Vista RTM - Blue screen (BSOD) on Install Toshiba M400 TabletPC

setup
toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
100 GB , 2GB RAM centrino duo processor

we uninstalled all anti-virus, spyware, we updated the bios to a "vista
version" for the M400 per toshiba website
http://www.csdsupport.toshiba.com/ta...vista_beta.cgi
we downloaded and ran the Vista upgrade advisor RC... = all ok

downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
install - not clean)
ran another install check... it tells us everything should work ok (except
my epson scanner - but who cares)
about 2hrs on the "completing final install 80% " the systems does a
normal install reboot .. upon reboot we hit a BSOD

Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
attempt to boot into safe mode thinking this will clear the error and allow
install to continue.. Vista returns an error that says something to the
effect that
vista installation can't continue in safe mode.... we all it to go into
normal mode.. same error occurs.. and repeats pattern... finally we select
the option to go
back to Win XP.. which we did..

Being the Geek that I am ... I was able to capture.. the mini crash dump
file.. and load it into WinDbg. debugger.. initally there were no symbols
for Vista up on the microsoft Symbols servers -HINT HINT.. TO MSFT
(SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did find
some RC1 Vista symbols package..
http://www.microsoft.com/whdc/devtoo...symbolpkg.mspx which I
downloaded and loaded into the debugger as a second source.. (attached at
the bottom)

I had not heard of mpfirewall.sys before and assumed it was some MS
Firewall service.. here's where things get interesting.. decided to search
the NET .. turns out it's MCafee firewall.. which is weird.. because I've
never purchased, used, or installed any MCafee stuff on my PC... did more
searching... and come to learn the problem could possibly be *** AOL ***
YIKES!! GO Away.. I had never used it on this system.. but I guess it's
security service installs Mcafee files.. and toshiba ships the unit with
AOL... even if it's just on your system (and not running) Vista install will
blow up... this is just a theory.. I'm going to test completely removing
AOL and delete mpfirewall.sys and re-attempt to update my PC to Vista..
details to follow... anyone at MS care to review the debug below and
provide more info? perhaps this should be a MSFT KB Article...

are there actually any Vista install log file somewhere .. that might
provide me with more info (if so where is it kept) - I'll provide update
after more testing...


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\dumps3\Mini111706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986, size
0x4, align 0x4)
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
Symbol search path is:
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:

WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
System Uptime: 0 days 0:00:36.223
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.................................................. .................................................. .....................................
Loading User Symbols
Loading unloaded module list
........
GetContextState failed, 0x80004005
CS descriptor lookup failed
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
Unable to get program counterUnable to load image
\SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for MpFirewall.sys
*** ERROR: Module load completed but symbols could not be loaded for
MpFirewall.sys
************************************************** *****************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )

Followup: MachineOwner
---------

GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
1: kd> ! analyze -v
GetContextState failed, 0x80004005
Unable to get program
counter******************************************* ************************************
*
*
* Bugcheck Analysis
*
*
*
************************************************** *****************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8bcacbb0, The address that the exception occurred at
Arg3: a2b9ba50, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005

FAULTING_MODULE: 81800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
MpFirewall+2bb0
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
0008:cbb0 ?? ???

TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
Unable to read trap frame at a2b9ba50

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0

STACK_TEXT:
a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0


STACK_COMMAND: kb

FOLLOWUP_IP:
MpFirewall+2bb0
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
0008:cbb0 ?? ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: MpFirewall+2bb0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: MpFirewall

IMAGE_NAME: MpFirewall.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

GetContextState failed, 0x80004005
1: kd> lmvm MpFirewall
start end module name
8bcaa000 8bcbe000 MpFirewall T (no symbols)
Loaded symbol image file: MpFirewall.sys
Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
Image name: MpFirewall.sys
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
GetContextState failed, 0x80004005

First,

Great job with what you have done so far! As far as where you might find
some more information the C:\windows\panther folder has all the setup logs
that you might want.

I think removing mpfirewall and reinstalling will fix your issue, once you
can find what layed it down that would help too. Then get that feedback to
MSFT so that they can include that in analysis tool.

