Latest security updates from WindowsUpdate ruined my computer -- h

[Guest]

I am a strict adherent to updating regularly through WindowsUpdate. I logged
on this morning to find a little icon in my tray saying several updates had
been downloaded and were ready to install. I looked at the list, saw 4
security updates, and an update for the Microsoft Malicious Software Remove
Tool (or whatever it's called), and I clicked install.

I installed all the updates and asked me to reboot, as usual. But now the
computer won't go past the main Windows logo and the horizontal moving bar
thing. So I left it on that screen and went to work, came home 8 hours later
and it was still on the Windows loading screen.

So I reset the comptuer and went into safe mode, and rolled back to
yesterday. No go.

I then went into safe mode to uninstall thse updates from Add/Remove
software, but when I click "Show Updates," only updates that I installed up
to March 14 are showing up, none beyond that.

This is the kind of thing that really upsets me. I do EVERYTHING Microsoft
tells me to do to keep my computer "safe" and now I can't even USE my
computer outside of safe mode.

Short of reinstalling (AGAIN), how can I fix what these recent updates have
done?

 

[Ramesh, MS-MVP]

Hi Aaron,

See if uninstalling the hotfixes (via Recovery Console) helps.

How to uninstall a hotfix or Service Pack via the Recovery Console?:
http://windowsxp.mvps.org/spuninst.htm

I've seen two instances where KB890859 (folder name $NtUninstallKB890859$ )
causes this problem.

 

[Guest]

Ramesh, thanks for the insight. You say you know of 2 other instances where
890859 causes this. Make that three - mine. And I know of about a half dozen
or more sprouting on other technical boards I participate in. What can you
tell us that Microsoft is doing about this?

Dick White

 

[Ramesh, MS-MVP]

Dick White,

I've installed all the recent updates and both of my systems, but could not
reproduce the problem here. Not sure what's causing this. But in one case,
one of my fellow MVPs said that it has to do with a language pack (or sort
of package) he installed. I'd be interested to hear the feedback from others
affected. BTW, I saw your post in the WindowsUpdate group. Should someone
needs to uninstall this fix (and if Windows does not load), Recovery Console
is the way to go:

http://windowsxp.mvps.org/spuninst.htm

 

[Guest]

Ramesh, thanks for the quick reply. Yup, that was me over in the other group,
and I've left tracks all over the groups at Broadband Reports and CNet Help
too if you want to visit with us over there...

A new wrinkle late last night - For S&G, I thought I would try your recovery
console method. I had stumbled around in the recovery console during some of
my earlier journeys down this path thinking it might be some sort of
DOS-screen type driver-roll back, inasmuch as I couldn't get even to Safe
Mode in the GUI to do a standard rollback to the day before accepting
Tuesday's patches from automatic update... but I couldn't figure out quite
what to do in the recovery console so I just went back to the full reinstall
process which though it would take an hour of babysitting, at least I knew I
could bring the system back to life. So I was pleased to see your description
of how the recovery console could be used to uninstall a hotfix.

Anyway, I tried your method in a controlled test. I started from a clean
reinstall (of which I now have much practice) and after it booted the first
time I went to Update and UNchecked all 16 listed critical updates except
890859. Thus I would install ONLY 890859, knowing full well that it, by
itself, was going to cause the meltdown (again). Then I followed your
recovery console instructions to uninstall the only hotfix in the $...$ list.
The uninstall process seemed to operate as advertised (a bunch of "1 file
copied" lines went by on the screen) and the batch terminated. However, when
I rebooted the system it was still stuck back in the endless initialization
failure loop. Soooo.... for my system anyway, the only way out is a complete
reinstall; the recovery console is not a solution. Sorry to take the wind out
of your sail on that one...

As for new developments and current status, I have stabilized the machine so
that at least my wife will speak to me again (her email is important to
her...) by taking it through one last full reinstall and then allowing all
patches EXCEPT 890859. I then went to Update and checked the box to hide that
remaining uninstalled item and also check the box in the Security Center
balloon tip to "don't bother me anymore" so that the system would not try to
do its own thing and blow itself away again the next time she checks her
email. I also submitted an official support request via email. It has been
assigned to Jerry Fang (perhaps you know him?). He reports in his
introductory email response that he has submitted it to the Product Group.

As I noted in my reply to Jerry, the good news is that system is currently
stable and protected from inflicting any further damage to itself by turning
off Automatic Update and hiding the patch. The bad news, however, it is still
exposed to whatever vulnerability that patch was intended to resolve and will
remain so until we can figure out what is wrong with the patch.

