to hang permenantly after aswrvrt (well at least for an hour or more as I eventually gave up and went to bed.) :-\

I’m running a dual monitor setup; on a normal boot attempt BIOS starts as normal, on what would nowmally become my second screen, Raid drivers load, and the XP splash screen starts on the same monitor and progresses for a while; The keyboard Lock LEDs flash and just about when I would expect the second larger monitor to spring into life and take over as primary monitor , I get the Monitor loss of signal l message on it, and a brief flash of BSOD on the first screen, followed by a forced re-boot.

As mentioned in an earlier post, everything has been performing faultlessly after your previous assistance; this issue arose after some recent microsoft security updates.

My only delay in getting the XP operating system off this RAID array has been due to corresponding with various software vendors to find a suitable program which will handle migrating XP to SSD off a software RAID array, whilst still giving XP access to the remaining data on the other partitions. I think/hope Paragon 14 will do it.

NirSoftBluescreenView doesn’t register any BSODs as there doesn’t seem to be a minidump for it to analyse.
The box was ticked, but no “Small Memory Dump” seems to get written. I wonder if this is related to the failure to disable auto re-start after BSOD??

6

I would recommend that you do the transfer soon, as the generated errors I am seeing in the addition text would tend to indicate a problem with the hard drive. Unless it is essential I would not use a RAID system

7

Certainly the intention is to get the operating system off the RAID array onto a dual partitioned SSD and add Win 7 to the other half.
Hopefully I can then break the array and re-import my data from backups.
Regarding the errors you mention, NVidia claims the RAID array is “Healthy” and the Smart status didn’t indicate a problem.
In Event viewer I do get a message quite regularly “An error was detected on device \Device\Harddisk6\D during a paging operation.”
I think I’ve narrowed this one down to a USB external 1 Tb HDD as it disappears when the disk is unplugged.

I can’t do anything about migrating to SSD though until I’ve bought one, some software for the migration, and more importantly being able to boot to a reliable XP to migrate over.

Thanks for looking into this for me, as I really don’t want to do a complete reinstall of XP and all it’s programs as I need to keep a working system on the go at the moment. Hence the migration of XP and the later adition of Win 7 to gradually move onto a bit at a time.

Any Ideas of where I head from here?
Which were the messages in the addition file which are pointing to HHD problems? I know Mailwasher has the odd issue as I’m running a very early version which does lock up occasionally.

8

As it stands I can see no apparent malware on the system

But if you could run an OTL scan I will check some different areas

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[]Select LOP and Purity
[]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir “%systemdrive%*” /S /A:L /C
/md5start
rpcss.dll
/md5stop
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

9

I think our last two messages must have crossed.
Currently scanning at the moment, I’m posting this from a netbook, but I have had a warning message

Windows No Disk
Exception Processing Message
c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c
I has to cancel this three times.

I’ll post up the results from the poorly PC when it finishes scanning itself.

The text file did, to the untrained eye at least, look like there are some (driver?) conflicts.
If the booting problem isn’t malware related, any ideas on where I go from here?
Thanks

10

OK, Now finished scanning, but only one file generated, No Extras.txt file generated.

Thanks Again

11

The log looks clean

Windows No Disk Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c
This report by OTL would suggest an intermittent problem within the RAID setup, unfortunately I know zilch about RAID configurations
12

In the pub at the moment, but I thought that since I have to ignore it exactly 5 times at each and every scan, it might well be related to the 5 external drives which are powered down, but which will all still have allocated drive letters.
I’m still wondering if it’s driver clashing with this latest windows update.
Also Still wondering what to try and disable before trying to re boot into full xp from safe mode.

13

Just tried re-running the scan with all 5 drives now powered up and visible within Windows Explorer in Safe Mode with Networking; the only option I realistically have at the moment.
Oddly I still need to hit the cancel button 5 times exactly with each scan in immediate succession, so the number 5 seems to be a coincidence.
I actually don’t think this is anything directly to do with the RAID setup, as all the issues occur post the drivers being loaded, so the Raid aspect should be transparent to Windows.
Nvidia control panel suggests that the RAID array is “Healthy” and “Smart Self-Test” points to both drives being OK as well.
Everythings been stable for ages; this problem only occurred on the re-boot to complete a set of Windows security updates.
Obviously it needed to re-boot following the partial install of these Hot Fixes & Security Updates, as some of the system files which needed updating must have been in use whilst Windows was running normally.
I assume this is where it screwed up and I now get a software clash of some sort when I try and go for the full re-boot; maybe from a driver somewhere?.
I wonder if running SFC might be a sensible option?

I did download a copy of Easeus ToDo Backup Home 6.1 from GiveAwayof the Day recently and immediately did a C drive backup along with creating a recovery disk. That will probably be my final option though as it will obviously overwrite all my existing C drive and prevent any other more simple recovery scenarios.

I did a quick google on that error message and came up with the following site
http://answers.microsoft.com/en-us/windows/forum/windows_xp-system/windows-no-disk-exception-processing-message/b1a67525-d5e8-46ae-9801-6b169547e656
which suggests that it’s related to me inserting and removing a USB stick, which would follow, as I was using one to run frst etc.

