I updated 11 windows xp updates today from Microsoft.com and restarted my pc like it asked me to. (There has definitely been absolutely NO CHANGE in my computer software or hardware installation apart from this updates) From then on, Windows cannot restart again! It is stopping at the blue screen with the following message: A problem has been detected and windows has been shutdown to prevent damage to your computer. PAGE_FAULT_IN_NONPAGED_AREA Technical Information:STOP: 0x00000050 (0x80097004, 0x00000001, 0x80515103, 0x00000000). I tried all kinds of restarting option namely, safe modes etc. but everything is returning to the blue screen. I hope Microsoft technical support has an answer as to how to resolve this problem. Please respond if anyone has an answer. Thanks

If you are not experiencing the Blue Screen on reboot and you have successfully installed the KB977165 update you do not need to do anything. The only situation in which you need uninstall the update is if you are experiencing blue screens on reboot. I hope this helps. Thanks, Kevin If you find that my answer was what you were looking for, please remember to click the "mark as answer" box below!

Hello Everyone, I wanted to post a link to the MSRC Team Blog that discusses this particular situation. This is the best place to go for updates regarding the issue being discussed in this thread. http://blogs.technet.com/msrc/ Thanks to everyone for the great discussion, I will be sure to update the thread as more information becomes available. Thanks, Kevin

Hello Everyone, I wanted to thank everyone for the great information and discusion in this thread! We have found that there is only one patch that requires un-installation to resolve the blue screen issue. KB977165 is the patch in question, the other patches do not seem to cause the blue screen behaviour and do not need to be uninstalled. With that in mind, here's the updated solution steps: Boot from your Windows XP CD or DVD and start the recovery console ( see this Microsoft article for help with this step ) Once you are in the Repair Screen.. Type this command: CHDIR $NtUninstallKB977165$\spuninst Type this command: BATCH spuninst.txt When complete, type this command: exit IMPORTANT: If you are able to uninstall the patch and get back into Windows, in order to stay protected you can use the following automated solution which secures your PC against the vulnerabilities that are resolved with KB977165 until you can successfully get the update installed without the blue screens. Please see the link below for the article describing the vulnerability that is fixed with KB977165 and how you can get protected without installing the actual KB update: http://support.microsoft.com/kb/979682 I also wanted to thank maxyimus for the great thread, and LThibx for their participation as well! Thanks, Kevin If you find that my answer was what you were looking for, please remember to click the "mark as answer" box below!

I followed your directions, and they DID NOT fix the BSOD. Updates were installed 2/12/10 around 10AM EST.

Blue Screen error 0x0000007B in Windows XP after installing KB977165 (MS10-015

To Terry in London,

Nice of you to post the log file. Sorry to say to you & everyone else having issues, but so far I have no issues. I work for a major company & my job is to analyze/eval/test/pilot/deploy the monthly security updates for 40,000+ PC's. I have this KB977165 update working fine on about 30 PC's.

A good log file is posted below. I don't have time at the moment to dig further into this, but I will later by comparing a bad log file w/ a good log file. I quickly noticed that I don't have your entry of "1.172: Failed To Enable SE_SHUTDOWN_PRIVILEGE", & I only have 1 entry of "KB977165 Setup encountered an error: The update.ver file is not correct." where yours has many of the same error.

[KB977165.log]

0.672: ================================================================================

0.672: 2010/02/09 14:53:08.399 (local)

0.672: c:\a0c6524b0656ba50da\update\update.exe (version 6.3.13.0)

0.672: Hotfix started with following command line:

0.672: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with error 0x2

1.047: ---- Old Information In The Registry ------

1.047: Source:C:\windows\system32\SET141.tmp (6.0.2900.3653)

1.062: Destination:C:\windows\system32\shlwapi.dll (6.0.2900.3462)

1.062: Source:C:\windows\system32\_000006_.tmp.dll (5.1.2600.2180)

1.062: Destination:

1.062: Source:C:\windows\system32\SET157.tmp (5.1.2600.3649)

1.062: Destination:C:\windows\system32\avifil32.dll (5.1.2600.3585)

