ie8 fix
madison

Hardware 2.0

Adrian Kingsley-Hughes
Home / News & Blogs / Hardware 2.0

Update causing BSoD for some XP users

By | February 11, 2010, 1:15pm PST

Summary: Reports are coming in that an update released this week by Microsoft for the Windows XP is causing problems for some users.

[UPDATE: Microsoft has withdrawn the update KB977165 from the Windows Update for this week. I've updated my patch removal instructions below to remove this update first.]

Reports are coming in that an update released this week by Microsoft for the Windows XP is causing problems for some users.

The problem is particularly nasty in that it causes a BSoD (Blue Screen of Death) with the error “PAGE_FAULT_IN_NONPAGED_AREA” and then sends the system into an endless cycle of reboots.

So, which patch is causing the problem? At present we don’t know, so the best fix it to uninstall all of the updates that were applied during this month’s Patch Tuesday.

If you’re suffering from this problem then there is a fix, albeit a convoluted one.

  1. Boot your XP system from the CD/DVD and enter the Recovery Console.
  2. At the Command Prompt type: CHDIR $NtUninstallKB977165$\spuninst
  3. At the Command Prompt type: BATCH spuninst.txt
  4. At the Command Prompt type: systemroot
  5. While step 2 removes the most likely culpit, if you continue to experience problems repeat steps 2 to 4 but replacing KB977165 in step 2 with each of the following in turn:
    KB978706
    KB978262
    KB978251
    KB978037
    KB977914
    KB975713
    KB975560
    KB971468
  6. When you’ve finished, type the following: exit

The above represents the best fix that I’ve been able to find for this problem.

Any one out there affected?

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Hardware 2.0”

Topics

BSOD, Reports, Microsoft Windows XP, Operating Systems, Microsoft Windows, Software, Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Disclosure

Adrian Kingsley-Hughes

All opinions expressed on Hardware 2.0 are those of Adrian Kingsley-Hughes. Every effort is made to ensure that the information posted is accurate. If you have any comments, queries or corrections, please contact Adrian via the email link here. Any possible conflicts of interest will be posted below. [Updated: February 23, 2010] - Adrian Kingsley-Hughes has no business relationships, affiliations, investments, or other actual/potential conflicts of interest relating to the content posted so far on this blog.

Biography

Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.

Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs. His most recent books include "Build the Ultimate Custom PC", "Beginning Programming" and "The PC Doctor's Fix It Yourself Guide". He has also written training manuals that have been used by a number of Fortune 500 companies.

Adrian also runs a popular blog under the name The PC Doctor, where he covers a range of computer-related topics -- from security to repairing and upgrading.

55
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Update causing BSoD for some XP users
lmmcgowan@... 17th Feb 2010
I keep reading how the update was removed by Micro$soft but I updated two PCs yesterday (2/17/2010) and the update was included. Did not cause me any problems.

But why was it there is MS supposedly removed it?

--Larry
View in thread
0 Votes
+ -
Update causing BSoD for some XP users
Loverock Davidson 11th Feb 2010
Is it really Microsoft this time or another case of people wanting to blame Microsoft? I'm going with the latter. Its got to be these obscure hardware configurations people have, not properly tested and not on Microsoft's WHQL. Plus its only a few rare cases anyway, nothing people should be upset about.
0 Votes
+ -
Flamebait response
GrimmReaperSound 11th Feb 2010
Ok, I feel like toasting someone today so here goes...
Are you that totally brainwashed by MS FUD that you cannot see that an MS supplied patch is at fault, not some obscure hardware. If the obscure hardware was working before the patch, it should continu after the patch. Obviously (at least to anyone capable of breathing) the fault here is clearly in Microsoft's camp.
Then again, someone of your upstanding track record cannot possibly be wrong (do you get this ironie at all?). Face the facts Lovey, MS messed up.
0 Votes
+ -
"MS messed up" ... or did they?
de-void-21165590650301806002836337787023 11th Feb 2010
Shall we NOT proclaim someone as guilty before we assess all the facts?

WHAT is crashing? A driver? OS Kernel code?

WHERE is the code crashing?

WHY is the code crashing? Code bug? Hardware failure? Memory corruption? Buggered motherboard?

WHO wrote the code? If it's a driver issue, chances are that MS did NOT write the code.

WHO is affected by this code and WHY (and how many)?

Adrian: I am somewhat troubled by this post: you don't cite your sources (links to crash reports?), you don't know WHAT is crashing and yet you rush out guidance on how to fix the issue by uninstalling some random set of patches?

