Re: illegal system dll relocation

Aqueous wrote:
No, wait, there's more.
I apparently was too fast in stopping the auto reboot and did not see that the blue screen warning has changed. now it says "stop c0000135 (unable to locate component)
this application has failed to start because winsrv was not found. Re-installing the application may fix this problem."
This is good news, I hope? Can you walk me through the re-installation? Also, i ordered from HP a "recovery disk" which will take a week to arrive. i should have the resources to download knoopix tonight.





"Lem" wrote:

Aqueous wrote:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this. Kernel32 issue: Your analysis prompts my recall of the history of this system. This is an HP box from 2005 with XP factory installed. I now realize I am using for my boot disk an older upgrade version CD of XP that i bought for a previous computer. In my state of mind I did not stop to think it was for the old system, was just glad i had an XP CD on the shelf...so it is possible the version of kernel32 onmy recoverey console is incompatible with this system. I simply have to hope that is not the case and as you say forge ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space allocation. However, i think using that recovery mode restores factory settings and wipes all data. I do have a backup of most critical personal files. most, not all. I do not think i have the technical facility to take out the HD and put it in another device. i'll have to think about that. Malware: I have most current norton version running with all standard protections in place, did a full scan a week ago, and regularly use adaware. I practice very safe computing--no guarantee but i am not the at-risk profile by any means. Precipitating event: I ran chkdisk more or less out of precaution since i had not done so in a long time. i was getting a minor annoying glitch in Word, so i was not totally feeling complacent about the system but figured i would start with routine maintenance before troubleshooting that. i think i will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time you are putting into it.


"Lem" wrote:

Aqueous wrote:
Lem, belay that last post, i am teaching myself DOS, kind of... I know how to copy the file, but there is no such file on c: and no i386folder on c: either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_
should i copy the DL_ file only and place it in the c: location you indicated?

"Lem" wrote:

Aqueous wrote:
I have a blue screen with this message: STOP: 0000269 illegal system dll relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address range reserved for windows systems DLLs The vendor should %%" I dont know how to troubleshoot this. Background: ran chkdisk as a routine maintenance. XP went to endless reboot. i tried booting from original XP disk, going to recovery console and I guess reinstalling kernel32.dll. still cycling. i am unable to reach safe mode but advanced options menu allows me to disable automatic restart so i could see the blue screen warning. Going to las known configuration has no effect. i have SP2 XP home edition. What do i do now?


Try the following:

1. boot from a Windows CD and go to recovery console.

2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old gdi32.dll in c:\windows\system32 directory)

3. Reboot normally

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

I'm not really sure what you did with respect to kernel32.dll. In particular, I don't know what you might have been attempting to do with the "map" command. Further, kernel32.dll is an integral part of Windows. If you overwrote it with an incorrect version, you may have terminally corrupted your current installation.

In addition, you haven't addressed what caused your problem in the first place (possibly a malware infestation). However, forging ahead ...

The first thing you should do is to make sure that any data that you care about is preserved. Assuming that you do not have a full backup (or otherwise you probably would simply have restored your drive from the backup), you can either remove the drive from your computer, put it in an external usb drive enclosure, hook it up to a second computer, and copy off the data, or build yourself a Knoppix CD, boot from that, and copy the data.

Putting aside data preservation issues, whether messing with kernel32.dll has created a problem, and whatever caused your initial problem, here are steps to replace gdi32.dll.

If there is no C:\i386 or C:\windows\servicepackfiles\i386\ folder, that suggests that your installation of Windows XP began with sp2 (which fits with you having an sp2 cd).

Assuming that Windows is located in C:\Windows and that your CD drive is E:\ go to the Recovery Console and type

cd C:\Windows\system32
ren gdi32.dll gdi32.dll.old
expand e:\i386\gdi32.dl_ c:\windows\system32\gdi32.dll
attrib -r c:\windows\system32\gdi32.dll

exit from Recovery Console and reboot.

If the above doesn't fix things, then you should probably try a Repair Install. See http://www.michaelstevenstech.com/XPrepairinstall.htm

Note that a Repair Install will likely *not* remove any malware that may have infested your computer and caused your problem in the first place. If you do a Repair Install and successfully get back to Windows, you should do a thorough check for malware, starting with a full scan with an up-to-date reputable antivirus app and again with a more generalized antimalware app such as MalwareBytes Antimalware (http://malwarebytes.org/).

Be aware that although a Repair Install is supposed to preserve your data and installed apps, things have been known to go wrong, which is why you should back up your data first.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

You are correct that using the recovery partition on the hard drive will wipe out everything. It restores the computer to its out-of-the-box condition.

Also, I'm not clear if using a retail XP CD to do a repair install will work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the existing file. If you already have done this, this command will fail because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't specify a destination, the expanded file goes into the current folder. The error in my previous post was that I specified the file name as the destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat differently than they do at a normal Command Prompt. For more detail on using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free download as an ISO image. It is a large download, about 700 Meg for the CD and a few Gig for the DVD. The difference is that the DVD has more applications. The CD will suffice for rescuing data. KNOPPIX is a flavor of LINUX, with very good intrinsic support for much hardware, in fact, better than XP itself. "live" means that it runs from CD without installing on the hard drive. KNOPPIX has a windows-like file manager, supports USB and firewire, and version 5 can write to disks formatted as FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm


Very first hit from Google:
http://support.microsoft.com/kb/885523

However, you will be unable to remove SP2 (because it wasn't installed as an update but as the initial OS). See some of the other hits from http://www.google.com/search?hl=en&q=winsrv&btnG=Google+Search&cts=1239285476829&aq=f&oq=

Be sure you know what the HP recovery disk is intended to do (and how to do it). I suspect that it is like the hidden partition -- and will restore your computer to a "like new" condition, with none of your applications or data.

Knoppix is pretty easy to use. You might want to do some reading here first:
http://www.knoppix.net/wiki/Main_Page
http://www.knoppix.net/wiki/Knoppix_FAQ

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
.