Re: illegal system dll relocation

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance



Success beyond expectations, based on precincts heard from so far. knoppix
was much easier both to obtain and use than the instructions appeared to my
novice eyes. Worked like a charm, very intuitive interface, and i saved all
my data and essentially evrything on the hard drive to an external hard
drive.
Then the recovery disks from HP arrived ahead of schedule. They offered the
option of full recovery (destroying data) or "standard recovery" which said
data files would be intact. i chose the standard option (belt and suspenders
person that i am). The instructions were highly detailed and the process
took a half hour, and only used 1 of the 12 HP disks sent. This restored
XP, apparently with all data files intact. Many applications including
Norton and current versions of Office did not make the jump-- the computer
thinks it is 2005 or 2003, it seems, and restored long-replaced versions --
but i should be able to uninstall the old software versions that are now
resident and reinstall my current versions. I dont even want to open files
until i have current software running, just to be careful, but the files are
showing up. not sure about outlook files, and i suspect i will need to
reinstall my broadband account. Just noting this for the record,it is not
hard to do. Do you think i need to do anything about the potential malware
source of this problem, other than running a scan with NIS2009 once it is
running? i wanted to get this off to you with heartfelt thanks for your
advice and encouragement. I learned a lot from this. You have a favorite
charity, I'll donate as soon as i can swing it. i'd like to mark this solved
as soon as we complete that detail. You cannot imagine how grateful I am.

"Lem" wrote:

Aqueous wrote:
No, wait, there's more.
I apparently was too fast in stopping the auto reboot and did not see that
the blue screen warning has changed. now it says "stop c0000135 (unable to
locate component)
this application has failed to start because winsrv was not found.
Re-installing the application may fix this problem."
This is good news, I hope? Can you walk me through the re-installation?
Also, i ordered from HP a "recovery disk" which will take a week to arrive.
i should have the resources to download knoopix tonight.





"Lem" wrote:

Aqueous wrote:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.


"Lem" wrote:

Aqueous wrote:
Lem, belay that last post, i am teaching myself DOS, kind of... I know how
to copy the file, but there is no such file on c: and no i386folder on c:
either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_
should i copy the DL_ file only and place it in the c: location you
indicated?

"Lem" wrote:

Aqueous wrote:
I have a blue screen with this message: STOP: 0000269 illegal system dll
relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address
range reserved for windows systems DLLs The vendor should %%" I dont know
how to troubleshoot this. Background: ran chkdisk as a routine maintenance.
XP went to endless reboot. i tried booting from original XP disk, going to
recovery console and I guess reinstalling kernel32.dll. still cycling. i am
unable to reach safe mode but advanced options menu allows me to disable
automatic restart so i could see the blue screen warning. Going to las known
configuration has no effect. i have SP2 XP home edition. What do i do now?


Try the following:

1. boot from a Windows CD and go to recovery console.

2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to
c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old
gdi32.dll in c:\windows\system32 directory)

3. Reboot normally

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

I'm not really sure what you did with respect to kernel32.dll. In
particular, I don't know what you might have been attempting to do with
the "map" command. Further, kernel32.dll is an integral part of
Windows. If you overwrote it with an incorrect version, you may have
terminally corrupted your current installation.

In addition, you haven't addressed what caused your problem in the first
place (possibly a malware infestation). However, forging ahead ...

The first thing you should do is to make sure that any data that you
care about is preserved. Assuming that you do not have a full backup
(or otherwise you probably would simply have restored your drive from
the backup), you can either remove the drive from your computer, put it
in an external usb drive enclosure, hook it up to a second computer, and
copy off the data, or build yourself a Knoppix CD, boot from that, and
copy the data.

Putting aside data preservation issues, whether messing with
kernel32.dll has created a problem, and whatever caused your initial
problem, here are steps to replace gdi32.dll.

If there is no C:\i386 or C:\windows\servicepackfiles\i386\ folder, that
suggests that your installation of Windows XP began with sp2 (which fits
with you having an sp2 cd).

