Error in PE and XP SP3 C0000005

[Migration User]

 

I have 50 vostro 1520 with exactly the same errors

The Laptops have Intel ich9m-e/m sata and the NIC is a Realtek pcie chipset 8111x - I am using the current release of Ghost Solution Suite

When booting into PE I get

The following information has been placed on the clipboard. Visit the Ghost forums at https://forums.symantec.com/syment/board?board.id=109 and supply this information to gain help with this error.
Symantec Ghost Client Agent
An exception has occurred of type C0000005
X:\GHOST - X:\GHOST\ngctw32.exe 11.5.1.2266
0x7617C4EC in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\user32.dll
0x7617C43B in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\user32.dll
0x76178B7B in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\user32.dll
0x41B9C3 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x4092AF in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x409950 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x40A0E9 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x40AEA8 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x44ECA4 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\GHOST\ngctw32.exe
0x77463833 in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\kernel32.dll
0x7769A9BD in \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\Windows\System32\ntdll.dll

This error will occur 1/3 times while just polling the server - and 5/6 times when trying to take or roll out an image.

I bypassed the console and ran the ghost32.exe and rolled out manually, however after reboot now XP Image gives a very similar error

The following information has been placed on the clipboard. Visit the Ghost forums at https://forums.symantec.com/syment/board?board.id=109 and supply this information to gain help with this error.
Symantec Ghost Client Agent
An exception has occurred of type C0000005
C:\Program Files\Symantec\Ghost - C:\Program Files\Symantec\Ghost\ngctw32.exe 11.5.1.2266
C:\WINDOWS\system32\USER32.dll!MsgWaitForMultipleObjectsEx+0x30
C:\WINDOWS\system32\USER32.dll!GetLastInputInfo+0x86
C:\WINDOWS\system32\USER32.dll!MsgWaitForMultipleObjects+0x1F
r:\depot_cont\ghost\gsstrunk\ghost\configureagent\agentlib\sockevent.cpp#433:SocketEvent::wait
    unsigned int msTimeout = 0x100FDD8
    unsigned int callerHorizon = 0xA8D2
r:\depot_cont\ghost\gsstrunk\ghost\configureagent\client\clientmain.cpp#4376:l_mainLoop
    unsigned int c_sock = 360
    unsigned int code = 0x1B40000
    unsigned int count = 0x42FFD8
r:\depot_cont\ghost\gsstrunk\ghost\configureagent\client\clientmain.cpp#4811:main
    int argc = 1
r:\depot_cont\ghost\gsstrunk\ghost\configureagent\client\clientmain.cpp#5289:g_runMain
    int argc = 1
    bool standalone = false
    unsigned int length = 216
    int wait = 0x77DF1701
    bool doReboot = false
r:\depot_cont\ghost\gsstrunk\ghost\configureagent\client\clientstate.cpp#117:ClientService::process
r:\depot_cont\ghost\gsstrunk\ghost\configureagent\library\src\win\firewall.cpp#405:Library::Win::l_serviceMain
    unsigned int argc = 1
    unsigned int data = 0
    unsigned int dataSize = 4
    unsigned int type = 0x100FF94
  ....

This error happens every single time and continues to crash after logging into windows making the machine unusable.  It does not show the copy and past window - the following occurs in event viewer along with the windows dialog box saying an app has crashed and would you like to send a error report

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date:  16/02/2010
Time:  17:13:48
User:  N/A
Computer: LAPTOP40
Description:
Fault bucket 115574833.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20   Bucket:
0008: 31 31 35 35 37 34 38 33   11557483
0010: 33 0d 0a                  3.. 

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date:  16/02/2010
Time:  17:13:52
User:  N/A
Computer: LAPTOP40
Description:
Faulting application ngctw32.exe, version 11.5.1.2266, faulting module user32.dll, version 5.1.2600.5512, fault address 0x00009675.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 6e 67 63   ure  ngc
0018: 74 77 33 32 2e 65 78 65   tw32.exe
0020: 20 31 31 2e 35 2e 31 2e    11.5.1.
0028: 32 32 36 36 20 69 6e 20   2266 in
0030: 75 73 65 72 33 32 2e 64   user32.d
0038: 6c 6c 20 35 2e 31 2e 32   ll 5.1.2
0040: 36 30 30 2e 35 35 31 32   600.5512
0048: 20 61 74 20 6f 66 66 73    at offs
0050: 65 74 20 30 30 30 30 39   et 00009
0058: 36 37 35                  675    

The bucket value chances but the 1004 event is the same each time.

