none
Blue Screen after KB4056894

    Question

  • Hi all,

    This morning I found my Windows 7 PC with a blue screen (0x000000c4). Startup repair didnt find anything to fix, then system restore indicated that KB4056894 had been installed over night. Used system restore to get back to immediately prior to this update and my PC booted up fine.

    Anyone else seen this?

    I'm on 64bit Windows 7 Pro, AMD Athlon 64 x2 Dual Core 4800+ CPU, 4GB RAM, SSD OS drive. Running microsoft security essentials and up to date with updates other than this last one.

    Cheers,

    • Changed type Gav_996 Friday, January 05, 2018 11:17 PM
    Friday, January 05, 2018 10:29 PM

Answers

  • Hi All, 

    This is a known issues that has been added to 4056894. Check detailed information below:

    Microsoft has reports of some customers with AMD devices getting into an unbootable state after installing this KB.   To prevent this issue, Microsoft will temporarily pause Windows OS updates to devices with impacted AMD processors at this time. Microsoft is working with AMD to resolve this issue and resume Windows OS security updates to the affected AMD devices via Windows Update and WSUS as soon as possible.   If you have experienced an unbootable state or for more information see KB4073707.  For AMD specific information please contact AMD.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 09, 2018 5:12 AM
    Moderator

All replies

  • I also received this update.  Also the same:  same blue screen error, Windows 7 64-bit on an AMD Athlon 64 x2 Dual Core.  Mine is the 3800+.  2GB RAM.  Exact same thing.  Installed update, rebooted, blue screen.  System Restore righted the ship.  I am running Norton for AntiVirus.  Wondering if there is an AMD issue with this fix?  Perhaps an issue with this latest Spectre security flaw?  Unfortunately I have nothing to offer by way of a fix.  Right now, only can offer a me too to the mix.

    I did see that Computer World

    https://www.computerworld.com/article/3246028/microsoft-windows/win7-monthly-rollup-kb-4056894-signals-early-abbreviated-patch-tuesday.html

    is saying this fix is a Meltdown fix only, for Win7.  If that is the case, while still early in this process, Meltdown is supposed to be an Intel problem.  Maybe that is the root cause?  I have seen several other posts of the me too type, and AMD processors. 

    Saturday, January 06, 2018 12:39 AM
  • Same thing here. BSOD about an hour after installing the update. My system has the reg key (set by AV vendor) to allow the update, but still got the BSOD none the less. The cure is worse than the problem. Removing the update.


    Wayne H

    EDIT: This update is known to potentially conflict with AV software which lead Microsoft to avoid installing it on a system until the AV software vendor whose software is running on said system indicate compatibility with the update, by way of a special registry key. Like I just said, however, that key was set on my system, but the BSOD still happened. Maybe the AV vendor didn't realize they actually had to do something rather than just set the key. Ugh. Will be sitting this one out until it's sorted out. Obviously cannot accept random BSODs, especially on systems that have run flawlessly for years on end.

    EDIT2: My CPU is Intel i7.

    • Edited by Wayne Hartell Saturday, January 06, 2018 3:49 AM Add CPU type
    Saturday, January 06, 2018 3:40 AM
  • Also have many machines failing on t his update mainly older AMD Athlons
    • Edited by freshEF Saturday, January 06, 2018 5:36 AM
    Saturday, January 06, 2018 5:36 AM
  • To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    It will automatically collect these files:  msinfo32, dxdiag, mini dumps, drivers hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There is 1 file for you to find manually:  memory dump file:

    C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results.

    In case dxdiag did not appear on the desktop please find and post it into the thread:  In the left lower corner type:  dxdiag > open each page > give it several minutes to load > save to desktop > post one drive or drop box share link

    Saturday, January 06, 2018 5:50 AM
  • Our Windows 7 ACER laptop, an AMD Athlon 64 X2 L310 machine, experienced the same thing overnight (PST). Restoring to prior to the update resolved the issue. Got a picture of the BSOD if anyone's interested.

    Saturday, January 06, 2018 6:01 AM
  • Hi got same thing this morning.

    found next solution 

    On startup, press F8 and select Repair Your Computer. From there, open a command prompt window. Check that the Windows drive is mapped by running

    dir d:
    

    Run the command

    dism /image:d:\ /remove-package /packagename:Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24002.1.4 /norestart
    

    It should say processing 1 of 1 and show a progress bar. If all goes well, it will say completed successfully and you can restart into Windows. We're going through checking for updates and hiding that patch so it won't reinstall. Hopefully Microsoft releases a patch to patch this patch soon.

