Help Deleted WINDOWS/System32/Csrss.exe file

[jlhwebgal]

I knew I had downloaded some serious malware and purchased a malware
removal tool. After trying to remove all of it in and out of safemode I
was left with Symantec and the removal software being unable to remove
a downloader virus at the subject directory. I was instructed to
manually delete the file that was found....guess what (yes I feel like
an idiot) the system wouldn't let me delete the file. So what did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager Initialization
system process terminated unexpectedly with status of 0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing with
another error. Any advice to get me back up and running without losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[Guest]

Hi Jennifer,

Boot into the Recovery Console and use the expand command in order to expand
the csrss.ex_ file from the i386 directory on the install CD to the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console, including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

 

[jlhwebgal]

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this happened.

Jennifer

 

[Guest]

Hi Jennifer,

When you first chose the R option to enter Recovery Console, you should have
then received a message regarding which Windows installation you want to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded from
the i386 folder (csrss.ex_ )....this needs to appear in the command, not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this happened.

Jennifer

 

[jlhwebgal]

Hi Patti,

I copied your instructions and I received the message "Access Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Hi Jennifer,

When you first chose the R option to enter Recovery Console, you should have
then received a message regarding which Windows installation you want to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded from
the i386 folder (csrss.ex_ )....this needs to appear in the command, not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this happened.

Jennifer

Hi Jennifer,

Boot into the Recovery Console and use the expand command in order to expand
the csrss.ex_ file from the i386 directory on the install CD to the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console, including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

I knew I had downloaded some serious malware and purchased a malware
removal tool. After trying to remove all of it in and out of safemode I
was left with Symantec and the removal software being unable to remove
a downloader virus at the subject directory. I was instructed to
manually delete the file that was found....guess what (yes I feel like
an idiot) the system wouldn't let me delete the file. So what did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager Initialization
system process terminated unexpectedly with status of 0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing with
another error. Any advice to get me back up and running without losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[Guest]

When you enter Recovery Console, do you receive the "1: C:\WINDOWS Which
Windows Installation would you like to log on to" prompt, or do you simply
receive a C:\ prompt?

If you do receive the "Which Windows Installation....." prompt, and you opt
for installation 1, at the C:\Windows prompt, key in:
cd system32
ENTER
Are you now at a C:\Windows\System32 prompt?


Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

Hi Patti,

I copied your instructions and I received the message "Access Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Hi Jennifer,

When you first chose the R option to enter Recovery Console, you should have
then received a message regarding which Windows installation you want to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded from
the i386 folder (csrss.ex_ )....this needs to appear in the command, not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this happened.

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

Boot into the Recovery Console and use the expand command in order to expand
the csrss.ex_ file from the i386 directory on the install CD to the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console, including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

I knew I had downloaded some serious malware and purchased a malware
removal tool. After trying to remove all of it in and out of safemode I
was left with Symantec and the removal software being unable to remove
a downloader virus at the subject directory. I was instructed to
manually delete the file that was found....guess what (yes I feel like
an idiot) the system wouldn't let me delete the file. So what did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager Initialization
system process terminated unexpectedly with status of 0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing with
another error. Any advice to get me back up and running without losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[jlhwebgal]

I simply receive a c:\ prompt there is no opting for an "installation
1"

Thanks,
Jennifer

When you enter Recovery Console, do you receive the "1: C:\WINDOWS Which
Windows Installation would you like to log on to" prompt, or do you simply
receive a C:\ prompt?

If you do receive the "Which Windows Installation....." prompt, and you opt
for installation 1, at the C:\Windows prompt, key in:
cd system32
ENTER
Are you now at a C:\Windows\System32 prompt?


Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

Hi Patti,

I copied your instructions and I received the message "Access Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Hi Jennifer,

When you first chose the R option to enter Recovery Console, you should have
then received a message regarding which Windows installation you want to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded from
the i386 folder (csrss.ex_ )....this needs to appear in the command, not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this happened.