1.062: Source:C:\windows\system32\SET16F.tmp (6.5.2600.3649)

1.062: Destination:C:\windows\system32\quartz.dll (6.5.2600.3580)

1.062: ---- New Information In The Registry ------

1.062: Source:C:\windows\system32\SET141.tmp (6.0.2900.3653)

1.062: Destination:C:\windows\system32\shlwapi.dll (6.0.2900.3462)

1.062: Source:C:\windows\system32\_000006_.tmp.dll (5.1.2600.2180)

1.062: Destination:

1.062: Source:C:\windows\system32\SET157.tmp (5.1.2600.3649)

1.062: Destination:C:\windows\system32\avifil32.dll (5.1.2600.3585)

1.062: Source:C:\windows\system32\SET16F.tmp (6.5.2600.3649)

1.062: Destination:C:\windows\system32\quartz.dll (6.5.2600.3580)

1.062: In Function GetReleaseSet, line 1240, RegQueryValueEx failed with error 0x2

1.062: SetProductTypes: InfProductBuildType=BuildType.Sel

1.062: SetAltOsLoaderPath: No section uses DirId 65701; done.

1.094: DoInstallation: FetchSourceURL for c:\a0c6524b0656ba50da\update\update_SP2GDR.inf failed

1.094: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed: 0xe0000102

1.109: BuildCabinetManifest: update.url absent

1.109: Starting AnalyzeComponents

1.109: AnalyzePhaseZero used 0 ticks

1.109: No c:\windows\INF\updtblk.inf file.

1.109: SetupFindFirstLine in LoadExclusionList Failed with error: 0xe0000102

1.109: Enumerating Devices of computer, GUID {4d36e966-e325-11ce-bfc1-08002be10318}

1.375: OEM file scan used 266 ticks

3.015: AnalyzePhaseOne: used 1906 ticks

3.015: AnalyzeComponents: Hotpatch analysis disabled; skipping.

3.015: AnalyzeComponents: Hotpatching is disabled.

3.015: FindFirstFile c:\windows$hf_mig$\*.*

3.094: KB977165 Setup encountered an error: The update.ver file is not correct.

3.140: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\driver cache\i386\ntoskrnl.exe has branch sp2qfe which is greater than branch for sp2gdr

3.156: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\system32\dllcache\ntoskrnl.exe has branch sp2qfe which is greater than branch for sp2gdr

3.234: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\system32\ntkrnlpa.exe has branch sp2qfe which is greater than branch for sp2gdr

3.250: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\driver cache\i386\ntkrpamp.exe has branch sp2qfe which is greater than branch for sp2gdr

3.265: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\system32\dllcache\ntkrpamp.exe has branch sp2qfe which is greater than branch for sp2gdr

3.265: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\driver cache\i386\ntkrnlpa.exe has branch sp2qfe which is greater than branch for sp2gdr

3.281: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\system32\dllcache\ntkrnlpa.exe has branch sp2qfe which is greater than branch for sp2gdr

3.375: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\system32\ntoskrnl.exe has branch sp2qfe which is greater than branch for sp2gdr

3.375: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\driver cache\i386\ntkrnlmp.exe has branch sp2qfe which is greater than branch for sp2gdr

3.390: AnalyzeForBranching: g_bRepeatInventory set to TRUE because target file c:\windows\system32\dllcache\ntkrnlmp.exe has branch sp2qfe which is greater than branch for sp2gdr

3.390: AnalyzeForBranching used 265 ticks.

3.390: AnalyzeComponents: Branch sp2gdr is not applicable to target workstation

3.390: AnalyzeComponents used 2281 ticks

3.859: Inventory complete: ReturnStatus=61675, 2765 ticks

5.015: CreateUninstall = 1,Directory = C:\windows$NtUninstallKB977165$

5.015: Num Ticks for invent : 3921

5.015: DoInstallation: Re-running Inventory.

5.015: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed: 0xe0000102

5.031: BuildCabinetManifest: update.url absent

5.031: Starting AnalyzeComponents

5.031: AnalyzePhaseZero used 0 ticks

5.031: No c:\windows\INF\updtblk.inf file.

