SP4 : BSOD > MUP.SYS

[Jan Didden]

Hi,

We have installed SP4 on a number of workstations and are experiencing BSOD
since then.

Stop 0x00000001e (0xc00000005,0xbfeaed16, 0x00000000, 0x00000000)
KMODE_EXCEPTION_NOT_HANDLED
Address : bfeaed16 base at bfeae000, datestamp 3e25bc59 - mup.sys

In Microsoft Knowledge Base Article -815023
(http://support.microsoft.com/default.aspx?scid=kb;en-us;815023) is
explained that mup.sys has been replaced in SP4 because of a potential
Buffer overflow vulnerability.

We are using Win2K workstations in a network with an SBS 4.5 Server and an
Win2K-Server.

I have seen other articles linking this problem with the Novell-client. In
the past we have used a Novell Server and therefore a Novell-client was
installed on these systems. The Novell client has been un-installed and the
Novell-server has been shut down.

Any help would be appreciated.

Thanks,

Jan

 

[Steve Duff [MVP]]

You can probably downrev to the MUP.SYS from SP3; test that
first of course, but I wouldn't expect any problems other than
you may have to fight with the file verifier at startup. (If that doesn't
fix the problem then MUP.SYS isn't the cause, just the
victim.)

I think this is probably one of those issues you should try referring
to MS PSS even though it may cost you a little $$$. It seems
the issue is widespread in your LAN enough to justify that.

Some versions of NWClient32 can cause this, but if that is
deinstalled it shouldn't be related. But you might check
the services database in the registry on an affected machine
to see if any of the Client32 low-level services are still loading
or trying to.

Steve Duff, MCSE
Ergodic Systems, Inc.