Blue Screen error 0x0000007B in Windows XP after installing KB977165 (MS10-015 – February 2010)

Anonymous
2010-02-10T05:46:19+00:00

I updated 11 windows xp updates today from Microsoft.com and restarted my pc like it asked me to. (There has definitely been absolutely NO CHANGE in my computer software or hardware installation apart from this updates)

From then on, Windows cannot restart again! It is stopping at the blue screen with the following message:

A problem has been detected and windows has been shutdown to prevent damage to your computer.

PAGE_FAULT_IN_NONPAGED_AREA

Technical Information:STOP: 0x00000050 (0x80097004, 0x00000001, 0x80515103, 0x00000000).

I tried all kinds of restarting option namely, safe modes etc.  but everything is returning to the blue screen.

I hope Microsoft technical support has an answer as to how to resolve this problem.

Please respond if anyone has an answer.

Thanks

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2010-02-16T21:14:54+00:00

If you are not experiencing the Blue Screen on reboot and you have successfully installed the KB977165 update you do not need to do anything.

The only situation in which you need uninstall the update is if you are experiencing blue screens on reboot.

I hope this helps.

Thanks,

Kevin

If you find that my answer was what you were looking for, please remember to click the "mark as answer" box below!

Was this answer helpful?

0 comments
Answer accepted by question author
Anonymous
2010-02-15T21:44:15+00:00

Hello Everyone,

I wanted to post a link to the MSRC Team Blog that discusses this particular situation.

This is the best place to go for updates regarding the issue being discussed in this thread.

http://blogs.technet.com/msrc/

Thanks to everyone for the great discussion, I will be sure to update the thread as more information becomes available.

Thanks, Kevin

Was this answer helpful?

0 comments
Answer accepted by question author
Anonymous
2010-02-11T21:17:30+00:00

Hello Everyone,

I wanted to thank everyone for the great information and discusion in this thread!

We have found that there is only one patch that requires un-installation to resolve the blue screen issue. KB977165 is the patch in question, the other patches do not seem to cause the blue screen behaviour and do not need to be uninstalled.

With that in mind, here's the updated solution steps:

  1. Boot from your Windows XP CD or DVD and start the recovery console (see this Microsoft article for help with this step)

Once you are in the Repair Screen..

  1. Type this command: CHDIR $NtUninstallKB977165$\spuninst        
  2. Type this command: BATCH spuninst.txt
  3. When complete, type this command: exit

IMPORTANT: If you are able to uninstall the patch and get back into Windows, in order to stay protected you can use the following automated solution which secures your PC against the vulnerabilities that are resolved with KB977165 until you can successfully get the update installed without the blue screens.

Please see the link below for the article describing the vulnerability that is fixed with KB977165 and how you can get protected without installing the actual KB update:

http://support.microsoft.com/kb/979682

I also wanted to thank maxyimus for the great thread, and LThibx for their participation as well!

Thanks,

Kevin

If you find that my answer was what you were looking for, please remember to click the "mark as answer" box below!

Was this answer helpful?

0 comments

434 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2010-02-11T21:54:38+00:00

    Hi Kevin,

    I have installed the above mentioned upgrade on Feb 9th but have not had blue screen problem yet. This is possibly because I have not turned my computer off. I am not sure about it. My question is: Should I uninstall KB977165 anyway as a preventive measure via ad and remove or does it mean that my computer will not be affected by this problem of blue screen?

    I am running windows XP on HP zd7140 us laptop,

    Thank you in advance for your reply.

    Honza

    Was this answer helpful?

    0 comments
  2. Anonymous
    2010-02-11T21:49:11+00:00

    I had an Eee PC with XP Home brought to me with this same problem. I rolled back KB977165, rebooted and the system worked fine. I reapplied KB977165 and the rest of the updates available at Microsoft Update, and the problem returned. I replaced %System32%\drivers\atapi.sys with a clean version from a XP SP3 distribution folder and rebooted... voila! Problem solved.

    For reference, the SHA1SUMs of the atapi.sys files:

    Non-working:

    bb3e36ad0c8ed6daab38653ea4a942d74b9f4ff6

    Working:

    a719156e8ad67456556a02c34e762944234e7a44

    If anyone wants to look at the non-working atapi.sys: (EDIT: This file is infected and is provided for use by security researchers.)

    https://patrickwbarnes.com/pub/atapi.sys (Currently Slashdotted)

    I will be looking at this more in-depth.  If I find anything more, it will be posted in a follow-up comment at the ISC:

    http://isc.sans.org/diary.html?storyid=8209

    UPDATE :

    I uploaded the non-working atapi.sys file to VirusTotal, and this is the result:

    http://www.virustotal.com/analisis/85aa49f587f69f30560f02151af2900f3dc71d39d1357727ab41b11ef828a7ff-1265925529

    Apparently, this update problem is the result of an infection.

    UPDATE 2 :

    I have updated my blog post on the subject with repair instructions (Windows XP only for now, using the Recovery Console):

    https://patrickwbarnes.com/blog/2010/02/microsoft-update-kb977165-triggering-widespread-bsod/ (Currently Slashdotted)

    UPDATE 3 :

    From the reports I have been receiving, the infected atapi.sys is the most common cause of this blue screen.  However, any driver that references the updated kernel bits incorrectly can also cause this blue screen.

    * If you have not yet applied the update

    Scan your computer with up-to-date antivirus software.  Make sure you use a product that has rootkit detection.  Since the infection I identified is the TDSS rootkit, using a tool specifically designed to detect that rootkit, such as the one from http://www.esagelab.com/ is highly recommended.  Do not apply this update until your system is clean.

    * If you are already experiencing this blue screen

    Remove your hard drive from your computer and install it in another computer.  On that computer, run an antivirus scan against your hard drive and remove any infections found.  If atapi.sys is removed, you will need to replace it from installation media or from another Windows system of the same version.  Restore your hard drive and attempt to boot again.  If it still does not boot, you may try a repair installation of Windows.  If that still does not work, you may need to reload your computer.

    Was this answer helpful?

    0 comments