See also
http://www.techsupportall.com/how-to-fix-no-disk-exception-processing-message-c0000013-parameters-75b6bf7c-4-75b6bf7c-75b6bf7c/

obviously I don’t know it’s validity, but I did alter the registry key fro 0 to 2 as suggested and then re-started the scan, which ran without interruption. I went for this as I couldn’t access the “remove hardware safely” option in the stystem tray from safe mode.

I suspect therefore that this error message is a red herring.

I can post the results of the last scan if you wish, but can’t seem to add them to this modified message.

14

OK been having a further look whist I still have Safe Mode accessible.
Assuming that the problem was caused by a failed Windows Update, which does look to be the case.

From Event Viewer, the following updates were downloaded and ready to install. Windows then failed to boot on the restart following the installation of these hot fixes.

Windows Malicious Software Removal Tool Jan 2014 KB890830
Security Update for XP & Server KB2917500
Security update for XP KB2914368
Security Update for Word 2003 KB2863866
Security update for Office 2007 KB2837615

Now looking through the Windows folder on C drive, the only Hotfix install log on the relevant date is for KB2914368
Also, this is the only Hotfix with an uninstall folder within the Windows root folder.

The “Fail to re-boot” issue started on 23rd Jan at about 01.23 ish as you can see from the attached logs.

Must go now as off to do a visit to my Dad’s

Thanks again for looking.

15

Are you able to uninstall those update from add/remove in control panel

16

Still over at my Dad’s at the moment, but I don’t think so.

I suspect that’s the problem as one or more of the last four of the five hotfixes crashed or clashed with something else during the re-boot, hence don’t show as installed.
Only the first one has an uninstall folder resident in the Windows folder, I wonder if it’s possible to force all of them to re-install from safe Mode?

17

You may be able to download the standalone packages to the desktop and then install them in safe mode

18

Working on it at the moment.

Windows Malicious Software Removal Tool Jan 2014 KB890830 downloaded and ran without issue
Security Update for XP & Server KB2917500 seemed to extract OK
Security update for XP KB2914368 re-installed and then uninstalled
Security Update for Word 2003 KB2863866 Error Message- cannot be applied
Security update for Office 2007 KB2837615 Error Message - Failed

Will need to re-boot to complete the uninstallation, but that will have to wait until after a very late tea ;D

19

Just an update, so you don’t think I’m ignoring you.
The various previous ideas never did work, though the really irritating bit is that I still can’t disable auto re-start after the BSOD, so I had to resort to getting my DSLR out and learn how to shoot video :wink:

Turned out to be a Stop 0x0000007F error, which I couldn’t get BlueScreenView to record as the PC was failing to write the minidump file.
I has an inspired thought and wondered if Avast was blocking it. Sure enough, when I uninstalled Awast, Minidumps started to be written, pointing to nvgts.sys NVidia’s SATA Performance Driver.
This seems to be something to do with the disk management, well after the RAID drivers have been invoked, and during the XP boot process.
I don’t think the driver is corrupted, but I guess it must be conflicting with something which was modified in Windows Update. I managed to uninstall one of the updates, two didn’t install anyway, so I couldn’t remove them and the other says that you can’t uninstall it.

Now in the process of backing up the faulty C partition so I can still at least get back to this point when I start delving deeper.
Also annoyingly I can’t get SFC /scannow to work from within Safe Mode, doubly annoying considering how long it took me to make an X-SP3 slipstreamed disk for it to verify against.
Does anyone know a cure for that one please? ( I understand it doesn’t work fom withing XP Recovery Console either)
I’ll see if I can boot to BART PC and try and run it on a remote Windows installation from there.

I’d wlcome any further inspiration for when this backup finishes in an hour or so.

20

That stop code (dependant on the second group) points to hardware

This error message can occur if either of the following conditions exists: •Your computer has hardware or software problems (hardware failure is the most common cause). •You try to over clock the speed of your computer's processor (for example, you set a 150 MhZ processor to run at 187 MhZ).

The above STOP error means a trap occurred in kernel mode and the trap is either one the kernel is not allowed to have or is always fatal.

The most common causes of a STOP 0x7F are:
•Low-level hardware corruption, such as corrupt memory (RAM)
•Mismatched memory modules
•A malfunctioning motherboard

To determine an approximate cause, examine the parameters at the top of the STOP screen:
**STOP 0x0000007F (0x000000XX, 0x00000000, 0x00000000, 0x00000000)
UNEXPECTED_KERNEL_MODE_TRAP
The most important parameter is the first one (0x0000000X) which may have several different values. The cause of this trap can vary, depending on the value of this parameter. All traps that cause a STOP 0x7F can be found in any Intel x86 microprocessor reference manual as they are specific to the x86 platform. Here are some of the most common ones:

Values Meaning

0x00000000 Divide by Zero Error
0x00000004 Overflow
0x00000005 Bounds Check Fault
0x00000006 Invalid Opcode
0x00000008 Double Fault

http://support.microsoft.com/kb/137539