cluberti

Agreed - I've installed this on pretty old Dell laptops as well, without issue. Also, other people have publicly posted being able to install on the Dell Inspiron 6400, so either you've got a bad DVD drive (I'm guessing this isn't likely) or your burn to disc (or even the ISO you downloaded) is corrupted in some way. All in all, I'd suggest a USB key install, but you've already mentioned that's out of the question currently. Also note that if you've got the ATI Mobility Radeon in that thing, the drivers aren't the greatest for it under x64, so you might want to consider x86 for that hardware as well.

Correct. This is the RTM build string used for Windows 7 and Windows Server 2008 R2.

Screen resolution is stored in the registry in HKLM for NT-based machines up through Vista, although Win7 seems to allow different configurations per user as of Win7 RTM. More testing should be done to confirm this, but after building a Win7 RTM machine on a box with 3 monitors, the changes I made for one user were not replicated to other (existing OR new users), and seemed to be per-user as it used to be in Win95 and 98.

I agree with Coffee - if it works without security, but fails with, that would sound to me like perhaps an LSP issue or a security provider issue. You are correct that the driver and WAP are working fine, and technically so is Vista (if it works unsecured, you've just tested winsock and WZC services, and they pass as well). That leaves the security provider having an issue, or an LSP on the stack. Consider using netsh to reset winsock, after running HiJackThis and Spybot at this point.

It's in the gray area, but I'm leaving the thread open. The build string is public as of yesterday, and discussions of such aren't warez. I'd caution folks from discussion of torrents and the like, but otherwise, this seems OK.

Well, I'd say you've got potential corruption or driver problems. Assuming you can't update the driver or replace it for the hard disk controller and chipset, unfortunately I'd say you probably need to flatten that partition and use the XP setup to create a new one in it's place.

Yes, this has been discussed here already in the WinPE section: http://www.msfn.org/board/index.php?showtopic=131887

Timmy Ho's!

Diskpart will be accurate, meaning something is causing diskmgmt.msc to fail somehow. What does Windows Explorer show as the C: volume size and available space? At this point, either you ignore diskmgmt.msc, or you'll have to rebuild.

I think you mean West .

The problem isn't winsock files not being protected, the problem is spybot removes an LSP (which is malicious) but doesn't remove it *properly*. Resetting winsock also resets the list of LSPs, causing it to work again (winsock is then no longer trying to make sure an LSP that's no longer on the system gets a crack at every packet).

According to Microsoft, in order to install Win7 from upgrade media, you have to have a qualifying previous version of Windows installed and activated. This would mean you'd have to physically have the XP bits on the hard disk, and that install would have to be activated. You could do a clean install with Vista upgrade media previously, but Vista upgrades were possible from XP directly, whereas they are not with Win7 (Win7 does a "clean install" for the upgrade - the "upgrade" media will "upgrade" XP insomuch as it will clean install Win7 only on a machine with an existing/activated XP install). Can this be worked around? Honestly, I don't know - I don't have an XP machine around anymore to try, but you could always try to use the Win7 media on a clean disk and see what happens. I know Win7 doesn't ask for an XP CD (or any other CD, for that matter) when you click "upgrade" and it does it's check, so Microsoft is likely correct in that it will actually have to be installed onto machines with a pre-existing OS activated for it to work.

Somehow this topic was closed - and in my opinion, should not have been (forum seems to think I did it too, but I was on vacation.... wierd). Re-opening, but let's keep it clean and mature, as always.

Correct. If the problem continues after clearing your cache (and making sure you're always using www.msfn.org), please post back that you are still seeing failures. However, clearing cache (completely) and using www.msfn.org/board should keep the problem from recurring.

Those "blank" windows are all html containers, hosting mshtml via the webbrowser control. That would indicate an IE problem, not a hardware problem. HTML help (the rightmost window) and the Student 2008 window both host the webbrowser control to display content, so I'd say something with the COM interfaces to IE are broken. If IE works fine otherwise, consider sfc /scannow or a system repair to fix it, then install the latest IE cumulative update.

I'd say it's either a driver issue (possible) or it really is an MFT problem. Would be interesting to see what diskpart says the drive size is, or what chkdsk says the size is.