Assuming that Windows is located in C:\Windows and that your CD drive is
E:\ go to the Recovery Console and type

cd C:\Windows\system32
ren gdi32.dll gdi32.dll.old
expand e:\i386\gdi32.dl_ c:\windows\system32\gdi32.dll
attrib -r c:\windows\system32\gdi32.dll

exit from Recovery Console and reboot.

If the above doesn't fix things, then you should probably try a Repair
Install. See http://www.michaelstevenstech.com/XPrepairinstall.htm

Note that a Repair Install will likely *not* remove any malware that may
have infested your computer and caused your problem in the first place.
If you do a Repair Install and successfully get back to Windows, you
should do a thorough check for malware, starting with a full scan with
an up-to-date reputable antivirus app and again with a more generalized
antimalware app such as MalwareBytes Antimalware (http://malwarebytes.org/).

Be aware that although a Repair Install is supposed to preserve your
data and installed apps, things have been known to go wrong, which is
why you should back up your data first.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

You are correct that using the recovery partition on the hard drive will
wipe out everything. It restores the computer to its out-of-the-box
condition.

Also, I'm not clear if using a retail XP CD to do a repair install will
work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to
c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the
existing file. If you already have done this, this command will fail
because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't
specify a destination, the expanded file goes into the current folder.
The error in my previous post was that I specified the file name as the
destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat
differently than they do at a normal Command Prompt. For more detail on
using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free
download as an ISO image. It is a large download, about 700 Meg for the
CD and a few Gig for the DVD. The difference is that the DVD has more
applications. The CD will suffice for rescuing data. KNOPPIX is a flavor
of LINUX, with very good intrinsic support for much hardware, in fact,
better than XP itself. "live" means that it runs from CD without
installing on the hard drive. KNOPPIX has a windows-like file manager,
supports USB and firewire, and version 5 can write to disks formatted as
FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm


Very first hit from Google:
http://support.microsoft.com/kb/885523

However, you will be unable to remove SP2 (because it wasn't installed
as an update but as the initial OS). See some of the other hits from
http://www.google.com/search?hl=en&q=winsrv&btnG=Google+Search&cts=1239285476829&aq=f&oq=

Be sure you know what the HP recovery disk is intended to do (and how to
do it). I suspect that it is like the hidden partition -- and will
restore your computer to a "like new" condition, with none of your
applications or data.

Knoppix is pretty easy to use. You might want to do some reading here
first:
http://www.knoppix.net/wiki/Main_Page
http://www.knoppix.net/wiki/Knoppix_FAQ

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

.



Relevant Pages

  • Re: illegal system dll relocation
    ... "Lem" wrote: ... i tried booting from original XP disk, going to recovery console and I guess reinstalling kernel32.dll. ... boot from a Windows CD and go to recovery console. ... Note that a Repair Install will likely *not* remove any malware that may have infested your computer and caused your problem in the first place. ...
    (microsoft.public.windowsxp.general)
  • Re: Unmountable Boot Volume AND Session3 Initialization Failed
    ... When I boot up my laptop as usual, it gives me BIOS options and then the PGP ... When I boot to that slipstreamed Windows XP Install CD, ... I'm able to get to the Recovery Console. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Unmountable Boot Volume AND Session3 Initialization Failed
    ... I believe I successfully created a 'slipstream' Windows XP install CD using ... I was given the Windows ... Install and Recovery Console options. ... aren't any drives installed on the system. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Unmountable Boot Volume AND Session3 Initialization Failed
    ... PGP encryption puts a 'hook' in the MBR, when you boot the hard disk the MBR hook runs a programs that presents you with the PGP screen so that you may unlock the disk. ... If no then the disk remains encrypted and there is diddly squat that you will be able to do with the Recovery Console. ... The next best thing would be to install PGP on another computer and then mount the disk on that installation and then see if you can unlock the disk or remove the encryption on the disk from the other Windows installation. ... aren't any drives installed on the system. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Help with Recovery
    ... Now i have gone through the procedure to get to the recovery console using ... both Windows XP Home and Windows XP Professional and i am having no problems ... The repair option, which once again you are unable to use, would ... brings me to a complete new install. ...
    (microsoft.public.windowsxp.perform_maintain)