5.031: SetupFindFirstLine in LoadExclusionList Failed with error: 0xe0000102

5.031: Enumerating Devices of computer, GUID {4d36e966-e325-11ce-bfc1-08002be10318}

5.125: OEM file scan used 94 ticks

5.250: AnalyzePhaseOne: used 219 ticks

5.250: AnalyzeComponents: Hotpatch analysis disabled; skipping.

5.250: AnalyzeComponents: Hotpatching is disabled.

5.250: FindFirstFile c:\windows$hf_mig$\*.*

5.297: KB977165 Setup encountered an error: The update.ver file is not correct.

5.437: AnalyzeForBranching used 109 ticks.

5.437: AnalyzePhaseTwo used 0 ticks

5.437: AnalyzePhaseThree used 0 ticks

5.437: AnalyzePhaseFive used 0 ticks

5.437: AnalyzePhaseSix used 0 ticks

5.437: AnalyzeComponents used 406 ticks

5.437: Downloading 0 files

5.437: bPatchMode = FALSE

5.437: Inventory complete: ReturnStatus=0, 422 ticks

5.437: Num Ticks for invent : 422

5.437: VerifyTargetFileSize: Unable to verify size as Source = NULL for file c:\windows\inf\HFX17A.tmp

5.453: Copied file: c:\windows\inf\branches.inf

7.453: Allocation size of drive C: is 4096 bytes, free space = 29125562368 bytes

7.469: AnalyzeDiskUsage: Skipping EstimateDiskUsageForUninstall.

7.469: Drive C: free 27776MB req: 40MB w/uninstall: NOT CALCULATED.

7.469: CabinetBuild complete

7.469: Num Ticks for Cabinet build : 2032

7.469: DynamicStrings section not defined or empty.

7.469: FileInUse:: Detection disabled.

8.469: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed: 0xe0000102

8.906: Num Ticks for Backup : 1437

9.015: Num Ticks for creating uninst inf : 109

9.031: Registering Uninstall Program for -> KB977165, KB977165 , 0x0

9.031: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed: 0xe0000102

15.828: System Restore Point set.

15.906: Copied file: C:\windows\system32\spmsg.dll

15.906: PFE2: Not avoiding Per File Exceptions.

15.953: GetCatVersion: Failed to retrieve version information from C:\windows\system32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB977165.cat with error 0x57

16.359: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\update_SP3GDR.inf -> c:\windows$hf_mig$\KB977165\update\update_SP3GDR.inf.

16.484: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\update_SP3QFE.inf -> c:\windows$hf_mig$\KB977165\update\update_SP3QFE.inf.

16.484: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\update_SP3GDR.inf -> c:\windows$hf_mig$\KB977165\update\update_SP3GDR.inf.

16.500: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\update_SP3QFE.inf -> c:\windows$hf_mig$\KB977165\update\update_SP3QFE.inf.

16.531: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\spuninst.exe -> c:\windows$hf_mig$\KB977165\spuninst.exe.

16.609: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\spmsg.dll -> c:\windows$hf_mig$\KB977165\spmsg.dll.

16.687: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\spcustom.dll -> c:\windows$hf_mig$\KB977165\update\spcustom.dll.

16.719: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\KB977165.CAT -> c:\windows$hf_mig$\KB977165\update\KB977165.CAT.

16.922: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\update.exe -> c:\windows$hf_mig$\KB977165\update\update.exe.

17.156: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\updspapi.dll -> c:\windows$hf_mig$\KB977165\update\updspapi.dll.

17.281: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\update.ver -> c:\windows$hf_mig$\KB977165\update\update.ver.

17.281: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\updatebr.inf -> c:\windows$hf_mig$\KB977165\update\updatebr.inf.

17.297: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\eula.txt -> c:\windows$hf_mig$\KB977165\update\eula.txt.

17.406: ProcessSetupContentSection: PROCESS_SETUP_CONTENT_OP_INSTALL: Copied c:\a0c6524b0656ba50da\update\branches.inf -> c:\windows$hf_mig$\KB977165\update\branches.inf.