The gaming graphics test measures the GPU horsepower (frames per second and speed/size of the GDDR on the card) for the most part, whereas the graphics test is specific to the capabilities of the specific D3D and DWM components that make up the Windows shell with Aero/Glass enabled, and how well the card performs under those specific APIs and routines.Usually the gaming graphics score is lower (but close in numeric value) compared to the graphics score, but with some older cards, low and mid-tier versions of high-end cards, and most onboard Intel integrated video cards, the converse seems to be regularly true (the drivers are likely tweaked for being fast for gaming, but not robust in the full D3D/DWM feature set). Note you can see what the "Graphics" and "Gaming Graphics" tests score specifically on your box by running the following commands from an elevated cmd prompt: "Graphics" test: winsat dwmformal -v "Gaming Graphics" test: winsat graphicsformal -v It's worth reiterating that while it might look odd at first, it's actually quite normal to see this.

Yes, they're boxed around and have a glass overlay.

Moving to XP forum.

Moving to XP forum.

I've tracked mine to my ISA firewall. If I go direct, everything works - as soon as I move the client behind ISA, the cookies don't survive for more than a few minutes (sometimes even less).

I think MagicAndre is right, this is probably "STATUS_ACCESS_DENIED", as I'm doubting you're running Windows from diskettes .

If it's a RAID1, no, it should rebuild without losing data. However, a RAID1 (mirror) should technically boot fine if one of the two mirrored drives is degraded, so I'd make sure you have a GOOD, RECENT backup to restore if this goes south.

This has been posted many times before. Let's try to keep the rehashing of news posts to a minimum, say, never at all? OK.