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

Boot into the Recovery Console and use the expand command in order to expand
the csrss.ex_ file from the i386 directory on the install CD to the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console, including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

I knew I had downloaded some serious malware and purchased a malware
removal tool. After trying to remove all of it in and out of safemode I
was left with Symantec and the removal software being unable to remove
a downloader virus at the subject directory. I was instructed to
manually delete the file that was found....guess what (yes I feel like
an idiot) the system wouldn't let me delete the file. So what did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager Initialization
system process terminated unexpectedly with status of 0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing with
another error. Any advice to get me back up and running without losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[needlove]

What happens at the c:\ prompt if you type "cd c:\windows\system32" w/o
quotes? does it do anything?

I simply receive a c:\ prompt there is no opting for an "installation
1"

Thanks,
Jennifer

When you enter Recovery Console, do you receive the "1: C:\WINDOWS Which
Windows Installation would you like to log on to" prompt, or do you
simply
receive a C:\ prompt?

If you do receive the "Which Windows Installation....." prompt, and you
opt
for installation 1, at the C:\Windows prompt, key in:
cd system32
ENTER
Are you now at a C:\Windows\System32 prompt?


Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

Hi Patti,

I copied your instructions and I received the message "Access Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

When you first chose the R option to enter Recovery Console, you
should have
then received a message regarding which Windows installation you want
to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely
seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command
to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded
from
the i386 folder (csrss.ex_ )....this needs to appear in the command,
not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even
though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this
happened.

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

Boot into the Recovery Console and use the expand command in
order to expand
the csrss.ex_ file from the i386 directory on the install CD to
the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console,
including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

I knew I had downloaded some serious malware and purchased a
malware
removal tool. After trying to remove all of it in and out of
safemode I
was left with Symantec and the removal software being unable to
remove
a downloader virus at the subject directory. I was instructed
to
manually delete the file that was found....guess what (yes I
feel like
an idiot) the system wouldn't let me delete the file. So what
did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got
the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager
Initialization
system process terminated unexpectedly with status of
0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing
with
another error. Any advice to get me back up and running without
losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[jlhwebgal]

I get access denied.

What happens at the c:\ prompt if you type "cd c:\windows\system32" w/o
quotes? does it do anything?

I simply receive a c:\ prompt there is no opting for an "installation
1"

Thanks,
Jennifer

When you enter Recovery Console, do you receive the "1: C:\WINDOWS Which
Windows Installation would you like to log on to" prompt, or do you
simply
receive a C:\ prompt?

If you do receive the "Which Windows Installation....." prompt, and you
opt
for installation 1, at the C:\Windows prompt, key in:
cd system32
ENTER
Are you now at a C:\Windows\System32 prompt?


Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

Hi Patti,

I copied your instructions and I received the message "Access Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

When you first chose the R option to enter Recovery Console, you
should have
then received a message regarding which Windows installation you want
to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely
seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command
to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded
from
the i386 folder (csrss.ex_ )....this needs to appear in the command,
not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even
though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this
happened.

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

Boot into the Recovery Console and use the expand command in
order to expand
the csrss.ex_ file from the i386 directory on the install CD to
the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console,
including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

I knew I had downloaded some serious malware and purchased a
malware
removal tool. After trying to remove all of it in and out of
safemode I
was left with Symantec and the removal software being unable to
remove
a downloader virus at the subject directory. I was instructed
to
manually delete the file that was found....guess what (yes I
feel like
an idiot) the system wouldn't let me delete the file. So what
did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got
the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager
Initialization
system process terminated unexpectedly with status of
0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing
with
another error. Any advice to get me back up and running without
losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[needlove]

According to this KB article: http://support.microsoft.com/kb/314058 it
sounds like SAM might be damaged and you drive is probably inaccessable from
recovery console if you wern't prompted to enter a password and if the
password was correct. But there are other bootable discs that use pure DOS
to access a drive with repair tools installed on the disk. Bart PE is one
that I know of but I have never used it. Google BartPE and you may find
others as well. I was able to use a file recovery program on another
drive/windows installation to recover files from a damaged drive using PC
Inspector file recovery trial version. I'm pretty limited in knowlege about
this type of thing but it looked like you were left hanging so I hope this
helps and you find an a solution.

I get access denied.

