Security Update for Windows XP (KB890859)

Hi,

I'm encountering a bizarre problem with a particular Security Update
(KB890859). To cut a very long story short, SUS wanted to update my machine
with the following updates (extract from Event Viewer);

Installation Ready: The following updates are downloaded and ready for
installation. This computer is currently scheduled to install these updates
on 21 June 2005 at 03:00.
- Security Update for Windows XP (KB890859)
- Microsoft Windows Installer 3.1
- Microsoft .NET Framework 1.1 Service Pack 1
- Microsoft .NET Framework Service Pack 2, English Version (SDK Applied)

Usually because we extensively test SUS updates on a test machine (based on
our companies standard build) there is no problems. However with these
particular updates I began encountering problems. SUS had finished
installing the updates it began to restart, but when Windows XP began to
initialise just after the start-up screen vanishes (black screen with XP
logo) a BSoD appears and then the machine reboots and the process starts
again stuck in a loop. After using system restore to undo the changes I set
about trying to install the updates 1 by 1 to see which is causing the
problem. All installed without a problem except KB890859 which causes
another BSoD and rebooting loop so after trying system restore again which
now failed and used safe mode to access spuninst to uninstall the update
which did work thankfully.
Now I'm left with a machine that works but every morning wants to install
KB890859 (because SUS realises it isn't installed so wants to install it), I
would be grateful if someone could help me resolve this issue so I can
install the update without this problem.

I also used windbg to check the crashdump from the BSoD and got this result:

************************************************** *****************************
*
* Bugcheck Analysis
*
************************************************** *****************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on
the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f88a4ffc, Virtual address for the attempted write.
Arg2: 046b6121, PTE contents.
Arg3: f87078cc, (reserved)
Arg4: 0000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xBE

LAST_CONTROL_TRANSFER: from bf89437a to 804dc411

STACK_TEXT:
f8707980 bf89437a 00030101 0000000c f87079a0 nt!KiTimerListExpire+0xb6
f87079ac bf89442f 00000000 00000001 e1a3d448 win32k!ldevLoadDriver+0x71
f87079c4 bf897596 e1a0f538 8229caa0 f87079ec win32k!ldevGetDriverModes+0x1b
f87079f4 bf892d44 00000000 00000000 f8707bf0 win32k!DrvBuildDevmodeList+0xa4
f8707a7c bf88d27f e1a3d448 f8707b0c f8707ad4
win32k!DrvProbeAndCaptureDevmode+0x408
f8707bf4 bf89348b 00000000 00000000 00000001 win32k!DrvCreateMDEV+0x42d
f8707ce8 bf88fff2 00000000 00000000 00000000
win32k!DrvChangeDisplaySettings+0x2e5
f8707d28 bf88ff60 00000001 f8707d64 0015fd98 win32k!InitVideo+0x3e
f8707d48 bf891264 f8707d64 804de7ec 00050000 win32k!UserInitialize+0x14d
f8707d50 804de7ec 00050000 00000058 0000005c win32k!NtUserInitialize+0x87
f8707d50 7c90eb94 00050000 00000058 0000005c nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0015fd80 00000000 00000000 00000000 00000000 0x7c90eb94


CHKIMG_EXTENSION: !chkimg -lo 50 -d !usbehci
f88a5001 - usbehci!EHCI_StopController+17
[ 6a:00 ]
f88a5003 - usbehci!EHCI_StopController+19 (+0x02)
[ 8b:00 ]
2 errors : !usbehci (f88a5001-f88a5003)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

STACK_COMMAND: kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

Please help...

Thanks in advance.

Martin Dobson
UK

"Martin Dobson" <> wrote in message
news:%
....
> When possible, the guilty driver's name (Unicode string) is printed on
> the bugcheck screen and saved in KiBugCheckDriver.


Did you see this printed anywhere?

> CHKIMG_EXTENSION: !chkimg -lo 50 -d !usbehci


Was that it? What version of usbehci.sys do you have
(version, size, and date as given in the following article)

<title>KB329632 - How to obtain and to install USB 2.0 drivers in Windows
XP Service Pack 1</title>


Note: this is not a recommendation to try that package, just a way
of getting more information.


