SP2 crashes during install

[Joe Schmuckatelli]

PMFJIH, but I've run across a problem I'm not quite sure what to do
with.

A customer of ours brings in a system, saying he's having problems
installing SP2 on his XP Home system via Software Update, and that
everything else he tried downloading installed without a hitch. His
system was rebooting on startup, so I did a manual uninstall of SP2
and a repair install of XP Home, which got it going again.

Got back to the desktop, tried installing SP2 from CD. The install
goes normally, until the section where it says it's doing its
"cleanup". After thrashing the hard drive for a bit, a window pops up
saying that the "application has encountered a problem and needs to
close". Specifically, it says that update.exe had an exception
0xc0000005 in module ntdll.dll. If one closes the update program and
reboots (this time, I remembered to turn off the Automatic Reboot
feature), it bluescreened with a stop 0x00000024, with no mention of a
filename.

To try and pin down the problem, I have:

1) Pulled the hard drive, hooked it into another machine, and run
chkdsk/f;
2) Scanned the hard drive for defects (none were found)
3) Scanned for bad memory (one bad stick found, removed)
4) Set XP for a diagnostic boot with only the Cryptographic service
checked (it added two RPC services);
5) Tried installing SP2 in Safe Mode;
6) Installed the MSI 3.1 v2 hotfix separately before trying the
install;

....all to no avail.

I am at a loss. If you need more information, please do not hesitate
to ask.

 

[PA Bear]

1. Uninstall SP2 via Add/Remove Programs and reboot.

2. Run a thorough check for hijackware, including posting your HijackThis
log to an appropriate forum.

Check for Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis (http://aumha.net/downloads/hijackthis.zip)
is the preferred tool to use. It will help you to both identify and remove
any hijackware/spyware.

**Post your HijackThis log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html, http://aumha.net/viewforum.php?f=30 or
other appropriate forum for expert analysis, not here.**

3. Do not install SP2 until an expert gives your HijackThis log a clean bill
of health.

Also see:

What to Know Before Downloading/Installing SP2
http://www.microsoft.com/windowsxp/sp2/sp2_whattoknow.mspx

Installing SP2 Step-by-Step
http://support.microsoft.com/default.aspx?scid=fh;[ln];xpsp2insthowto

Troubleshooting Your Installation
http://support.microsoft.com/default.aspx?scid=fh;[ln];xpsp2insttshoot

WinXP SP2 FAQ: What to do after installing SP2
http://support.microsoft.com/default.aspx?scid=fh;ln;xpsp2installed

Service Pack (any) Installation Checklist (MVP Jupiter Jones)
http://www3.telus.net/dandemar/spackins.htm

WinXP SP2-specific Page (MVP Jupiter Jones)
http://www3.telus.net/dandemar/xpsp2.htm

The hard disk space requirements for Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?kbid=837783

 

[Joe Schmuckatelli]

2. Run a thorough check for hijackware, including posting your HijackThis
log to an appropriate forum.

I checked the startup page of msconfig, as (most of the time, at
least) one or more of said programs will show up there. I saw
nothing. Still, I shall do so, plus a virus scan with two different
programs.

FYI, for spyware, not only do I use HijackThis, but also Ad-aware,
Spybot, and recently threw Ewido into the mix.

 

[Joe Schmuckatelli]

1. Uninstall SP2 via Add/Remove Programs and reboot.

Update: two virus scanners, three spyware scanners and a quick
session with HijackThis later, I find:

No virusseseseseseseses
A number of tracking cookies
A few spyware registry settings
Possibly one spyware file, but not an executable

Still no luck.

Error signature:

AppName: update.exe AppVer: 5.5.1005.0
ModName: ntdll.dll ModVer: 5.1.2600.1006 offset: 0000db88

Any other suggestions?

 

[antioch]

Update: two virus scanners, three spyware scanners and a quick
session with HijackThis later, I find:

No virusseseseseseseses
A number of tracking cookies
A few spyware registry settings
Possibly one spyware file, but not an executable

Still no luck.

Error signature:

AppName: update.exe AppVer: 5.5.1005.0
ModName: ntdll.dll ModVer: 5.1.2600.1006 offset: 0000db88

Any other suggestions?

