Please help – (blue screen of death)W2K won’t boot up

Environment:

Dell PowerEdge 1650 Intel Pentium III - 512MB
Windows 2000 server, Service pack 3 with latest Microsoft patches.

Problem:

I updated my antivirus software merak mail server integrated antivirus with AVAST32Antivirus engine then updated my avg antivirus software and it required a system reboot. Afterwards, the system kept rebooting itself with the blue screen of death in each time.

Solution tried so far::
1. Invoked the last known good option from the start up. Did not work.
2. Booted in safe mode successfully, when I looked in the event viewer the system log was corrupted.
3. Disabled event log service and renamed the system.evt file in Winnt\system32\config. Event viewer system log recovered.
4. Tried normal boot up again same error.
5. Looked into event viewer system log the following error message appeared.
Error: Service Control Manager.

Boot start or system start driver
Awlegacy.sys
MRXSMB
NETBIOS
NETBT
RASACED
6. Tried to disable most services like the antivirus and removed most program from windows start-up Run registry key. Reboot the system same error.
7. Boot in safe mode again and restored the system data from previous day backup successfully. Reboot in normal mode again same error.
8. It cannot be any device driver problem because the only devices on it are the two NIC cards and they are fine

With this my day ended

What to do next?

Google search on file Awlegacy.sys and found out to be a Pcanywhere legacy driver, located Winnt\system32\Drivers

Spoken to a friend who suggested that updating virus software using pcanywhere could cause havoc.

Now, I’m confident that if I remove pcanywhere from the system. It will solve the problem.

Have I missed anything?

Any help will be gratefully appreciated.

I could be way out but uninstall your antivirus sofware if possible and re install without the update.

try to get pestpatrol from one of your friend if you could or you could go to some internet cafe and use the dsl connection to download it to cd rom and run it in your computer. It will find out all kind of spywares and viruses that even top of the line anti viruses cannot detect.
May be I could be wrong but there is no harm to get pestpatrol and it is free. You can download it at www.zonelabs.com

or bootup your system with antivirus. It will remove all the viruses. Forgot to add it in early reply, sorry.

micky05


Go here :-
http://support.microsoft.com/default...b;en-us;174630

[gloworange]Windows Restarts Continuously with Blue Screen [/gloworange] The information in this article applies to:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Professional
Microsoft Windows NT Server, Enterprise Edition 4.0
Microsoft Windows NT Server 3.5
Microsoft Windows NT Server 3.51
Microsoft Windows NT Server 4.0
Microsoft Windows NT Workstation 3.5
Microsoft Windows NT Workstation 3.51
Microsoft Windows NT Workstation 4.0

This article was previously published under Q174630
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry

SYMPTOMSWhen you start Windows, your computer may briefly display the blue startup screen and then continuously restart.
CAUSEThis behavior can occur if the following conditions exist:
A fatal system error (STOP error) causes the computer to stop.
The Automatically Reboot option is enabled under Recovery on the Startup/Shutdown tab in System properties.
The Windows paging file is smaller than the amount of physical memory installed in the computer or there is insufficient free space on the system hard disk to write the error dump file (Memory.dmp).
RESOLUTIONWARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

NOTE: To work around this issue, you require a parallel installation of Windows.

To make the necessary changes, follow these steps:
Install Windows to a different folder.
Run Regedt32.exe from the new installation of Windows, and then go to the HKEY_LOCAL_MACHINE key.
On the Registry menu, click Load Hive, and then open the System file in the original Windows installation location. By default, this installation is located at %SystemRoot%\System32\Config\System.
Enter an arbitrary name when you receive a prompt for a key name in the Load Hive window. This loads the original HKEY_LOCAL_MACHINE hive as a subkey of the current key.
Change the value data in the AutoReboot value to 0 (zero), instead of 1, in the following key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl

Collapse the HKEY_LOCAL_MACHINE subkey and unload the hive.
This disables the Automatically Reboot option in the original Windows installation. After you follow these steps, you may be able to gather information from the STOP error message and resolve the problem that prevents the computer from starting.

Another workaround may be necessary if the minimum size of the paging file is set to a value less than the amount of physical memory. Windows requires a paging file on the system drive large enough to hold all of physical memory, plus 1 megabyte (MB), to write debugging information. You can modify the PagingFiles value of the original installation so that the dump file can be created by the STOP error message. Enough free disk space must be available on the system drive for the paging file.

Follow these steps to change the PagingFiles value in the System file in the original Windows installation location:
Follow steps 1-4 from the preceding workaround.
Change the data value of the PagingFiles value to allow a minimum value of the amount of physical memory plus 1 MB, but not greater than the amount of free space on the hard disk. The key name is:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory Management

For example: "drive:\pagefile.sys nnnnnn" where drive is the letter of the system hard disk and nnn is a number for the minimum and maximum size of the paging file.
Check the following key to verify that the CrashDumpEnabled value is set to a data value of 1:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl

Collapse the HKEY_LOCAL_MACHINE subkey and unload the hive.
Attempt to start the original installation of Windows and the STOP error message should appear. The dump information is stored in the paging file.
Restart the computer and select the parallel installation of Windows. This allows the dump file to be created and you may be able to use the information to resolve the problem that causes the STOP error message in the original installation.

NOTE: The dump file is saved in the %SystemRoot%\Memory.dmp file, where %SystemRoot% is the parallel installation system folder.
MORE INFORMATIONWindows may encounter a problem during startup that results in a STOP error message. Depending on the system configuration, the blue screen may not be displayed long enough to record the error information. Using the workarounds listed above, you can alter the startup process so that important information about the STOP error message can be gathered.

For additional information about how to troubleshoot STOP error messages, click the article numbers below to view the articles in the Microsoft Knowledge Base:
123750 Debugging Windows NT Setup STOP Screens

129845 Blue Screen Preparation Before Contacting Microsoft

165863 Troubleshooting Stop 0x0A Messages in Windows NT

For additional information about a parallel install of Microsoft Small Business Server, click the article number below to view the article in the Microsoft Knowledge Base:
252777 How to Perform a Parallel Installation on Small Business Server



Good luck
Dr_Evil

I also saw this on the NTBUGTRAQ Mailing list....

Quote:

---

Just a quick heads up to anyone using Symantec AV.

The Norton anti-virus definitions file for 11th Feb 2003 (.004 I am
told) was somehow corrupted. In our fairly large environment, all
workstations that received that update no longer had working AV.

Our test labs with newer versions of NAV have experienced similar
issues.

We are finding that manual steps are required to get NAV working again
with working signatures are rather cumbersome.

Symantec seems to be keeping the info very close to their chest. They
do acknowledge the problem happened yesterday if you call with an issue
regarding it. However I couldn't find any mention anywhere else.


ben

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation

---