How about you warn us that reports are coming in, link to the sources and wait until someone somewhere is able to isolate what's going on and what the correct remedies are before potentially having users screw up their machines any more than they already are?
0 Votes
+ -
Ignore Adrian's instructions: Here's the solution to KB977165
de-void-21165590650301806002836337787023 11th Feb 2010
http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/73cea559-ebbd-4274-96bc-e292b69f2fd1?prof=required

Look for responses by Kevin Hau & Pa Bear, e.g.:

@everyone posting in this thread:

1. Uninstalling KB977165 will automatically restore the previous versions of ntkrnlpa.exe and ntoskrnl.exe so there's no need to find "a way to replace them."

2. That being said, the newer versions of ntkrnlpa.exe and ntoskrnl.exe address the very serious & currently-being-exploited security vulnerability described in MS10-015 so you really do not want to avoid this update! Instead, open a free support incident per my previous reply.

3. Encountering a STOP error (e.g., 0x00000050) after installing this update could mean that your computer's already been compromised by the security vulnerablity addressed by MS10-015, yet another reason to open a free support incident!

Microsoft can't fix something if you don't tell them about it! Please open a free support incident ASAP so they know there are "dead bodies!"

For home users, no-charge support is available by calling 1-866-PCSAFETY (and/or 1-866-234-6020 and/or 1-800-936-5700) in the United States and in Canada or by contacting your local Microsoft subsidiary. There is no-charge for support calls that are associated with security updates. When you call, clearly state that your problem is related to a Security Update and cite the update's KB number (e.g., KB999999).

Or you can...

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Consumer Security Support home page & Microsoft Update Solution Center also offer support options
https://consumersecuritysupport.microsoft.com/
http://support.microsoft.com/ph/6527#tab3

For more information about how to contact your local Microsoft subsidiary for security update support issues, visit the International Support Web site: http://support.microsoft.com/common/international.aspx

For enterprise customers, support for security updates is available through your usual support contacts.
0 Votes
+ -
Microsoft did NOT mess up...
i8thecat Updated - 12th Feb 2010
Call it what it is... This is just the first of many gentle MS nudges to get people off XP and onto Windows 7...

Those of us who have supported Windows since the early days know this is business as usual for MS... MS doesn't want people using XP... They want users on Windows 7... What better way to accomplish this than help XP become a little less desirable... Windows ME and Vista are the only releases they haven't done this for.... But they might do it for Vista at some point in the future.
0 Votes
+ -
Rhetorical question maybe?
rahbm 11th Feb 2010
Are you that totally brainwashed by MS FUD that you cannot see that
an MS supplied patch is at fault...?

In the case of LD, and many of the other MS bigots here, YES.

Having to do the following to FIX a patch:
Boot ... from the CD/DVD and enter the Recovery Console.
(that would be the retail copy DVD I have to buy???)
At the Command Prompt type: CHDIR
$NtUninstallKB978706$\spuninst
At the Command Prompt type: BATCH spuninst.txt
At the Command Prompt type: systemroot
Now repeat steps 2 to 4 but replacing KB978706 in step 2 with each of
the following in turn:
KB978262, KB978251, KB978037, KB977914
KB977165, KB975713, KB975560, KB971468
When you?ve finished, type the following: exit
is truly scary; so much for LD always raving on about always having to
use the command line in Linux!

Funny, I only have to click "Apply" in Ubuntu and it just works.

Fascinating how MS (and its fanboys) always blame the user when
something goes wrong - as it inevitably does.
0 Votes
+ -
No need for the CLI in Windows either.
ye 12th Feb 2010
Oh...that's right...you're referring to an eight year and two generations old OS.

Fascinating how MS (and its fanboys) always blame the user when something goes wrong - as it inevitably does.

Has anybody done that?
0 Votes
+ -
Sigh
rahbm Updated - 12th Feb 2010
No need for the CLI in Windows either

Really? Then Windows Power Shell would be pointless.

In any case, your heading is just a red herring and simply an attempt
at deflection. I said nothing about a CLI and Windows, I was
commenting on how LD relentlessly claims that Linux needs to be
continually recompiled and that everything must be done at the CLI,
and that even if that were true, it would be trivial compared to
the repair process needed for this MS patch.

As for the blame game, this Talkback is riddled with MS fanboys
either blaming the user or excusing Microsoft. Some are proudly
exhorting that none of their machines is affected, implying that there
is no problem. By the same logic, because I don't have cancer,
then there is no such thing.

