Solved

BSOD/Stop error after login in XPPro on Domain

Posted on 2004-10-18
18
2,858 Views
Last Modified: 2010-08-05
I'm getting four different BSOD/Stop errors after login on my XPPro SP2 (and all current hotfixes) system.  They appear to come up in a random order and after 3-6 reboots I am able to log in successfully.  These errors only happen under my domain account.  They never happen when logging on as the local admin account.

Here's what I'm getting:
The most common one is:  0x1000008e (0xc0000005, 0x80606859, 0xef59ebf0, 0x00000000) no further parameters

The second most common one:  0x00000024 (0x001902fe, 0xf896b904, 0xf896b600, 0x8057a65e) no further parameters.  About half the time it appears after an application error which references a random 6 character exe name, e.g. YM15FA.EXE.  The exe is never found on my system once I successfully get logged in.

Third most common:  0x10000050 (0xffffffe8, 0x00000001, 0x804d917e, 0x00000000) Page_Fault_In_Nonpaged_Area.  Like the Stop 24 it sometimes is preceeded by a random named 6 character exe.  

A handful of times I've also seen:  0x00000019 (0x00000020, 0xe29435e8, 0xe2943758, 0x0c2e0079) Bad_Pool_Header

In every case the BSOD happens after login during the applying computer settings dialog appears.  It usually gets far enough for my desktop wallpaper (but not my desktop icons) to appear.  It always happens before my login sound plays.

I'm running a:
Dell Optiplex GX270
1/2 gig of ram
Intel 82865G video card (driver 6.14.10.3762)
SoundMax integrated audio (driver 5.12.1.3600)
Intel Pro/1000 MT NIC (driver 7.0.34.2)
As a member of a domain
A03 bios
OfficeScan 6.5

I did a clean build of the system about a week ago and installed drivers from Dell for my chipset and the hardware listed above.  3 of my coworkers also did clean build's on identical GX270's a week ago.  2 are error free, the third is experiencing the same symptoms as I am.  All of us are on A03 bios (A06 is available).

I've found two differences in comparing this to my coworker's systems.  
1.  Two of my coworkers are running SoundMax 5.12.1.3355.  One is error free, the other is experiencing the same problems as I am.
2.  I have customized (no third party utilities) my desktop to make XP resemble W2K.  No one else has (including the coworker who is experiencing the same problems as I am).

I do not believe the customization or the different SoundMax driver versions are relevant, but mention them for sake of thoroughness.

I have tried (in order):
1.  Updated drivers for everything listed above
2.  Reapplied SP2 after driver installation
3.  Rolled back to previous driver versions for everything listed above
4.  Reapplied SP2
5.  Updated back to the newest drivers
6.  Reapplied SP2

I was able to log in successfully after completing #2 above, however the next morning my system went back to BSOD's on login.  I then did steps 3 and 4 and was able to log in successfully.  As before, the next time I rebooted I got BSOD's again.  Finally I tried 5 and 6 and was unsuccessful after 5+ reboots so I logged on as my local admin account, deleted my domain profile and was successful.  

The other coworker having this problem also tried deleting his domain profile and was successful for a few reboots but then experienced the same series of BSOD's again.  

Today after 5 reboots I was successful with no BSOD.  My coworker was successful after 3 BSOD's.  

In retrospect, I do not believe any of my steps 1-6 or deleting the domain profile were effective.  

After successfully logging in today I've defraged my hd (it was minimally fragmented).  Run chkdsk /f, and spent a lot of time not finding too many useful KB Articles.  

If anyone has any ideas I'd sure appreciate the help!

PS:  Yes, I know, udpate the bios, but we're all on the same bios rev and half of us are working so I don't think it's the bios either.
0
Comment
Question by:Septicemia
  • 10
  • 4
  • 2
  • +2
18 Comments
 
LVL 10

Expert Comment

by:Longbow
Comment Utility
Does everything work OK without the SP2 ?
Can you log on the Domain pressing F8 at PC restart and choose Safe Mode with Network ?
0
 

Expert Comment

by:willmays
Comment Utility
The random exe you mentioned makes it sound spyware / adware / virus related.

Any chance of being able to run a virus scanner over the affected machines and seeing what turns up?

