Resolution to KB971486 and 0x000000E3 Blue Screen, Windows XP

I had a client experiencing a blue screen of death (BSOD) upon every boot with error 0x000000E3, “a thread tried to release a resource it did not own”. This was not a BSOD error I ever recalled seeing. Most of the information I found on the Internet was irrelevant, but I did find several postings on forums from users who were experiencing this exact same error. I quickly realized all the postings were from today or yesterday! All reported that this error occurred after running some Microsoft updates, which was the exact symptoms of my client. Unfortunately, all the solutions were to do a repair install of Windows XP.

So I set about to find a better solution than a repair install. I won’t bore you with the details of how I discovered the fix so I can get this info out there as soon as possible and help the poor souls who will likely experience this problem in the next few days or weeks. I found that Microsoft update KB971486 is the trigger to the problem.

(Update: see the end of this article for an additional method of uninstalling KB971486. Update #2: see another method suggested by a commenter for those using a boot CD or attaching their hard drive to another computer) I was able to resolve the issue for my client by accessing his hard drive from a boot CD and manually copying the following files:

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrnlmp.exe” “c:\Windows\driver cache\i386\ntkrnlmp.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrnlpa.exe” “c:\Windows\driver cache\i386\ntkrnlpa.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrpamp.exe” “c:\Windows\driver cache\i386\ntkrpamp.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntoskrnl.exe” “c:\Windows\driver cache\i386\ntoskrnl.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrnlpa.exe” “c:\Windows\system32\ntkrnlpa.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntoskrnl.exe” “c:\Windows\system32\ntoskrnl.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrnlmp.exe” “c:\Windows\system32\dllcache\ntkrnlmp.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrnlpa.exe” “c:\Windows\system32\dllcache\ntkrnlpa.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntkrpamp.exe” “c:\Windows\system32\dllcache\ntkrpamp.exe”

COPY  “C:\Windows\$NtUninstallKB971486$\ntoskrnl.exe” “c:\Windows\system32\dllcache\ntoskrnl.exe”

In effect, this is uninstalling the update. Update #3 I would suggest that after you get your computer booting, you properly uninstall the update from the Add/Remove Programs control panel. Note that while I used a boot CD to access the hard drive, you could also remove the drive and connect it to another computer and accomplish the same thing. I’m sure there are other methods, but that is beyond the scope of this article.

I’ve not had time to fully test all aspects of this fix, so I can’t guarantee this will fix the problem if you are experiencing it, or if this is a complete fix. But hopefully it will get your computer booting so you can use it.

Links to Digg, FaceBook, Twitter, etc. are at the end of this article just above the comments. Do everyone a favor and spread the word, as this seems like this may be an emerging widespread problem.

Update: There is another method for uninstalling any Microsoft update that is applicable here. Here is the quick rundown:

1. Boot from your Windows XP CD or DVD and start the recovery console (see this Microsoft article for help with this step)

2. Type this command: CHDIR $NtUninstallKB971486$\spuninst

3. Type this command: BATCH spuninst.txt

4. Type this command: exit

The computer should restart and hopefully your problem will be fixed. Again, go to the Add/Remove Programs control panel and properly uninstall KB971486.

Update #2: If using UBCD or any other boot CD, a simple solution is to rename the file C:\Windows\$NtUninstallKB971486$\spuninst\spuninst.txt to spuninst.bat then just double-click it. This will automate the uninstallation process. Thanks to commenter Mark for the tip!

Update #3: A few users have commented that “properly” uninstalling the update from Add/Remove Programs control panel made things worse. I have now personally observed this. So I am recommending that once you fix the blue screen problem using one of the above methods, don’t bother uninstalling KB971486 from the Add/Remove Programs control panel.

  • Gemma

    Hi Marcel
    i have the exact problem yesterday..but i cannot get my computer to do anything past the error screen.
    it will not boot of the cd..or go into safe mode or any other mode.
    it just keeps flicking back to the error screen every time i push enter on safe mode or any other command on that window..
    i have xp sp3 aND MY COMPUTER IS NORMALLY WORKING VERY WELL..

    PLEASE CAN YOU HELP ME AS THIS IS DRIVING MAD.
    THANKS

  • I normally use the Ultimate Boot CD for Windows to do work like this. There are other boot CDs that could work just as well or connect your hard drive to another functioning computer.

    The fix itself is fairly easy, but honestly, getting to the point to execute the fix can be very difficult if you aren’t used to doing work like this. If you can’t get your computer to boot from a CD or have the ability to connect your hard drive to another computer, it may be best for you to take it to your local technology expert. Don’t risk making the problem worse.

  • Donald

    Marcel: I had the same BSOD after the 13 evil updates, and also could not safe boot. Thanks for id’ing the problem update. I borrowed a Winternals Admin pak from my company IT folks. This boots from a CD, but read the existing operating system. I was going to just pick a system restore date, but knowing the problem patch, I was able to use the Winternals hotpatch uninstall utility on KB971486. This seems to have done the trick, as my system has loaded properly, and I did not have to loose a day or two’s worth of files using the restore point.

    Apologies to others, but Winternals apparently a) cost major $$$$ (but our IT folks said it has saved them many times), and b) worse news, was bought by Microsoft. Here is their 2007 statement from the press release: “Winternals offerings are no longer available for purchase. However, Microsoft is exploring integrating these technologies into future offerings.” Yes, and they improved my computer with that hotpatch on Wednesday.

    Good luck to others.

    Donald.

  • Hi Marcel…

    All I want to say is THANK YOU…. and you’re a GENIUS….

    … And… THANK YOU… THANK YOU x infinity~~~.. hoho

  • I’m glad this resolved the error for you, Donald!

  • You’re welcome, grateful poor soul!