What happens at the c:\ prompt if you type "cd c:\windows\system32" w/o
quotes? does it do anything?

I simply receive a c:\ prompt there is no opting for an "installation
1"

Thanks,
Jennifer

Patti MacLeod wrote:
When you enter Recovery Console, do you receive the "1: C:\WINDOWS
Which
Windows Installation would you like to log on to" prompt, or do you
simply
receive a C:\ prompt?

If you do receive the "Which Windows Installation....." prompt, and
you
opt
for installation 1, at the C:\Windows prompt, key in:
cd system32
ENTER
Are you now at a C:\Windows\System32 prompt?


Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

Hi Patti,

I copied your instructions and I received the message "Access
Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

When you first chose the R option to enter Recovery Console, you
should have
then received a message regarding which Windows installation you
want
to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely
seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the
command
to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want
expanded
from
the i386 folder (csrss.ex_ )....this needs to appear in the
command,
not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

Hi Patti,

Thank you so much for responding. I have a feeling this is going
to
work however....

I cannot find my hard drive. Would it still be called "C" even
though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this
happened.

Jennifer

Patti MacLeod wrote:
Hi Jennifer,

Boot into the Recovery Console and use the expand command in
order to expand
the csrss.ex_ file from the i386 directory on the install CD
to
the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console,
including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:

I knew I had downloaded some serious malware and purchased a
malware
removal tool. After trying to remove all of it in and out of
safemode I
was left with Symantec and the removal software being unable
to
remove
a downloader virus at the subject directory. I was
instructed
to
manually delete the file that was found....guess what (yes I
feel like
an idiot) the system wouldn't let me delete the file. So
what
did the
"einstein" in me do? I renamed it to Csrss2....rebooted and
got
the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager
Initialization
system process terminated unexpectedly with status of
0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also
failing
with
another error. Any advice to get me back up and running
without
losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[John John]

At the recovery console run chkdsk /r on the disk.

John

I get access denied.

What happens at the c:\ prompt if you type "cd c:\windows\system32" w/o
quotes? does it do anything?

I simply receive a c:\ prompt there is no opting for an "installation
1"

Thanks,
Jennifer

Patti MacLeod wrote:

When you enter Recovery Console, do you receive the "1: C:\WINDOWS Which
Windows Installation would you like to log on to" prompt, or do you
simply
receive a C:\ prompt?

If you do receive the "Which Windows Installation....." prompt, and you
opt
for installation 1, at the C:\Windows prompt, key in:
cd system32
ENTER
Are you now at a C:\Windows\System32 prompt?


Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:


Hi Patti,

I copied your instructions and I received the message "Access Denied"

I really appreciate the help you have given and hope you are able to
offer more.

TIA,

Jennifer

Patti MacLeod wrote:

Hi Jennifer,

When you first chose the R option to enter Recovery Console, you
should have
then received a message regarding which Windows installation you want
to log
onto.....the message would look something like this:

1: C:\WINDOWS

Which Windows Installation would you like to log on to
(To cancel, press ENTER)?

If you are seeing option 1 for C:\WINDOWS, then it is definitely
seeing your
hard drive, as it recognizes the Windows installation.

Now, assuming that your CD/DVD drive is drive letter D, the command
to use
would look like this:

expand D:\i386\csrss.ex_ C:\Windows\System32\csrss.exe

Note the underscore at the end of the filename that you want expanded
from
the i386 folder (csrss.ex_ )....this needs to appear in the command,
not the
full file extension of EXE
Following the underscore, there is a space before
C:\Windows\System32\csrss.exe



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:


Hi Patti,

Thank you so much for responding. I have a feeling this is going to
work however....

I cannot find my hard drive. Would it still be called "C" even
though I
changed my boot sequence? When I run a "dir" on c I get nothing.

The command I used was d:\>expand [/d:I386\CSRSS.EXE]
[C:\WINDOWS\System32\] [/y]

Any advice as I am unfamiliar with using this console.

Thank you so much in advance I have been in tears since this
happened.

Jennifer

Patti MacLeod wrote:

Hi Jennifer,

Boot into the Recovery Console and use the expand command in
order to expand
the csrss.ex_ file from the i386 directory on the install CD to
the
Windows\System32 directory on hard drive.