--
Josh
http://windowsconnected.com
"kevin forsythe" <> wrote in message
news:%...
> setup
> toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
> 100 GB , 2GB RAM centrino duo processor
>
> we uninstalled all anti-virus, spyware, we updated the bios to a "vista
> version" for the M400 per toshiba website
> http://www.csdsupport.toshiba.com/ta...vista_beta.cgi
> we downloaded and ran the Vista upgrade advisor RC... = all ok
>
> downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
> install - not clean)
> ran another install check... it tells us everything should work ok
> (except my epson scanner - but who cares)
> about 2hrs on the "completing final install 80% " the systems does a
> normal install reboot .. upon reboot we hit a BSOD
>
> Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
> attempt to boot into safe mode thinking this will clear the error and
> allow install to continue.. Vista returns an error that says something to
> the effect that
> vista installation can't continue in safe mode.... we all it to go into
> normal mode.. same error occurs.. and repeats pattern... finally we
> select the option to go
> back to Win XP.. which we did..
>
> Being the Geek that I am ... I was able to capture.. the mini crash dump
> file.. and load it into WinDbg. debugger.. initally there were no
> symbols for Vista up on the microsoft Symbols servers -HINT HINT.. TO MSFT
> (SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did
> find some RC1 Vista symbols package..
> http://www.microsoft.com/whdc/devtoo...symbolpkg.mspx which I
> downloaded and loaded into the debugger as a second source.. (attached
> at the bottom)
>
> I had not heard of mpfirewall.sys before and assumed it was some MS
> Firewall service.. here's where things get interesting.. decided to
> search the NET .. turns out it's MCafee firewall.. which is weird..
> because I've never purchased, used, or installed any MCafee stuff on my
> PC... did more searching... and come to learn the problem could possibly
> be *** AOL *** YIKES!! GO Away.. I had never used it on this system..
> but I guess it's security service installs Mcafee files.. and toshiba
> ships the unit with AOL... even if it's just on your system (and not
> running) Vista install will blow up... this is just a theory.. I'm
> going to test completely removing AOL and delete mpfirewall.sys and
> re-attempt to update my PC to Vista.. details to follow... anyone at MS
> care to review the debug below and provide more info? perhaps this should
> be a MSFT KB Article...
>
> are there actually any Vista install log file somewhere .. that might
> provide me with more info (if so where is it kept) - I'll provide update
> after more testing...
>
>
> Microsoft (R) Windows Debugger Version 6.6.0007.5
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\dumps3\Mini111706-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
> ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986,
> size 0x4, align 0x4)
> DbsSplayTreeRangeMap::Add: ignoring zero-sized range at
> ?00000000`00000000?
> Symbol search path is:
> SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
>
> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
> Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
> *** ERROR: Module load completed but symbols could not be loaded for
> ntoskrnl.exe
> Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
> Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
> Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
> System Uptime: 0 days 0:00:36.223
> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
> Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
> *** ERROR: Module load completed but symbols could not be loaded for
> ntoskrnl.exe
> Loading Kernel Symbols
> .................................................. .................................................. ....................................
> Loading User Symbols
> Loading unloaded module list
> .......
> GetContextState failed, 0x80004005
> CS descriptor lookup failed
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> Unable to get program counterUnable to load image
> \SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
> *** WARNING: Unable to verify timestamp for MpFirewall.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> MpFirewall.sys
> ************************************************** *****************************
> * *
> * Bugcheck Analysis *
> * *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )
>
> Followup: MachineOwner
> ---------
>
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> 1: kd> ! analyze -v
> GetContextState failed, 0x80004005
> Unable to get program
> counter******************************************* ************************************
> * *
> * Bugcheck Analysis *
> * *
> ************************************************** *****************************
>
> KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
> This is a very common bugcheck. Usually the exception address pinpoints
> the driver/function that caused the problem. Always note this address
> as well as the link date of the driver/image that contains this address.
> Some common problems are exception code 0x80000003. This means a hard
> coded breakpoint or assertion was hit, but this system was booted
> /NODEBUG. This is not supposed to happen as developers should never have
> hardcoded breakpoints in retail code, but ...
> If this happens, make sure a debugger gets connected, and the
> system is booted /DEBUG. This will let us see why this breakpoint is
> happening.
> Arguments:
> Arg1: c0000005, The exception code that was not handled
> Arg2: 8bcacbb0, The address that the exception occurred at
> Arg3: a2b9ba50, Trap Frame
> Arg4: 00000000
>
> Debugging Details:
> ------------------
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
>
> FAULTING_MODULE: 81800000 nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> FAULTING_IP:
> MpFirewall+2bb0
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> 0008:cbb0 ?? ???
>
> TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
> Unable to read trap frame at a2b9ba50
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> BUGCHECK_STR: 0x8E
>
> LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0
>
> STACK_TEXT:
> a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> MpFirewall+2bb0
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> 0008:cbb0 ?? ???
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: MpFirewall+2bb0
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: MpFirewall
>
> IMAGE_NAME: MpFirewall.sys
>
> BUCKET_ID: WRONG_SYMBOLS
>
> Followup: MachineOwner
> ---------
>
> GetContextState failed, 0x80004005
> 1: kd> lmvm MpFirewall
> start end module name
> 8bcaa000 8bcbe000 MpFirewall T (no symbols)
> Loaded symbol image file: MpFirewall.sys
> Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
> Image name: MpFirewall.sys
> Timestamp: unavailable (00000000)
> CheckSum: 00000000
> ImageSize: 00014000
> Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
> GetContextState failed, 0x80004005
>
>
>
>
>

