HP XW4600 BSOD Reboot After XP installs security updates

[pcollins1]

I have 2 brand new HP XW4600 Workstations. After Last weeks Microsoft Security updates for May were downloaded and installed on these workstations, they Blue Screened and kept rebooting directly after login. I windbg the mini dumps and it seems to point to CSRSS.EXE crashing after these updates. The only thing I can do is restore, or unistall updates to a prior update. It does not affect any of the other machines, which are not related to this particular model.
It must be related to a driver or piece of hardware, but I can't figure out which one. I have to turn off updates, until I can find a fix.

Anybody else experienced this and found a cure??
Here is the bugcheck:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 8979e020, Terminating object
Arg3: 8979e194, Process image file name
Arg4: 805d164c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 8979e020

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

STACK_TEXT:
acc71d00 805d07f3 000000f4 00000003 8979e020 nt!KeBugCheckEx+0x1b
acc71d24 805d16f7 805d164c 8979e020 8979e194 nt!PspCatchCriticalBreak+0x75
acc71d54 805413fc 8979e268 c0000005 0052eb88 nt!NtTerminateProcess+0x7d
acc71d54 7c90eb94 8979e268 c0000005 0052eb88 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0052eb88 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

 

[BadBigBen]

0x000000F4: CRITICAL_OBJECT_TERMINATION

One of the many processes or threads crucial to system operation has unexpectedly exited or been terminated. As a result, the system can no longer function. Specific causes are many, and often best resolved by a careful history of the problem and the circumstances of the error message. One user, who experienced this on return from Standby mode on Win XP SP2, found the cause was that Windows was installed on a slave drive.

Source: aumha.org

Here is the KB from MS, that refrences the last sentence in the quote:

Connecting a hard disk drive in slave only mode leads to system halt during resume from standby

http://support.microsoft.com/kb/330100

my suggestion:

check to see if they are IDE/PATA drives (rare now a days), and if that is not the case, then install one Security Update after another until it BSODs, then reverse it and go on to the next...

write down which one did it...

PS: strangely I only see one Security Update for May, and that one was for Office...



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[wahnula]

I would try some seat-of-the-pants troubleshooting: what do these two machines have/run/do that others do not? I would start by disabling all the HP diagnostics and proprietary software, for the time being.

Next, work backwards to see what else they have in common exclusive of other PCs on the network. I'm betting it's an HP package that is in conflict with MS, maybe a security thing?

Ben the "...2 brand new HP XW4600 Workstations..." seems to rule out PATA, but it can't hurt to have a look.

My thinking is that if these are both new machines, and they both have the exact same fault, then you're undoubtedly not the only one to have this happen. Search HP support with a string from the fault and see what you get. Best of luck.

Tony

Users helping Users...

 

[pcollins1]

I have put the exact same post out on the HP forum, but as of yet have had no response. The bug check I posted above does say driver_fault:
DEFAULT_BUCKET_ID: DRIVER_FAULT
but it does not at least as I can tell which driver is causing the fault. I do know it is these windows updates that are causing the problem, in the fact that if I remove them, the machines start working correctly.
Thanks for the info, if you think of anything else, let me know.