Then try a group more suited to your problem where SP2 and various problems
associated with it, has been/is being discussed to some length.
Once subscribed do a right click on this group and put in SP2 in either
subject or message - not both at the same time - each one at a time
Link below-

news://msnews.microsoft.com/microsoft.public.windowsupdate

You seem to have covered just about everything I have read as suggestions in
the update group - bar one little thing.
Did you have any AV running and other prgs in the background.
Some have even ended processes in Task Manager.
I cannot remember any post mentioning the a problem at 'cleanup'. Most
don't get that far.
Any help with the error numbers/Google or MS?
May be a good idea to do a 'find' on those as well.
Then of course there are the 50-60 other updates of criticals after SP2.
They are another story :-(.
If you get to install SP2 OK, I would suggest that the others are done with
care and 4 or 5 at a time and not in a big bunch and not from WU Home. Have
WU scan the system, then printout all the updates on offer.
Go to the respective Download page for each and burn to disk and install -
reboot after every one even if not asked.
I wish all the luck in the world.
Antioch

 

[Joe Schmuckatelli]

You seem to have covered just about everything I have read as suggestions in
the update group - bar one little thing.
Did you have any AV running and other prgs in the background.

If you'll see the original post, I did a bare boot -- disabled all
services. Hell, I even tried it from safe mode.

Any help with the error numbers/Google or MS?

None at all, I'm afraid. Did that before I stopped in here.

If you get to install SP2 OK,

Funny you should mention that. Last thing (or two) I tried after
checking some of the links in Bear's .sig, was 1) Installing the
Prescott fix (even though the machine is a P3), and, having
uninstalled it after the system hung during bootup, 2) Downloading a
fresh copy of the standalone SP2 install file and running that. Good
news -- it successfully installed. Bad news -- I *still* get a stop
0x24 on startup.

Sigh.

 

[PA Bear]

AppName: update.exe AppVer: 5.5.1005.0

ModName: ntdll.dll ModVer: 5.1.2600.1006 offset: 0000db88

See, for example,
http://www.bleepingcomputer.com/startups/update.exe-10671.html

<QP>
When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**
</QP>

Got a link to the forum thread where you posted your HijackThis log for
review?

NB: Simply deleting UPDATE.EXE is NOT likely to resolve all problems.

 

[antioch]

If you'll see the original post, I did a bare boot -- disabled all
services. Hell, I even tried it from safe mode.


None at all, I'm afraid. Did that before I stopped in here.


Funny you should mention that. Last thing (or two) I tried after
checking some of the links in Bear's .sig, was 1) Installing the
Prescott fix (even though the machine is a P3), and, having
uninstalled it after the system hung during bootup, 2) Downloading a
fresh copy of the standalone SP2 install file and running that. Good
news -- it successfully installed. Bad news -- I *still* get a stop
0x24 on startup.

Sigh.

I don't believe it has not taken completely.
But do go to the updates - there are at least 4 'great helpers'
in there. Give the full details of fixes you have tried.
I did a neighbours SP2 two weeks ago, armed with the free disk and a
printout of every single SP fix from updates.
It took the best part of three hours, four pots of fresh coffee and a brandy
or two. The install held and then we did all the other criticals, two at a
time.
All went OK - what I will never know is that the whole thing could have been
done in half an hour doing the direct way.
But with the current situation with Black Tuesdays, its not worth taking the
chance.
I will watch out for you in updates - be prepared to be depressed(not that
you are not already) when you see the traffic in there :-(.
Watch out for the MS Spyware WGA/WGAN etc?
Rgds
Antioch

 

[antioch]

If you'll see the original post, I did a bare boot -- disabled all
services. Hell, I even tried it from safe mode.


None at all, I'm afraid. Did that before I stopped in here.


Funny you should mention that. Last thing (or two) I tried after
checking some of the links in Bear's .sig, was 1) Installing the
Prescott fix (even though the machine is a P3), and, having
uninstalled it after the system hung during bootup, 2) Downloading a
fresh copy of the standalone SP2 install file and running that. Good
news -- it successfully installed. Bad news -- I *still* get a stop
0x24 on startup.

Sigh.

Forgot to mention that that stop x24 figured in the Aug updates I think -
something to do with the boot order - I think it required the original
install CD. Cant find the post - sorry.
Antioch

 

[Joe Schmuckatelli]

See, for example,
http://www.bleepingcomputer.com/startups/update.exe-10671.html

NB: Simply deleting UPDATE.EXE is NOT likely to resolve all problems.

Um. What I posted was from the SP2 program crash; that is NOT in the
boot sequence.

 

[rweinglass]

I started getting the EXACT same problem/error with SP2 installs, right
after installing SP2 on machines that just had the Oct 10th "Black
tuesday" patches installed.
I can say with certainty that one of those patches causes this
particular error when sp2 is installed after it. However I have not
figured out which of the 10/10/06 released patches is the culprit yet.