  • eddy bob

    I have a couple of questions to ask before i can thank you, lol. I had the same issue wit my aunts comp.She had asked me to fix the system because of the tremendous amount of viruses. After completing the task. I unfortunately, out of good judgment, decided to update her windows xp sp3 with the update utility. When i restarted the computer of course the same error popped up and all the same problems arose. There was a lot of critical data that she never backs up on her system, therefore, i decided not to wipe the system clean, thank-god!. However, my question is when u say “copy” what exactly do you want to copy? do u mean to copy the files from the cd to that directory? can i just delete those particular files? or just cut an paste those files to the cd? Im quite confused. But nonetheless god bless your soul! thank-you so much

  • Eddy Bob: First off, the data is likely safe, so don’t sweat it too much. Although it is always a good idea to back up your client’s data when (or before) working on their computer, so keep that in mind for the future. As far as the details for the fix, the idea is that once you are booted from a boot CD (like the Ultimate Boot CD for Windows), you will have full access to the hard drive, and then by following the steps listed you will in effect have uninstalled the update. If you notice, each line has three parts:

    Copy “file path 1” “file path 2”

    Basically you are copying the file listed in the first file path of each line to the second file path.

    If you don’t feel comfortable attempting this, then don’t feel ashamed to get a local expert to help you out (but please make sure they are reputable). This fix is technically challenging to perform if you don’t have the right tools and experience. Reassure your aunt that you did the right thing by running updates and that it is Microsoft’s fault they released this faulty update. She is not the only one who got bit by this bug.

  • Plaggi

    Guys,

    this is great suff!

    I’ve sorted it out as mentioned in the instructions. Afterwards I’ve tried to uninstall the patch. The system gave me a warning message saying that a lot of componets could be affect by removing the patch. Well I did it and after a restart I’m now asked to re-activate my system. The strang thing ist that my internet connect is not working anymore.

    Anyone with the same experience and ideas for a solution?

    By the way windows always it trying to re-install the patch. Therefore I haben’t found a solution also.

    Thanks for you hints!

    Cheers,
    Plaggi

  • where do I deliver the fruit basket

    Thanks Marcel!

  • Sorry to hear about the further problems, Plaggi. You could try activating via telephone. Also, you could reinstall the patch and if it crashes the system again, just do the fix without the “proper uninstall”.

  • Fruit is fine, margaritas are better!

  • Mark

    The user had forgotten his administrator password so I couldn’t get into the Recovery Console. I booted up with the Ultimate Boot CD.

    I had a little trouble here:

    3. Type this command: BATCH spuninst.txt

    It came up as an invalid command. So I opened the spuninst.txt file in NotePad and then saved it as spuninst.bat. Then I was able to just double-click on it to execute it. The system is up and running. Thanks!

  • Excellent suggestion, Mark! The BATCH command is only valid from the Recovery Console. But your method is a lot easier than what I originally suggested when using Ultimate Boot CD or any other boot CD!

  • Vincent Madrigal

    You are incredible ! The short cut worked beautifully !! As soon as I started back up it was wanting to install the update….

    Almost bought a new computer until I found this !

  • Brian

    Thank you, Marcel!

    Someone on Microsoft’s QA team should have their hat handed to them over this little snafu.

  • ScottG

    “Thank you, Marcel!

    Someone on Microsoft’s QA team should have their hat handed to them over this little snafu.”

    Ditto on both counts – except Marcel should get their hat to wear as a trophy, and their heads should roll (and then be mounted on his wall)! I literally just spent most of last nite and today trying to fix my wife’s Dell Inspiron E1505 laptop via the usual methods assuming there was an MBR issue (I want my Saturday back, Microsoft)….

    I used nearly the same solution that Mark did 4 entries or so ago with UBCD (a BRILLIANT tool – I’ve saved countless computers from the sketchiness that MS Repair can induce). In short, I used the Explorer2 navigator to copy/rename the SPUNINST.TXT to SPUNINST.BAT, clicked the BAT file to run it, restarted, and smiled with joy when I got the OS back.

    The update still appeared in Add/Remove Programs, and I formally uninstalled it after getting the warning message that it could upset other programs. Rebooted again, reran the other updates that I guess didn’t get applied (hiding the toxic one); we’ll see how the stability holds up after the wife catches up on her lost Sims 2 time… 🙂

    It should be noted that in our case, the BSOD error code was slightly different – actually, I encountered 2 different ones, as I was completely unable to boot in under any form of Normal or Safe modes:

    1) SAFE MODE (bluescreen appeared after stalling momentarily on \WINDOWS\SYSTEM32\DRIVERS\MUP.SYS):

    PAGE_FAULT_IN_NONPAGED_AREA
    STOP: 0x00000050 (0xC837A064, 0x00000001, 0x80537009, 0x00000000)

    NOTE: the second of the five addresses seemed to change – I got 0xC8379064 on 2nd run, 0xC837713C on 3rd….didn’t test it on the others below, but it probably behaves the same.

    2) SAFE MODE w/NETWORKING:
    PAGE_FAULT_IN_NONPAGED_AREA
    STOP: 0x00000050 (0xC8308FA4, 0x00000001, 0x80537009, 0x00000000)

    3) SAFE MODE w/COMMAND PROMPT:
    PAGE_FAULT_IN_NONPAGED_AREA
    STOP: 0x00000050 (0xC8361064, 0x00000001, 0x80537009, 0x00000000)

    3) LAST KNOWN GOOD CONFIGURATION
    &
    4) START WINDOWS NORMALLY (Windows XP logo appeared for a few secs, then):

    STOP: 0x0000007E (0x80000003, 0x805C49B8, 0xBA4CB2B4, 0xBA4CAFB0)

    Marcel – since you gave a nicely succinct solution above, can you now give us geeky types a postmortem on how you came across the solution for this?

    Thanks again to all of you for your help – easily the best advice I saw all day!

  • Thanks for all the kind words!

    ScottG: The way I came across the solution was not as interesting as you might think. As already mentioned, I booted with UBCD. After running CHKDSK and doing a few minor maintenance tasks and going on the little bit of information that I had found on the Internet, I surmised that one of the updates had to be the cause the problem. So I looked in C:\Windows directory for the $NtUninstallxxx directories to try to find the likely culprit. I sorted by descending date of modification and found the most recent directories. I looked at what files existed in each of the spuninst directories and basically made an educated guess that an error as showstopping as this one had to involve some pretty core OS modules. The files in this particular update matched my hunch and I was successful. That’s pretty much it.

  • Mark Latham

    Your new fix was the fix!
    Thank you very much for your thoughtfulness to post this.
    A great timesaver sir!