BTW you may find you get more informed assistance from a newsgroup
which specializes in your OS, especially on installation and recovery.


HTH

Robert Aldwinckle
---

Thanks Robert,

I tried your suggestion as detailed in the KB article 329632, however it
appears I already have the correct version drivers for USB 2.0 compatability
plus the drivers are digitially signed as approved drivers for windows, here
is the version information;

Driver Files for Intel(R) 82801EB USB2 Enhanced Host Controller - 24DD
File: C:\WINDOWS\system32\drivers\usbehci.sys - Version: 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158)
File: C:\WINDOWS\system32\drivers\usbhub.sys - Version: 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158)
File: C:\WINDOWS\system32\drivers\usbport.sys - Version: 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158)
File: C:\WINDOWS\system32\hccoin.dll - Version: 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158)
File: C:\WINDOWS\system32\usbui.dll - Version: 5.1.2600.2180
(xpsp_sp2_rtm.040803-2158)

Based on the article KB329632 this version of the USB 2.0 drivers is
correct, so I'm perplexed to why Windows has a problem when installing the
update when it checks the drivers image (CHKIMG_EXTENSION: !chkimg -lo 50 -d
!usbehci).

Thanks for all your help so far...

Martin Dobson
UK

"Robert Aldwinckle" <> wrote in message
news:...
> "Martin Dobson" <> wrote in message
> news:%
> ...
>> When possible, the guilty driver's name (Unicode string) is printed on
>> the bugcheck screen and saved in KiBugCheckDriver.
>
>
> Did you see this printed anywhere?
>
>> CHKIMG_EXTENSION: !chkimg -lo 50 -d !usbehci
>
>
> Was that it? What version of usbehci.sys do you have
> (version, size, and date as given in the following article)
>
> <title>KB329632 - How to obtain and to install USB 2.0 drivers in Windows
> XP Service Pack 1</title>
>
>
> Note: this is not a recommendation to try that package, just a way
> of getting more information.
>
>
> BTW you may find you get more informed assistance from a newsgroup
> which specializes in your OS, especially on installation and recovery.
>
>
> HTH
>
> Robert Aldwinckle
> ---
>
>

"Martin Dobson" <> wrote in message
news:%
....
At end of previous subthread:
"Martin Dobson" <> wrote in message
news:%
> [Date: Wed, 22 Jun 2005 09:52:36 +0100]
....
> Based on the article KB329632 this version of the USB 2.0 drivers is
> correct, so I'm perplexed to why Windows has a problem when installing the
> update when it checks the drivers image (CHKIMG_EXTENSION: !chkimg -lo 50 -d
> !usbehci).


Here's a different tack. Do you know what those USB drivers are needed
for exactly on your system? What would you lose if you disabled them
before booting after the update? Do you think that the same crash would
occur? Supposedly you can use the Recovery Console to disable drivers
but I have never done so or know what the consequences are of trying it.


Let's look back at your Stack:

> STACK_TEXT:
> f8707980 bf89437a 00030101 0000000c f87079a0 nt!KiTimerListExpire+0xb6
> f87079ac bf89442f 00000000 00000001 e1a3d448 win32k!ldevLoadDriver+0x71


FWIW my hunch is the USB driver may be just a victim and not the real culprit.
E.g., I'd be curious to know if this address is in a different driver: e1a3d448
If so I'd be just as willing to suspect it, as to reflexively blame the one which
is getting stomped on. Note that the one getting stomped on seems to be
more in the vicinity of the stack... <eg>


Also, here are some more entries from the Stack Trace which make
me wonder if booting in VGA mode might change your symptom too.

> win32k!DrvChangeDisplaySettings+0x2e5
> win32k!InitVideo+0x3e



Good luck

Robert
---

"Martin Dobson" <> schrieb:

> Now I'm left with a machine that works but every morning wants to install
> KB890859 (because SUS realises it isn't installed so wants to install it), I
> would be grateful if someone could help me resolve this issue so I can
> install the update without this problem.

Hm, I've seen some messages on that one too. The culprit in these cases
has been ntoskrnl.exe and ntkrnlpa.exe not beeing installed in the new
version, cause they have been classfied as OEM drivers. Check back which
version these files have on the machine in trouble.

