sconstantine ... I read your response and was initially excited and tried your solution, but of all the updates you listed only one was on this workstation and removing it did not work..
I do not have the luxury of re-installing windows or recoverying windows xp everytime, because I work for a school system and this nasty c000021a stop error is now on 21 desktops and laptops and counting. Some of them had the windows updates turned on, and others did not. Some are dell workstation, some are dell laptops, other are gateway desktops and gateway laptops. The model numbers are numerous. needless to say that this is not happening to any one specific machine type. I have tried all the microsoft (so called knowledge base) help files, which there are several addressing this specific issue. They range from alleged issues with IE to removing these updates as you suggested.
I have also tried booting into safe mode, but everytime the machines stops then auto reboot after trying to load AGPCPQ.sys. So my genius solution was to use recovery console to stop loading this AGPCPQ.sys at boot, but when I try to restart in safe mode again it now stops at AGP440.sys. Yes! I stopped that one from loading as well, but now it stops at mup.sys. Obviously this is not the solution.
Dell, Microsoft and Novell were all consulted, and as you would expect and bunch garbage and no solution.
Any suggestion will be greatly appreciated.
Please Help!!!!!!!!!!!!!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
flubbster... I searched for KB893066, KB893086, KB890859 and KB890923. Of these updates KB890859 was the only one installed on this machine that I have on my work desk.
An update to this issue: I booted in safe mode waited for the system to stop and reboot. Shut it down and rebooted with Knoppix and looked at the ntbtlog.txt file that is created in C:\Windows after safe mode fails and this is what I got..... See attached.
aarrrgghhhh...... what could have been installed that could wipe out all those systems?
do they all have Google Desktop Search by any chance? If so.... kill them using the boot cd if you can.
It really looks like the chipset got corrupted, based on the log. How across all those systems tho? Can you trace back, through install logs maybe on the server, what the last update/install was that was pushed out to the systems? You could try downloading the chipset driver for a test system and install using the boot cd and see if that helps.
I'm really beginning to wonder if you have a nasty that is propogating across the network. I assume you have antivirus and firewalls in place. Do you have an antivirus package that is cd bootable, like Norton's ? (even tho I hate norton, you can boot from it). You'll need to set BIOS for CD Boot as first choice obviously..
Over what kind of timeframe was the problem observed? Did 20 systems get it at once? Did it start with 2, then within 2 days reach 20? etc....
I would still try doing the chipset on a test system if you can use Ultimate Boot to install it...
meanwhile, back at the ranch... I'm still investigating for you....
Give this a try. Use a working system and get to the %Systemroot%\system32 folder
copy these files:
Gdi32.dll
Msvcrt.dll
Comctl32.dll
On a bad system, use a command prompt or boot cd, whichever, to replace the existing ones. Now.. how do you copy them over? Not sure. If a floppy is available, that is the easiest way. Does the Ultimate Boot Cd allow you to usb USB sticks? If so, might want to try that. Otherwise, if you have an XP cd or service pack 2 CD, you can try to extract them from the \1386 folder, like so:
expand x:\i386\Gdi32.dl_ c:\windows\i386\Gdi32.dll
attempt to register it:
regsvr32 Gdi32.dll
repeat for the other 2 files
may be able to do this from the recovery console by inserting the service pack cd into the drive after the console loads and you get the command prompt
OK I took a laptop with me that has the error. I copied the dll's from my working laptop to my thumb drive and booted with the ultimate boot cd and i recognized the thumb drive and allowed full access to the system 32 folder. However, even though the ultimate boot cd has a start menu and a run command, it gave an error that says it could not register the dll. So i rebooted without registering and still got that @#$% blue screen ^%$# microsoft $%^&^%$#$%@#$% error!
hmmmm... I would think that the dll's should self-register at boot, unless it is not reaching them. This is getting frustrating... can only imagine how you feel.
OK... find a live chicken.... spin it over the bad pc and chant "Bill Gates is Wonderful"
hope that got a smile....
Ok...commonality. Something pushed out from the server via GPO or something. A common update. An Antivirus update. A virus that is spreading.... something along those lines. Have you tried a virus scan with a bootable Scanner CD? Norton's will do it. I think others will also.