No software is perfect; so why do the MS fanboys and bigots fly into
such a frenetic rage whenever anybody dares to suggest that this fact
of life may apply to Windows, as it so often has over the years?

Really, it isn't worth getting ulcers about; MS won't thank you for it.
0 Votes
+ -
What a difference a few hours makes..
Werecow 11th Feb 2010
Going with the latter would be a mistake, as would blaming "obscure hardware configurations" and stating that it's "only a few rare cases". 11 of 34 machines on my network (none of which have exotic non-WHQL hardware) were hit this morning on the first boot after the update was applied. It's a widespread problem, enough so that MS stopped offering the MS10-015 KB977165 update some time before 4pm on 11 Feb.

It's usually best to sit on your hands and refrain from comment until you have data to support your opinion.
0 Votes
+ -
re: What a difference a few hours makes..
rtk 12th Feb 2010
11 of 34 machines on my network (none of which have exotic non-WHQL hardware) were hit this morning on the first boot after the update was applied.

For a counterpoint, none of the 500+ machines that were patched via WSUS on Wednesday and Thursday have had this problem.
0 Votes
+ -
So what?
rahbm 12th Feb 2010
Are you trying to imply that the problem is just a figment of some
people's imagination unless it affect every single XP machine?
0 Votes
+ -
re: So what?
rtk 13th Feb 2010
No, stop trying to put words in my mouth. I'm saying there's more to this than just the update.

And looking at the new information available, I'll happily imply that I didn't experience any problems because none of my machines were infected with a rootkit.
0 Votes
+ -
Testing for WHQL?
pwatson 12th Feb 2010
Where is the Microsoft program I can run to generate a report of the hardware currently being used?
0 Votes
+ -
NO it's not the user
easysoul 12th Feb 2010
I've had the BSOD; misreads to external drives
showing empty files; sound comes and goes; slower
internet; slower program response.
Are you a troll for Microsoft?
0 Votes
+ -
7 reasons? How about 1 NOT to stick with XP...
Narg 11th Feb 2010
LOL! Adrian, you crack me up. First you post a lengthy article on why to keep XP. Then, you show us the main reason to NOT KEEP XP!
0 Votes
+ -
The main one?
Lester Young 11th Feb 2010
I don't think it's BSOD. We don't know how widespread this one is.
0 Votes
+ -
Hush, now
rapson Updated - 11th Feb 2010
We all know XP is still better than Windows 7, even if you can't boot it up.

Edit: Meant for Narg's post above this one.

Carl Rapson
0 Votes
+ -
RE: Update causing BSoD for some XP users
b93950 11th Feb 2010
Here again customers need not worry about viruses or Trojans on Window based computer because Microsoft does a good job of screwing up your operating system with their lack of intelligence.

Yes, they posted a fix, but who ever gets a Recovery CD these days, nobody, why, because Microsoft will not allow manufacturer to ship them to customers.

Who has a CD drive on a Netbook, nobody!

Dammit, its time for a Class-Action Lawsuit against Microsoft!
0 Votes
+ -
Wow, what have you been smoking? ...
babyboomer57 11th Feb 2010
"but who ever gets a Recovery CD these days, nobody, why, because Microsoft will not allow manufacturer to ship them to customers."

Nobody gets a recovery CD anymore because the bits are included on the hard drive in a recovery partition. Read the documentation that came with your PC and LEARN HOW TO USE IT.

If you are too stupid to make a CD or DVD, contact the manufacturer of your PC and request one, they will be happy to mail you one (for a price). After all, the only reason they didn't send you one in the first place was to save money, not because MS wouldn't let them.

Netbooks are set up the same way. YOU KNEW it didn't have a CD or DVD drive when you bought it, too, so it is YOUR fault, not Microsoft's.

If you want to ***** to someone, go look in the mirror and scream away, loser. sad

Sorry people, some people just get under my skin.
0 Votes
+ -
Crap, I'm almost out of my BP meds ... Grrrrrrr .... (NT)
babyboomer57 11th Feb 2010
nt
0 Votes
+ -
Conspiracy Theory Alert:
GrimmReaperSound 11th Feb 2010
MS could just be trying to push XP out the door by putting out BSOD generating "patchs".
0 Votes
+ -
Yea, so they can kill all the netbooks they ...
babyboomer57 11th Feb 2010
practically gave away WinXP on to keep Linux off of them.