As a temporary measure I have disabled the Symantec Ghost Configuration Server service on the server, however if I start the service again the ghost client on the XP machines will crash when it polls.

I hope this gives Symantec enough information to find a resolution to this issue.

James
 

[Migration User]

Mine came when it updated the ghost client on the machine.  In the status window in console, it shows Updating files SUCCESS followed by a WARNING about not being able to apply the update.  I have seen it in the PE environment, and I have seen it in windows at the logon screen.  I have ONLY seen it with version the latest 2.5.1 patch

[Migration User]

Unless we can reproduce this here with the equipment we have then in order to make some progress I'd really need to examine a system which is having this happen in some considerable detail, because the trigger for this fault is likely some distance (in terms of both code and time) from the place where the fault happens. This means the normal diagnosis process of analyzing a post-mortem dump isn't enough to trace the root cause and develop a fix or workaround.

For a complex defect like this we need to work more closely with a customer having this issue; as that can involve everything from working with a Ghost or VMWare image of a machine exhibiting the fault to (for some hardware-dependent defects) obtaining customer hardware that we can return once we've determined the cause of the problem and developed a fix, and the process of escalating to this level is managed from the technical support side, not the development side where I'm based.

BadgerCS, (or any other customer reading this) if you are currently working on this with technical support and you are willing and able to support a Ghost or VMWare image of a machine which repeatably fails as the restored image described above does, that would be an immense help and if you do get in touch with me directly (my e-mail address is in my Connect forum profile if you expand the "Additional Information" bit of the page) then that might be useful to expedite us getting some of this information which we need to work this all out - I do need to work in with out support folks on issues like this so it's really best if you have case number and a support contact I can coordinate with to ensure that they are kept in the loop, though.

[SEParation]

Hey Guys.  Not sure if anyone needs this still....but using the PC-DOS PE instead of the WinPE for imaging has worked on several computers for me.  I was having the same issue using the WinPE with updated drivers.  Switched client environments to PC-DOS and imaging worked, although it is much slower....about 1/3 the speed. 

[Migration User]

Has anyone found any other workarounds for this issue.  I'm having the same problem ghosting my WinXP SP3 Machine.  Has symantec been able to reproduce the issue?

-Paul

[Migration User]

We don't currently have an in-house reproduction case - there are a number of elements which appear to be required to trigger this happening - but I'm looking into this with the cooperation of BadgerCS with the aim of learning what triggers the problem and thus developing a workaround which other customers could test. I don't want to get ahead of that investigation; when there's more known, I'll be able to comment more.

[Migration User]

Ive got a machine doing this error in the PE right now.  I can boot my CD, put the partition on, start the PE, and have it ping my ghost server.  When I click the button to have it restore, that error pops up on the CLONE step.  It has done this on the machine about 10 times now in 2 days.

[Migration User]

I will sit on the machine and not restore it for the time being.  Depending on if you still want to try something on it, what that is, and how long it takes to respond, I can have the machine wait

[Migration User]

When I switched to PCDOS to do the restore, it restored fine but came up in Windows with the following

The following information has been placed on the clipboard. Visit the Ghost forums at https://forums.symantec.com/syment/board?board.id=109 and supply this information to gain help with this error.
Symantec Ghost Client Agent
An exception has occurred of type C0000005
C:\Program Files\Symantec\Ghost - C:\Program Files\Symantec\Ghost\ngctw32.exe 11.5.1.2269
C:\WINDOWS\system32\USER32.dll!MsgWaitForMultipleObjectsEx+0x30
C:\WINDOWS\system32\USER32.dll!GetLastInputInfo+0x86
C:\WINDOWS\system32\USER32.dll!MsgWaitForMultipleObjects+0x1F
0x41B9C3 in \Device\HarddiskVolume1\Program Files\Symantec\Ghost\ngctw32.exe
0x4092AF in \Device\HarddiskVolume1\Program Files\Symantec\Ghost\ngctw32.exe
0x409950 in \Device\HarddiskVolume1\Program Files\Symantec\Ghost\ngctw32.exe
0x40A0E9 in \Device\HarddiskVolume1\Program Files\Symantec\Ghost\ngctw32.exe
0x40BAF9 in \Device\HarddiskVolume1\Program Files\Symantec\Ghost\ngctw32.exe
C:\WINDOWS\system32\ADVAPI32.dll!CryptVerifySignatureW+0x29
C:\WINDOWS\system32\kernel32.dll!GetModuleFileNameA+0x1BA

[Migration User]

sorry, i posted this under the wrong item in the list, should be under the one for the workaround

[Migration User]

Well, after 1 week and no response, we replaced the motherboard and processor and the issue stopped

[Migration User]

I wanted to touch on this topic.