    Regards,

    Mark

  • Lisa K

    Marcel you are brilliant. I am now into my customer’s computer where I can find and correct any other problems. You have saved the day. Thank you for taking the time to put this info out here for all other techs and support person to use. Again Thank you, thank you.

  • A Jones

    Just coming through to give my thanks as well. When a friend of mine was describing their problem to me, at first I thought it was just a MBR issue. Well not only was that not the case, but this was the first time I had encountered this issue. After enough searching, I found a link here on a messageboard and your updated tip worked like a charm. Thanks again.

  • Lauri J

    Marcel thank you for taking time to research this and solve things. I went to control panel / add-remove and uninstalled that Security Update, then did a reboot, but I’m not quite having the same thing as everyone else.. I don’t have any loops or things listed above. What I have is that dang blue screen after a reboot and it stays there for a good 8 minutes each time before finally showing start/task bar and my desktop with icons. Now, after removing KB971486, it’s still doing the same thing. Any ideas on this??

  • Jimmy

    You are my hero! Thank you!!!

  • Ed

    Worked for me thanx

  • Lauri J.

    Addendum to my earlier post… I tried doing a system restore to several dates (10/13, 10/14, etc.), and get message: computer cannot be restored! Bummer!!!!!!!!!

  • Lori Schimming

    My HERO also. Thank you so very much! After struggling for days…. this was the key!

  • dale

    Thanks for the info — worked like a charm!

  • cr08

    Thanks for the simple fix there with the ‘BATCH spuninst.txt’ solution. Ran into this fun one myself and was close to doing a fresh reinstall.

    Would be nice to find out what the common thread is to people being affected by this. Seems whilst a large number of people are getting hit from all the results on google, an equal number of people have it installed and haven’t encountered a single issue.

  • Carol

    You’re a good man, Marcel. The shortcut didn’t work for me (I’m not a pro) but the longer version did. Thank you!

  • Carsten

    Remember to disable the Microsoft update KB971486 in windowsupdate, otherwise it will be installed next time the updates are downloaded.

  • Patrick

    I am a novice at most of this. I have the UBCD up, but what is the process I have to go through to copy those files from above? I have know idea how to use this tool. I don’t even know where to start? Any help would be appreciated.

  • Patrick: I would follow the suggestion from Mark where you rename the spuninst.txt file to spuninst.bat then double-click it. This should run the uninstall process then you can reboot. If you are not comfortable with that, then you could try to suggestion to boot from a Windows XP CD and do the uninstall from the command line (steps 1 – 4). Beyond that, it is best to allow your local technology expert to help you out. Don’t make things worse. Good luck!

  • Patrick

    Where do I go in UBCD to find that file? Thanks!

  • Rose needs help (from techsupportforum)

    I’ve tried to find the file KB971486 in the Add/remove program but I cant seem to find it. Should i use the UBCD to find the file or am I be able to do it without one? I didnt find the file in the Add/Remove program but that might be because i have not uninstalled it using the CD but when i searched for the file I found it but im unable to delete or uninstall it for now. The CD is still necessary for the uninstallation to work, correct?

  • Justin

    Marcel,

    i had been searching for eons after a windows update caused my endless loop. your rare but specific instructions are appreciated beyond words. THANK YOU! you sir, deserve a nobel prize.

    anything i can do for you, let me know. (i got caught with my pants down and you came to the rescue)

  • Patrick: C:\Windows\$NtUninstallKB971486$\spuninst\spuninst.txt

  • Rose: You may need to check the “show updates” box in Add/Remove Programs.

  • the perrys

    You guys are awesome. Used the “update” method typed in the three commands and it worked like a charm and was easy enough to do. I used a windows xp pro intallation disk to get into system recovery as our dell did not come with recovery disks. the affected pc is running xp home. It would have cost me a lot of money to fix my childs pc as mine was not affected. So, thank you, thank you and thank you.

  • Zezo

    Marcel thanks a million

  • this has been driving everyone nuts

    Marcel, I am hoping this works and will reply within 24. But this is driving a lot of folks NUTS. The connecting factor is its all linked to the “Red October” M$ updates, across multiple OS’s and hardware.

    Have been searching for AGES for a)a simple NON-GUI method to uninstalling a OS-breaking update where your OS will not boot or even log anything and b)MS commentary on issues related to the october update problems (there are virtually no solutions provided).

    One symtom is the “mup.sys” hang or “mup.sys reboot”. This is what you will find a lot of problems that are linked to this issue blogged under. The poor souls are being advised to update hardware, reinstall and update BIOS’s in attempts to fix this ultra lethal issue. Its just unreal.

    Any downtime on a home family pc (such as hours) is hugely damaging – luckily in my case we always have a fallback install of Ubuntu Linux in place for just these types of scenarios (which are sadly at least once a year in my experience). Would suggest to your clients/readers to do the same – a simple filesys install of any human friendly linux (Ubunutu 9 for example, but there are loads of them around) means when Windows fails, you can still get into a working OS with email, internet and tools to find a solution or at least keep you going for a few days while the issue is sorted out, and access your files also. Also consider a live Linux disk as a companion to the (very wonderful) WinUBCD.

    Finally – just thanks so much for your work here marcel – to me you embody the true power of the internet community. Cheers dude.

  • this has been driving everyone nuts

    Attn the perrys : would really appreciate hearing the differences between your two PC’s since you have ONE that was working with the updates, and ONE that wouldnt. This could help with Marcel’s early query about finding the common thread.

  • Todd

    Thanks for posting this solution. I ran the recovery console from the CD and then went to the add/remove programs control panel and properly uninstall KB971486. After everything was done I rebooted and things seemed to be fine. However, when I came home today I had the same blue screen of death again. Am I not uninstalling KB971486 propery? Any help would be great.

  • Chris Staley

    Perfect!

    I was already in the Windows Recovery Console and the

    CHDIR $NtUninstallKB971486$\spuninst

    BATCH spuninst.txt

    commands worked perfectly for me! This has been bugging me for hours! This is the very first time I’ve ever had a windows update toast my computer, and I work in Windows Systems Support. The info is very much appreciated.

