BleepingComputer.com: Symantec AV install and 0000218 stop error

I need a little help concerning a stop error issue I'm seeing on some machines on my network.

Environment is WinXP Embedded and SAV Corp Ed. v10.1.5.5000 on a domain. SAV 10.1 has been installed and running on all out production machines since Feb/Mar 09 with no problems up until now.

Initally, the problem manifested itself when a machine was restarted. WINXP splash screen would show, then the logon screen, which was garbled. Eventually, we would just get a BSOD stop error c0000218 cannot load registry file/hive: sysroot\sys32\config\software is corrupt, unreadable, or not writable.

Restarting the machine and choosing Last Known Good Configuration would allow windows to load and the user to logon. If Symantec was uninstalled, the machine would be fine. You could re-boot/logon without a problem. With Symantec uninstalled, I tried re-installing and re-booting, but that just leads to the same problem once you reboot. Install is being done from the Symantec System Console on our AV server as a remote install, or by navigating to the network share that contains the install files and initiating the install from the client.

So I did a little bit of research on the net and it seems that the problem may lie in Symantec's writing to registry files during the shut down process. I located a program called UPHClean from M$ that is supposed to fix these types of issues and in their readme doc, it specifically states a Userenv 1517 error, that I also see in my App log. Why we're just now seeing this problem after so many months is beyond me. Symantec AV scans report nothing, as do the M$ MSRT, and I've even run MBAM.

I appreciate any help. This has been driving me crazy.

FWIW, http://support.microsoft.com/kb/307545.

Seems that there doesn't have to be a Symantec connection for this to occur.

Louis

Doesn't make a lot of sense though. Install Symantec, PC won't boot. Uninstall, PC boots fine. FWIW, I have cloned backups that do this after re-installing symantec. Why would multiple machines all of a sudden start doing this at the same time?

LOL...I don't claim to understand the causes of file corruption/damage, whether registry files or system files.

All I know is that such happens probably much more frequently than we imagine and it's not until a critical process is impacted...that we become knowledgeable of such.

Louis

Quote

The moral?
Stay away from Norton