Vista RTM - Blue screen (BSOD) on Install Toshiba M400 TabletPC

Discussion in 'Windows Vista Installation' started by kevin forsythe, Nov 17, 2006.

  1. setup
    toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
    100 GB , 2GB RAM centrino duo processor

    we uninstalled all anti-virus, spyware, we updated the bios to a "vista
    version" for the M400 per toshiba website
    http://www.csdsupport.toshiba.com/tais/csd/support/windows_vista/vista_beta.cgi
    we downloaded and ran the Vista upgrade advisor RC... = all ok

    downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
    install - not clean)
    ran another install check... it tells us everything should work ok (except
    my epson scanner - but who cares)
    about 2hrs on the "completing final install 80% " the systems does a
    normal install reboot .. upon reboot we hit a BSOD

    Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
    attempt to boot into safe mode thinking this will clear the error and allow
    install to continue.. Vista returns an error that says something to the
    effect that
    vista installation can't continue in safe mode.... we all it to go into
    normal mode.. same error occurs.. and repeats pattern... finally we select
    the option to go
    back to Win XP.. which we did..

    Being the Geek that I am ... I was able to capture.. the mini crash dump
    file.. and load it into WinDbg. debugger.. initally there were no symbols
    for Vista up on the microsoft Symbols servers -HINT HINT.. TO MSFT
    (SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did find
    some RC1 Vista symbols package..
    http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx which I
    downloaded and loaded into the debugger as a second source.. (attached at
    the bottom)

    I had not heard of mpfirewall.sys before and assumed it was some MS
    Firewall service.. here's where things get interesting.. decided to search
    the NET .. turns out it's MCafee firewall.. which is weird.. because I've
    never purchased, used, or installed any MCafee stuff on my PC... did more
    searching... and come to learn the problem could possibly be *** AOL ***
    YIKES!! GO Away.. I had never used it on this system.. but I guess it's
    security service installs Mcafee files.. and toshiba ships the unit with
    AOL... even if it's just on your system (and not running) Vista install will
    blow up... this is just a theory.. I'm going to test completely removing
    AOL and delete mpfirewall.sys and re-attempt to update my PC to Vista..
    details to follow... anyone at MS care to review the debug below and
    provide more info? perhaps this should be a MSFT KB Article...

    are there actually any Vista install log file somewhere .. that might
    provide me with more info (if so where is it kept) - I'll provide update
    after more testing...


    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\dumps3\Mini111706-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
    ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986, size
    0x4, align 0x4)
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    Symbol search path is:
    SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:

    WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for
    ntoskrnl.exe
    Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
    Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
    Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
    System Uptime: 0 days 0:00:36.223
    WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for
    ntoskrnl.exe
    Loading Kernel Symbols
    .........................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ........
    GetContextState failed, 0x80004005
    CS descriptor lookup failed
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    Unable to get program counterUnable to load image
    \SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for MpFirewall.sys
    *** ERROR: Module load completed but symbols could not be loaded for
    MpFirewall.sys
    *******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )

    Followup: MachineOwner
    ---------

    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    1: kd> ! analyze -v
    GetContextState failed, 0x80004005
    Unable to get program
    counter*******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8bcacbb0, The address that the exception occurred at
    Arg3: a2b9ba50, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005

    FAULTING_MODULE: 81800000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
    referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    MpFirewall+2bb0
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    0008:cbb0 ?? ???

    TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
    Unable to read trap frame at a2b9ba50

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: WRONG_SYMBOLS

    BUGCHECK_STR: 0x8E

    LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0

    STACK_TEXT:
    a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    MpFirewall+2bb0
    GetContextState failed, 0x80004005
    GetContextState failed, 0x80004005
    0008:cbb0 ?? ???

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: MpFirewall+2bb0

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: MpFirewall

    IMAGE_NAME: MpFirewall.sys

    BUCKET_ID: WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    GetContextState failed, 0x80004005
    1: kd> lmvm MpFirewall
    start end module name
    8bcaa000 8bcbe000 MpFirewall T (no symbols)
    Loaded symbol image file: MpFirewall.sys
    Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
    Image name: MpFirewall.sys
    Timestamp: unavailable (00000000)
    CheckSum: 00000000
    ImageSize: 00014000
    Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
    GetContextState failed, 0x80004005
     
    kevin forsythe, Nov 17, 2006
    #1
    1. Advertisements

  2. kevin forsythe

    Josh Guest

    First,

    Great job with what you have done so far! As far as where you might find
    some more information the C:\windows\panther folder has all the setup logs
    that you might want.

    I think removing mpfirewall and reinstalling will fix your issue, once you
    can find what layed it down that would help too. Then get that feedback to
    MSFT so that they can include that in analysis tool.

    --
    Josh
    http://windowsconnected.com
     
    Josh, Nov 17, 2006
    #2
    1. Advertisements

  3. COMCAST will install McAfee if you use COMCAST's security services.

    --
    The personal opinion of
    Gary G. Little


     
    Gary G. Little, Nov 17, 2006
    #3
  4. removing mcaffee and the mpfirewall.sys allowed to install with no problems.

     
    kevin forsythe, Nov 18, 2006
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.