18.594: Copied file: C:\windows\system32\ntkrnlpa.exe

19.719: Copied file: C:\windows\system32\ntoskrnl.exe

19.750: Copied file: C:\windows\Driver Cache\i386\ntoskrnl.exe

20.547: Copied file: C:\windows\Driver Cache\i386\ntkrpamp.exe

20.890: Copied file: C:\windows\Driver Cache\i386\ntkrnlpa.exe

21.265: Copied file: C:\windows\Driver Cache\i386\ntkrnlmp.exe

21.437: Copied file: C:\windows\system32\DllCache\ntoskrnl.exe

21.547: Copied file: C:\windows\system32\DllCache\ntkrpamp.exe

21.640: Copied file: C:\windows\system32\DllCache\ntkrnlpa.exe

21.750: Copied file: C:\windows\system32\DllCache\ntkrnlmp.exe

21.844: Copied file: c:\windows$hf_mig$\KB977165\SP3GDR\ntkrnlpa.exe

22.484: Copied file: c:\windows$hf_mig$\KB977165\SP3GDR\ntoskrnl.exe

23.125: Copied file: c:\windows$hf_mig$\KB977165\SP3GDR\ntkrpamp.exe

23.469: Copied file: c:\windows$hf_mig$\KB977165\SP3GDR\ntkrnlmp.exe

23.828: Copied file: c:\windows$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe

24.187: Copied file: c:\windows$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe

24.562: Copied file: c:\windows$hf_mig$\KB977165\SP3QFE\ntkrpamp.exe

24.922: Copied file: c:\windows$hf_mig$\KB977165\SP3QFE\ntkrnlmp.exe

25.375: DoInstallation: Installing assemblies with source root path: c:\a0c6524b0656ba50da\

25.375: Num Ticks for Copying files : 16360

25.390: Num Ticks for Reg update and deleting 0 size files : 15

25.390: ---- Old Information In The Registry ------

25.390: Source:C:\windows\system32\SET141.tmp (6.0.2900.3653)

25.390: Destination:C:\windows\system32\shlwapi.dll (6.0.2900.3462)

25.390: Source:C:\windows\system32\_000006_.tmp.dll (5.1.2600.2180)

25.390: Destination:

25.390: Source:C:\windows\system32\SET157.tmp (5.1.2600.3649)

25.390: Destination:C:\windows\system32\avifil32.dll (5.1.2600.3585)

25.422: Source:C:\windows\system32\SET16F.tmp (6.5.2600.3649)

25.422: Destination:C:\windows\system32\quartz.dll (6.5.2600.3580)

25.422: ---- New Information In The Registry ------

25.422: Source:C:\windows\system32\SET141.tmp (6.0.2900.3653)

25.422: Destination:C:\windows\system32\shlwapi.dll (6.0.2900.3462)

25.422: Source:C:\windows\system32\_000006_.tmp.dll (5.1.2600.2180)

25.422: Destination:

25.422: Source:C:\windows\system32\SET157.tmp (5.1.2600.3649)

25.422: Destination:C:\windows\system32\avifil32.dll (5.1.2600.3585)

25.422: Source:C:\windows\system32\SET16F.tmp (6.5.2600.3649)

25.422: Destination:C:\windows\system32\quartz.dll (6.5.2600.3580)

26.140: UpdateSpUpdSvcInf: Source [ProcessesToRunAfterReboot] section is empty; nothing to do.

26.140: IsRebootRequiredForFileQueue: c:\windows\system32\ntkrnlpa.exe was no-delay replaced; reboot is required.

26.140: IsRebootRequiredForFileQueue: c:\windows\system32\ntoskrnl.exe was no-delay replaced; reboot is required.

26.140: DoInstallation: A reboot is required to complete the installation of one or more files.

26.140: UpdateSpUpdSvcInf: Source [ProcessesToRunAfterReboot.RebootNotRequired] section is empty; nothing to do.

32.187: RebootNecessary = 1,WizardInput = 0 , DontReboot = 1, ForceRestart = 0

Blue Screen error 0x0000007B in Windows XP after installing KB977165 (MS10-015 – February 2010)

434 additional answers