Downloading the patch manually (DC) and running the exe with parameter /o
(like OEM) fixed the installation and afterwards the permanent attempts
to install the patch again and again vanished. It's your risk for sure

Bye,
Freudi

Thanks for the suggestion, but unfortunately it didn't work so I had to
regress my changes once again...

Martin Dobson
UK

"Ottmar Freudenberger" <> wrote in message
news:42b9d88f$0$15429$...
> "Martin Dobson" <> schrieb:
>
>> Now I'm left with a machine that works but every morning wants to install
>> KB890859 (because SUS realises it isn't installed so wants to install
>> it), I
>> would be grateful if someone could help me resolve this issue so I can
>> install the update without this problem.
>
> Hm, I've seen some messages on that one too. The culprit in these cases
> has been ntoskrnl.exe and ntkrnlpa.exe not beeing installed in the new
> version, cause they have been classfied as OEM drivers. Check back which
> version these files have on the machine in trouble.
>
> Downloading the patch manually (DC) and running the exe with parameter /o
> (like OEM) fixed the installation and afterwards the permanent attempts
> to install the patch again and again vanished. It's your risk for sure
>
> Bye,
> Freudi

Hi Robert,

The USB Drivers in question are used by my mouse and a HP IPAQ H5450
synchronisation cradle. The puzzling thing for me is my machine is a
standard build that our company uses, all the other machines in my office
(identical hardware) have installed this update without problems. The only
difference with my machines hardware is I have a USB cradle for my H5450...
As for booting in VGA? Do you mean changing my resolution to VGA or booting
in safe mode when the patch installs and reboots?

It's an annoyance I could do without, this means that as soon as new updates
are released by our SUS server I will have to install them all manually
because SUS we still want to install KB890859 which causes the BSoD.
I have seen forums on the web where people I having the exact same problem,
but no solution...

Thanks for all your help so far...

Martin Dobson
UK

"Robert Aldwinckle" <> wrote in message
news:...
> "Martin Dobson" <> wrote in message
> news:%
> ...
> At end of previous subthread:
> "Martin Dobson" <> wrote in message
> news:%
>> [Date: Wed, 22 Jun 2005 09:52:36 +0100]
> ...
>> Based on the article KB329632 this version of the USB 2.0 drivers is
>> correct, so I'm perplexed to why Windows has a problem when installing
>> the
>> update when it checks the drivers image (CHKIMG_EXTENSION: !chkimg -lo
>> 50 -d
>> !usbehci).
>
>
> Here's a different tack. Do you know what those USB drivers are needed
> for exactly on your system? What would you lose if you disabled them
> before booting after the update? Do you think that the same crash would
> occur? Supposedly you can use the Recovery Console to disable drivers
> but I have never done so or know what the consequences are of trying it.
>
>
> Let's look back at your Stack:
>
>> STACK_TEXT:
>> f8707980 bf89437a 00030101 0000000c f87079a0 nt!KiTimerListExpire+0xb6
>> f87079ac bf89442f 00000000 00000001 e1a3d448 win32k!ldevLoadDriver+0x71
>
>
> FWIW my hunch is the USB driver may be just a victim and not the real
> culprit.
> E.g., I'd be curious to know if this address is in a different driver:
> e1a3d448
> If so I'd be just as willing to suspect it, as to reflexively blame the
> one which
> is getting stomped on. Note that the one getting stomped on seems to be
> more in the vicinity of the stack... <eg>
>
>
> Also, here are some more entries from the Stack Trace which make
> me wonder if booting in VGA mode might change your symptom too.
>
>> win32k!DrvChangeDisplaySettings+0x2e5
>> win32k!InitVideo+0x3e
>
>
>
> Good luck
>
> Robert
> ---
>
>
>