  • Jennifer

    Hi Marcel, Before I try your solution, can I boot up from my Windows XP CD I originally got along with my computer?

    The print on the CD says that the disk should be used to re-install my operating system.

    Here is how my problem came about:

    I had originally received a blue screen that said “IRQL_NOT_LESS_OR_EQUAL”. I then restarted my computer and received a message that my computer recovered from a serious error and I selected to send the error report. I then got an Internet Explorer screen that said I had an incompatible device driver and to go to the Windows Update page and do a Custom scan. After doing that, it was found that I needed two updates for drivers. I don’t remember the exact names of the drivers however one was for the graphics driver and another for a networking driver. I also downloaded some other critical updates. When I restarted my computer the blue screen of “A thread tried to release a resource it did not own.” came up.

    What was the KB971486 update for?

    Many Thanks!

  • Marcel for President

    Marcel, I could kiss you right now! Your fix worked perfectly on my computer. I had the endless BSoD 0xE3 loop on my computer, and no startup option would work. I booted into recovery console, used your two simple commands, and PRESTO! my computer boots again! A friend was planning to come over, copy my hard drive, and then do a reinstall tomorrow, but thankfully I did some research online from my work computer and arrived here. Thank you, thank you, thank you. I was LOST without my computer!

  • Mark

    Marcel

    I was able to stop the update on my two laptops, but unfortunately, it killed my desktop. Thanks for the keen insight. Going to show a little ignorance though in your recommended fix. Like Eddy Bob, I have a question about the process of ‘copying’ the files you mention at the top. I removed the hard drive from my affected computer and placed it in an enclosure I have. I’ve got it hooked up to my laptop and found the four .exe files in the $NtUninstallKB971486$ folder.

    If I understand the steps correctly, I should copy the four .exe files and replace the four in the cache with these. Then also replace the two in the system32 folder and then the four in the system32/dllcache? Once this is done rehook the drive back to the original computer, boot up and use remove program to get rid of the update for good.

    Is that the right idea?

    Thanks a million.

    Mark

  • KBWood

    I downloaded Ubuntu and got into all my files. I see the KB971486 under the Windows folder, but I don’t have an xp disk to make UBCD, so what are my options for uninstalling this update. No way to do it with Ubuntu?

  • This had me freakin out!!!

    OMG!!! Thank you so much for this, Marcel. It’s funny that I was on hold with Microsoft yesterday for like an hour and I found your page within 15 minutes by using google. I’ve had my Dell for 5 yrs with absolutely no problems at all. Well, except for the small occasional bugs. I’ve been putting off backing up my data for a while now and I will be sure to do that ASAP.

  • Patrick

    Marcel:

    Thank you for all of your help so far. Am I correct in that I can’t make a UBCD or a Win XP Recovery disc for Windows XP on a Vista system. I think this is what my problem is because the pics from the UBCD website don’t match what I see on my screen from the disc that I made from my brother’s Vista system. Thanks!

  • Todd: the update may have ran again overnight, perhaps? Just fix it again and turn your Automatic Updates to notify you before installation.

  • Jennifer, yes that is the correct CD. In addition to reinstalling the system, you can use it for what is called the “Recovery Console”. More information is on this Microsoft web page

  • Mark: a simple solution is to rename the file C:\Windows\$NtUninstallKB971486$\spuninst\spuninst.txt to spuninst.bat then just double-click it. This will automate the uninstallation process.

  • KBWood: I’m not sure if your Ubuntu CD can write to NTFS. Do you not have a regular XP install disc or can you borrow one?

  • Patrick: I’m not a super-duper expert on UBCD, but I think you should be able to make a UBCD from Vista that will boot on an XP system. The boot CD really does not care what system is installed on the internal hard drive (if any at all!).

  • KBWood

    No Marcel, I don’t have an xp install disk and pretty sure can’t borrow one. Moved to FL with all friends up in MI. So in Ubuntu, I couldn’t find a “C” file named C:\Windows\$NtUninstallKB971486$\spuninst\spuninst.txt and do the rename thing?
    Also I do have Vista on a different desktop. So like you told Patrick, maybe I can create one on here and use it on the xp unit for this fix?

  • KBWood: since you have a second machine, you can either create a boot cd on that machine or pull your hard drive out of your XP machine and connect it to the Vista machine to access the files. However, like I’ve said to others, if you don’t feel comfortable doing this, don’t risk making things worse – take your computer to a local trustworthy computer expert. They should be able to follow the instructions on this site and fix your computer fairly quickly.

  • KBWood

    I’m sorry I forgot to mention that my new machine also didn’t come with an install disk like my xp one. So slaving is my only option, huh? Sounds scary. I’ll have to watch some vids and read up on that if that’s my only option.

  • this has been driving everyone nuts

    Attn : KBWood – re using Ubuntu. Your options are to run the changes manually via commmandline. Ubuntu will mount your disks so you can view them via the “Places” menu and easily copy the backup files mentioned in this posting to their correct places (essentially the first posting has all the locations).

    The livecd is a great way to get online again in the case where you need to check mail, print an airline ticket, or google for a solution to your computer problem – when Windows packs up. You will need to review Ubuntu forums for specific issues, but essentially to run the fix in this forum posting you just need to use ubuntu to enable access to the filesystem for XP so you can copy and “uninstall” the files manually. Hope that helps.

  • this has been driving everyone nuts

    IMPORTANT : my resolution involved uninstalling THREE of the updates. I will post some more fine grain details in other forums as well to spread the word, but essentially in my case :

    Symptoms : XPSP2 halts in safe mode at “\WINDOWS\SYSTEM32\DRIVERS\MUP.SYS” or “\WINDOWS\SYSTEM32\DRIVERS\IOMDISK.SYS” and reboots over and over after the updates were done.

    Solution : rollback of KB971486 on its own DID NOT resolve the issue. However, rollback of KB971486 and additionally – KB958869( GDI+ security changes) and KB969059 (Indexing Service security changes) sorted this out instantly. Kudos to Marcel for leading the way to enlightenment.

    My theory is that its the Indexing service change that also creates issues on startup (in addition to KB971486). I have not proven this theory tho.

    Method : same as described here – manual running of the batch uninstall script in the uninstall for each.

