Page 1 of 3 123 LastLast
Results 1 to 15 of 45
  1. #1
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts

    Question Windows Updates cause BSOD

    I've already posted this in Windows Forums, but due to the nature of the problem (which is that installing Windows Updates repeatedly caused my computer to fail with BSODs), I think this forum might be the better place to post it.

    Windows Forums • Can't boot Windows 7 since Windows updates installed - View topic
    http://forum.mintywhite.com/viewtopi...p=36765#p36765

    Subject: Windows Updates cause BSOD
    Posted: Fri Oct 11, 2013 10:42 am
    Frank D

    Following up on my previous post, now that my PC was working again, I made a full system image backup, and then tried installing only five of the 26 Windows Updates (labeled "Security") that were offered -- just the first five that dealt with Windows itself and were shown as "Important," figuring that that was only one-fifth of the risk of installing all 26 at once. I'm sorry now that I didn't take note of the KB numbers of the updates.

    Well, it happened again! At 32%, I got the BSOD! :sick: I had just recovered from this experience earlier in the day. Cold chills ran down my back. The main info on the blue screen was STOP: 0x0000007E, and at the bottom something about "shield.sys".

    I figured that, as fallback, I at least have the new full image backup that I had just done, in reserve. So I tried restarting the machine, twice. Each time it ended up failing at the same point, 32%, with the same BSOD.

    As a last resort, I tried rebooting in Safe Mode, which worked. In Safe Mode, I got the message: "Failure configuring Windows updates. Reverting changes. Do not turn off your computer." (Screenshot posted at http://gyazo.com/3a7a148bb4e76f4718996e1d2d4940cd). This was a welcome sign. At least, I thought, I'm going to be saved from having to restore from my image backup.

    It took a half hour, with five automatic restarts and four repeats of that message, before my computer rebooted into normal, working Windows again. Needless to say, I don't ever want to have to live through that kind of experience again!

    On my screen now appeared a "Windows" window with information stating: "Windows has recovered from an unexpected shutdown. Windows can check online for a solution to the problem." I didn't bother looking for it. I've posted two screenshots of the window (the text was too long for only one shot) at: http://gyazo.com/306dad6469461cb7dc9eaeb5eeb0bf78 and http://gyazo.com/49cbe44f8143b460ae37fd65391925a3. If anybody is interested I can post the contents of those two files mentioned, "that help describe the problem."

    At this point the Windows Updates window popped up, offering 21 updates (screenshot posted at http://gyazo.com/4c5912c068707fad928fe9867ac19d71), five fewer than previously. This might indicate that Windows Update had "learned its lesson" and had given up on the five that I had previously tried to install. Who knows?

    All I know now is that I am totally leery of installing any more Windows Updates.

    And now I'd like to ask: Can anyone offer any opinions or knowledge about my experience and what I can or should do about it? I know I can't do without them, but . . . I'd appreciate any help in this regard. Thank you.

    Frank D

    P.S. There is much talk about using System Restore points to recover from a situation where Windows Updates go wrong. But my question is, how do you run a System Restore when your system won't boot or only boots to a BSOD? The only answer I know is to use a Windows Install DVD to get to the System Restore option. This is just about as uncertain and time-consuming as running a full system image restore. Any comments?
    Last edited by frankd14612; 2013-10-11 at 13:48.

  2. #2
    Super Moderator jwitalka's Avatar
    Join Date
    Dec 2009
    Location
    Minnesota
    Posts
    6,797
    Thanks
    117
    Thanked 799 Times in 720 Posts
    You stated you can boot to Safe Mode. You can do a System Restore from there.

    Jerry

  3. The Following User Says Thank You to jwitalka For This Useful Post:

    frankd14612 (2013-10-11)

  4. #3
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    I'd boot in Safe Mode and track down the owner of shield.sys to begin with. Then uninstall the software or disable it from starting via Device Manager (Show hidden drivers > non-plug and play section?) or by renaming it.

    Copy all minidumps from C:\Windows\Minidump to the Desktop, zip and attach them here, we'll try to analyse them.

  5. The Following User Says Thank You to satrow For This Useful Post:

    frankd14612 (2013-10-11)

  6. #4
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    Jerry,

    I didn't have that option, since there were no restore points at that time. I had unknowingly wiped out all my previous RPs by restoring from an image backup that didn't include restore points, and I couldn't get SR to create any RPs, even after trying three or four repair options. But I've got SR working now, so I will follow your suggestion in the future.

