After XP splash, BSOD

[Guest]

I have a XP Pro machine with Pointsec. When the machine boots, it pasts the
Pointsec then the Windows XP splash comes up, then BSOD, and it is so fast I
cannot read it before it reboots. I have tried safemode, and tried to do a
repair.
I cannot get into safemode or do a repair with a disk. Cannot slave disk
due to Pointsec.
I would like to try to save the data. How can I stop the BSOD so I can read
the problem and try to fix. I have a feeling it is a memory error, but not
sure. At the time before the BSOD, we were useing a USMT software to copy
data to a new machine. Any thoughts greatly appreciated.

 

[Gerry]

Richard

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure even after you have
solved the problem as it's better disabled. Check for variants of the
Stop Error message.

An alternative is to keep pressing the F8 key during Start-Up and select
option - Disable automatic restart on system failure.

If you are using a wireless keyboard and the F8 key does not work
substitute a wired keyboard and mouse for this exercise only.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Hi Gerry, thank you for your reply.. can not get into the control panel
because the failure to boot, however your F8 and disable worked. I have an
error
Stop: 0X05001086 (0x000000000, 0x000000000,0x000000000,
0x000000000
I will research error.. but any thoughts... please send them along.. thank
you again.

 

[Gerry]

Richard

Please recheck this 0X05001086 for a typo? It makes no sense!


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Yes, after rechecking... it reads
Technical informatiion:
*** STOP: 0x05001086 (0X00000000,0X00000000,0X00000000,0X00000000)
I cannot seem to find anything on this either...
There has to be a way of getting in.....
Thank you for your attempts....

 

[Guest]

I put the hard drive in another exact laptop D600 and it has the same amount
of memory...
I get the same stop code.

 

[Gerry]

Richard

What are your anti-virus and anti-spyware arrangements?

http://www.elephantboycomputers.com/page2.html#Removing_Malware

What is the corresponding error (if any) in Event Viewer?

Please post copies of all Error and Warning Reports appearing in
the System and Application logs in Event Viewer for the last boot. No
Information Reports or Duplicates please. Indicate which also appear in
a previous boot.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Part of the Description of the error will include a link, which you
should double click for further information. You can copy using copy
and paste. Often the link will, however, say there is no further
information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Hi Gerry,
Cannot get in to view anything... thats the problem.
Once the Windows splash screen comes up... it BSOD with the stop error.
I think I am dead in the water.
The unit does have mcafee on it and lavasoft.

Is there any utility to let the unit boot, and go past pointsec then let me
go into dos and retreve or do a system restore. ? ANYTHING

 

[Gerry]

Richard

Try disconnecting all hardware peripherals except keyboard, mouse and
monitor?

What is your computer make and model? In what year was it new?

How is Windows XP described on your Windows XP CD?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

The CD is a Dell Reinstallation Microsoft Windows XP Pro SP2
The Laptop is a Dell Latitude D600
Manufacture date 8/12/04
Everything is disconnected, including removing CD drive out of bay. Same
outcome

 

[Gerry]

Richard

Were you using USMT software to copy from the problem machine to
another? I should say that I have no knowledge of USMT software so you
need to bear this mind.

I am wondering whether the best move would be to try a Repair Install
using the Dell Reinstallation Microsoft Windows XP Pro SP2 CD. Do you
have a Dell Manual or lierature explaining how to use the CD? Whatever
you do you do not want to do a Clean Install (as distinct from a Repair
Install) if you have data on the hard drive which you cannot afford to
lose. If you need to recover important data take the machine to a
computer engineer.

More about Repair Install
http://michaelstevenstech.com/XPrepairinstall.htm

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

We can loose the data.. hate too however.
Not sure it was the USMT software.

I tried using a repair from the disk, however when we get to that point...
it does not reconize teh partition because the partition has the pointsec on
it so it is encripted. Thank you for all your help.. I will give it one more
shot,, then format.

 

[liciniusx]

We can loose the data.. hate too however.
Not sure it was the USMT software.

I tried using a repair from the disk, however when we get to that point...
it does not reconize teh partition because the partition has the pointsecon
it so it is encripted. Thank you for all your help.. I will give it one more
shot,, then format.









- Afficher le texte des messages précédents -

We had the same problem here on 5 machines last week. We removed the
Pointsec encryption from the offending laptops (various makes, we
plugged the hard disk in a two-spindle laptop to do this) and
everything is now working fine on those machines.

I don't know yet what is the exact problem. And we haven't re-
installed Pointsec either on these.

 

[Guest]

I am having the same problem Richard. I have automatic Windows update set on
two of my computers. Both updated last night and both are having the same
BSOD issue you are having. I have found similar posts with no resolutions as
of yet. It sounds like a security update issue.

 

[Gerry]

Cole

This message for some reason hasn't reached Google from
(e-mail address removed):

We had the same problem here on 5 machines last week. We removed the
Pointsec encryption from the offending laptops (various makes, we
plugged the hard disk in a two-spindle laptop to do this) and
everything is now working fine on those machines.

I don't know yet what is the exact problem. And we haven't re-
installed Pointsec either on these.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Sven Boden]

The problem is PointSec, their software panics from time to time
causing BSOD and making it easier to reinstall usually than to try to
decrypt the harddisk.
It doesn't happen on all computers on which you install PointSec, but
once you get it your toast. It seems that as soon as you have a
windows problem on which you would normally use the recovery
console&chkdsk/r e.g. a registry problem or so, you're in problems
with PointSec (as it won't allow you on the harddisk).

Did anyone already find a good way to deal with these BSOD's (they
even occur on the very last version of PointSec) or a good way to
uninstall/decrypt PointSec from your PC.

Regards,
Sven

 

[Sven Boden]

I'll answer my own mail... the solution is to decrypt the harddisk and
uninstall PointSec. You need a PointSec recovery boot cd for this. If
your pointsec is installed on a corporate level your helpdesk should
be able to help you. It involves interrupting the boot, resuming from
the cd, calling the pointsec helpdesk for a key and letting it
decrypt.

After that you can do some changes on your PC to make PointSec belief
your PC is unencryptable ;-) ... furthermore I can recommend safeboot
as PointSec alternative.

And I have a feeling that the Microsoft updates of last days seem to
increase the amount of BSOD's again on PointSec installed PC's

Regards,
Sven

 

[david.nicholds]

I'll answer my own mail... the solution is to decrypt the harddisk and
uninstall PointSec. You need a PointSec recovery boot cd for this. If
your pointsec is installed on a corporate level your helpdesk should
be able to help you. It involves interrupting the boot, resuming from
the cd, calling the pointsec helpdesk for a key and letting it
decrypt.

After that you can do some changes on your PC to make PointSec belief
your PC is unencryptable ;-) ... furthermore I can recommend safeboot
as PointSec alternative.

And I have a feeling that the Microsoft updates of last days seem to
increase the amount of BSOD's again on PointSec installed PC's

Regards,
Sven





- Show quoted text -

I have just seen this problem specifically after KB943460 is applied,
ftdisk being the last failure straight after this patch applied on a
machine that happens to be running an older Pointsec PC 6.1.3 b1122
build and McAfee.

Pointsec PC has no back door for removal, in this scenario you should
create a recovery disk using the unique recovery file for the
particular machine to decrypt the machine - this will require 2
authorised accounts allowed to create the recovery media, and an
account authorised to run the recovery disk when you boot from it (see
chapters 14 and 15 of the Pointsec Admin Guide regarding different
recovery methods). Once the machine is back up, go to add remove
programs and remove Pointsec to tidy up (you won't be prompted after
removal using the recovery disk) and reboot. Next, remove KB943460 in
add/remove programs, and reinstall Pointsec from your corporate
Installation.

I've escalated this KB943460 issue with the product support team, it
affects Universal Resource Identifiers and shell32 shellexecute which
is a considerable change. See

http://support.microsoft.com/kb/943460

This might be resolvable according to whitelisting capabilities in the
registry after the patch is applied as can be seen in the article
above,

The KB943460 patch has been having some odd affects on other products
as well if you look around. The machine in question I saw this on was
an IBM T60 also running MCAfee as well, but had been for some time
with Pointsec 6.1.3 for over a year, quite happily before the patch.
Fact is, this bsod was seen immediately after applying KB943460 and
this is very evident in the logs.

Furthermore, version 6.2 with KB943460 has been seen to be running
fine on my own machine that I'm tapping away on right now without any
whitelisting changes - so I can't concur Sven's comments regarding the
newer versions of Pointsec either. Also, I personally don't run
MCAfee, I use a "new" Checkpoint product that nobody knows about yet
that does AV as well.

It might be a problem with another product that lives in the Kernel
such as McAfee that is exacerbated after applying KB943460, nobody has
tried removing McAfee, installing Pointsec and KB943460 to concur yet
apart from what I have on my machine. I'll post any further info/
resolutions from the support team once they get their teeth into it.

 

[Technobard]

In order to get through the issue of immediate BSOD you need to boot
up, and as soon you see the hardware splash screen begin tapping both
SHIFT keys on your keyboard at the same time. This will get you to an
alternate boot menu for Pointsec.
If you know how to use BartPE you can add the correct drivers for the
OS and do basic drive maintenance to correct certain issues with the
HDD.
You are in no way able to jeopardize the integrity of the encrypted
data or access it but are able to use the tools to do certain repairs.
Remember to never adjust the partitions or the MBR as you will corrupt
the whole disk encryption and render the system a boat anchor.

The KB943460 patch has been having some effects on other various
systems and applications. In some instances the patch has caused
issues with various anti-virus programs, and even audio drivers in
certain makes of Dell and Fujitsu systems. These compiled with the
driver that does the encryption cause almost immediate BSOD. The best
course of action is to do a recovery of the drive with the help of
your help desk trained in its support. This will usually allow you to
recover the data or at least gain access to it to be removed by some
other means.

excelsior