So, you want root cause, eh? Don't trust us? Well, I don't trust me either (although we were right). See here: // IRP list, showing the major IRP locations - in this case, Ntfs, Npfs, and Tcpip: Driver IRP[0] IRP[1] Maj/Min Function Count Name of Driver 8a683030 88670da8 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\NDProxy 8a7633f8 89cc57a0 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\Compbatt 8a6c5f38 8a683198 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\MountMgr 8a76a608 8a7345a0 8a733598 ( e, 0) IRP_MJ_DEVICE_CONTROL 5 \Driver\ACPI 8a76a608 8a731a80 (16, 0) IRP_MJ_POWER 1 \Driver\ACPI 8a6e5030 886f7700 886fc6e0 ( e, 0) IRP_MJ_DEVICE_CONTROL 5 \FileSystem\sr 89d69b78 87e7ad98 88127b20 ( c, 2) IRP_MJ_DIRECTORY_CONTROL 144 \FileSystem\Ntfs 89d69b78 8a6a6008 ( d, 0) IRP_MJ_FILE_SYSTEM_CONTROL 1 \FileSystem\Ntfs 89d69b78 ffbcb008 ( 0, 0) IRP_MJ_CREATE 1 \FileSystem\Ntfs 8a6e0f38 89cb9c88 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\CmBatt 8a67e438 89cb8c50 ( 0, 0) IRP_MJ_CREATE 1 \Driver\Cdrom 8a6df898 f7ce8b28 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\IBMPMDRV 8a6c6860 89d68450 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\Ftdisk 89d1b3b0 896b8ec8 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\NdisTapi 8a689870 84b003c8 f7f574f0 ( e, 0) IRP_MJ_DEVICE_CONTROL 3 \Driver\BTKRNL 8a67f030 88418bc8 88450e70 ( e, 0) IRP_MJ_DEVICE_CONTROL 19 \Driver\Tcpip 8a6ceca0 885cef68 885d3008 ( e, 0) IRP_MJ_DEVICE_CONTROL 2 \Driver\NdisWan 89cc2208 88920940 ( 3, 0) IRP_MJ_READ 1 \Driver\TermDD 8a6bb030 8956a008 f7c072f8 ( 3, 0) IRP_MJ_READ 2 \Driver\Kbdclass 8a6bd140 88b15008 f7db9710 ( 3, 0) IRP_MJ_READ 2 \Driver\Mouclass 0 89596a30 ( d, 0) IRP_MJ_FILE_SYSTEM_CONTROL 1 name not available 89619a98 8831cd98 88435c08 ( d, 0) IRP_MJ_FILE_SYSTEM_CONTROL 26 \FileSystem\Npfs 89619a98 842c6598 86af3280 ( 3, 0) IRP_MJ_READ 82 \FileSystem\Npfs 89bb3168 88915e70 ( 3, 0) IRP_MJ_READ 1 \FileSystem\Msfs 89ad3898 889a1338 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\SAVRT 8957b948 8854d680 8865c6d8 ( e, 0) IRP_MJ_DEVICE_CONTROL 4 \FileSystem\MRxSmb 8a685d10 89c7c7d0 ( f, 0) IRP_MJ_INTERNAL_DEVICE_CONTROL 1 \Driver\usbehci 89d694c8 896d47d0 89683838 ( f, 0) IRP_MJ_INTERNAL_DEVICE_CONTROL 4 \Driver\usbuhci 8956e198 88870c08 88974698 ( 3, 0) IRP_MJ_READ 2 \Driver\SPBBCDrv 89bb2030 8885dec8 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\IPSec 89cba030 886542a0 8865a5f0 ( e, 0) IRP_MJ_DEVICE_CONTROL 6 \Driver\IpNat 8957f598 88444738 88a6c5d0 ( e, 0) IRP_MJ_DEVICE_CONTROL 2 \Driver\NetBT 895ae540 889cc990 889cdc18 ( e,2d) IRP_MJ_DEVICE_CONTROL 3 \Driver\AFD 895ae540 885f76a8 889df4a8 ( e, 9) IRP_MJ_DEVICE_CONTROL 5 \Driver\AFD 895ae540 885c7640 885c7bd0 ( e,43) IRP_MJ_DEVICE_CONTROL 10 \Driver\AFD 895ae540 88a39720 88b05530 ( e, 3) IRP_MJ_DEVICE_CONTROL 3 \Driver\AFD 895ae540 886b26a8 88a6d730 ( e,20) IRP_MJ_DEVICE_CONTROL 2 \Driver\AFD 88a64990 88982a30 ( 3, 0) IRP_MJ_READ 1 \Driver\Ndisuio 889b5030 889dd828 ( e, 0) IRP_MJ_DEVICE_CONTROL 1 \Driver\irda 889a5cd0 88663dd0 886652b8 ( 3, 0) IRP_MJ_READ 4 \Driver\AegisP 8a68af38 884ff4a8 885024b0 ( e, 0) IRP_MJ_DEVICE_CONTROL 20 \Driver\HTTP 0 89cc1a28 89d89008 ( 0, 0) IRP_MJ_CREATE 2 name not available Driver IRP[0] IRP[1] Maj/Min Function Count Name of Driver 42 Drivers with 1 or more Active IRPs, accounting for 376 of 376 Active IRPs // First looking at the NTFS IRPs, showing us pending in FltMgr, a filter driver wants // to act on these writes (symevent.sys), but it isn't able to yet because something // further up the tree is pending (also note csrss.exe as the handle object): 1: kd> !drvobj 89d69b78 Driver object (89d69b78) is for: \FileSystem\Ntfs Driver Extension List: (id , addr) Device Object list: 8a6e0020 89d69a60 1: kd> !devobj 8a6e0020 Device object (8a6e0020) is for: \FileSystem\Ntfs DriverObject 89d69b78 Current Irp 00000000 RefCount 0 Type 