    Frank

  7. #5
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    Satrow,

    I found that the owner of shield.sys is Microsoft, and after googling a bit that it is listed as "safe."

    I wouldn't want to go about trying to disable a Microsoft system file, because of what unintended consequences might follow.

    I've zipped up the Minidumps folder from Windows and attached it to this post.

    I appreciate your and Jerry's follow-up.

    Frank
    Attached Files Attached Files
    Last edited by frankd14612; 2013-10-11 at 18:25.

  8. #6
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    Frank, it looks like shield.sys is part of Rollback RX from http://horizondatasys.com/en/product...px?ProductId=1

    What these programs do is block any changes to Windows - they must be disabled before running Windows Update.

  9. The Following User Says Thank You to satrow For This Useful Post:

    frankd14612 (2013-10-11)

  10. #7
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    Quote Originally Posted by satrow View Post
    Frank, it looks like shield.sys is part of Rollback RX from http://horizondatasys.com/en/product...px?ProductId=1

    What these programs do is block any changes to Windows - they must be disabled before running Windows Update.
    Satrow,

    Bingo! Thank you for your detective work.

    I had installed Rollback Rx, about three months ago, tried it out for about a month, didn't like it for its invasive behavior, and uninstalled it completely -- or so I thought. I guess this is just a leftover piece of trash the uninstaller didn't take with it. Now that I know what it is I will delete it.

    While looking for shield.sys I found two other files, shieldf.sys and shieldm.sys and in Properties found that they belonged to Horizon also. I disabled them pending a reboot, which I will do immediately.

    Frank

  11. #8
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    Satrow,

    That wasn't it.

    When I rebooted I got the BSOD! The info at the bottom was STOP: 0x0000007B. I tried two more times and got the same results. I then tried to boot into Safe Mode and again got the same BSOD! At this point I knew I had asked for trouble. My main concern now was to get those three files back where they were.

    I could have booted with the Windows Install DVD and done a System Restore, but on a whim I restarted with Hiren's Boot CD and went into the Mini-XP mode. I renamed the shieldf.sys and shieldm.sys back to their original names (I hadn't deleted them) and used the Search function to retrieve the shield.sys file from the Recycle Bin and copied it back to the Windows\System32\drivers folder. When I rebooted, all was well again, but it wasn't a pleasant experience.

    What I said about Rollback Rx is still true, but apparently that driver is still required by the OS.

    So I'm back to where I was at the top of this thread.

    Frank

  12. #9
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    Just during the latest crash dump, there are 3x shield*.sys drivers loaded; judging from the dates, Shdbus.sys is another Rollback driver that was loaded. It looks like the issue was caused by Rollback calling a file that no longer exists, I'd guess it's one that was deprecated/replaced during Windows Updates.

    fffff880`00fea000 fffff880`00ff2000 Shdbus Shdbus.sys Wed Jul 31 11:28:49 2013 (51F8E6E1)
    fffff880`0119f000 fffff880`011b2000 shield shield.sys Wed Jul 31 11:28:35 2013 (51F8E6D3)
    fffff880`015a1000 fffff880`015ac000 Shieldf Shieldf.sys Wed Jul 31 11:28:43 2013 (51F8E6DB)
    fffff880`01598000 fffff880`015a1000 Shieldm Shieldm.sys Wed Jul 31 11:28:57 2013 (51F8E6E9)
    Code:
    
    BugCheck 1000007E, {ffffffffc0000005, fffff800030bae20, fffff88003acfaa8, fffff88003acf300}
    Probably caused by : shield.sys ( shield+12a0 )
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
    BugCheck 1000007E, {ffffffffc0000005, fffff88001038013, fffff88002e83a88, fffff88002e832e0}
    Probably caused by : shield.sys ( shield+1013 )
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
    BugCheck 1000007E, {ffffffffc0000005, fffff80003084e20, fffff88003acfaa8, fffff88003acf300}
    Probably caused by : shield.sys ( shield+12a0 )
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
    BugCheck 1000007E, {ffffffffc0000005, fffff80002e74e20, fffff88002aa2aa8, fffff88002aa2300}
    Probably caused by : shield.sys ( shield+11f7 )
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
    BugCheck 609, {2, 0, 319a0, 0}
    Probably caused by : shield.sys ( shield+69a0 )
    ииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииииии``
    BugCheck 609, from the oldest crash, is an error not used by MS, it may be an internal Rollback error (self-reporting?) or an error from the compiler used to create Rollback.