COMCAST will install McAfee if you use COMCAST's security services.

--
The personal opinion of
Gary G. Little


"kevin forsythe" <> wrote in message
news:%...
> setup
> toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
> 100 GB , 2GB RAM centrino duo processor
>
> we uninstalled all anti-virus, spyware, we updated the bios to a "vista
> version" for the M400 per toshiba website
> http://www.csdsupport.toshiba.com/ta...vista_beta.cgi
> we downloaded and ran the Vista upgrade advisor RC... = all ok
>
> downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
> install - not clean)
> ran another install check... it tells us everything should work ok
> (except my epson scanner - but who cares)
> about 2hrs on the "completing final install 80% " the systems does a
> normal install reboot .. upon reboot we hit a BSOD
>
> Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
> attempt to boot into safe mode thinking this will clear the error and
> allow install to continue.. Vista returns an error that says something to
> the effect that
> vista installation can't continue in safe mode.... we all it to go into
> normal mode.. same error occurs.. and repeats pattern... finally we
> select the option to go
> back to Win XP.. which we did..
>
> Being the Geek that I am ... I was able to capture.. the mini crash dump
> file.. and load it into WinDbg. debugger.. initally there were no
> symbols for Vista up on the microsoft Symbols servers -HINT HINT.. TO MSFT
> (SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did
> find some RC1 Vista symbols package..
> http://www.microsoft.com/whdc/devtoo...symbolpkg.mspx which I
> downloaded and loaded into the debugger as a second source.. (attached
> at the bottom)
>
> I had not heard of mpfirewall.sys before and assumed it was some MS
> Firewall service.. here's where things get interesting.. decided to
> search the NET .. turns out it's MCafee firewall.. which is weird..
> because I've never purchased, used, or installed any MCafee stuff on my
> PC... did more searching... and come to learn the problem could possibly
> be *** AOL *** YIKES!! GO Away.. I had never used it on this system..
> but I guess it's security service installs Mcafee files.. and toshiba
> ships the unit with AOL... even if it's just on your system (and not
> running) Vista install will blow up... this is just a theory.. I'm
> going to test completely removing AOL and delete mpfirewall.sys and
> re-attempt to update my PC to Vista.. details to follow... anyone at MS
> care to review the debug below and provide more info? perhaps this should
> be a MSFT KB Article...
>
> are there actually any Vista install log file somewhere .. that might
> provide me with more info (if so where is it kept) - I'll provide update
> after more testing...
>
>
> Microsoft (R) Windows Debugger Version 6.6.0007.5
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\dumps3\Mini111706-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
> ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986,
> size 0x4, align 0x4)
> DbsSplayTreeRangeMap::Add: ignoring zero-sized range at
> ?00000000`00000000?
> Symbol search path is:
> SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
>
> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
> Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
> *** ERROR: Module load completed but symbols could not be loaded for
> ntoskrnl.exe
> Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
> Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
> Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
> System Uptime: 0 days 0:00:36.223
> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
> Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
> *** ERROR: Module load completed but symbols could not be loaded for
> ntoskrnl.exe
> Loading Kernel Symbols
> .................................................. .................................................. ....................................
> Loading User Symbols
> Loading unloaded module list
> .......
> GetContextState failed, 0x80004005
> CS descriptor lookup failed
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> Unable to get program counterUnable to load image
> \SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
> *** WARNING: Unable to verify timestamp for MpFirewall.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> MpFirewall.sys
> ************************************************** *****************************
> * *
> * Bugcheck Analysis *
> * *
> ************************************************** *****************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )
>
> Followup: MachineOwner
> ---------
>
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> 1: kd> ! analyze -v
> GetContextState failed, 0x80004005
> Unable to get program
> counter******************************************* ************************************
> * *
> * Bugcheck Analysis *
> * *
> ************************************************** *****************************
>
> KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
> This is a very common bugcheck. Usually the exception address pinpoints
> the driver/function that caused the problem. Always note this address
> as well as the link date of the driver/image that contains this address.
> Some common problems are exception code 0x80000003. This means a hard
> coded breakpoint or assertion was hit, but this system was booted
> /NODEBUG. This is not supposed to happen as developers should never have
> hardcoded breakpoints in retail code, but ...
> If this happens, make sure a debugger gets connected, and the
> system is booted /DEBUG. This will let us see why this breakpoint is
> happening.
> Arguments:
> Arg1: c0000005, The exception code that was not handled
> Arg2: 8bcacbb0, The address that the exception occurred at
> Arg3: a2b9ba50, Trap Frame
> Arg4: 00000000
>
> Debugging Details:
> ------------------
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
>
> FAULTING_MODULE: 81800000 nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
> referenced memory at "0x%08lx". The memory could not be "%s".
>
> FAULTING_IP:
> MpFirewall+2bb0
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> 0008:cbb0 ?? ???
>
> TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
> Unable to read trap frame at a2b9ba50
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>
> BUGCHECK_STR: 0x8E
>
> LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0
>
> STACK_TEXT:
> a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> MpFirewall+2bb0
> GetContextState failed, 0x80004005
> GetContextState failed, 0x80004005
> 0008:cbb0 ?? ???
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: MpFirewall+2bb0
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: MpFirewall
>
> IMAGE_NAME: MpFirewall.sys
>
> BUCKET_ID: WRONG_SYMBOLS
>
> Followup: MachineOwner
> ---------
>
> GetContextState failed, 0x80004005
> 1: kd> lmvm MpFirewall
> start end module name
> 8bcaa000 8bcbe000 MpFirewall T (no symbols)
> Loaded symbol image file: MpFirewall.sys
> Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
> Image name: MpFirewall.sys
> Timestamp: unavailable (00000000)
> CheckSum: 00000000
> ImageSize: 00014000
> Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
> GetContextState failed, 0x80004005
>
>
>
>
>