McAfee Stinger (http://vil.nai.com/vil/stinger/) is a good first choice, followed by their command line virus scanner tool (available by extracting a superdat file)
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
Perhaps a problem at the user level, try to create a new user; given that the Admin logon creates no problems for you; and assign the permissions / access levels you need.
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
You receive a "STOP: 0x00000050" error message when you try to upgrade to Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?scid=kb;en-us;873159
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
A "STOP: 0x1000008E In Emupia2k.sys" Error Message Appears After You Upgrade from Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;310740

Also check the Event Logs for more detail
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
0
 
LVL 69

Accepted Solution

by:
Merete earned 150 total points
Comment Utility
Based on my experience, the problem may occur due to these factors.

1. The Winsrv.dll file or the Basesrv.dll file in C:\Windows\System32 is missing or is not updated during the installation of SP2.

2. The update KB824141 was installed.

3. The system registry is corrupted.

To troubleshoot this issue, we will uninstall SP2. Please note, since the computer cannot run properly, it is necessary for us to uninstall SP2 to resolve the issue. After the computer can run properly, we will remove the files that may lead to this problem and then reinstall SP2 again.

Please perform the following steps. The following steps are a little complicated, please read it carefully before you go any further.

1. First, disable any Anti-Virus programs and BIOS-level Anti-Virus protection.

2. Make sure you have set your CD-ROM as the first priority boot device. You may refer to your computer manual for information on how to do this.

3. Insert the Windows XP CD into your CD-ROM and reboot your computer.

4. When you see "Press any key to boot from CD" on the screen, press a key to let your computer boot from the Windows XP CD.

5. When the computer boots from the CD-ROM, it will check your hardware and then prompt you with the following options:

*To set up Windows XP now, press Enter.
*To repair a Windows XP installation using Recovery Console, press R.
*To quit Setup without installing Windows XP, press F3.

6. Press the R key to start the Recovery Console.

7. If you have a dual-boot or multiple-boot computer, select the installation that you need to access from the Recovery Console.

8. When you are prompted, type the Administrator password, and then press Enter.(If you didn't set a password, just leave it blank.)

9. At the command prompt, type the following commands and press Enter after each line:

CD $NTServicePackUninstall$\SPUNINST

BATCH SPUNINST.TXT

EXIT

10. After restarting the computer, if the system boots successfully, please go to Add/Remove Programs and uninstall Windows XP Service Pack 2.

Note: If the computer does not boot successfully after using spuninst.txt, please edit the registry in Safe Mode:

a. Restart the computer.

B. Keep pressing the F8 key until the Windows Startup menu appears.

C. Choose Safe Mode, and press Enter.
(Note: In Safe Mode, your system display and Desktop will look and perform differently than in Normal Mode. This is only temporary.)

d. Type in "REGEDIT" and navigate to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs

e. On the right Pane, right click on "ObjectName" and click Modify, change the Value Data box to "LocalSystem", and then click OK.

11. Restart the system, go to Add/Remove Programs and uninstall "824141".

12. Restart the system again and try to reinstall Windows XP Service Pack 2.

0
 

Author Comment

by:Septicemia
Comment Utility
Wow!  Thanks for all the suggestions.  

First off though - 11 reboots this morning before a successful login.  1 was a 0x00000024, 1 was a 0x00000019, the rest were 0x1000008E.  3 with random file names.  One I had an application error with sms_reen.exe (we are Running SMS 2003).  I also noted that when I finally had a successful boot it took 5+ minutes to actually get logged in.  Afer a successful login it sent 8 error reports to MS.

Now for the responses...

To Longbow:  We all were running W2K SP4 and formatted and installed XP & SP2 while off the network, so we never evaluated the hardware without SP2 installed.  A Safe Mode with Networking boot is successful.

To Willmays:  We're running Trend Micro's OfficeScan.  I ran an AV scan yesterday and it came up clean.  Certainly could have missed something.  We got hit with rbot.qg at the beginning of the month (which is what prompted the format and install of XP) and it was a couple of days before Trend had an update that successfully detected and removed it.

To Astaec:  It's definitely a user level problem, but it seems to be profile specific rather than account specific.  If I log on to my pc, I get the BSOD's, however when I was helping my coworker try and fix this problem, I could log on to his pc without incident, but when he tried he'd get the BSOD's.