Here is an MSKB article that describes Recovery Console,
including how to
access it:
Description of the Windows XP Recovery Console
http://support.microsoft.com/kb/314058/en-us



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


:


I knew I had downloaded some serious malware and purchased a
malware
removal tool. After trying to remove all of it in and out of
safemode I
was left with Symantec and the removal software being unable to
remove
a downloader virus at the subject directory. I was instructed
to
manually delete the file that was found....guess what (yes I
feel like
an idiot) the system wouldn't let me delete the file. So what
did the
"einstein" in me do? I renamed it to Csrss2....rebooted and got
the
blue screen of death:

STOP: c000021a {Fatal System Error} The Session Manager
Initialization
system process terminated unexpectedly with status of
0xc0000034
(0x00000000 0x00000000). The system has been shut down.

Attempts to reinstall Windows XP from the cd are also failing
with
another error. Any advice to get me back up and running without
losing
my data?

I know I am asking a lot but you seem like a great group of
trouble-fixers.

TIA
Jennifer

 

[Patti MacLeod]

Hi Jennifer,

Although it may seem to some like I left you hanging, the truth of the
matter is that I am a shiftworker and was working nightshift last night (and
again tonight), therefore I was busy sleeping all day in preparation for my
shift tonight.

Looking over my initial response to you, I am thinking that perhaps I should
have first had you try booting into Last Known Good Configuration. Since you
stated in your original post that you had been working in Safe Mode, you
know how to invoke the Windows Advanced Options menu..........invoke this
menu and select Last Known Good Configuration (your most recent settings
that worked).

Since you are left at a C: prompt and not asked which Windows installation
to log onto when attempting to boot into Recovery Console, your Windows
installation is not being recognized. Is your hard drive connected to a SATA
or RAID controller by chance? If so, you may need to load the controller
drivers from floppy disk during the initial Setup screen after booting from
the install CD.

If still no joy after trying to boot into Last Known Good Configuration, you
*may* be able to boot to your XP desktop by creating and booting from an XP
boot disk. Instructions are here:
How To Create a Boot Disk for an NTFS or FAT Partition in Windows XP
http://support.microsoft.com/kb/305595/en-us
If you *are* able to successfully boot to XP using the boot disk, navigate
to the Windows\System32 folder and see if you can successfully rename the
csrss2 file back to csrss.exe
See if you can now boot successfully into XP without the boot disk.

You had also mentioned how attempts to reinstall XP resulted in another
error message.......what was the error message that you received?



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User

I get access denied.

<snip>

 

[needlove]

My apologies patti..

Hi Jennifer,

Although it may seem to some like I left you hanging, the truth of the
matter is that I am a shiftworker and was working nightshift last night
(and again tonight), therefore I was busy sleeping all day in preparation
for my shift tonight.

Looking over my initial response to you, I am thinking that perhaps I
should have first had you try booting into Last Known Good Configuration.
Since you stated in your original post that you had been working in Safe
Mode, you know how to invoke the Windows Advanced Options
menu..........invoke this menu and select Last Known Good Configuration
(your most recent settings that worked).

Since you are left at a C: prompt and not asked which Windows installation
to log onto when attempting to boot into Recovery Console, your Windows
installation is not being recognized. Is your hard drive connected to a
SATA or RAID controller by chance? If so, you may need to load the
controller drivers from floppy disk during the initial Setup screen after
booting from the install CD.

If still no joy after trying to boot into Last Known Good Configuration,
you *may* be able to boot to your XP desktop by creating and booting from
an XP boot disk. Instructions are here:
How To Create a Boot Disk for an NTFS or FAT Partition in Windows XP
http://support.microsoft.com/kb/305595/en-us
If you *are* able to successfully boot to XP using the boot disk, navigate
to the Windows\System32 folder and see if you can successfully rename the
csrss2 file back to csrss.exe
See if you can now boot successfully into XP without the boot disk.

You had also mentioned how attempts to reinstall XP resulted in another
error message.......what was the error message that you received?



Regards,

--
Patti MacLeod
Microsoft MVP - Windows Shell/User


<snip>