    Next Step : I am VERY certain that its not all three, but two of the updates in combination that fixed my issue. But which of the 2 is the question. I aim to backup my (now working) WinXP to an image so i can rollback, and then test some combinations of these updates again to see which way it breaks.

    Key Point : Microsoft Updates QA needs a kick in the pants. But we knew that already…..

  • KBWood

    Totally new to Ubuntu…just dloaded it to try and fix this since I don’t have xp disk. Anyway, how do I get to the command line feature? Should I be on their forums instead of asking you here? Sorry.

  • this has been driving everyone nuts

    KBWood : Technically you should be on Ubuntu forums. I raised it here as an alternate (e.g. in the case where UBCD4Win is not buildable or obtainable or in case such as yours where recovery console not accessible). Also its a great backup plan as its NON windows….. so a windows virus that takes out your WinXP doesnt affect it for example (99% of the time).

    The relevant part to this fix : commandline you would use an app called TERMINAL in your accessories meny and use Linux commandlines/commands to navigate and copy files. e.g. “cp” instead of “copy”. However, i would suggest just using the PLACES menu to open up the folders representing your WinXP C drive and doing the whole thing via copy&paste commands on the desktop GUI which would make it far easier and similar to the windows approach of moving files. Essentially the Ubunutu equivalent of windows explorer. Copy the files required from the $UninstallXXXXXX$/spuninst directory to the windows/dll cache or similar dir. The key thing about Ubunutu is you get to see and access your C drive again so you can actually do this maintenance. You dont need to necessarily use commandline if you arent linux savvy, just use the general gui and explorer functions. This is similar to what you would have is you used UBCD4WIN as a boot up.

    Hope that helps.

  • Apparently, there is a link to download the Recovery Console ISO image here http://www.thecomputerparamedic.com/files/rc.iso

  • KBWood

    I don’t understand how the copy/paste method would do what Marcel said with Copy “file path 1” “file path 2”.
    On a ubuntu instruction page, I seen something that sounded similar.
    mv: The mv command will move a file to a different location or will rename a file. Examples are as follows: “mv file foo” will rename the file “file” to “foo”
    I am so confused with all this, and the stress from it all doesn’t help me to think straight. I’m trying. Sorry and thanks.

  • I used the recovery console to remove it and the system booted fine. How can you stop the update from just coming down again because surely this would cause the same problem?

  • this has been driving everyone nuts

    KBWood : If Ubuntu isnt helping or making it complex, i suggest just download the Recovery Console iso as per marcel’s link so you can get to the recovery console and then continue as normal. Keep ubuntu for another ocassion where you have time to become familiar with it or just want to get a browser going during a failure, rather than use it for this fix.

  • KBWood

    Apparently, there is a link to download the Recovery Console ISO image here http://www.thecomputerparamedic.com/files/rc.iso

    So is this basically a way in to do this fix for people like me without an XP disk? And after I get this, can I do the short method in Update #1, or do I have to do the long Copy version fix?

  • KBWood

    Marcel and ‘this has been driving everyone nuts’…I can’t say enough thanks for what you guys have done for me and everyone. My problem is resolved thanks to that link. So for anyone without the xp cd, this is your hookup. Dload that ISO and burn image to cd. Boot that disk is your bsod drive and do the Update #1 commands. So simple after days of headaches. You guys are awesome. I’ll quit blowing up this thread now. LOL. Thanks again and again and again…….

  • dig dug

    Hey, Marcel, so I used the quick four-step solution and finally got past the BSOD! I went to uninstall the update right away but when they asked me to restart after the uninstall, it restarted with a STOP: 0x0000007E. I’m not sure what I did that caused this, so hopefully you can help.

  • Dig Dug: the 0×0000007E error is pretty generic. Try running a chkdsk on your hard drive from the recovery console. If that doesn’t work, here is Microsoft’s official page on the error. Good luck!

  • Hello from Russia!
    Can I quote a post in your blog with the link to you?

  • Jennifer

    Hi Marcel,

    Your fix worked for me to get rid of the “A thread tried to release a resource it did not own.” message. Thanks!

    Now my original blue screen that says “IRQL_NOT_LESS_OR_EQUAL” has popped up again. When I restart my computer, if I am able to log on I get a message from Microsoft saying that a serious error has occurred and asks me whether or not I want to send an error report. When I send the error report it tells me that I have an incompatible device driver. It is not clear to me as to which device driver is the problem one. Is there a way to find out?

  • Like KBwood, I am also without a WinXP cd. Unlike him, I don’t have the application to run ISO files. Before I found this thread, I just went through add/remove programs assuming that if I took off all of the windows updates then i would be set, and for a while it seemed like i was – then bsod happened. I can run my computer for a while before bsod occurs which seems a bit different from most who are posting that they can’t get past the bsod upon boot up. I don’t really understand the copying options in update 1 as to whether or not I need a boot cd for that also given that I can actually maneuver around on my computer a bit.

    Is my only option to wait around for a Windows update to have another update which actually fixes this, or is that wishful thinking?

  • Polprav: yes, please do!

  • Jennifer: That error is also pretty generic. Chkdsk is a good first start. From there, research the error message on the Internet. Good luck!

  • Doug: If you can boot into Windows, then you don’t have the same problem as everyone else. General Windows maintenance is recommended.

  • Richard

    Hi Marcel,

    I also encountered this blue screen problem and tried to uninstall the update using the method described above. However, when I tried to boot from the Window XP CD, it never got to the Recovery Console and another blue screen error pop up. Any idea what this is and how I can fix it?

    *** STOP: 0x0000007E (0xC0000005, 0xF785480BF, 0xF8994208, 0xF8993F08)
    *** pci.sys- address F748E0BF base at F8541000, DateStamp 3b7d855c

    Thanks

  • Richard: This could be something like bad RAM, or as simple as a bad CD.

  • Ash

    Thanks so much for this. Fortunately, I had a friend’spc which had an option to boot into the recovery console on boot-up. I used the “uninstall any Microsoft update” method as described in the 4 steps, and rebooted normally. No cd needed. Didn’t need to uninstall any other updates as another commenter did.