Yea, that would be smart.
0 Votes
+ -
As I have said before... RUN A REGISTRY CLEANER!
Lerianis10 11th Feb 2010
Before you automatically start saying that an update from Microsoft is causing a BSOD... everytime I had EVER seen a BSOD on Windows XP, running a registry cleaner fixed the problem immediately by getting rid of sometimes THOUSANDS of bad registry entries.
0 Votes
+ -
That's like saying ...
de-void-21165590650301806002836337787023 11th Feb 2010
... that, this one time, you refilled your car's windscreen washer bottle and two miles down the road your tire got a flat, therefore your washer bottle punctured your tire.

Registry cleaners HUGELY over-emphasize their effectiveness. They're almost as self-promoting as Kate Gosselin The OctoMom and Paris Hilton combined. And about as useful.

BSOD are caused by code running in kernel mode causing an unhandled exception forcing the kernel to shut-down.

True, sometimes, you may have drivers that didn't clean up after themselves, but unless you frequently install and uninstall large numbers of flaky drivers, you're unlikely to be affected by orphan driver code.

MUCH more likely is that you've either experienced a bug in the OS' kernel code (which is surprisingly rare) or you've got a broken driver.
0 Votes
+ -
Registry?
OhTheHumanity 11th Feb 2010
Not sure that is correct. I have never seen this in my years of managing thousands of PC's. Usually a BSOD is caused by buggy drivers, bad hardware, NTFS issues, or AV. But hey I have only run across a 1000+ machines, so maybe I need to run across a million?
0 Votes
+ -
RE: Update causing BSoD for some XP users
techfix 11th Feb 2010
Not going off half-cocked and doing some fact checking might work better than the blame game. If this was happening on a mass scale then Microsoft would need to look into it. I concur with the comments from Loverock Davidson that blaming Microsoft is the easy way out.
0 Votes
+ -
What doesn't cause XP to bluescreen?
Cylon Centurion Updated - 11th Feb 2010
Just about everything I did caused my system to die on me. Another reason I dumped the OS for Vista.
0 Votes
+ -
Eh?
rag@... 11th Feb 2010
You call that an upgrade?
0 Votes
+ -
I loved Vista
Cylon Centurion 11th Feb 2010
Everything about it was just so much better than XP.

I heavily despise XP.
0 Votes
+ -
100 XP machines here.....
OhTheHumanity 11th Feb 2010
And no reports of any problems today. I have Dell's, HP's, custom builts, and Lenovo's.
0 Votes
+ -
No problems on campus
rag@... 11th Feb 2010
We've got 1,200-1,300 on campus here, and I haven't seen any calls on this come through.
0 Votes
+ -
No Issues Here, and a Possible Reason?
AstroCreep 12th Feb 2010
My workstation environment is primarily Dell notebooks running Windows XP.

Since the issue is fairly widespread (yet limited...wrap your head around that one, lol!) and at this point there doesn't seem to be any 'tie' between them all. I wonder if it may have something to do with the audio card/driver, since Windows XP (and previous versions) handled the audio within the kernel memory space. I've actually seen something similar in the past (Windows 2000, anyway) where a defective audio card caused a user's system to BSoD, while referencing ntoskrnl.exe. I disabled the audio in the BIOS (onboard audio) of the user's PC and she hadn't had a BSoD since. Well, in the last eight months or so I was at that company.

It wasn't until Windows Vista that Microsoft broke audio out into its own memory space.

As a precaution, I *did* unapprove this update in WSUS, although the majority of my users already ran their updates.
0 Votes
+ -
So how come
Yagotta B. Kidding 11th Feb 2010
they haven't updated yet?

Consider this a warning.
0 Votes
+ -
More info about BSOD. Seeing on Win 7?
alokgovil Updated - 11th Feb 2010
I had the patches coming on Tuesday, and also installed Kaspersky Internet Security 2010 within a few hours.

Saw BSOD in Windows 7 Home Premium 64-bit:

kl1.sys
PAGE_FAULT_IN_NONPAGED_AREA

The aforementioned system file belongs to Kaspersky. A search on the internet revealed no other user facing the same error (people have talked about other BSODs with kl1.sys, but not page fault). So I am wondering if my BSOD is related to Microsoft patches or not.
0 Votes
+ -
How DARE you post useful information! (nt)
Lester Young 11th Feb 2010
.
0 Votes
+ -
That sounds like.....
OhTheHumanity 11th Feb 2010
A problem with Kaspersky mucking with the system files. So did you update and reboot before you installed Kaspersky? I would sure hope so, and if so then I would say Kaspersky is mucking with the system page file or something that is supposed to be present there. AV is one of those that can cause this.