00000008 Flags 00000000 DevExt 8a6e00d8 DevObjExt 8a6e0880 ExtensionFlags (0000000000) AttachedDevice (Upper) 89d6a268 \FileSystem\FltMgr Device queue is not busy. 1: kd> !devobj 89d69a60 Device object (89d69a60) is for: Ntfs \FileSystem\Ntfs DriverObject 89d69b78 Current Irp 00000000 RefCount 1 Type 00000008 Flags 00000040 Dacl e101690c DevExt 00000000 DevObjExt 89d69b18 ExtensionFlags (0000000000) AttachedDevice (Upper) 8a69ccb8 \FileSystem\FltMgr Device queue is not busy. 1: kd> !irp 87e7ad98 Irp is active with 14 stacks 13 is current (= 0x87e7afb8) No Mdl: No System Buffer: Thread 88a6f3e8: Irp stack trace. cmd flg cl Device File Completion-Context [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 >[ c, 2] 0 1 8a6e0020 88a53928 00000000-00000000 pending \FileSystem\Ntfs Args: 00001000 00000c5b 00000000 00000000 [ c, 2] 0 0 89b0a870 88a53928 00000000-00000000 \Driver\SymEvent Args: 00001000 00000c5b 00000000 00000000 1: kd> !fileobj 88a53928 \WINDOWS Device Object: 0x89d6c030 \Driver\Ftdisk Vpb: 0x8a6bf7b0 Access: Read SharedRead SharedWrite Flags: 0x40000 Handle Created FsContext: 0xe17dbd20 FsContext2: 0xe1232838 CurrentByteOffset: 0 1: kd> !handle 00000c5b processor number 1, process 8951c020 PROCESS 8951c020 SessionId: 0 Cid: 037c Peb: 7ffdf000 ParentCid: 034c DirBase: 20d90000 ObjectTable: e4bac9f0 HandleCount: 816. Image: csrss.exe Handle table at e7db8000 with 816 Entries in use 0c5b: Object: 882318c8 GrantedAccess: 001f03ff Entry: e7db98b0 Object: 882318c8 Type: (8a75b730) Thread ObjectHeader: 882318b0 (old version) HandleCount: 1 PointerCount: 3 1: kd> !irp 88127b20 Irp is active with 14 stacks 13 is current (= 0x88127d40) No Mdl: No System Buffer: Thread 88a6f3e8: Irp stack trace. cmd flg cl Device File Completion-Context [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 [ 0, 0] 0 0 00000000 00000000 00000000-00000000 Args: 00000000 00000000 00000000 00000000 >[ c, 2] 0 1 8a6e0020 88a04838 00000000-00000000 pending \FileSystem\Ntfs Args: 00001000 00000c5b 00000000 00000000 [ c, 2] 0 0 89b0a870 88a04838 00000000-00000000 \Driver\SymEvent Args: 00001000 00000c5b 00000000 00000000 1: kd> !fileobj 88a04838 \WINDOWS\system32 Device Object: 0x89d6c030 \Driver\Ftdisk Vpb: 0x8a6bf7b0 Access: Read SharedRead SharedWrite Flags: 0x40000 Handle Created FsContext: 0xe17c8d20 FsContext2: 0xe1278780 // Now we go to look at Npfs (named pipe file system), to try and determine what it // is further up the tree that is pending: 1: kd> !drvobj 89619a98 Driver object (89619a98) is for: \FileSystem\Npfs Driver Extension List: (id , addr) Device Object list: 89bb6030 1: kd> !devobj 89bb6030 Device object (89bb6030) is for: NamedPipe \FileSystem\Npfs DriverObject 89619a98 Current Irp 00000000 RefCount 204 Type 00000011 Flags 00000240 Dacl e17d9774 DevExt 89bb60e8 DevObjExt 89bb6188 ExtensionFlags (0000000000) Device queue is not busy. 1: kd> !irp 842c6598 Irp is active with 1 stacks 1 is current (= 0x842c6608) No Mdl: No System Buffer: Thread 88a2d020: Irp stack trace. cmd flg cl Device File Completion-Context >[ 3, 0] 0 1 89bb6030 87c554f0 00000000-00000000 pending \FileSystem\Npfs Args: 00000400 00000000 00000000 00000000 1: kd> !fileobj 87c554f0 \lsass Device Object: 0x89bb6030 \FileSystem\Npfs Vpb is NULL Flags: 0x40080 Named Pipe Handle Created FsContext: 0xe7fe8449 FsContext2: 0x88961bc0 Private Cache Map: 0x00000001 CurrentByteOffset: 0 1: kd> !irp 86af3280 Irp is active with 1 stacks 1 is current (= 0x86af32f0) No Mdl: No System Buffer: Thread 88711658: Irp stack trace. cmd flg cl Device File Completion-Context >[ 3, 0] 0 1 89bb6030 88711e58 00000000-00000000 pending \FileSystem\Npfs Args: 00000216 00000000 00000000 00000000 // We can see that there is an IRP to the network namespace: 1: kd> !fileobj 88711e58 \net\NtControlPipe31 Device Object: 0x89bb6030 \FileSystem\Npfs Vpb is NULL Flags: 0x40082 Synchronous IO Named Pipe Handle Created