    So I’m at the point where I can properly remove the update from add/remove programs, and receiving a warning about other updates possibly not working properly…wondering what to do.

  • Ash

    I forgot to add, I would be interested in the boring details and steps you took to pin the problem down to the update, Marcel. When and if you get the time. Thanks again for quickly posting your findings and updates. Saved me from having to do a repair install.

  • Ash: at this point I would refrain from removing it from the Add/Remove Programs control panel. A few users here have mentioned, and I have now personally observed that doing this can make things worse. At this point, if it’s working, leave it alone 🙂

  • Roger

    New Toshiba NB200 – XP wants to do a massive update, but then I get the BSOD, with no way out. I tried this:

    Solution : rollback of KB971486 on its own DID NOT resolve the issue. However, rollback of KB971486 and additionally – KB958869( GDI+ security changes) and KB969059 (Indexing Service security changes) sorted this out instantly. Kudos to Marcel for leading the way to enlightenment.

    Unfortunately, it didn’t work.

    I have Norton Ghost 14 fortunately, and I did a backup before this all happened. Sorry, no answers, except don’t allow Windows Update to happen? Doesn’t sound like a good answer either.

  • Jack Berkery

    There’s more to the problem.

    I removed it in recovery mode and the system booted up fine. I even removed it with Add/Remove Programs. But when I shutdown (not reboot) it merely reinstalls itself again and the problem comes right back. How can I get rid of it permanently?

  • Editor’s note: the following is good information, but since it requires installing the KB971486 update, we can’t be sure it won’t cause the blue screen problem for those affected. Attempt at your own risk.

    Check the links for more info:

    http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1579

    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?pg=2&p=1&tid=1715d718-b06e-496c-9a43-4129467ae56a&dg=microsoft.public.windowsupdate&cat=en_US_2231886c-4c59-45b0-92e0-8881ddf5f40b&lang=en&cr=US&sloc=en-us

  • MisterB

    Thank you! I consider myself an “IT Pro” and yet I have been dealing with an associate’s computer for nearly a week to no avail. These are the first set of instructions that got me past the BSOD.

  • Thank you very much, Marcel. I got my computer back!!

    In my case, ntoskrnl.exe and ntkrlpa.exe are missing from the folder Windows\System32 after the installation of KB971486 failed. I simply dragged those two files back from folder Windows\System\dllcache (same as the one in Windows\NtUninstallKb971486$) with a UBCD and would hate to image what “repair” would have been done to my computer without reading your posting. In my case, the presence of both KB971486.log and KB971486Uninst.log indicates that both installation and un-installation of KB971486 failed.

    I really appreciate everyone who took the time to post replies to this instance. I’ve learned a lot these past few days!! The editor is right and I am not going to proceed with KB971486 since I have my computer run in a very restricted mode.

  • Marcel, I have to respectfully disagree that my problem is not kb971486 related. That patch of updates occurred the night before I began receiving the bsod which I had never experienced on this computer after 5 1/2 years of use. I did go through add/remove programs and uninstall 11 of the 12 (couldn’t find the 12th) updates that occurred on 10/21/09 which has seemed to progress the problem. In particular I’ve noticed that it has some relation to internet applications, and allowing the computer to idle for longer than 5 minutes. If I attempt to log on to AIM my computer freezes up and goes to a new bsod, the congruency between the two bsod’s (before and after removing from add/remove programs) is that the BCP1 & 4 error code is the same – 0x00000003 & 0x805c8c88 . At this point with your testing have you discovered whether or not the recovery console will repair ‘additional’ damage done by removing the kb971486 file through add/remove programs? Should I attempt to reinstall the updates? I’m still trying to find my winxp cd. Thank you for your help and advice regarding this forum, I definitely feel stranded at this point.

  • Doug, If you know how to, take a look at the recently created log files with names beginning with KBnnnnnn in Windows folder. The log files can be read with notepad. Though technical, you should be able to tell which update failed. In my case, both files KB971486.log and KB971486uninst.log said the processes failed and that was why important Windows exe files were missing.

  • Doremi- Thanks for your response, All 11 files seem to be riddled with errors. In the case of 971486 I’ve got: Failed to Enable SE_Shutdown_Privilege ; RegOpenKeyEx failed with error 0x2 ; & The Update.ver file is not correct. RegOpenKeyEx & Cab does not exist seem to be the most common throughout the files, but there are also uninstall logs of all the updates which say Uninst- Check Uninstall Data for Multi Instancing [Instances] section not found, not sure if thats normal or not. Its possible that I might be able to get my hands on a winxp tomorrow. Is recovery console still the way to go, and with all of my files having this RegOpenKeyEx issue, do I need to be doing the recovery console installation for all? Going back further in the windows folder to a month ago I’m finding that the failed to enable Se_Shutdown_Priv & regopenkeyex scripts are amongst other updates, but none which have rendered my computer to blue screenage..do I leave these files alone? Sorry for the length and thank you so much for the help.

  • Doug,

    In my case, only KB971486 has Uninst.log and it said un-installation failed at end. If you can find any KBnnnnUninst.log file, that may be the update causing BSOD. WinXP CD is not going to work. You need a bootable CD such as UBCD4Win or recovery console. With a boot CD, I would simply follow update#2 to rollback the most recent update(s) with a KBnnnnUninst.log file. However, I’m no expert and. if you could, you should backup your files before you proceed with any test. Don’t worry about updates logs files created months ago for now. I think you should probably get your computer back in shape first, backup all the files then restore and redo all the updates suggested by Microsoft web site.

  • Thanks doremi, if I can’t get a boot CD, is going through this website for UBCD what I need? None of my uninstall logs have an ‘uninstall failed,’ so I’m not sure that this leads me to discerning which update is the actual cause, although I’m positive that the strain of updates is what has perpetuated these issues as by their appearance in Event Viewer at the time of the update.

    http://www.ubcd4win.com/downloads.htm

  • Doug, Again, I am no expert.

    If you are positive that the strain of updates is the cause of the issues. check to see which log has the most recent time stamp and follow Update#2 to uninstall the updates one at a time. With any luck, you may be able to undo all the updates and get your computer back in shape. Best of luck to you!!

    BTW, You will need a XP CD and SP1 or SP2 to make UBCD4Win.