    If Rollback had been uninstalled successfully, none of those drivers would exist on your drive and you wouldn't be posting here.

    Do you currently have any Comodo security products installed?

  13. The Following User Says Thank You to satrow For This Useful Post:

    frankd14612 (2013-10-12)

  14. #10
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    Do you currently have any Comodo security products installed?
    Yes, I have Comodo Programs Manager installed.

    I just loaded the program and checked, and I see that Rollback Rx is still shown as installed. Silly question, but should I do the obvious and uninstall it?

    Frank
    Last edited by frankd14612; 2013-10-12 at 09:09.

  15. #11
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    There should be a maintenance setting, whereby you can disable Rollback while you update Windows or other software. You could try using that then allow Windows to update, if all goes well after a second test reboot, you should be good to go.

    Or, just uninstall Rollback, it's your choice - you need a mix of security software that doesn't get in the way too much, yet still keeps your data safe.

  16. The Following User Says Thank You to satrow For This Useful Post:

    frankd14612 (2013-10-12)

  17. #12
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    Quote Originally Posted by satrow View Post
    There should be a maintenance setting, whereby you can disable Rollback while you update Windows or other software. You could try using that then allow Windows to update, if all goes well after a second test reboot, you should be good to go.

    Or, just uninstall Rollback, it's your choice - you need a mix of security software that doesn't get in the way too much, yet still keeps your data safe.
    First: Rollback Rx was not an installed program at this time. I recall uninstalling it back in August, about a month after I started using it, but there must have been components still lingering on. I really don't know.

    Next: More bad news:

    I used Comodo Programs Manager to uninstall Rollback Rx (even though the program was NOT installed there were obviously remnants in the Shield folder in C:\Programs(386) and tried to run a System Restore. But, as soon as I started it . . .

    Disaster! A BSOD saying STOP: 0x0000007A appeared. When I rebooted a black screen appeared and told me that there was no operating system found. I used my Hiren's Boot Disc and it verified that there was no OS. I used my Windows Installation DVD and verified again that there was no OS. I tried the usual Repair option but it failed. Likewise the System Restore option. Finally, I inserted my backup program's boot disc and did the inevitable: I restored my previous full system image backup, which was done last night.

    Result: I am back in business again, but now I'm unsure of what to do next. Is my only option to contact Rollback and ask them what to do? Or is there some other option?

    Frank

  18. #13
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,492
    Thanks
    284
    Thanked 577 Times in 480 Posts
    On a personal level, I'd track down all traces of Rollback with Autoruns and block them from loading; this may be rather more difficult if any parts load from within something like Wininit.exe or Appinit. Autoruns will show all these entries. You can save your Autoruns.arn to zip and attach here if you wish, we'll look through it for you. http://technet.microsoft.com/en-us/s.../bb963902.aspx

    Rollback support may be the safest option, no telling how long before they'd respond though, especially over a weekend.

  19. The Following User Says Thank You to satrow For This Useful Post:

    frankd14612 (2013-10-12)

  20. #14
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    I see now that I was wrong when I said that Rollback Rx had been uninstalled. It is still installed. After the crash I had in August, I incorrectly thought I had uninstalled it, and just didn't think to look for it again. Regardless, I hadn't run it since then and didn't realize that its drivers were still present and in force.

    I am now gun-shy after my previous uninstall of Rollback Rx and the system crash that occurred as a result (see message #12 above). I have sent a message to Horizon DataSys, vendors of Rollback Rx, and have received a confirmation e-mail from them with a ticket number and assurance that I will be contacted ASAP.

    In the meantime I will not try to install any Windows Updates on my PC, and will create System Restore points and system backups after every significant event in case I run into further trouble.

    Thank you for your continuing help in this case.

    Frank

  21. #15
    Star Lounger
    Join Date
    Dec 2009
    Location
    New York, USA
    Posts
    64
    Thanks
    35
    Thanked 4 Times in 4 Posts
    As you advised, I've attached a copy of my Autoruns.arn (zipped) to this message.

    Frank
    Attached Files Attached Files

Page 1 of 3 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •