POSReady 2009 updates ported to Windows XP SP3 ENU

[Dave-H]

I installed five of harkaz's modified updates yesterday.

KB2953522 (IE8), KB2932079 (.NET 2.0), KB2931365 (.NET 4.0), KB2931352 (.NET security update), and KB2926765 (XP security update).

 

All seemed well, but a while after the updates were installed, the machine suddenly blue screened.

The stop error was 0x0000004E, PFN_LIST_CORRUPT, apparently thrown by ntoskrnl.exe.

On restart, the machine seemed OK again.

 

However this morning, after booting up and leaving it for a while, I found it with another BSOD.

This time the stop error 0x00000044, MULTIPLE_IRP_COMPLETE_REQUESTS.

 

Any ideas? I am a bit suspicious of KB2931352, as that seemed to replace a lot of .NET files, including some that were from ten years ago!

Edited May 16, 2014 by Dave-H

[submix8c]

Google on the first error

"PFN_LIST_CORRUPT" XP

only gives seemingly related problems in two of the links, indicating some kind of driver conflict (weird).

http://www.tomshardware.com/forum/264217-45-pfn_list_corrupt-windows

http://social.technet.microsoft.com/Forums/windows/en-US/d1f74f02-b38a-48c9-99a5-e72c4c9e1ddc/pfnlistcorrupt

Here is some further info -

http://www.reviversoft.com/blog/2013/09/pfn-list-corrupt/

 

Could it be that Error#1 led to Error#2, which it seems so.

 

I'd have installed only one at a time, ran with it for a while to confirm viability, then the next one, and so on. Paricularly I would have done the IE8 one first, then the XP one, then the NT ones lowest version to highest version.

 

HTH (no, I haven't tried them yet but will eventually)

[MagicAndre1981]

share the dumps, maybe we can see anything useful.

[Dave-H]

Thanks, I think I will be a bit more wary next month!

Touching wood, the machine seems to be stable again now.

Whatever caused the BSODs seems to have cleared itself.

I'm wondering if it was the .NET optimisation service, that runs after any .NET updates, that caused the crashes.

It seems to have done its job now, and isn't running any more.

The only other symptom I was getting was that the startup seemed to be slow (after the desktop loaded) and I was getting pop-up error messages that the Firewall wasn't running. This cleared eventually, and the startup now seems to be normal again.

I've had this before after updates, so it may or may not be relevant.

[Dave-H]

share the dumps, maybe we can see anything useful.

OK, here they are!

I've given them a dummy .txt extension so the forum will let me upload them.

I hope they give some clue as to what happened!

Cheers, Dave.

Mini051614-01.dmp.txt

Mini051614-02.dmp.txt

[submix8c]

OUCH!

.NET optimisation service

I turn that bad boy off (disable the Service) IMMEDIATELY after any updates. It (IMHO) drags the system.

[harkaz]

I saw a symevent.sys driver file in the Mini051614-02.dmp crash dump, which is releated to the crash, according to BlueScreenView. (It'[s marked red in the analyser).

 

According to a quick Google search, symevent.sys is a Norton-related driver.

 

I don't have any clue why this driver file is implicated. Maybe it's patched update.exe...

Edited May 16, 2014 by harkaz

[submix8c]

(sigh...) Not that this helps (it's even apparently related to Win7), but...

http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/symeventsys-bugcheck-code-0x4e-regular-bsod/a693f73f-1868-490e-9577-b2d0412b9ae9

 

edit -

I don't have that file (SAV v10) -however- it -appears- that it's a part of SEP (v11 + ?)?

http://madminblog.blogspot.com/2009/11/symeventsys-i-hate-you.html

Further it -appears- that it's also part of older versions of NAV -

http://www.pcreview.co.uk/forums/windows-xp-norton-antivirus-symevent-sys-blue-screen-t427125.html

 

...Symantec Event Manager Driver...

Perhaps an Update to your Symantec AV (whatever version) is necessary (if it exists). I may be able to help you out with finding it -if- you provide which Product/Version you have installed.

 

edit - found this

 

RegistryKey : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SymEvent
Image Path : C:\WINDOWS\system32\Drivers\SYMEVENT.sys

Obviously a "running service"...

 

edit2 - errr...

http://www.msfn.org/board/topic/113748-bdsod-stop-error-0x000000f4/

edit3 - via a (web archive) link in the topic - go here and check if this will work for you -

ftp://ftp.symantec.com/public/english_us_canada/symevnt/

Edited May 16, 2014 by submix8c

[Dave-H]

Well I do have Norton Utilities installed on the system (Norton Utilities 2002 in fact, the last one before you had to buy the whole suite including the AV!) so that explains the presence of symevent.sys.

I also have Norton Crashguard and Norton CleanSweep.

I know many people have no time for these programs, but they have worked well for me over the years.

 

I've checked my BlueScreenView history (a great program BTW, which I've had installed for years!) and there are no previous incidents caused by symevent.sys recorded, but there are four stop errors recording symmonnt.sys as the cause.

The last two were back in January of this year, the other two back in July 2012.

 

It could be that there was some interaction which went on here which caused the system to fall over, but it's never done that after a Windows Update session before.

Edited May 16, 2014 by Dave-H

[submix8c]

(FWIW, see my above post link to SYMEVENT FTP site...)

[Dave-H]

Thanks!

My version of SYMEVENT is 12.5.4.2, and the version on the FTP site is 12.8.6.38.

I will update it.

Even if it didn't cause the problem, and I've no reason to think that it has ever caused a similar issue before, it's always worth having the latest version.

Cheers, Dave.

Edited May 16, 2014 by Dave-H

[DarkRats]

There are a few conflicts with these "fixed" updates, but I think you can get around them using a little detective work and turning off certain programs or services, or even drivers, temporarily during the install process. In my case the problem was with Symantec Endpoint Protection. Got the BSOD. Tracked the cause first to SEP which I turned off. Again got the BSOD. Discovered a non-plug & Play Driver called NAVEX15 which had to be disabled. So, shut down both SEP and the NAVEX15 Driver, installed the update, started the NAVEX15 Driver and rebooted. All was well. IE8/XP was updated and the update shows in the list of software installed. Feels good.

[Dave-H]

Hmm, sounds like these updates would be more safely installed in Safe Mode!

Will they install in Safe Mode, I've never tried?

I know the .NET updates need the Windows Installer, which I think won't work in Safe Mode, but how about the others?

Edited May 16, 2014 by Dave-H

[harkaz]

The problem is most likely caused by the patched update.exe file. I was not sure at first but the issue seems to be present in any machine with Norton software installed.

 

I will try to cook up a more "clean" patch which will not cause this memory address conflict. The update.exe file uses the standard IsInfFileTrusted patch. This patch has been used since 2005, when Gurgelmeyer created USP5. But there are other ways to achieve the same result. These patches may not suffer from this problem.

[Dave-H]

Thanks harkaz!

I'm not sure how many people do have Norton/Symantec system utility software installed nowadays, but Norton Anti-Virus is certainly still quite commonly used.

If you think there is a conflict here, and it can be fixed, that's great.

 

Thank you very much indeed for all you're doing to keep Windows XP safe and alive!

Cheers, Dave.