  • hi thanks for this it explained allot but i still have a little problem i have a dell laptop and don’t know if i shod take the HD out or not to do what you said to do with the hard drive
    i have also just downloaded (WindowsXP-KB936929-SP3-x86-ENU) don’t know if it will be of any help maybe i could put it onto a cd or something like that and then boot of that cd if you have any better ideas they would be of great help thank you very much
    KLAUS-PETER HEISE

  • i was trying to reach safe mode to get rid of the recent “scvhost.exe” virus and found that i could not restart in safe mode. at first, i was able to restart in normal mode but then i changed the boot.ini in windows to force safe mode, which was stupid, because it locked me into safe mode. uninstalling a variety of KBnnnnnn files has not helped so far. i do have a repair console by virtue of having a windows XP cd, but i think i can maybe get back to a normal boot if i can somehow change the boot.ini without getting to windows to let it boot normally and not force safe mode. anyone know how to do that?

  • Don Kirk

    OMG Thank You! This post has just saved me hundreds of dollars and possibly my marriage (as my wife was none too pleased that “I” had wrecked the family PC by using Windows Update!)

  • i was able to boot successfully by creating a new boot file using the recovery console.

    command was bootcfg \rebuild.

    this allows you to create and name a new boot file. upon rebooting, you will be allowed to choose the new boot instead of the one that is locked. once i got back to the desktop, i ran a malware removal tool called “combofix” and it scrubbed the scvhost virus [browser hijack]. then i reverted back to the original boot and everything was fine.

    moral of the story is never change your boot.ini in windows to force safe mode because you can just restart and hit F8 to get boot options. once you get stuck outside of the desktop OS, you have no way to change the boot.ini to let windows boot in normal mode.

    i believe the failure of the updates to properly install left me particularly vulnerable to the virus as the windows updates specifically mentioned that their purpose was to avert remote access and browser hijacking.

    read about bootcfg here:
    http://support.microsoft.com/kb/291980

    read about and download combofix here:
    http://www.bleepingcomputer.com/combofix/how-to-use-combofix
    combofix is an extremely invasive malware removal tool. use with caution and read the tuturial.

    keyword that might help others find this thread:
    greatfeedmill = all browsing becomes directed to this site upon hijack

    thread linking greatfeedmill to loss of boot capability:
    http://forum.bullguard.com/forum/10/GreatFeedMill-IE-Firefox-Brows_78768.html

  • I’ve been fighting with a clients PC that was riddled with virus and spyware and thought I had it all cleaned up, but the KB971486 update, after it was installed, would prevent XP from booting up, instead getting a BSOD of STOP 0x000000E3.

    Following the advice to remove the drive and hook it up via USB and copy the files as instructed above allowed the machine to boot again, but when I installed the update again, the BSOD came back. I download the update to install it manually, and it to failed.

    Then I saw the advice to run Combofix, which I did, and it detected a ROOT KIT! Once I permitted ComboFix to finish cleaning the PC, I then tried again to install KB971486 and it worked beautifully. So, when an update fails, don’t just fix the PC so it will boot and ignore the update. This computer could have been returned to the client with the ROOT KIT still on it!

    Thanks for the advice!!!

    Carey Holzman
    co-host: Computer America Show

  • XP CRASH

    I’m having the same XP logon problem (black screen, moveable white mouse cursor after XP welcome screen). None of the F8 SafeMode logon options work.

    My computer is a generic no-name PC. It has 2 physical drives and 3 drive partitions:

    C: drive – Windows 2000 Professional SP4
    D: drive – some Adobe applications
    F: drive – Windows XP Professional SP3

    I can log in normally to the C drive (Windows 2000) partition, see all the other drives, and access the data on all the drives. I’m using the Windows 2000 partition now to access the Internet and write this message.

    I downloaded the recovery console iso image Marcel mentioned above, burned it to disc, and booted from it.

    The Windows install options were listed as:

    1. C:\WINNT
    2. E:\windows

    But the C drive is Windows 2000 Professional and the E drive is the recovery console disc in the CD drive. Why doesn’t the F drive installation (my computer’s Windows XP Pro SP3 installation) appear?

    A person on another site suggested that the recovery console gets confused sometimes and mislabels drives. The person suggested that I just select the E drive install and try to run the suggested fix commands.

    I selected the E:\windows option and entered my XP administrator password.

    I entered the suggested fix commands at the E:\windows prompt to uninstall the patch:

    cd $ntuninstallkb971486$
    cd spuninst
    batch spuninst.txt

    The computer then displayed the following lines several times:

    “The system cannot find the file or directory specified.”
    “The system cannot find the file specified.”

    Even though I was at E:\windows, and XP is installed on the F drive, I think I was accessing XP on my computer, as the administrator password I used to access E:\windows is the password for the XP installation on my computer. However, the commands did not find the directory or the files???

    I tried it a second time just to make sure I had not mis-typed the commands, and the same error lines displayed.

    Do you know what might be happening?

    Is there a way to access the F drive Windows XP Pro install through the recovery console so I can uninstall the patch?

    Could someone please help? I feel like I’m so close to resolving this issue. Thanks very much for your help.

  • this has been driving everyone nuts

    UPDATE : my previous posting mentioned i needed to uninstall 3 updates to get back to a boot state. I have since narrowed this down to the KB971486 update. I installed updates INDIVIDUALLY by seperate reboots, rather than all at once. All Updates worked (in the sense that windows started up ok) except KB971486.

    HOWEVER – since putting all the other updates in, and skipping KB971486, i have had problems in terms of IRQ messages, and most prominently – full freezes/memory corruption errors. This has made the whole OS unusuable as after 2 minutes it locks up. Essentially a full freeze, with menus going transparent.

    My theory is maybe its linked to the GDI+ update (KB958869) perhaps which needs (maybe) something from KB971486? Also looking at .NET updates being a problem.

    Has anyone had similar experience and resolved it? I am fairly sure its still related to the updates. Again – driving me nuts.