Took a while to get a bootable virus scan disc but the results are as expected. No virus detected. I just don't get it. These machines will not even run in Debugger mode, the last known good configuration doesn't work and windows restore option does not work. We tried to use the restore option from the Windows CD and each machine responded differently, most froze during the restore process and two of them completed, but either of the two restores full functionality and has numerous issues and errors. One tech has been on and off the phones with Microsoft since 8am, and nothing. ??????????
Back... been researching this thing for you and it sure seems like an update that crashed all your systems. Most likely related to an incompatability with the chipsets on the systems ( I hope). I would like you to try this from Microsoft. You will need an XP CD to boot into the recovery console and your admin password for the system you are trying this on of course.
http://support.microsoft.c
Has to do with the video driver agp440.sys compatability with certain updates after sp2 is installed. The final solution is to attempt to get updated BIOS from the mfg. However, this will disable the service and use the built-in video driver.
please give this kb a shot and let me know how you make out.
I have already tried this approach from day one. Look at my original question
" I have also tried booting into safe mode, but everytime the machines stops then auto reboot after trying to load AGPCPQ.sys. So my genius solution was to use recovery console to stop loading this AGPCPQ.sys at boot, but when I try to restart in safe mode again it now stops at AGP440.sys. Yes! I stopped that one from loading as well, but now it stops at mup.sys. Obviously this is not the solution."
It didn't work for us either...
Sorry.. I read that several times and just didn't make the connection.
I found a reference to Winlogon.exe that handles the logon process. It is located in 3 locations typically:
c:\windows\system32
c:\windows\system32\dllcac
c:\windows\servicepackfile
I have a couple of ideas you can try if you like.
Try to replace the winlogon.exe in the first 2 locations: system32 ans system32\dllcache
you will need to expand it from an xp cd using expand d:\1386\winlogon.ex_ c:\windows\system32
repeat for the dllcache location
Have you tried to update the bios on an infected system yet? I really think you should.
I just tried that using the ultimate boot cd, and the only thing it did was to put the machine in a auto-reboot loop. When I attempt to disable the reboot after error in the F8 advance confige options menu nothing happens. But, on the bright side, I don't see the c000021a blue screen anymore because now its stuck in a "boot loop".
I just got word that if we can't find the source, then all the machine that are showing the error now are going to be imaged and anyone that pops up in the future will be re-imaged as well without troubleshooting.... Don't you just love politics!
Wonderfulll.. the leg is infected... cut it off!!!!!!!!!!!!!!
I really wish I could have helped you to solve this. I have spent so much time looking into to this. It looks like it is a pretty common problem, with no real solution.
The thing that really concerns me though is the sequence of "infections" that youi have seen. It looks like the problem just multiplied across the network. You really need to look at the timeline of the infections and compare them against your server logs to see if you can correlate what might have been pushed out to the pc's just before they crapped out.
Iknow... I know... I'm probably not telling you naything that you don't know or haven't done... but just in case. I can't tell you how many times I tried to troubleshoot a bad piece of electronics only to discover the damn thing wasn't even plugged in!!! LOL
Anyway, I truly wish you the best. One more suggestion if I may. You might want to suggest only doing a few systems initially to see if they get re-infected and track very carefully what is being pushed out to them from the server..
Other than that... It was a pleasure to "meet" you..
all the best,
Frank
Thanks for putting in the time... I gave everyone in the department a copy of our dialog along with all the data, and hopeful solutions that never worked. We (the real techs) have put this in our "X-files" cabinet along with one of the older laptops that is displaying the error message for anyone one who wants to take a crack at it later.
So, how do I close this dialog and assign you the necesary points even though we didn't exactly get a solution. Or, do you want to take another shot at this with the one bad laptop that we are keeping?
It's up to you. To close it out just click on accept this as a solution in one of the comment boxes and you close it out. It will also allow you to split the points if you like between more than one person if you feel that it is deserved. You can assign the points in any proportion you like. So, click on accept solution in one of our comments for the "primary" solution and any "assisted" solutions. It is pretty much easy.
Take care and good luck. You can always come back and post a comment if you like. If I find anything else, I will post one myself.
Take care,
Frank
Business Accounts
Answer for Membership
by: flubbsterPosted on 2008-04-10 at 06:17:46ID: 21324380
It would seem obvious that the problem was caused by an update of some sort that is conflicting with some installed software common to all machines. Could you list the updates that you looked for and actually removed? This is my first glimpse of your issue.