    For me it was C:/Windows/symstem32/

    and Dism.exe /ima... same

    Worked for me, hope it'll help you. And dont install this update again, while not fixed

    also thread at ms

    https://answers.microsoft.com/en-us/windows/forum/windows_7-update/stop-0x000000c4-after-installing-kb4056894-2018-01/f09a8be3-5313-40bb-9cef-727fcdd4cd56?auth=1&rtAction=1515190079156

    • Edited by alex mihovich Saturday, January 06, 2018 7:45 AM
    • Proposed as answer by tomct Thursday, January 11, 2018 5:11 PM
    Saturday, January 06, 2018 7:36 AM
  • Same issue (stop error 0x000000c4) on Win7pro 64-bit, AMD Athlon Dual Core 4850e, SSD OS drive. Using only MSE AV.
    Saturday, January 06, 2018 3:53 PM
  • My AMD Athlon 64x2 Windows 7 Pro system hung at the Starting Windows boot screen.

    I recovered as you did with system restore then disabled auto updates for now.

    So far the only problems I've seen reported are with the AMD devices....Maybe  a little payback directed

    towards AMD ...? (I'm kinda kidding ...)

    Jim in Newberg Oregon

    Saturday, January 06, 2018 8:16 PM
  • Hi, same problem, but after trying your fix i'm getting error: 0x800f0805 the specified package is not valid windows package.

    Do you have any sugestions?
    Saturday, January 06, 2018 11:58 PM
  • Same blue screen (0x000000c4) experienced after KB4056894 WU install on AMD Athlon 64 3000+ running Win7 Home Premium SP1 and MS Security Essentials. Startup repair failed to find the problem on startup repair but was able to boot from the installation medium and use a restore point to back out the patch, booting fine now. Hiding the update for now, waiting for MS to release a proper patch.

    • Edited by Ken-Net Sunday, January 07, 2018 5:03 AM clarified
    Sunday, January 07, 2018 12:15 AM
  • Hello --  I had the same issue -- in my case its a w7 /32bit os ---  I too have an older AMD  processor --- 

    AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ 

    After the update was applied -- I restarted the system and when w7  started to boot, it failed and then got a 

    screen that had me start window normally or do a repair --- I  selected "repair" and it took about 10 minutes to fix -- It did ask me if I wanted to use a restore point .... I said yes --- 

    it seems to be working OK for now after the repair --- has this issue effected intel processors? 

    Sunday, January 07, 2018 4:59 AM
  • See:

     https://www.reddit.com/r/sysadmin/comments/7ode4s/problems_with_windows_7_quality_rollup_kb4056894/

    DISM /image:X:\ /cleanup-image /revertpendingactions

    ...worked for me on WIN 7 32-bit machine without restore point. All changes reverted after reboot.

    CPU AMD 4450e. Only AV was MS Sec Essentials.
    Monday, January 08, 2018 12:18 AM
  • Hi all,

    For me KB4056894 is killing my Windows old Amd computer too.

    OS was windows 7 x86 sp1.

    Fortunately the update was on few computers to validate.

    On friday i have found how to remove the update with dism (/get-packages and /removepackage)

    I ll try : DISM /image:X:\ /cleanup-image /revertpendingactions

    I have some computers that have made hard reboot repared windows and exited domain, but i didnt know if this was this update who cause problem. I'll investigate on this.

    Best regards

    Monday, January 08, 2018 7:43 AM
  • Hi,

    It is appreciated that you can help us collect the dump file under %systemroot%\MEMORY.DMP. Upload them to a network drive and share the link here.

    In this way, we can analyze the problem with more information.

    Thanks for your corporation.

    Best regards,

    Vivian


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, January 08, 2018 9:42 AM
  • Hi,

    After some investigations :

    Removing KB4056894 only didnt solve the problem, i must remove KB4056897 too. Removing KB4056897 only didnt work too.

    The command : DISM /image:X:\ /cleanup-image /revertpendingactions works very well and was way faster than my old method of searching and removing each kb separatly.

