[Inquirer2]

Hopefully, some more skilled members can assist me with this vexing issue.

After machine assembled (see specs if relevant below) Installed XP Pro, then SP2, no problems apparent after each discrete install (Encountered same problem with updates after first tried "integrated" or "slipstreamed" install so then went to step by step install method to make sure problem was not with slipstreamed disk). Issues happened after everything was working well. So, being prudent, performed windows update and found there were approx 36 security and other updates post SP2 updates, e.g. .NET framework, etc.

After install of updates, on reboot, I get the BSOD and STOP error 0xC000021A. Initially, the machine will go into a loop of rebooting, but hitting F5 and selecting don't reboot on error stops this, leaving the error to be read.

Believing the problem to be one of the Hotfixes/updates, I want to uninstall or disable the hotfixes in question rather than install Windows again.

In order to do this, I think I have to use the Recovery Console. I know how to get to the console, select the OS folder and log in as the administrator - the problem is how to properly remove the updates.

I want to use the correct Recovery Console command, whether it be DISABLE or DELETE or something else.

If someone has successfully removed a troublesome update before, I would appreciate the advice on both the correct command to utilize and also, the particular syntax to use - e.g. Disable $ntuninstallKB896423 (space - or enter or suffix?)

Any other words of advice would be appreciated.

I find it interesting that service pack 2 did not cause the problem as I have read is the case with some users, but one of the updates. Thoughts on this are also appreciated, otherwise, if advice on using Recovery Console given gets me going, I'll have to try installing the updates one at a time to find the culprit.

For what it may be worth, machine is a new homebuilt machine w/ Asus A8n-Sli Premium MB (Bios set to single card for Nvidia Quadro 540, AMD 4400+ dual core cpu (bios not updated to most recent 1011, but at 1008 allows even XP to see "2" processors - AMD driver then installed with no problems), 2GB SDRAM, 2 250GB SATA drives, NEC 3500a DVD burner, no sound card currently installed and onboard sound disabled - will be using A) M-audio 1814 firewire - I did install a PCI (texas instrument chipset) 3 port firewire card (Motherboard PCI slot 2) that caused no problems on install of XP or SP2. Device manager showed no issues on install or post SP2.

[Advertisements]

When you see the C:\Windows Prompt, type this command:

DIR $*

This lists all the folder starting with the letter $ which are all the hotfixes/updates...

These are actually the backup folders...running the hotfix/update moved the original files here.

It will lost the date of the install...cannot recall if it lists the time...think it does.

Note the numbers matching the date you installed the problematic Hotfix(es).

To remove, change to that directory by typing this:

CHDIR $NtUninstallKB{whateverthenumberis}$\spuninst


Once in that folder, it's pretty simple

execute the spuninst.txt which contains command line instructions to remove replace the updated files with the old ones

Type this:

BATCH spuninst.txt

If it were me, I'd do it one at a time, then reboot....tedious, but you can then learn which one is causing the issue.

Now, this only applies to hot fixes updates....you will not be able to remove directx or dot.net or windows media player 10 files (though you can correct the hotfix patches to those installations

[gerryf]

When you see the C:\Windows Prompt, type this command:

DIR $*

This lists all the folder starting with the letter $ which are all the hotfixes/updates...

These are actually the backup folders...running the hotfix/update moved the original files here.

It will lost the date of the install...cannot recall if it lists the time...think it does.

Note the numbers matching the date you installed the problematic Hotfix(es).

To remove, change to that directory by typing this:

CHDIR $NtUninstallKB{whateverthenumberis}$\spuninst


Once in that folder, it's pretty simple

execute the spuninst.txt which contains command line instructions to remove replace the updated files with the old ones

Type this:

BATCH spuninst.txt

If it were me, I'd do it one at a time, then reboot....tedious, but you can then learn which one is causing the issue.

Now, this only applies to hot fixes updates....you will not be able to remove directx or dot.net or windows media player 10 files (though you can correct the hotfix patches to those installations

[gerryf]

fwiw, a big cause of this error is a poorly installed hotfix, as you know....

I do not know if you downloaded all those updates at once, or in groups, but I generally have more success doing them several at a time

[Inquirer2]

Dear Gerryf

Thanks for the advice. Will try later today and post result. Actually, although I always suspected a problem, this is the first time had one downloading all updates at once rather in groups as you suggest - I think that's cause I never had a batch this large as I havent built a machine in 18 months so the amount of updates were less.

Anyway, thanx for the advice - Inquirer2

[Inquirer2]

Update -

Progress, but no success yet.

There were 35 updates installed. I uninstalled in batches and called them A,B,C etc and rebooted periodically to see effect of removal.

Some updates would not uninstall or would only partially uninstall, telling me "access denied". This happened for three updates: KB885836 (WordPad security update), KB887797 (Cumulative Update for Outlook Express - where three files were denied access and one was copied/replaced) and KB891781, a security update, could not find what for.

Only a couple of updates remain to be uninstalled. The current result is the stop error no longer prevents progress to logon screen. At the logon screen the mouse moves and the avatar is present but neither in safe nor normal mode does XP yet allow me to log in. It could be I should leave it run for 15 minutes and walk away, but 3 minutes results in "dead" buttons - clicking on user avatar or turn off machine does not result in corresponding action. Interestingly, soft touch on power button results in message windows shutting down and it does, in fact, shut down and power off.

Any suggestions on how to proceed, especially about what to do about the access denied updates?

Thanks, Inquirer2

[Inquirer2]

Sorry for not thinking clearly - type command on spuninst.txt reveals path of files to be copied outside windows and subdirectories, hence the access denied message. These would likely not be culprits in logon.
I'm letting windows boot and run for a while to see if giving it time to boot makes a difference.

[Inquirer2]

Success! Thank you Gerryf

After all updates uninstalled, clicking on Avatar would not start windows, however, Ctrl Alt Delete and entering username and password did work. Entering Control Panel add remove software revealed all updates gone and only service pack 2 remained.

Now I can install the updates again, a few at a time and see what happens.

Thank you very much for your advice.

Inquirer2