illegal system dll relocation

A

Aqueous

I have a blue screen with this message: STOP: 0000269 illegal system dll
relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address
range reserved for windows systems DLLs The vendor should %%" I dont know
how to troubleshoot this. Background: ran chkdisk as a routine maintenance.
XP went to endless reboot. i tried booting from original XP disk, going to
recovery console and I guess reinstalling kernel32.dll. still cycling. i am
unable to reach safe mode but advanced options menu allows me to disable
automatic restart so i could see the blue screen warning. Going to las known
configuration has no effect. i have SP2 XP home edition. What do i do now?
 
L

Lem

Aqueous said:
I have a blue screen with this message: STOP: 0000269 illegal system dll
relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address
range reserved for windows systems DLLs The vendor should %%" I dont know
how to troubleshoot this. Background: ran chkdisk as a routine maintenance.
XP went to endless reboot. i tried booting from original XP disk, going to
recovery console and I guess reinstalling kernel32.dll. still cycling. i am
unable to reach safe mode but advanced options menu allows me to disable
automatic restart so i could see the blue screen warning. Going to las known
configuration has no effect. i have SP2 XP home edition. What do i do now?

Try the following:

1. boot from a Windows CD and go to recovery console.

2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to
c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old
gdi32.dll in c:\windows\system32 directory)

3. Reboot normally

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 
A

Aqueous

Thanks.i need a little more hand-holding,sorry to say. i am now in a dos
environment looking at a c:\windows> prompt. (I chose windows but it could
have been D:\i386). The instructions i followed before to reinstall kernel32
dll were >cd system 32 then >ren [names of files, new and old] and then >map.
Then there was an expand command, and exit. I just followed the directions
by rote but dont know exactly what i executed with this, so that is my level
of understanding. i am just guessing that the dos command for copy is "copy"
and i have no idea how to navigate to the place i want to copy to, or what
the command for, um, paste? is. Can you give me step by step directions from
the point of having the c: prompt in Recover console? i apologize for my
ignorance and am grateful for your help.
 
A

Aqueous

Lem, belay that last post, i am teaching myself DOS, kind of... I know how
to copy the file, but there is no such file on c: and no i386folder on c:
either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_
should i copy the DL_ file only and place it in the c: location you
indicated?
 
L

Lem

Aqueous said:
Lem, belay that last post, i am teaching myself DOS, kind of... I know how
to copy the file, but there is no such file on c: and no i386folder on c:
either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_
should i copy the DL_ file only and place it in the c: location you
indicated?

I'm not really sure what you did with respect to kernel32.dll. In
particular, I don't know what you might have been attempting to do with
the "map" command. Further, kernel32.dll is an integral part of
Windows. If you overwrote it with an incorrect version, you may have
terminally corrupted your current installation.

In addition, you haven't addressed what caused your problem in the first
place (possibly a malware infestation). However, forging ahead ...

The first thing you should do is to make sure that any data that you
care about is preserved. Assuming that you do not have a full backup
(or otherwise you probably would simply have restored your drive from
the backup), you can either remove the drive from your computer, put it
in an external usb drive enclosure, hook it up to a second computer, and
copy off the data, or build yourself a Knoppix CD, boot from that, and
copy the data.

Putting aside data preservation issues, whether messing with
kernel32.dll has created a problem, and whatever caused your initial
problem, here are steps to replace gdi32.dll.

If there is no C:\i386 or C:\windows\servicepackfiles\i386\ folder, that
suggests that your installation of Windows XP began with sp2 (which fits
with you having an sp2 cd).

Assuming that Windows is located in C:\Windows and that your CD drive is
E:\ go to the Recovery Console and type

cd C:\Windows\system32
ren gdi32.dll gdi32.dll.old
expand e:\i386\gdi32.dl_ c:\windows\system32\gdi32.dll
attrib -r c:\windows\system32\gdi32.dll

exit from Recovery Console and reboot.

If the above doesn't fix things, then you should probably try a Repair
Install. See http://www.michaelstevenstech.com/XPrepairinstall.htm

Note that a Repair Install will likely *not* remove any malware that may
have infested your computer and caused your problem in the first place.
If you do a Repair Install and successfully get back to Windows, you
should do a thorough check for malware, starting with a full scan with
an up-to-date reputable antivirus app and again with a more generalized
antimalware app such as MalwareBytes Antimalware (http://malwarebytes.org/).

Be aware that although a Repair Install is supposed to preserve your
data and installed apps, things have been known to go wrong, which is
why you should back up your data first.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 
A

Aqueous

at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.
 