    Computer Hardware : AMD Athlon 4450B 2.30 Ghz 2 Go RAM

    Concerning memory.dmp on the computer i have just repared the date of file is 17/08/2016 i think it is not the good file for u?

    Best regards

    Monday, January 08, 2018 10:00 AM
  • Thank you very mach, vertical2010!

    The most accurate solution to the problem so far!

    Monday, January 08, 2018 2:53 PM
  • 260 systems around the office, 50 had BSD.

    Of the 3 I was troubleshooting, none had the Package_for_RollupFix~31bf3856ad364e35~amd64~~7601.24002.1.4

    However, we are having good success with vertical2010's command of:

    DISM /image:X:\ /cleanup-image /revertpendingactions

    It takes about an hour, but we are able to recover the systems.

    Thanks vertical2010.

    Monday, January 08, 2018 6:31 PM
  • Hi,

    After some investigations :

    Removing KB4056894 only didnt solve the problem, i must remove KB4056897 too. Removing KB4056897 only didnt work too.

    The command : DISM /image:X:\ /cleanup-image /revertpendingactions works very well and was way faster than my old method of searching and removing each kb separatly.

    Computer Hardware : AMD Athlon 4450B 2.30 Ghz 2 Go RAM

    Concerning memory.dmp on the computer i have just repared the date of file is 17/08/2016 i think it is not the good file for u?

    Best regards

    you mean you had both KB4056894 and KB4056897 installed on your Win7 computer?

    KB4056897 is a security-only update, not a rollup like KB4056894.

    Monday, January 08, 2018 6:39 PM
  • Same thing here. BSOD about an hour after installing the update. My system has the reg key (set by AV vendor) to allow the update, but still got the BSOD none the less. The cure is worse than the problem. Removing the update.


    Wayne H

    EDIT: This update is known to potentially conflict with AV software which lead Microsoft to avoid installing it on a system until the AV software vendor whose software is running on said system indicate compatibility with the update, by way of a special registry key. Like I just said, however, that key was set on my system, but the BSOD still happened. Maybe the AV vendor didn't realize they actually had to do something rather than just set the key. Ugh. Will be sitting this one out until it's sorted out. Obviously cannot accept random BSODs, especially on systems that have run flawlessly for years on end.

    EDIT2: My CPU is Intel i7.


    Wayne, the CPU type is not specific enough.  what kind of Intel i7 processor do you have and what "generation" is it from (there are MANY different kinds of i7 CPUs)?  use either (msinfo32.exe) or (dxdiag.exe) to gather the specific CPU type and speed.
    Monday, January 08, 2018 6:43 PM
  • To evaluate the BSOD please post logs for troubleshooting.

    Using administrative command prompt copy and paste this whole command:

    Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    The command will automatically collect the computer files and place them on the desktop.

    Then use one drive or drop box to place share links into the the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    It will automatically collect these files:  msinfo32, dxdiag, mini dumps, drivers hosts, install, uninstall, services, startup, event viewer files, etc.

    Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    There is 1 file for you to find manually:  memory dump file:

    C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results.

    Sometimes the dxdiag file needs to be found manually:  In the left lower corner search type:  dxdiag > open each page > allow a few minutes for it to fully load  save to the desktop > post into the thread using a one drive or drop box share link.

    Monday, January 08, 2018 7:53 PM

  • I have a Dell system model Optiplex 740 running an AMD Athlon CPU 1640B
    Bios version 2.2.7  Running Windows 7 Professional 32-bit.  It does have the
    latest version of Symantec Antivirus loaded (Not the Norton stuff, the corporate Symantec stuff)

    System attempted to apply update KB4056894  the 2018-01 Security Monthly
    Quality Rollup for Windows 7 for x86 systems.  System then rebooted
    and was unable to reload Windows.

    I booted the machine hitting F8 then selected Repair you Computer
    to boot off the Dell OEM Diagnostics partition.  I then selected to
    Restore the system using a Restore Point from 1/5/2018  6:32:08PM which
    was made immediately before attempting to apply the update.

    The system restored and booted into Windows.  I then ran Windows Updates
    and told it to Check for Updates, then the KB4056894 update showed up,
    I then Hid the update to prevent the system from attempting to install it
    again.