Hi,

Looking into this further there seems to be quite a lot of people having
this same problem, but the consensus seems to be the same "Microsoft are not
acknowledging it!" see this link;

http://www.askwoody.com/patchcomments.php?statusid=31

Martin Dobson
UK

"Martin Dobson" <> wrote in message
news:%...
> Hi,
>
> I'm encountering a bizarre problem with a particular Security Update
> (KB890859). To cut a very long story short, SUS wanted to update my
> machine with the following updates (extract from Event Viewer);
>
> Installation Ready: The following updates are downloaded and ready for
> installation. This computer is currently scheduled to install these
> updates on 21 June 2005 at 03:00.
> - Security Update for Windows XP (KB890859)
> - Microsoft Windows Installer 3.1
> - Microsoft .NET Framework 1.1 Service Pack 1
> - Microsoft .NET Framework Service Pack 2, English Version (SDK Applied)
>
> Usually because we extensively test SUS updates on a test machine (based
> on our companies standard build) there is no problems. However with these
> particular updates I began encountering problems. SUS had finished
> installing the updates it began to restart, but when Windows XP began to
> initialise just after the start-up screen vanishes (black screen with XP
> logo) a BSoD appears and then the machine reboots and the process starts
> again stuck in a loop. After using system restore to undo the changes I
> set about trying to install the updates 1 by 1 to see which is causing the
> problem. All installed without a problem except KB890859 which causes
> another BSoD and rebooting loop so after trying system restore again which
> now failed and used safe mode to access spuninst to uninstall the update
> which did work thankfully.
> Now I'm left with a machine that works but every morning wants to install
> KB890859 (because SUS realises it isn't installed so wants to install it),
> I would be grateful if someone could help me resolve this issue so I can
> install the update without this problem.
>
> I also used windbg to check the crashdump from the BSoD and got this
> result:
>
> ************************************************** *****************************
> *
> * Bugcheck Analysis
> *
> ************************************************** *****************************
>
> ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
> An attempt was made to write to readonly memory. The guilty driver is on
> the
> stack trace (and is typically the current instruction pointer).
> When possible, the guilty driver's name (Unicode string) is printed on
> the bugcheck screen and saved in KiBugCheckDriver.
> Arguments:
> Arg1: f88a4ffc, Virtual address for the attempted write.
> Arg2: 046b6121, PTE contents.
> Arg3: f87078cc, (reserved)
> Arg4: 0000000b, (reserved)
>
> Debugging Details:
> ------------------
>
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: CODE_CORRUPTION
>
> BUGCHECK_STR: 0xBE
>
> LAST_CONTROL_TRANSFER: from bf89437a to 804dc411
>
> STACK_TEXT:
> f8707980 bf89437a 00030101 0000000c f87079a0 nt!KiTimerListExpire+0xb6
> f87079ac bf89442f 00000000 00000001 e1a3d448 win32k!ldevLoadDriver+0x71
> f87079c4 bf897596 e1a0f538 8229caa0 f87079ec
> win32k!ldevGetDriverModes+0x1b
> f87079f4 bf892d44 00000000 00000000 f8707bf0
> win32k!DrvBuildDevmodeList+0xa4
> f8707a7c bf88d27f e1a3d448 f8707b0c f8707ad4
> win32k!DrvProbeAndCaptureDevmode+0x408
> f8707bf4 bf89348b 00000000 00000000 00000001 win32k!DrvCreateMDEV+0x42d
> f8707ce8 bf88fff2 00000000 00000000 00000000
> win32k!DrvChangeDisplaySettings+0x2e5
> f8707d28 bf88ff60 00000001 f8707d64 0015fd98 win32k!InitVideo+0x3e
> f8707d48 bf891264 f8707d64 804de7ec 00050000 win32k!UserInitialize+0x14d
> f8707d50 804de7ec 00050000 00000058 0000005c win32k!NtUserInitialize+0x87
> f8707d50 7c90eb94 00050000 00000058 0000005c nt!KiFastCallEntry+0xf8
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 0015fd80 00000000 00000000 00000000 00000000 0x7c90eb94
>
>
> CHKIMG_EXTENSION: !chkimg -lo 50 -d !usbehci
> f88a5001 - usbehci!EHCI_StopController+17
> [ 6a:00 ]
> f88a5003 - usbehci!EHCI_StopController+19 (+0x02)
> [ 8b:00 ]
> 2 errors : !usbehci (f88a5001-f88a5003)
>
> MODULE_NAME: memory_corruption
>
> IMAGE_NAME: memory_corruption
>
> FOLLOWUP_NAME: memory_corruption
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> MEMORY_CORRUPTOR: LARGE
>
> STACK_COMMAND: kb
>
> FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
>
> BUCKET_ID: MEMORY_CORRUPTION_LARGE
>
> Followup: memory_corruption
> ---------
>
> Please help...
>
> Thanks in advance.
>
> Martin Dobson
> UK
>

"Martin Dobson" <> wrote in message
news:
....
> "Robert Aldwinckle" <> wrote in message
>> Here's a different tack. Do you know what those USB drivers are needed
>> for exactly on your system?
....