http://technet.microsoft.com/en-us/library/cc957625.aspx
0 Votes
+ -
Or
condelirios 11th Feb 2010
Hard Disk Failure... A worn out hard disk can cause that blue screen... oh.. But that wouldn't be a software update problem would it?
0 Votes
+ -
Unlikely...
alokgovil 11th Feb 2010
Since this is a new laptop, I had run full length self-tests as well as surface-scans on the hard disk just two days back. No errors were found.
0 Votes
+ -
Did reboot
alokgovil 11th Feb 2010
Yes I did reboot before installation of Kaspersky.
0 Votes
+ -
Main cause is malware infection
IE9 12th Feb 2010
https://patrickwbarnes.com/blog/2010/02/microsoft-update-kb977165-triggering-widespread-bsod/
0 Votes
+ -
Malware may be one cause, but don't chalk it up as "main" cause yet.
Werecow 12th Feb 2010
KB977165 + a reported infection in atapi.sys is apparently causing the BSOD for some, but that wasn't the case in my company. Multiple virus/malware scans are run at shutdown on my machines, and they were shown clean before the update was applied. Numerous techs in my area are reporting the same thing, so it's not just me, and it's not due only to a hosed atapi.sys. The jury's still out...
0 Votes
+ -
Yep, killed my Mother-in-laws Vista SP2 box
Spats30 16th Feb 2010
This is just what I needed to know the other night
when my mother-in-law called. Unfortunately,
Vista automatically starts a "recovery" process
and prompted her to continue, which then attempts
a reinstall of the OS itself, while attempting to
leave the user files. That failed, too. Now I'll
end up having to do a full reinstall this weekend.
I'll probably migrate her to W7, though.
0 Votes
+ -
Vista and Windows 7 make recovery much easier.
ye 12th Feb 2010
Another benefit these two operating systems have over XP is the ability to run System Restore from the DVD. Recovering from this kind of problem (assuming it is valid) is as easy as booting from the DVD, choosing the recovery option, and running System Restore.
0 Votes
+ -
Problem on Vista Ultimate
knoxbury 12th Feb 2010
I installed Windows updates yesterday with 977165 being one of them. Today, I received my first BSOD ever on a Vista Ultimate machine. I have since uninstalled 977165. We'll see if this corrects the problem.
0 Votes
+ -
RE: Update causing BSoD for some XP users
bentleycorbitt 12th Feb 2010
Re: Update

The word might be that the Update has been removed from
Windows Update, however, I ran Windows Update on a system
this morning, and update KB977165 still showed in the
list, so be advised that the removal might be a rolling
one that hasn't hit all MS Update Server yet.
0 Votes
+ -
Turn OFF automatic updates
stevemalmquist@... 12th Feb 2010
I've turned off the automatic update function on my users machines to avoid just this kind of problem. Then once a month or so I apply the update myself. Then if there are issues like this one you can just wait until the fix is in. Go to System (Control Panel) and click the Automatic Update tab, just click to turn them off and you should be alright.
0 Votes
+ -
Patch Tuesday... WTF Wednesday...
i8thecat 12th Feb 2010
This is why you wait a few days to a week to install anything from MS...
0 Votes
+ -
RE: Update causing BSoD for some XP users
TD. 12th Feb 2010
My computer (Windows XP) was not in Blue Screen mode but in a Black Screen that would reboot every 30 seconds. No error message was given. It would not boot into Windows XP and would not allow me to boot into Safe Mode (one of the choices offered on the Black Screen). I followed your directions and removed KB977165. I am up and running again. I was just about to reformat when a co-worker told me about your fix. I am very grateful for this information. Thank you, TD.
0 Votes
+ -
RE: Update causing BSoD for some XP users
therealme2006@... 12th Feb 2010
You are the hero of the day. I have been working on BSoD error for several days now trying to fix what I thought was a registry problem due to a severe virus... I had forgotten all about the windows update that applied the other day, until I saw this article... This saved so much information. Thank you!
0 Votes
+ -
From the looks of it.....
OhTheHumanity 12th Feb 2010
It looks to be a virus that is causing this is the atapi.sys kernal files being infected. Not sure but makes sense. Many many more patched just fine and I had a 100% success rate with my systems. Ed Bott has a post on some more info about it.
0 Votes
+ -
RE: Update causing BSoD for some XP users
lmmcgowan@... 17th Feb 2010
I keep reading how the update was removed by Micro$soft but I updated two PCs yesterday (2/17/2010) and the update was included. Did not cause me any problems.

But why was it there is MS supposedly removed it?

--Larry

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix