Blue Screen error 0x0000007B in Windows XP after installing KB977165 (MS10-015 – February 2010)

Anonymous
2010-02-10T05:46:19+00:00

I updated 11 windows xp updates today from Microsoft.com and restarted my pc like it asked me to. (There has definitely been absolutely NO CHANGE in my computer software or hardware installation apart from this updates)

From then on, Windows cannot restart again! It is stopping at the blue screen with the following message:

A problem has been detected and windows has been shutdown to prevent damage to your computer.

PAGE_FAULT_IN_NONPAGED_AREA

Technical Information:STOP: 0x00000050 (0x80097004, 0x00000001, 0x80515103, 0x00000000).

I tried all kinds of restarting option namely, safe modes etc.  but everything is returning to the blue screen.

I hope Microsoft technical support has an answer as to how to resolve this problem.

Please respond if anyone has an answer.

Thanks

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2010-02-16T21:14:54+00:00

If you are not experiencing the Blue Screen on reboot and you have successfully installed the KB977165 update you do not need to do anything.

The only situation in which you need uninstall the update is if you are experiencing blue screens on reboot.

I hope this helps.

Thanks,

Kevin

If you find that my answer was what you were looking for, please remember to click the "mark as answer" box below!

Was this answer helpful?

0 comments
Answer accepted by question author
Anonymous
2010-02-15T21:44:15+00:00

Hello Everyone,

I wanted to post a link to the MSRC Team Blog that discusses this particular situation.

This is the best place to go for updates regarding the issue being discussed in this thread.

http://blogs.technet.com/msrc/

Thanks to everyone for the great discussion, I will be sure to update the thread as more information becomes available.

Thanks, Kevin

Was this answer helpful?

0 comments
Answer accepted by question author
Anonymous
2010-02-11T21:17:30+00:00

Hello Everyone,

I wanted to thank everyone for the great information and discusion in this thread!

We have found that there is only one patch that requires un-installation to resolve the blue screen issue. KB977165 is the patch in question, the other patches do not seem to cause the blue screen behaviour and do not need to be uninstalled.

With that in mind, here's the updated solution steps:

  1. Boot from your Windows XP CD or DVD and start the recovery console (see this Microsoft article for help with this step)

Once you are in the Repair Screen..

  1. Type this command: CHDIR $NtUninstallKB977165$\spuninst        
  2. Type this command: BATCH spuninst.txt
  3. When complete, type this command: exit

IMPORTANT: If you are able to uninstall the patch and get back into Windows, in order to stay protected you can use the following automated solution which secures your PC against the vulnerabilities that are resolved with KB977165 until you can successfully get the update installed without the blue screens.

Please see the link below for the article describing the vulnerability that is fixed with KB977165 and how you can get protected without installing the actual KB update:

http://support.microsoft.com/kb/979682

I also wanted to thank maxyimus for the great thread, and LThibx for their participation as well!

Thanks,

Kevin

If you find that my answer was what you were looking for, please remember to click the "mark as answer" box below!

Was this answer helpful?

0 comments

434 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2010-02-12T06:09:19+00:00

    Patrick Barnes is right on the money. The virus potentially causing these issues is a rootkit called TDSS. It hides its files from detection by infecting ATAPI.SYS, which controls commands written to/from your hard drive. It's the perfect place for a rootkit to hide.

    I work for a major PC repair outfit and I've run across this increasingly. For every computer we perform a virus removal on, we run Kaspersky, McAfee, Trend Micro, Panda, Webroot, and Spyware Doctor, all run from a bootable PE disc. Even with all that, NONE OF THEM DETECT THE INFECTED ATAPI.SYS. Trend Micro's rootkit buster fails to detect it as well.

    The only tool I've seen that manages to detect it is a dedicated TDSS removal tool from http://www.esagelab.com/. Unfortunately, that does little good if you're already experiencing BSODs.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2010-02-12T06:03:52+00:00

    If you want to track down what may be interfering with KB977165 you can do it by getting off a minidump file (with a boot cd/live cd or put hard drive in another system) from C:\windows\minidump it should be the most recent file(s)

    then use the windbg (microsoft debug tools for x86) to open the minidump file and it should tell you what driver is suspected to have caused the fault.

    Here is a link to those: http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx#a

    We only had this problem on some systems and have tracked down via the minidump to an old ATI driver (ati2mtag.sys) on FireGL cards in Precision T3400 workstations. After installing the newest ATI drivers, we were able to apply 977165 again without any bluescreen crashes.

    Hope this helps some to track it down.

    Was this answer helpful?

    0 comments