L

Lem

Aqueous said:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.

You are correct that using the recovery partition on the hard drive will
wipe out everything. It restores the computer to its out-of-the-box
condition.

Also, I'm not clear if using a retail XP CD to do a repair install will
work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to
c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the
existing file. If you already have done this, this command will fail
because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't
specify a destination, the expanded file goes into the current folder.
The error in my previous post was that I specified the file name as the
destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat
differently than they do at a normal Command Prompt. For more detail on
using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free
download as an ISO image. It is a large download, about 700 Meg for the
CD and a few Gig for the DVD. The difference is that the DVD has more
applications. The CD will suffice for rescuing data. KNOPPIX is a flavor
of LINUX, with very good intrinsic support for much hardware, in fact,
better than XP itself. "live" means that it runs from CD without
installing on the hard drive. KNOPPIX has a windows-like file manager,
supports USB and firewire, and version 5 can write to disks formatted as
FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 
A

Aqueous

followed your directions. the file expanded, so that worked, and directory
shows a file gdi32.dll (from 2002) and a gdi32.dll.old (from 2008). there is
also gdiplus.dll. I had not noticed that before.

unfortunately windows still does not boot, but cycles (i shut that off
again.) No difference.

I also looked at the file info for kernel32.dll and find one dated 2002 and
one called kernel32.old dated 2007. there are lots of files with dates all
over the place, but for what it is worth.

I am unclear on the sequence of next steps -- downnload the knoppix product
(i will do that promptly)and use that to salvage data, then try the repair
install (daunting as it looks) --or try somethihg else? I believe I can also
purchase a boot disk from hp--i assume that would have the current versions
of both kernel and gdi drivers. if that would offer any advantage at this
point, i dont know. if you think it is worth waiting for that, to arrive
before i attempt the repair install, i will. I should have it anyway.

If you are still willing to advise, I remain grateful.




Lem said:
Aqueous said:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.

You are correct that using the recovery partition on the hard drive will
wipe out everything. It restores the computer to its out-of-the-box
condition.

Also, I'm not clear if using a retail XP CD to do a repair install will
work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to
c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the
existing file. If you already have done this, this command will fail
because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't
specify a destination, the expanded file goes into the current folder.
The error in my previous post was that I specified the file name as the
destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat
differently than they do at a normal Command Prompt. For more detail on
using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free
download as an ISO image. It is a large download, about 700 Meg for the
CD and a few Gig for the DVD. The difference is that the DVD has more
applications. The CD will suffice for rescuing data. KNOPPIX is a flavor
of LINUX, with very good intrinsic support for much hardware, in fact,
better than XP itself. "live" means that it runs from CD without
installing on the hard drive. KNOPPIX has a windows-like file manager,
supports USB and firewire, and version 5 can write to disks formatted as
FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 
T

Tim Meddick

Hi Aqueous,
Seeing how no-one's replied to you in a while - - I was
under the impression all modern HP machines came with a recovery partition,
meaning that you can press F1 or F10 or something and within a few "clicks"
your machine is back up just like brand new!? You will still need the
knoppix disk to salvage your data though BEFORE you use this option.
 
A

Aqueous

No, wait, there's more.
I apparently was too fast in stopping the auto reboot and did not see that
the blue screen warning has changed. now it says "stop c0000135 (unable to
locate component)
this application has failed to start because winsrv was not found.
Re-installing the application may fix this problem."
This is good news, I hope? Can you walk me through the re-installation?
Also, i ordered from HP a "recovery disk" which will take a week to arrive.
i should have the resources to download knoopix tonight.





Lem said:
Aqueous said:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.

You are correct that using the recovery partition on the hard drive will
wipe out everything. It restores the computer to its out-of-the-box
condition.

Also, I'm not clear if using a retail XP CD to do a repair install will
work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to
c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the
existing file. If you already have done this, this command will fail
because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't
specify a destination, the expanded file goes into the current folder.
The error in my previous post was that I specified the file name as the
destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat
differently than they do at a normal Command Prompt. For more detail on
using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free
download as an ISO image. It is a large download, about 700 Meg for the
CD and a few Gig for the DVD. The difference is that the DVD has more
applications. The CD will suffice for rescuing data. KNOPPIX is a flavor
of LINUX, with very good intrinsic support for much hardware, in fact,
better than XP itself. "live" means that it runs from CD without
installing on the hard drive. KNOPPIX has a windows-like file manager,
supports USB and firewire, and version 5 can write to disks formatted as
FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 
A

Aqueous

Thank you Tim. This clarifies the sequence for me, as i am unfamiliar with
knopppix functionality. I have to organize the resources to download knoppix
and will do so in 24 hrs. I am still hopeful i can repair windows and not
have to resort to the F10 solution.
 