> Hi Robert,
>
> The USB Drivers in question are used by my mouse and a HP IPAQ H5450 synchronisation cradle. The puzzling thing for me is my
> machine is a standard build that our company uses, all the other machines in my office (identical hardware) have installed this
> update without problems. The only difference with my machines hardware is I have a USB cradle for my H5450...

Looks as if you could try disabling the drivers then as a test
(e.g. if only to see if you get past the initial crash)
It would be awkward not to have a mouse
but you could use Mousekeys as an alternative.


> As for booting in VGA? Do you mean changing my resolution to VGA or booting in safe mode when the patch installs and reboots?

Yes. I think Safe mode includes VGA mode by default.


>
> It's an annoyance I could do without, this means that as soon as new updates are released by our SUS server I will have to install
> them all manually because SUS we still want to install KB890859 which causes the BSoD.

Why not put that one in your list of declined updates?
Use the wuaucpl.cpl link How does Automatic Updates work?
(or wuaucpl.hlp) for more details (Index item: declined updates...)


BTW did you try to find out any more about this address?

>> FWIW my hunch is the USB driver may be just a victim and not the real culprit.
>> E.g., I'd be curious to know if this address is in a different driver: e1a3d448

If you have pstat.exe (e.g. from the Support Tools)
you could use it to list loaded modules (e.g. without having
to resort to commands in your debugger.)


Good luck

Robert
---

Hi,

Well unfortunately we use SUS which abolishes the use of Windows Update URL
and relies on your SUS Server receiving updates directly from Microsoft, the
workstations using the SUS Server have no control on how or when to install
dates it is all group policy controlled.

Martin Dobson
UK

"Robert Aldwinckle" <> wrote in message
news:ebtg2m$...
> "Martin Dobson" <> wrote in message
> news:
> ...
>> "Robert Aldwinckle" <> wrote in message
>>> Here's a different tack. Do you know what those USB drivers are
>>> needed
>>> for exactly on your system?
> ...
>
>> Hi Robert,
>>
>> The USB Drivers in question are used by my mouse and a HP IPAQ H5450
>> synchronisation cradle. The puzzling thing for me is my
>> machine is a standard build that our company uses, all the other machines
>> in my office (identical hardware) have installed this
>> update without problems. The only difference with my machines hardware is
>> I have a USB cradle for my H5450...
>
> Looks as if you could try disabling the drivers then as a test
> (e.g. if only to see if you get past the initial crash)
> It would be awkward not to have a mouse
> but you could use Mousekeys as an alternative.
>
>
>> As for booting in VGA? Do you mean changing my resolution to VGA or
>> booting in safe mode when the patch installs and reboots?
>
> Yes. I think Safe mode includes VGA mode by default.
>
>
>>
>> It's an annoyance I could do without, this means that as soon as new
>> updates are released by our SUS server I will have to install
>> them all manually because SUS we still want to install KB890859 which
>> causes the BSoD.
>
> Why not put that one in your list of declined updates?
> Use the wuaucpl.cpl link How does Automatic Updates work?
> (or wuaucpl.hlp) for more details (Index item: declined updates...)
>
>
> BTW did you try to find out any more about this address?
>
>>> FWIW my hunch is the USB driver may be just a victim and not the real
>>> culprit.
>>> E.g., I'd be curious to know if this address is in a different driver:
>>> e1a3d448
>
> If you have pstat.exe (e.g. from the Support Tools)
> you could use it to list loaded modules (e.g. without having
> to resort to commands in your debugger.)
>
>
> Good luck
>
> Robert
> ---
>
>
>