[Tony I.]

I'm trying to troubleshoot my nephew's PC. He's running Windows XP (I think Pro, but am not sure). The problem is a BSOD shortly (30-60 seconds maybe) after boot time.

The error is a STOP 0xD4, "driver unloaded without canceling pending operations", and appears to be caused by av5flt.sys. Google says that this file part of the Panda anti-virus program, which I know is installed on that machine.

It seemed like the obvious first step was to get into safe mode and uninstall Panda or prevent it from loading until I could figure out what was wrong. The problem is that the same thing happens even in safe mode -- when I would assume av5flt.sys should not even be getting loaded in the first place.

I was hoping someone here could give me advice on how to gain some control over what is loaded so that I can at least get into safe mode. I could swear that I'd seen an interface before where Windows tells you everything it wants to load during system boot, and gives you the option to allow or veto it, but nothing on the advanced boot menu does that.

My theory is that this is either Panda being too clever for its own good by forcing itself to be loaded even in safe mode, or else it's some kind of malware.

Another symptom that I didn't expect is that when I tried to boot safe mode with command prompt, I got the graphical shell (followed by the BSOD) instead of the command prompt.

Anyway, a lot of weird stuff seems to be going on, and my image as the IT guru of the family is beginning to tarnish, so if anyone sees anything familiar about this problem or has any advice, please feel free to chime in. Thanks.

[Advertisements]

I'm not familiar with this particular error, but it sounds like you are going to either need to use the Recovery Console, or do a repair install. Some of these links may be useful:

http://support.micro...kb/314058/en-us
http://www.informati...cleID=185301251
http://askbobrankin....ry_console.html
http://askbobrankin.com/fix_mbr.html
http://support.microsoft.com/kb/315341
http://www.realtechnews.com/posts/2537

Hope something here helps.
Good luck, and please post back with your progress.

[1101doc]

I'm not familiar with this particular error, but it sounds like you are going to either need to use the Recovery Console, or do a repair install. Some of these links may be useful:

http://support.micro...kb/314058/en-us
http://www.informati...cleID=185301251
http://askbobrankin....ry_console.html
http://askbobrankin.com/fix_mbr.html
http://support.microsoft.com/kb/315341
http://www.realtechnews.com/posts/2537

Hope something here helps.
Good luck, and please post back with your progress.

[Tony I.]

I'm not familiar with this particular error, but it sounds like you are going to either need to use the Recovery Console, or do a repair install. Some of these links may be useful:

http://support.micro...kb/314058/en-us
http://www.informati...cleID=185301251
http://askbobrankin....ry_console.html
http://askbobrankin.com/fix_mbr.html
http://support.microsoft.com/kb/315341
http://www.realtechnews.com/posts/2537

Hope something here helps.
Good luck, and please post back with your progress.

I managed to figure things out for myself before you posted, but thanks anyway. Not to say that I actually fixed anything, I just forced XP to boot so that we could get in and copy some important files off the hard drive. I did use recovery console, and the first thing I tried was deleting the offending driver. I rebooted and got the same error, and when I went back into recovery console the file had been restored. So I deleted it again, and then copied null.sys in it's place. I rebooted again, and this time the system came up. Apparently having a file already present called av5flt.sys prevented whatever mechanism had restored it last time from doing so again.

Once I was booted, all kinds of messages and dialogs started popping up, including several attempts by Windows Installer to install something. My brother-in-law was sitting beside me as this was going on, and he told me that this happens all the time. So the machine apparently had more problems than just this apparently corrupted driver. He had already resolved himself to reinstalling XP on the machine, so we copied off all the important files and he went ahead and tried to do the install from the hidden recovery partition that the PC manufacturer provided in lieu of a Windows XP CD. A couple of attempts doing that failed, apparently the recovery partition is hosed as well. So he's going to just buy a copy of XP and do a clean install. Which is probably for the best anyway, since the recovery partition won't let you just install XP, it also installs all the trialware and other garbage that came preinstalled on the PC.

Thanks again for your assistance. Sorry I couldn't wait for your response, but they called me about this on Friday, and it had to be fixed immediately because school is starting soon, and my nephew's summer homework was on the hard drive.

As far as the error itself, my own research indicated that 0xD4 is generally caused by a driver doing normal things, but not making proper use of the Windows APIs. IE it's usually due to a programming error. My brother-in-law said he recently ran a registry fix program on the computer, and it's possible that that contributed to the problem. I still haven't got the foggiest idea why the driver was loaded during safe mode, and I don't think I'll ever know. All the MS documentation I looked at said "if you can't boot, start up in safe mode and do the following...". As if they had completely ruled out the possibility that someone would be unable to start in safe mode.

Tony