Thanks again.
Dick White

 

[Ramesh, MS-MVP]

Dick White,

Thanks for the detailed feedback. And sorry to hear the Recovery Console
procedure did not fix the problem for you. On the contrary, one of my fellow
MVPs (who was facing this problem) could roll-back the hotfix successfully
via the method that I described, and he confirmed that he could start
Windows after that.

No. Actually the MVPs don't work for Microsoft, but awarded by Microsoft.
You can learn more about the MVP Program here:
http://mvp.support.microsoft.com

 

[Guest]

I can add two more machines to this list.

I originally thought that the update damaged the kernel so I dumped a new
copy of the kernel into the system32 directory... the error no longer
displayed when I selected "disable automatic reboot on system error" from the
boot menu but the system still hung before getting to the winlogon screen.

I will be removing the updates one by one once I dig up the xp cd again,
however, this will only prove that 890859 is the cause of this problem... it
does not provide a solution.

I have been trying to think what aftermarket software these two machines
have in common which could have caused this conflict.
Currently the only things these machines had in common are:
-Running Windows XP Pro SP2 with all updates applied.
-Microsoft Office 2003
-Nero Burning Rom
-Roxio Easy Media Creator
-Nvidia detonator drivers
-Soundblaster Live.
-Norton Systemworks 2005

Do any of you guys have the same software / hardware?

 

[Guest]

I fixed both of my computers which had this problem.
How I did it:
-Loaded recovery console from xp cd
-Change directories into c:/windows/$NtUninstallKB890859$/spuninst/
-ran "BATCH SPUNINST.TXT"
-exit and restart computer

Then it was still rebooting so I selected disable automatic restart from the
safe mode menu.
This allowed me to view the error message which was "kernel32.dll missing or
corrupt"
So I replaced the kernel via the recovery console and rebooted.
No errors, no restarts!

Now if only I knew what had caused the problem.

 

[Treeman]

YOU MAY WANT TO WAIT A WEEK AFTER THE RELEASE OF UPDATES AND PROWL THE
FORUMS & NEWSGROUPS TO SEE IF THERE ARE ANY PROBLEMS BEFORE YOU DO YOUR
OWN UPDATES.
Hindsite is always 20/20
Best,
Treeman

 

[Ramesh, MS-MVP]

Thanks Ramesh, your suggestion of removing update 890859 did the trick.

Thanks for the feedback, glyph.

 

[Guest]

Yes, me too, and now i'm stuffed also. i recently discovered how to remove a
buggy update via the recovery console only to discover the spuninst.txt file
was missing from the kb890859 folder. (i think this happened because i
accesed it via another install of xphome which removed the update i think but
still didn't fix the reset loop i'm in). can someone tell me the contents of
this file so i can get back into xppro?!

 

[Maurice N ~ MVP]

Sean,

If you are still unable to login to Normal mode of XP, check on the
following.

Turn off "reboot on error" setting for Windows.

Go to My Computer, then select Properties. Select the "Advanced" TAB and in
the Startup and Recovery section click the "Settings" button. At System
Failure block,
"Un-check" the "Automatically restart" line. Apply change, make clean exit.

This will prevent a "reboot on error", and will also show (when you have
Windows exception) the error code and its description.

IF a STOP error occurs, write down its number and complete description and
follow up on fixes.

If Normal mode of Windows is still "re-booting" itself, reboot pc ...
Try F8 selective startup of XP ---- choose the option with "boot logging".
Hopefully you would then be able to see the contents of "Ntbtlog.txt", see
which drivers and services may be the problem. The following is a snippet
from XP's Help and Support: on Enable Boot Logging

Starts while logging all the drivers and services that were loaded (or not
loaded) by the system to a file.

This file is called ntbtlog.txt and it is located in the %windir% directory.


See Aumha.org's knowledge base on stop errors and keep it handy
http://aumha.org/win5/kbestop.php


If you get stuck in loading Windows in Normal mode, reboot into Safe Mode
(tap F8 at bootup).
Use XP's Event Viewer to get more detail on your "error".
Start button/ Run / type
eventvwr.msc<enter> --
or Go to Control Panel / Performance and Maintenance/Administrative
Tools >Event Viewer.
Review the sections and look for Errors or Warnings that match the
time the event occurred.
Double click the line that is at issue---the information may give a
clue on the issue.