The company I work for uses Lenovo laptops. The problem seems to happen on the T400's we bought last year. It also seems to run fine on half of them. The other half which is about 30 computers will not image from PE using ngctw32.exe -console -initiate taskname

If I put the image down with ghost.exe and boot into windows the ngctw32.exe client fails to start and reports the error listed below.

What is strange is we just imaged 300 incomming student T410, T510, and X201 and never saw this error. Our reason for concern is our second year students are returning from vacation shortly with 300 T400's. We will need to rebuild many of them.

I feel this issue could partly be a problem with the intel cpu or motherboard chipset used in building these systems last year and partially somethinng wrong with the ngctw32.exe 2269. I cannot replace all of the motherboards and cpu's because I cannot get any hardware issues when using PC-Doctor and memory86+. Lenovo will certainly push back if I present a 100 machine part recall with no errors other than ngctw32.exe bombs.

Thanks in advance

Faulting application name: ngctw32.exe, version: 11.5.1.2269, time stamp: 0x4b67efe9

Faulting module name: USER32.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb2f

Exception code: 0xc0000005

Fault offset: 0x000190fb

Faulting process id: 0x7f4

Faulting application start time: 0x01cb42de08a8e543

Faulting application path: C:\Program Files\Symantec\Ghost\ngctw32.exe

Faulting module path: C:\Windows\system32\USER32.dll

Report Id: 4c089bab-aed1-11df-b42c-002713b5cc83

[Migration User]

Thanks to the help of BadgerCS who made a machine available to me to diagnose, my determination was that the root cause in his case was a manufacturing fault which meant that the SMBIOS UUID of the machines - their unique ID for PXE booting and management - was not set.

There are various techniques for various operating systems to retrieve this data; as part of some re-work for some other badly-designed motherboards which did not work in GSS 2.5.0, in GSS 2.5.1 it ended up that if the machine UUID is not set at all, it was working its way through all the fallback code paths to try and get a valid ID. One of the last code paths was designed for Windows NT 4 and Windows 95, and tried to access the data by mapping the BIOS physical memory into the client. 

It appears that one some machines, depending on a) the precise layout of the client address space, which is affected by things like Antivirus programs which inject themselves into it, and b) the precise physical memory layout of the BIOS data being retrieved, the BIOS memory data will sometimes end up at the same address as an undocumented internal piece of the Windows GUI, and the observed fault is a later consequence of these two factors coming together on top of the initial problem of a missing SMBIOS UUID which causes this fallback code path to be tried.

Internally there is a Level 2 support case open for this, and I've supplied the above information along with a code fix to the team in Symantec who have taken over the building and QA of the Ghost product so that it can be resolved, but I don't have any influence on what will happen beyond that; I would expect that a trial build will be made available to the customers with the support case open to verify the diagnosis and resolution. Unfortunately my employment with Symantec is ending so the timing and what will happen beyond that I can't speculate on, however.

In the meantime, something you may be able to try with machines that have this problem is using a manufacturer-supplied tool (if one exists) to reprogram the SMBIOS data - the UUID, asset tag and machine serial number are usually stored in Flash memory on the motherboard and some manufacturers may have tools to change this data available to customers post-manufacture. As long as the machine SMBIOS UUID is present and a valid value (i.e., not all the same byte such as all 0's or all 0xFF) then the problematic code path in existing GSS 2.5.1 installs should be avoided.

[Migration User]

First off Nigel you are brilliant. Another technitian has verified that there is no UUID set on the lenovo laptops demostrating these errors. This leaves us with contact lenovo to acquire a method to set the UUID or recall their motherboards. Thank you

Secondly I have worked with you about 6 times now over the last 5 years with ghost problems, feature requests, and how to opperate the system effciently. I am with a heavy heart knowing now that you are leaving your post. I have said statements over the year with ghost, "I am sure it can be done, and if I dont know how I am sure Nigel will" I have said these statements so much it was as if you worked here at the Tuck School.

I wish you luck in next role and or company.

[Migration User]

Hello Nigel,

Thank you for finding this for us. I was able to resolve few of my Cases with this suggestion for which I am grateful to you. Thanks a lot!

ALL THE BEST!

[Migration User]

You are always helpful and professional with responses.  It will be sad to see you go and lose such a valuable amount of GSS knowledge

[Migration User]

Hi,

The c0000005 issue has been addressed in Ghost 2.5.1 build 2298. You can find more information on the link given below.

https://www-secure.symantec.com/connect/blogs/ghost-client-error-c0000005-resolved-build-2298