File Object is currently busy and has 0 waiters. FsContext: 0xe73e9458 FsContext2: 0x88711490 Private Cache Map: 0x00000001 CurrentByteOffset: 0 1: kd> !irp 8831cd98 Irp is active with 1 stacks 1 is current (= 0x8831ce08) No Mdl: No System Buffer: Thread 88a2d020: Irp stack trace. cmd flg cl Device File Completion-Context >[ d, 0] 5 1 89bb6030 88477bc8 00000000-00000000 pending \FileSystem\Npfs Args: 00000000 00000000 00110008 00000000 1: kd> !fileobj 88477bc8 \lsass Device Object: 0x89bb6030 \FileSystem\Npfs Vpb is NULL Flags: 0x40080 Named Pipe Handle Created FsContext: 0xe7e3b3f1 FsContext2: 0xfa0d3280 Private Cache Map: 0x00000001 CurrentByteOffset: 0 // We can see that there is an IRP to the workstation service: 1: kd> !irp 88435c08 Irp is active with 1 stacks 1 is current (= 0x88435c78) No Mdl: No System Buffer: Thread ff6a1b38: Irp stack trace. cmd flg cl Device File Completion-Context >[ d, 0] 5 1 89bb6030 886752d0 00000000-00000000 pending \FileSystem\Npfs Args: 00000000 00000000 00110008 00000000 1: kd> !fileobj 886752d0 \wkssvc Device Object: 0x89bb6030 \FileSystem\Npfs Vpb is NULL Flags: 0x40080 Named Pipe Handle Created FsContext: 0xe8601429 FsContext2: 0x886754d0 Private Cache Map: 0x00000001 CurrentByteOffset: 0 // Knowing the workstation service and the network is where our IRPs are going, we should // start looking at the Tcpip IRPs, because we're definitely hanging up here...: 1: kd> !drvobj 8a67f030 Driver object (8a67f030) is for: \Driver\Tcpip Driver Extension List: (id , addr) Device Object list: 89603668 8961fa60 8961fb78 895cd388 89cc7030 // ...and here it is, SYMTDI.SYS doing heap operations - note these IRPs won't complete // until SYMTDI finishes it's heap operations: 1: kd> !irp 88418bc8 Irp is active with 2 stacks 1 is current (= 0x88418c38) No Mdl: No System Buffer: Thread 885ff8d0: Irp stack trace. cmd flg cl Device File Completion-Context >[ e, 0] 0 e1 89cc7030 895816c8 a9fa2db0-886af200 Success Error Cancel pending \Driver\Tcpip SYMTDI!rHeapFree Args: 00000000 00000000 00120034 00000000 [ e, 0] 0 0 89576ab0 895816c8 00000000-00000000 \Driver\SYMTDI Args: 00000000 00000000 00120034 00000000 1: kd> !irp 88450e70 Irp is active with 2 stacks 1 is current (= 0x88450ee0) No Mdl: No System Buffer: Thread 885ff8d0: Irp stack trace. cmd flg cl Device File Completion-Context >[ e, 0] 0 e1 89cc7030 895816c8 a9fa2db0-896b0568 Success Error Cancel pending \Driver\Tcpip SYMTDI!rHeapFree Args: 00000000 00000000 00120038 00000000 [ e, 0] 0 0 89576ab0 895816c8 00000000-00000000 \Driver\SYMTDI Args: 00000000 00000000 00120038 00000000 1: kd> !fileobj 895816c8 Device Object: 0x89cc7030 \Driver\Tcpip Vpb is NULL Flags: 0x40000 Handle Created CurrentByteOffset: 0 1: kd> lmvm symtdi start end module name a9f8f000 a9fca000 SYMTDI (export symbols) SYMTDI.SYS Loaded symbol image file: SYMTDI.SYS Image path: \SystemRoot\System32\Drivers\SYMTDI.SYS Image name: SYMTDI.SYS Timestamp: Mon Aug 07 18:52:32 2006 (44D7C430) CheckSum: 00030C5E ImageSize: 0003B000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 1: kd> lmvm symevent start end module name aa1ae000 aa1d0000 SYMEVENT (export symbols) SYMEVENT.SYS Loaded symbol image file: SYMEVENT.SYS Image path: \??\C:\Program Files\Symantec\SYMEVENT.SYS Image name: SYMEVENT.SYS Timestamp: Mon Sep 18 20:52:19 2006 (450F3F43) CheckSum: 0001BF20 ImageSize: 00022000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 I don't know how old your Symantec Antivirus engine is on this machine, but it's definitely VERY out of date. Note Symantec updates BOTH it's virus definitions AND it's engines, but it only auto updates the virus defs. You can find the latest versions of symevent and symtdi.sys from here. This isn't guaranteed, of course, to solve your issues, but it's the best "first step" you can take. If the problems persist, uninstall SYMTDI (the email scanning component of Symantec Antivirus).