    This happened to 2 systems at the customer site, both of them model 740's
    Unfortunately the second system had a blank local admin password
    set into it so I was not able to get into the System Recovery Options from
    the Dell partition - because that requires a password and will not allow you
    to use a blank password!!  (normally if I need to login locally to a machine
    I use the utility at http://pogostick.net/~pnh/ntpasswd/bootdisk.html to
    blank the password, but in this case the password was already blank)  It
    kind of really irked me since I distinctly recall being able to use a
    blank password on System Recovery.  So maybe the password database got
    hosed.

    Unfortunately the Linux command chntpwd was modified to remove the capability
    to change the password of a user.  It used to allow you to change user passwords
    but nowadays you can only blank them out.

    As a result of this I'll probably have to reinstall windows from scratch.
      And there was no BSOD!!!   It just hung in booting forever.  So now I have 2 machines one fixed the other broken, identical models.

    Monday, January 08, 2018 10:52 PM
  • Hi All, 

    This is a known issues that has been added to 4056894. Check detailed information below:

    Microsoft has reports of some customers with AMD devices getting into an unbootable state after installing this KB.   To prevent this issue, Microsoft will temporarily pause Windows OS updates to devices with impacted AMD processors at this time. Microsoft is working with AMD to resolve this issue and resume Windows OS security updates to the affected AMD devices via Windows Update and WSUS as soon as possible.   If you have experienced an unbootable state or for more information see KB4073707.  For AMD specific information please contact AMD.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 09, 2018 5:12 AM
    Moderator
  • Hi,

    To avoid the inconvenience of BSOD, you can hide the update when you check for update in Control Panel and wait for a hotfix which is going to publish to handle this issue. 

    Thank you for your understanding.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, January 09, 2018 5:52 AM
  • Hi erpmanila3w,

    I know KB4056897 is a security update. On my impacted system i have both in "pending installation". Removing only KB4056894 didnt change anything and windows can't boot. But with KB4056897 removed windows can boot. I didnt explain why but i have tested that on 5 computers and they had the same result.

    Best regards

    Tuesday, January 09, 2018 7:15 AM
  • It's not the AMD problem. It's the KB4056894 + Antivirus problem.
    Tuesday, January 09, 2018 8:24 AM
  • Hi,

    It is very strange. I have about 100 machine that could have installed this update. Machines from 2007 to 2015 (intel in 2007, amd in 2009 to 2012 and intel after), and only my 2009 computers are impacted.

    All have the same antivirus.

    Best regards

    Tuesday, January 09, 2018 9:03 AM
  • Some suggestions for those running dual boot system – at least what finally worked for me – so maybe others can recover.  I have 3 hard drives – with a dual boot setup that has options for Win 7 or XP.  (I know…who uses XP…no one, until MS kills your computer and you can boot into XP so you can backup all your data).

    Partitioned each drive so each has two volumes.  Thus, I had drive letters C, D, E, F, G, H.  After running the DISM “Package_for_Rollup” script noted early in this conversation, I then tried the various methods to recover (Last known configuration, recover from previous restore point 1 week ago).  After 2 days of banging my head, I had to change the drive assignments for system image recovery to work.  System image was trying to restore drives (C, N), but those were not the drives recognized at startup.  Boot was labeling them as G, H (volume 5, 6) when I went into command prompt at Windows cd recovery.

    Boot into system recovery using Windows CD, then use command line prompt. 

    Select a drive “C:” 

    Run Disk partition: Diskpart

    See volumes:  List volume

    Find your boot volume that is not labeled correctly

    Reassign drive letter:  Select volume=5

    Remove letter=g

    Assign letter=c

    Select volume=6

    Remove letter=h

    Assign letter=n

    Now close out cmd prompt, run restore options using recovery CD (I had lost my automatic restore points by this time and had to use a 3 year old system image)

    Running windows update is another fiasco.  I let run for 14 hours with no updates.  I then ran Option 2 from this page link below and it worked, but also ran a number of other Windows 7 update resets before that worked. 

    https://superuser.com/questions/951960/windows-7-sp1-windows-update-stuck-checking-for-updates

    Tuesday, January 09, 2018 2:52 PM
  • Thank you, thank you, thank you! DISM worked great for me to remove that exact rollup. Bravo!!
    Thursday, January 11, 2018 5:12 PM