L

Lem

Aqueous said:
No, wait, there's more.
I apparently was too fast in stopping the auto reboot and did not see that
the blue screen warning has changed. now it says "stop c0000135 (unable to
locate component)
this application has failed to start because winsrv was not found.
Re-installing the application may fix this problem."
This is good news, I hope? Can you walk me through the re-installation?
Also, i ordered from HP a "recovery disk" which will take a week to arrive.
i should have the resources to download knoopix tonight.





Lem said:
Aqueous said:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.


:

Aqueous wrote:
Lem, belay that last post, i am teaching myself DOS, kind of... I know how
to copy the file, but there is no such file on c: and no i386folder on c:
either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_
should i copy the DL_ file only and place it in the c: location you
indicated?

:

Aqueous wrote:
I have a blue screen with this message: STOP: 0000269 illegal system dll
relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address
range reserved for windows systems DLLs The vendor should %%" I dont know
how to troubleshoot this. Background: ran chkdisk as a routine maintenance.
XP went to endless reboot. i tried booting from original XP disk, going to
recovery console and I guess reinstalling kernel32.dll. still cycling. i am
unable to reach safe mode but advanced options menu allows me to disable
automatic restart so i could see the blue screen warning. Going to las known
configuration has no effect. i have SP2 XP home edition. What do i do now?


Try the following:

1. boot from a Windows CD and go to recovery console.

2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to
c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old
gdi32.dll in c:\windows\system32 directory)

3. Reboot normally

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

I'm not really sure what you did with respect to kernel32.dll. In
particular, I don't know what you might have been attempting to do with
the "map" command. Further, kernel32.dll is an integral part of
Windows. If you overwrote it with an incorrect version, you may have
terminally corrupted your current installation.

In addition, you haven't addressed what caused your problem in the first
place (possibly a malware infestation). However, forging ahead ...

The first thing you should do is to make sure that any data that you
care about is preserved. Assuming that you do not have a full backup
(or otherwise you probably would simply have restored your drive from
the backup), you can either remove the drive from your computer, put it
in an external usb drive enclosure, hook it up to a second computer, and
copy off the data, or build yourself a Knoppix CD, boot from that, and
copy the data.

Putting aside data preservation issues, whether messing with
kernel32.dll has created a problem, and whatever caused your initial
problem, here are steps to replace gdi32.dll.

If there is no C:\i386 or C:\windows\servicepackfiles\i386\ folder, that
suggests that your installation of Windows XP began with sp2 (which fits
with you having an sp2 cd).

Assuming that Windows is located in C:\Windows and that your CD drive is
E:\ go to the Recovery Console and type

cd C:\Windows\system32
ren gdi32.dll gdi32.dll.old
expand e:\i386\gdi32.dl_ c:\windows\system32\gdi32.dll
attrib -r c:\windows\system32\gdi32.dll

exit from Recovery Console and reboot.

If the above doesn't fix things, then you should probably try a Repair
Install. See http://www.michaelstevenstech.com/XPrepairinstall.htm

Note that a Repair Install will likely *not* remove any malware that may
have infested your computer and caused your problem in the first place.
If you do a Repair Install and successfully get back to Windows, you
should do a thorough check for malware, starting with a full scan with
an up-to-date reputable antivirus app and again with a more generalized
antimalware app such as MalwareBytes Antimalware (http://malwarebytes.org/).

Be aware that although a Repair Install is supposed to preserve your
data and installed apps, things have been known to go wrong, which is
why you should back up your data first.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
You are correct that using the recovery partition on the hard drive will
wipe out everything. It restores the computer to its out-of-the-box
condition.

Also, I'm not clear if using a retail XP CD to do a repair install will
work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to
c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the
existing file. If you already have done this, this command will fail
because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't
specify a destination, the expanded file goes into the current folder.
The error in my previous post was that I specified the file name as the
destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat
differently than they do at a normal Command Prompt. For more detail on
using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free
download as an ISO image. It is a large download, about 700 Meg for the
CD and a few Gig for the DVD. The difference is that the DVD has more
applications. The CD will suffice for rescuing data. KNOPPIX is a flavor
of LINUX, with very good intrinsic support for much hardware, in fact,
better than XP itself. "live" means that it runs from CD without
installing on the hard drive. KNOPPIX has a windows-like file manager,
supports USB and firewire, and version 5 can write to disks formatted as
FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

Very first hit from Google:
http://support.microsoft.com/kb/885523

However, you will be unable to remove SP2 (because it wasn't installed
as an update but as the initial OS). See some of the other hits from
http://www.google.com/search?hl=en&q=winsrv&btnG=Google+Search&cts=1239285476829&aq=f&oq=

Be sure you know what the HP recovery disk is intended to do (and how to
do it). I suspect that it is like the hidden partition -- and will
restore your computer to a "like new" condition, with none of your
applications or data.

Knoppix is pretty easy to use. You might want to do some reading here
first:
http://www.knoppix.net/wiki/Main_Page
http://www.knoppix.net/wiki/Knoppix_FAQ

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 
A

Aqueous

Success beyond expectations, based on precincts heard from so far. knoppix
was much easier both to obtain and use than the instructions appeared to my
novice eyes. Worked like a charm, very intuitive interface, and i saved all
my data and essentially evrything on the hard drive to an external hard
drive.
Then the recovery disks from HP arrived ahead of schedule. They offered the
option of full recovery (destroying data) or "standard recovery" which said
data files would be intact. i chose the standard option (belt and suspenders
person that i am). The instructions were highly detailed and the process
took a half hour, and only used 1 of the 12 HP disks sent. This restored
XP, apparently with all data files intact. Many applications including
Norton and current versions of Office did not make the jump-- the computer
thinks it is 2005 or 2003, it seems, and restored long-replaced versions --
but i should be able to uninstall the old software versions that are now
resident and reinstall my current versions. I dont even want to open files
until i have current software running, just to be careful, but the files are
showing up. not sure about outlook files, and i suspect i will need to
reinstall my broadband account. Just noting this for the record,it is not
hard to do. Do you think i need to do anything about the potential malware
source of this problem, other than running a scan with NIS2009 once it is
running? i wanted to get this off to you with heartfelt thanks for your
advice and encouragement. I learned a lot from this. You have a favorite
charity, I'll donate as soon as i can swing it. i'd like to mark this solved
as soon as we complete that detail. You cannot imagine how grateful I am.

Lem said:
Aqueous said:
No, wait, there's more.
I apparently was too fast in stopping the auto reboot and did not see that
the blue screen warning has changed. now it says "stop c0000135 (unable to
locate component)
this application has failed to start because winsrv was not found.
Re-installing the application may fix this problem."
This is good news, I hope? Can you walk me through the re-installation?
Also, i ordered from HP a "recovery disk" which will take a week to arrive.
i should have the resources to download knoopix tonight.





Lem said:
Aqueous wrote:
at the expand step, response is
"unable to create file gdi32.dll.
0 files expanded"

I hope you have more thoughts on this.
Kernel32 issue: Your analysis prompts my recall of the history of this
system. This is an HP box from 2005 with XP factory installed. I now realize
I am using for my boot disk an older upgrade version CD of XP that i bought
for a previous computer. In my state of mind I did not stop to think it was
for the old system, was just glad i had an XP CD on the shelf...so it is
possible the version of kernel32 onmy recoverey console is incompatible with
this system. I simply have to hope that is not the case and as you say forge
ahead. Or do you think i need to address this possibility first?

The HP did not come with a boot disk, but has some kind of recovery space
allocation. However, i think using that recovery mode restores factory
settings and wipes all data. I do have a backup of most critical personal
files. most, not all. I do not think i have the technical facility to take
out the HD and put it in another device. i'll have to think about that.
Malware: I have most current norton version running with all standard
protections in place, did a full scan a week ago, and regularly use adaware.
I practice very safe computing--no guarantee but i am not the at-risk profile
by any means.
Precipitating event: I ran chkdisk more or less out of precaution since i
had not done so in a long time. i was getting a minor annoying glitch in
Word, so i was not totally feeling complacent about the system but figured i
would start with routine maintenance before troubleshooting that. i think i
will never run it again.

I hope you can still guide me out of this mess. I appreciate all the time
you are putting into it.


:

Aqueous wrote:
Lem, belay that last post, i am teaching myself DOS, kind of... I know how
to copy the file, but there is no such file on c: and no i386folder on c:
either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_
should i copy the DL_ file only and place it in the c: location you
indicated?

:

Aqueous wrote:
I have a blue screen with this message: STOP: 0000269 illegal system dll
relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address
range reserved for windows systems DLLs The vendor should %%" I dont know
how to troubleshoot this. Background: ran chkdisk as a routine maintenance.
XP went to endless reboot. i tried booting from original XP disk, going to
recovery console and I guess reinstalling kernel32.dll. still cycling. i am
unable to reach safe mode but advanced options menu allows me to disable
automatic restart so i could see the blue screen warning. Going to las known
configuration has no effect. i have SP2 XP home edition. What do i do now?


