Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. You receive "0x0000006B" and "0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2

You receive "0x0000006B" and "0XC000021A" Stop error message after uninstalling McAfee Agent 4.6.2 in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2

View products that this article applies to.

Symptoms

On a computer that is running Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2, you uninstall McAfee Agent 4.6.2 and restart the the computer. The computer crashes during the startup process. Additionally, you receive a Stop Error message that is similar to one of the following:

STOP: 0XC000021A (Parameter1, Parameter2, Parameter3, Parameter4)
STATUS_SYSTEM_PROCESS_TERMINATED


STOP: 0x0000006B (Parameter1, Parameter2, Parameter3, Parameter4)
PROCESS1_INITIALIZATION_FAILED

Note The four parameters in the Stop error message may vary, depending on the configuration of the computer.

Consider the following two scenarios for the two different stop errors.

  • Scenario 1: STOP 0XC000021A STATUS_SYSTEM_PROCESS_TERMINATED
    A Windows Update package containing an update for Win32k.sys was installed. Then McAfee agent was removed using FrmInst.exe /FORCEUNINSTALL command and then system was rebooted.
  • Scenario 2: STOP 0x0000006B PROCESS1_INITIALIZATION_FAILED
    Microsoft Security update or a hotfix is installed on the system. After few minutes McAfee Agent is removed using FrmInst.exe /FORCEUNINSTALL command, while BootCat.cache is being rebuilt and then system was rebooted.

↑ Back to the top

Cause

This problem occurs due to unexpected behavior from McAfee Agent uninstaller. The uninstaller renames the folder {F750E6C3-38EE-11D1-85E5-00C04FC295EE} to tmpxxxx.tmp.

Note: The folder {F750E6C3-38EE-11D1-85E5-00C04FC295EE} is located under C:\Windows\System32\Catroot\ and contains the catalog files.

↑ Back to the top

Resolution

To resolve this issue, review the following McAfee Advisory:

Blue screen error on Windows systems when uninstalling McAfee Agent 4.6.2
https://kc.mcafee.com/corporate/index?page=content&id=KB75956


↑ Back to the top

More Information

Code Integrity component of Microsoft, validate the digital signature of each driver when an attempt is made to load it in the memory. The system references the C:\Windows\System32\CodeIntegrity\BootCat.cache file. If it does not find the hash for the driver being loaded in that file then it looks under C:\Windows\System32\Catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder. BootCat.cache gets updated after a few minutes after a patch is installed. If the BootCat.cache file is not found, then after the system boots up it may take around 10-15 minutes to re-create a new BootCat.cache file. In both the cases BootCat.cache is built using the catalog files contained in the C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder.

Scenario 1 described in Symtoms section, BootCat.cache do not have the updated hash for the new Win32k.sys binary and the C:\Windows\System32\Catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} is renamed to C:\Windows\System32\Catroot\tmpXXXX.tmp, in this case, Win32k.sys cannot be validated as the catalog file cannot be accessed.

In Scenario 2 described in Symtoms section, while the BootCat.cache was getting updated, McAfee Agent was removed. This results in renaming of C:\Windows\System32\Catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder and now the BootCat.cache cannot be built properly because the source catalog information cannot be accessed.

↑ Back to the top

Keywords: kb

↑ Back to the top

Article Info
Article ID : 2746140
Revision : 1
Created on : 1/7/2017
Published on : 8/17/2012
Exists online : False
Views : 520