removing mcaffee and the mpfirewall.sys allowed to install with no problems.

"Gary G. Little" <> wrote in message
news:455e0f02$0$612$...
> COMCAST will install McAfee if you use COMCAST's security services.
>
> --
> The personal opinion of
> Gary G. Little
>
>
> "kevin forsythe" <> wrote in message
> news:%...
>> setup
>> toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
>> 100 GB , 2GB RAM centrino duo processor
>>
>> we uninstalled all anti-virus, spyware, we updated the bios to a "vista
>> version" for the M400 per toshiba website
>> http://www.csdsupport.toshiba.com/ta...vista_beta.cgi
>> we downloaded and ran the Vista upgrade advisor RC... = all ok
>>
>> downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
>> install - not clean)
>> ran another install check... it tells us everything should work ok
>> (except my epson scanner - but who cares)
>> about 2hrs on the "completing final install 80% " the systems does a
>> normal install reboot .. upon reboot we hit a BSOD
>>
>> Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
>> attempt to boot into safe mode thinking this will clear the error and
>> allow install to continue.. Vista returns an error that says something
>> to the effect that
>> vista installation can't continue in safe mode.... we all it to go into
>> normal mode.. same error occurs.. and repeats pattern... finally we
>> select the option to go
>> back to Win XP.. which we did..
>>
>> Being the Geek that I am ... I was able to capture.. the mini crash dump
>> file.. and load it into WinDbg. debugger.. initally there were no
>> symbols for Vista up on the microsoft Symbols servers -HINT HINT.. TO
>> MSFT
>> (SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did
>> find some RC1 Vista symbols package..
>> http://www.microsoft.com/whdc/devtoo...symbolpkg.mspx which I
>> downloaded and loaded into the debugger as a second source.. (attached
>> at the bottom)
>>
>> I had not heard of mpfirewall.sys before and assumed it was some MS
>> Firewall service.. here's where things get interesting.. decided to
>> search the NET .. turns out it's MCafee firewall.. which is weird..
>> because I've never purchased, used, or installed any MCafee stuff on my
>> PC... did more searching... and come to learn the problem could possibly
>> be *** AOL *** YIKES!! GO Away.. I had never used it on this system..
>> but I guess it's security service installs Mcafee files.. and toshiba
>> ships the unit with AOL... even if it's just on your system (and not
>> running) Vista install will blow up... this is just a theory.. I'm
>> going to test completely removing AOL and delete mpfirewall.sys and
>> re-attempt to update my PC to Vista.. details to follow... anyone at MS
>> care to review the debug below and provide more info? perhaps this
>> should be a MSFT KB Article...
>>
>> are there actually any Vista install log file somewhere .. that might
>> provide me with more info (if so where is it kept) - I'll provide update
>> after more testing...
>>
>>
>> Microsoft (R) Windows Debugger Version 6.6.0007.5
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>> Loading Dump File [C:\dumps3\Mini111706-01.dmp]
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
>> ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986,
>> size 0x4, align 0x4)
>> DbsSplayTreeRangeMap::Add: ignoring zero-sized range at
>> ?00000000`00000000?
>> Symbol search path is:
>> SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
>> Executable search path is:
>>
>> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
>> Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
>> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
>> *** ERROR: Module load completed but symbols could not be loaded for
>> ntoskrnl.exe
>> Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
>> Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
>> Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
>> System Uptime: 0 days 0:00:36.223
>> WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
>> Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
>> *** WARNING: Unable to verify timestamp for ntoskrnl.exe
>> *** ERROR: Module load completed but symbols could not be loaded for
>> ntoskrnl.exe
>> Loading Kernel Symbols
>> .................................................. .................................................. ....................................
>> Loading User Symbols
>> Loading unloaded module list
>> .......
>> GetContextState failed, 0x80004005
>> CS descriptor lookup failed
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> Unable to get program counterUnable to load image
>> \SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
>> *** WARNING: Unable to verify timestamp for MpFirewall.sys
>> *** ERROR: Module load completed but symbols could not be loaded for
>> MpFirewall.sys
>> ************************************************** *****************************
>> * *
>> * Bugcheck Analysis *
>> * *
>> ************************************************** *****************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )
>>
>> Followup: MachineOwner
>> ---------
>>
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> 1: kd> ! analyze -v
>> GetContextState failed, 0x80004005
>> Unable to get program
>> counter******************************************* ************************************
>> * *
>> * Bugcheck Analysis *
>> * *
>> ************************************************** *****************************
>>
>> KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
>> This is a very common bugcheck. Usually the exception address pinpoints
>> the driver/function that caused the problem. Always note this address
>> as well as the link date of the driver/image that contains this address.
>> Some common problems are exception code 0x80000003. This means a hard
>> coded breakpoint or assertion was hit, but this system was booted
>> /NODEBUG. This is not supposed to happen as developers should never have
>> hardcoded breakpoints in retail code, but ...
>> If this happens, make sure a debugger gets connected, and the
>> system is booted /DEBUG. This will let us see why this breakpoint is
>> happening.
>> Arguments:
>> Arg1: c0000005, The exception code that was not handled
>> Arg2: 8bcacbb0, The address that the exception occurred at
>> Arg3: a2b9ba50, Trap Frame
>> Arg4: 00000000
>>
>> Debugging Details:
>> ------------------
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>>
>> FAULTING_MODULE: 81800000 nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 0
>>
>> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
>> referenced memory at "0x%08lx". The memory could not be "%s".
>>
>> FAULTING_IP:
>> MpFirewall+2bb0
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> 0008:cbb0 ?? ???
>>
>> TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
>> Unable to read trap frame at a2b9ba50
>>
>> CUSTOMER_CRASH_COUNT: 1
>>
>> DEFAULT_BUCKET_ID: WRONG_SYMBOLS
>>
>> BUGCHECK_STR: 0x8E
>>
>> LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0
>>
>> STACK_TEXT:
>> a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0
>>
>>
>> STACK_COMMAND: kb
>>
>> FOLLOWUP_IP:
>> MpFirewall+2bb0
>> GetContextState failed, 0x80004005
>> GetContextState failed, 0x80004005
>> 0008:cbb0 ?? ???
>>
>> SYMBOL_STACK_INDEX: 0
>>
>> SYMBOL_NAME: MpFirewall+2bb0
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> MODULE_NAME: MpFirewall
>>
>> IMAGE_NAME: MpFirewall.sys
>>
>> BUCKET_ID: WRONG_SYMBOLS
>>
>> Followup: MachineOwner
>> ---------
>>
>> GetContextState failed, 0x80004005
>> 1: kd> lmvm MpFirewall
>> start end module name
>> 8bcaa000 8bcbe000 MpFirewall T (no symbols)
>> Loaded symbol image file: MpFirewall.sys
>> Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
>> Image name: MpFirewall.sys
>> Timestamp: unavailable (00000000)
>> CheckSum: 00000000
>> ImageSize: 00014000
>> Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
>> GetContextState failed, 0x80004005
>>
>>
>>
>>
>>
>
>