Regarding KB873159 we're not using Bootskin or anything similar.
Regarding the 8E bug check article.  I've not been able to identify which driver is causing the problem.  I'm not that good at debugging all the hex parameters on BSOD's.

To Merete:  I'm going to try your suggestion now and I'll come back and update this question after I've finished.

Thanks again everyone!
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
Thanks for the detail.

I've had occasion to take advantage of Microsoft's FREE XP SP2 support using their technical chat interface when we encountered errors I couldn't resolve and they've been wonderful!

 Was Microsoft Windows XP Service Pack 2 (All Languages) installed on your computer when you purchased it?
If the product was already installed on your computer when you purchased it, contact your computer manufacturer.
If you purchased the product separately, use one of the support options below.
If you are not sure where your product came from, see further instructions.
 
E-mail Support - Response Time: Up to 24 hours (Monday - Friday)
Unlimited support requests are included at no charge
All additional support requests are $35.00 US per request or use an existing contract
 
Individual Chat Support
Wait time: 0 seconds
Hours of Operation
Unlimited support requests are included at no charge
(888) SP2-HELP (772-4357)
No charge support for issues related to SP2.
From the next link...

http://support.microsoft.com/ph/6794/en-us/

Click the top-right icon area entitled:  "Contact a Support Professional by Email, Online, or Phone."

":0) Asta


 
 


0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:Septicemia
Comment Utility
I think it's working :)

I've done about a half dozen reboots today and so far I've not experienced the BSOD.

I followed Merete's suggestion with a few exceptions.

After I ran the batch command in the recovery console I rebooted and tried to uninstall SP2 from the control panel.  After about 90 minutes it failed.  I then rebooted into safe mode and changed the registry key that Merete suggested in step 10d.  I rebooted back into normal mode and tried to remove SP2 again from the control panel.  Once again it failed.  

I then restarted and reinstalled SP2.  So far so good.  

I never did find KB824141 installed, but I never successfully uninstalled SP2 either.

Astaec - I actually wound up trying the free XP SP2 support from MS before I tried Merete's suggestion.  Unfortunately I had an absolutely dismal experience and after about an hour of getting pointed to completely irrelevant KB articles I gave up.  

I'm going to hold off until tomorrow before saying that this is definitely resolved, but it certainly looks that way right now.

Thanks again everyone!
0
 
LVL 27

Assisted Solution

by:Asta Cu
Asta Cu earned 45 total points
Comment Utility
Good news and bad news!  I've used their tech chat service and gotten follow up Emails on various complex issues and the experiences have always been positive.  Sorry to hear that bad news.

Very happy to hear the good news from the information provided by our excellent Expert, Merete!

In all Operating Systems of Windows; it's always amazed me that many issues complex and trivial with all the process steps that should resolve them, didn't.  BUT when multiple reboots were done to rebuilt registry entries, register components and the like, problems were solved.

With all the end-user variables, troubleshooting is always an adventure ( to say the least ).

Crossing my fingers and wishing you well.

Asta
0
 
LVL 69

Expert Comment

by:Merete
Comment Utility
aw tis true, I always try to keep the problems in as simple based as possible and in front of my thoughts as I diagnose them and not stray into the abyss of endless ways to fix things, luckily I had just repaired a same simialr problem as yours the day before so it was fresh in my mind. Thanks astaec fingers crossed that alls well again for you, now you have to relax and try not to worry lol.. Its called after shock eheheh
 Sincerely Merete
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
":0)
0
 

Author Comment

by:Septicemia
Comment Utility
Everything is still working fine, so I think we're good to go here.  

Thanks again!
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
Good news, please accept the expert comment which helped you with the "A" level they likely deserve to finalize this.
":0) Asta
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
Thank you for confirming the issue remains stable.  If I really helped, I'm pleased!  If I didn't, I'd be more than happy to ask that my points move to Merete.

In the meantime, if the same issue resurfaces, please post and I'll respond when I can.

":0) Asta
0
 

Author Comment

by:Septicemia
Comment Utility
Comments accepted.  Definitely well worth the A rating!  :)
0
 
LVL 27

Expert Comment

by:Asta Cu
Comment Utility
YAY!  ":0)
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now