Try the following:

1. boot from a Windows CD and go to recovery console.

2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to
c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old
gdi32.dll in c:\windows\system32 directory)

3. Reboot normally

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

I'm not really sure what you did with respect to kernel32.dll. In
particular, I don't know what you might have been attempting to do with
the "map" command. Further, kernel32.dll is an integral part of
Windows. If you overwrote it with an incorrect version, you may have
terminally corrupted your current installation.

In addition, you haven't addressed what caused your problem in the first
place (possibly a malware infestation). However, forging ahead ...

The first thing you should do is to make sure that any data that you
care about is preserved. Assuming that you do not have a full backup
(or otherwise you probably would simply have restored your drive from
the backup), you can either remove the drive from your computer, put it
in an external usb drive enclosure, hook it up to a second computer, and
copy off the data, or build yourself a Knoppix CD, boot from that, and
copy the data.

Putting aside data preservation issues, whether messing with
kernel32.dll has created a problem, and whatever caused your initial
problem, here are steps to replace gdi32.dll.

If there is no C:\i386 or C:\windows\servicepackfiles\i386\ folder, that
suggests that your installation of Windows XP began with sp2 (which fits
with you having an sp2 cd).

Assuming that Windows is located in C:\Windows and that your CD drive is
E:\ go to the Recovery Console and type

cd C:\Windows\system32
ren gdi32.dll gdi32.dll.old
expand e:\i386\gdi32.dl_ c:\windows\system32\gdi32.dll
attrib -r c:\windows\system32\gdi32.dll

exit from Recovery Console and reboot.

If the above doesn't fix things, then you should probably try a Repair
Install. See http://www.michaelstevenstech.com/XPrepairinstall.htm

Note that a Repair Install will likely *not* remove any malware that may
have infested your computer and caused your problem in the first place.
If you do a Repair Install and successfully get back to Windows, you
should do a thorough check for malware, starting with a full scan with
an up-to-date reputable antivirus app and again with a more generalized
antimalware app such as MalwareBytes Antimalware (http://malwarebytes.org/).

Be aware that although a Repair Install is supposed to preserve your
data and installed apps, things have been known to go wrong, which is
why you should back up your data first.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

You are correct that using the recovery partition on the hard drive will
wipe out everything. It restores the computer to its out-of-the-box
condition.

Also, I'm not clear if using a retail XP CD to do a repair install will
work on your factory-installed system.

My bad. I gave you the wrong syntax.

cd c:\windows\system32 [This command changes the directory to
c:\windows\system32]

ren gdi32.dll gdi32.dll.old [This is intended to save a copy of the
existing file. If you already have done this, this command will fail
because it won't find gdi32.dll]

expand e:\i386\gdi32.dl_ [The destination is optional. If you don't
specify a destination, the expanded file goes into the current folder.
The error in my previous post was that I specified the file name as the
destination, rather than the folder into which the file goes.]

Don't bother with the attrib command I previously suggested.

The recovery console is somewhat limited. Commands work somewhat
differently than they do at a normal Command Prompt. For more detail on
using the Recovery Console, see http://support.microsoft.com/kb/314058

You should look into burning a Knoppix "live" CD, which is a free
download as an ISO image. It is a large download, about 700 Meg for the
CD and a few Gig for the DVD. The difference is that the DVD has more
applications. The CD will suffice for rescuing data. KNOPPIX is a flavor
of LINUX, with very good intrinsic support for much hardware, in fact,
better than XP itself. "live" means that it runs from CD without
installing on the hard drive. KNOPPIX has a windows-like file manager,
supports USB and firewire, and version 5 can write to disks formatted as
FAT32 or NTFS, among others.

http://www.knopper.net/knoppix/index-en.html
--

Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

Very first hit from Google:
http://support.microsoft.com/kb/885523

However, you will be unable to remove SP2 (because it wasn't installed
as an update but as the initial OS). See some of the other hits from
http://www.google.com/search?hl=en&q=winsrv&btnG=Google+Search&cts=1239285476829&aq=f&oq=

Be sure you know what the HP recovery disk is intended to do (and how to
do it). I suspect that it is like the hidden partition -- and will
restore your computer to a "like new" condition, with none of your
applications or data.

Knoppix is pretty easy to use. You might want to do some reading here
first:
http://www.knoppix.net/wiki/Main_Page
http://www.knoppix.net/wiki/Knoppix_FAQ

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top