  • notpcwise

    I too experienced the BSOD with a STOP: 0X0000007E. Followed suggestions on this forum to uninstall KB971486 and about 10 others. Now I’m getting the BSOD with page_fault_in_nonpaged_area with STOP: 0X00000050. I can access Recovery Console using a XP/HE upgrade cd, but cannot seem to get out of this issue. Help would be greatly appreciated.!!

  • this has been driving everyone nuts

    Update : I found that on my PC there was a rootkit virus. This is similar to a previous post, and combofix removed it. Once that had been removed the instabilities are still there – BUT – i was able to properly install the KB971486 update (!). The issue was with having a rootkit which locked up the start up sequence post update – e.g. the security update killed it, but as a by product the rootkit wouldnt let winxp startup. In any case – i now have a)no rootkit (i hope) and b) KB971486 installed and c)still lockup/freeze problems.

    Anyone with similar experience or hints on where to go from here please post. I may try uninstalling KB971486 to see if freezes stop.

  • Wayne Williams

    I am glad to see I am not alone with this problem. I ran the October update and then put Toshiba M35X-S161 in standby mode, as I was going to return later to read e-mail and wanted a quick boot. As I have just found (after days of frustration, contacting Microsoft and Toshiba) there were problems across extensive makes and users. I, having been medically disables since April 1997 and living on poverty level SSI disability income since, can not afford the kind of irresponsible conduct perpertrated by Microsoft. I wish someone would start a Class Action suit against them for this!

  • Dan

    Hi Marcel,

    Just wanted to pass on a big thank you for this information.

    Due to a non-related issue, I ended up needing to do a system restore – upon completing this, my old updates needed to be redone (according to ms update) – after the 50 or so updates, got the stop error upon re-boot.

    The fix for me was quite simple as I have two o/s’s installed on the c drive (long story), was able to boot into the secondary o/s which runs out of the file folder windows.0 – then copied the files over to the main o/s’s windows folders per your instructions.

    Re-booted and was back to normal!

    Thanks again – was a huge help! You Da Man!!!

    d

  • Marco

    Thank you Marcel Brown, my hero!

  • Dharmendu Patel

    Thanks for your great solutions. It helps me to avoid formatting my pc. It is really a great help for me.

    I appreciate your effort.

    Thanks a lot.

  • Mike

    That was a great fix. Thanks for the help That was a tough one.

    -Sizz

  • Russ Price

    I’ve had the same problem and fixed it the same way but now the problem is how do you stop that update from wanting to download again? I’ve turned off automatic updates and still when I go to shut down, there’s always an update(same one) that wants to install. Does anybody know how to make it go away for good?

  • Valerie

    Please help, I don’t have a reboot CD or DVD, I don’t know how to fix this problem, yes same thing after updates,etc, restart, and the blue screen. Oi keep hitting F12, can’t fix. Please help

  • Jeff Russell

    I had a customer bring me their computer that was booting with this error. A quick google search brought me here. I applied the fix in the article and they are up and running again!

    Thank you for the research you did and for posting the remediation.

    Regards,

    Jeffrey S. Russell

  • gotts

    when i try update 3 tha computer keeps telling me its not a valid path

  • Sidney

    Thank you very much. help me a lot. However, I am very interested in the details of how you discovered the fix. That may help to fix a similar problem later on.

  • inktank

    i have a refurbished Toshiba Tablet PC which seem to be especially susceptible to this. I do not have a recovery dc, there is no CD drive, only a thumb drive. I cannot access a cmd prompt, cannot get it to network. nothing. no help on microsoft website, no help from toshiba as I have called them. Its not a hardware issue because it happened to me on the same day most other people, mid Oct. Ive read its a clash between the service pack and 3rd party anti-virus software.

    If theres any other help out there, or maybe a little step by step on what to put on my thumbdrive in order to access the C drive and overwrite those files i’d be grateful, and possssibly and preferably without losing my files. I know my way around windows to sort things out and fix things without losing all of my work but iffff i can get it to boot up but this one just baffles me

  • inktank: You have two options. The first is to try a USB CD drive to boot from a CD like UBCD. The other is to try to make a bootable flash drive. Doing a quick search, I found this web site: http://www.pendrivelinux.com/install-and-boot-ultimate-boot-cd-ubcd-from-a-usb-device/

    Good luck!

  • Cardinal

    Just a quick note:

    If you choose to roll back the KB971486 by slaving the HDD and using the spuninst.txt -> spuninst.bat process, remember to change the drive designation from C to E (or whatever the new designation is) in spuninst.txt first. Rolling back KB971486 on C won’t fix the problem when the messed up HDD becomes E when you slave it.

    I wish I realized that an hour ago. 😮

  • deedenton

    I have a million hours of research on my new gateway laptop. the Blue screen keeps coming up. or if i hit alt+f10 it says edit windows boot options for:windows setup
    path: \windows\system32\boot\winload.exe.
    When I called gateway tech support my called went to india and the rep said there is no recovery disk for my computer windows 7. Which I now know cannot be the truth. I am now in tears and dont know what to do…..plz help

  • Cal

    Not to sound completely computer illiterate, but the files you show to copy above show C: on the first part and c: on the second part. What are you telling me to do? Simply copy these files from the boot CD to the hard drive or is the C: the file you want copied and the c: the destination?

    Thanks for all the help on this.

  • Cal

    Just another question as I printed and read through this fix. When you get to the command prompt and type the copy command, do you type it exactly as it is writtenwith spacing and quotation marks, etc? This forum has been extremely interesting to read and I appreciate all the information here that points to a fix.

    Thank you all very much for sharing!

  • Cal

    Hello, I am seeing the 0x000000E3 error and I have read through the suggested fixes all of you have outlined. I am curious as to how the copy command text is to be entered. Do I enter it as it is above for example Copy “C:\…..” “c:\…..” with with quotations included? Does this format copy from C: to c:, I have not seen that format before.

    I attempted this question once before but I am not sure what information you are looking for as afr as the box “website” is concerned.

    Thank you for all the information in these posts, it looks like it should fix my problem.

  • Gary Luyben

    Great fix. worked like a charm

  • Mowse

    I got the blue screen after updating windows too, but i use vista, what steps do i take?

  • That was a great fix. Thank you very much. help me a lot.

Pin It on Pinterest

Share This

Share This

Share this post with your friends!