cluberti

The error is not coming from your RIS server (per se), it's coming from the NT setup routine. It does a check to make sure you have at least 512K of low memory available before loading the bootstrap, otherwise the box will crash or hang if there is less than 512K (I believe the setup routine accesses about 510 - 511K of low memory during base setup). If you have a BIOS with a memory hole configured, this is where the problem is occurring. This error is more prevalent in AMI BIOSes, but can be seen in any BIOS where a memory hole has been configured. There is nothing you can do on your RIS server, you need to fix the BIOS on that machine or those machines - otherwise, setup is not going to continue.

If you've found it to be a faulty hard disk, no, no reason to analyze the dump file yet. See if removing that disk resolves the issue (assuming that's not the hard disk Vista is installed on).

I've PM'ed you the location of the FTP.

Since I deal with 2GB+ memory dump files daily, I switched to WinRAR when it could compress a 4GB dump to 85MB, and WinZip could achieve about 700MB - 1GB on it's best compression settings for the same files. I .CAB things when I'm looking for compatibility across Windows boxes (XP and up), but WinRAR when I want a file compressed to upload to me.

Well, we didn't - sort of. It has been out since the NT4 days, but since we acquired sysinternals, we also acquired a BSOD screensaver. Interesting

Since the problem does not occur in safe mode, but disabling all user-mode non-Microsoft services and startup items, this actually only leaves actual hardware drivers, and file system filter drivers (whether they be antivirus, antispyware, or firewall filter drivers). If you configure your machine for a complete dump via the keyboard, you can dump it to help determine what is running in kernel. Here's what you do: 1. Create or set the following registry value: Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters Value: CrashOnCtrlScroll Type: REG_DWORD Data: 1 2. Right-Click on the "My Computer" icon on the desktop and select "Properties"; this will open the "System Properties" window. Go to the "Advanced" tab and click "Performance Options". Click "Change" under "Virtual Memory". Set the pagefile to be located on the partition where the OS is installed, and set it to be equal to Physical RAM + 50 MB. 3. Also in the "System Properties" window, click on the "Advanced" tab, then click "Startup and Recovery". Make sure "Complete Memory Dump" is selected. You can change the location of the memory dump file to a different local partition if you do not have enough room on the partition where the OS is installed. 4. You will need to reboot for these changes to take effect. 5. Once the machine is up and SYSTEM is using 100% CPU, hold down the RIGHT CTRL key and press the SCROLL LOCK key twice - this will cause the box to bugcheck and create a memory.dmp file. Once the box reboots and comes back up, you should be able to open the file in windbg or cdb for analysis (or let me know via PM if you want an upload location for me to look at it).

Most of these are rootkits, and streams won't detect it (they're hidden, and streams only shows you ones that are not). However, I believe that gmer can find and detect ADS rootkits - most A/V engines don't catch these yet (even at their highest levels of protection) until it's too late (or, not at all, in most cases).

Take your pick: http://www.google.com/search?q=display+IP+...amp;startPage=1

Have you tried using the OEM install disc that came with the laptops?

Fast user switching for domain-attached machines, and related, the rewrite of winlogon.

Is it happening continuously, or was it just the one time? A shutdown like that (with no bluescreen or warning, etc) seems like a hardware issue - assuming it didn't go through the "Windows is shutting down" process.

A file called setupp.ini in the \i386 (or \amd64, for x64 versions of XP) will tell you about the version of the disc. You cannot use a key from one disc version on another (for example, retail keys will not work on VLK or OEM media installs).

Is the computer physically powering off, or is it bugchecking (bluescreen, BSOD) and restarting itself?

Note that particular virus is pretty nasty, as it uses the alternate data stream on a folder in C: to hide itself (a real PITA to remove). I'd suggest reformatting and starting over, making sure to download all installation files necessary from another, noninfected machine, because you're not going to be plugging that new machine into any networks during the reinstall. 1. Get AVG on that box first. 2. Install applications in order, one at a time. Scan the machine after each app install, and you'll probably find the culprit. Otherwise, it came in from the outside, or from another machine on your network. Since you probably have a decent hardware firewall/router in place, this isn't likely, but anything is possible.

Are you logged on as the system administrator, and do you have read/write access to the actual .hiv file? If you are not administrator of the machine, or the .hiv file is read-only (or on read-only medium), you'll get an access denied error. Also note that you need correct permissions on the HKLM key itself to load the .hiv file.

RYU81, check your PM.

If the System File Checker was asking for the CD, it was likely trying to checksum some of the files from the media against files on disk. You really should put the CD in (or make a local source and point the registry to the new location) before running SFC - that's a pretty important part to make sure your files are checked properly.

Who cares? Microsoft never promises anyone that the OS will stay the same from release to release, just like any other OS vendor. Should we sue Apple because of the changes from OS9 to OS X? That's just silly. And any developer worth their weight in code knows to use the system variables and APIs when writing applications, and not direct paths or direct function calls. If you write code that calls direct paths or function calls, then you will be rewriting your code. Read the SDK before writing code for Windows in the future if this is the case. Yes, and now it's in a different location in Vista - but still accessible by the %APPDATA% variable, just as it is in XP. You're entitled to your opinion about Vista, but your points are a bit silly.

[quote name='jcarle' post='173891' date='Aug 22 2004, 08:57 AM']Sometimes I wonder if all of us put together know more about Microsoft's products the Microsoft does.[/quote] I don't know about that, jcarle .

You can do it manually via regedit, so long as it's a registry .hiv file.

http://support.microsoft.com/kb/315279 Note that Nvidia NICs based on particular broadcom and marvell chipsets are especially a PITA with RIS integration. You may need to befriend Google as you go forward if you run into troubles.

If you provide it a CD with SP1 extracted to it (run the sp1 executable with the /x parameter, and burn the resulting folder structure to a CD), does it work, or is it an actual problem reading from the CD drive itself?

It's not a virus - it's the fact that IE7 updates psapi.dll, and software can break because of it: http://www.hanselman.com/blog/TheProcedure...LLAfterIE7.aspx

The "SYSTEM" process represents the kernel executive, meaning any process loaded in kernel - basically, if you've got any file system filter drivers loaded (antivirus, antispyware, firewall, etc), it could be causing this. A few questions to be asked: 1. When did this start happening? 2. What changed on your system before this started happening? 3. If you pull the network cable from the machine, does the problem continue? 4. If you boot into safe mode, does the problem occur? 5. If you download autoruns and shellexview and disable all non-Microsoft items in these two utilities, does the problem persist?

Have you compressed it with WinRAR? If so, I'll PM you an FTP location to use.