SP 4 fails

Once installed, the Express Install of Win2K Service Pack 4 fails on reboot, with the flag "ntoskrnl.exe missing or corrupt ". I then reinstall my most recent Disk Image copy of the OS SP3, and work with it a while longer before trying again in a couple of weeks with a fresh d'load from MSoft.

However, the problem is clearly with me. Win2k has failed in other contexts with this error, and Disk Image makes it too easy to recover. What is the referenced file? Can it be copied, stored and applied when the system is running well? Will the repair console attend to a defective copy?

Obliged for any instruction
Oyster

 

ntoskrnl.exe missing or corrupt

Oyster,

I am recently experiencing the same message. I have another boot drive with WIN2K on it, and once tried copying this file from the otherdrive, but it made no difference. For some reason, the system does not see this file -- it is there, though, when I boot to dos and check it.

I am uncertain why this problem is occurring. One of the things I read was a Microsoft bulletin about one of their hotfixes causing this issue. However, the bulletin claimed that the boot issue (no more details) was caused by a hotfix versus SP3. But it might be, as you suspect, entirely a Microsoft operating issue that can be cured by reverting to SP3 or earlier. Or, by uninstalling hotfixes. I am going to try these things, and see what happens, since I can always restore. I can also try (or can I?) re-installing w2k over top of itself, not a fresh install, to revert to the original W2k -- but I am not sure about this, I have never done it, I have always been ghosting backwards.

However, too many people are having success with SP4 to rule these solutions in. It may be that the solution only removes the symptom.

It is also possible that the problem is caused by a virus. In my system at present, I have had some abnormal terminations when I try to run some types of virus scans. I get the message after performing installs of virus software or virus file updates, or executing SCANDISK. This is after formatting and then restoring all three of my boot drives (W98/W2k/W2k). It is almost as if there is a virus that is defending itself against any detection/removal by hitting the reboot button. If so, this virus is hiding in the system somehow and surviving a reformat. I don't understand how it can do this but the people who write these keep trying new things.

Another thing that makes me suspicious of a virus is that my Windows 98 gets broken as well, the only way I can get to a bootable configuration is to reformat all three drives and restore all three drives.

I scanned my system successfully using Norton Systemworks 2003 CD. So if this is a virus it is likely recent.

I have had no instances of any virus trying to send emails in OE. My system is set to scan any outgoing email. And I do not open attachments unless someone has told me they are sending one. I did go to MLB.com and try to sign up to listen to baseball games, then I started having the problem. It could be that my computer was infected by infected ActiveX code at that site.

But to return to the hotfix possibility, since one of them (I can't remember which one) was causing a boot issue, maybe it is just a matter of removing it. I think I read about this in this forum. I think I'll go back and look for it again, to see which hotfix it is, then try uninstalling it first.

Hopefully the other folks here on this forum have many good ideas.

I have just gone to the Microsoft site and read about one problem resulting in this error message. The problem results if the boot.ini is missing or points at some wrong place. Read http://support.microsoft.com/default.aspx?scid=kb;en-us;124550&Product=win2000. So one means of dealing with the message might be to replace a copy of the boot.ini file. But how would the boot.ini file be corrupted?

Tom In Dallas

 

Tom in Dallas,

If you suspect a virus, try some online scans, maybe one drive at a time or even parts of each drive. Could even be an infected MBR, or infected image. Might be some helpful information here on repairing MBR.

RAV

Housecall

 

RAV,

Per your suggestion I tried several online scans. They get terminated about halfway through the C drive, either by the browser closing or by the system being rebooted. Or one time iteven changed the frequency of my output to something my monitor could not read. However, my monitor gave me a box explaining this. This is a war, man.

At the last I had the ntoskrnl.exe message on D: (W2k) again. This time I examined the C: drive and found no boot.ini. I tried to copy over a boot.ini I had saved on another drive. I was told that I cannot replace the boot.ini on C: because it was in use. So, it was there, but hidden. And the virus was keeping it in use.

I reformatted and restored C: and am thinking I have to suppose this is an boot sector virus. What is the MBR anyway?

I read the message you posted the link to but as you know it specifies that re-installing the MBR cannot be done if you have more than 4 partitions, or if you have a multi-boot system. I lost out on that on both counts.

Well, actually, the boot drive is only three partitions (drive 0). It is drive 1 that is 5 partitions. I could back up C, E, and F, then execute fdisk/mbr, then if necessary restore C, E, and F. Then, if it is set only to boot to C: (W98), I can re-install W2k on D and G, then restore them.

 

I'm not going to be much help with the MBR repair on a multiboot system. That's why I posted the link, hoping you could find something useful there. But, I can suggest you download HijackThis from the CWShredder link in my signature. Place it in a permanent folder. Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. That I can help with.

 

... this is an boot sector virus. What is the MBR anyway

MBR = Master Boot Record = Boot Sector

 

I took my computer in to be de-virused and it turned out that the motherboard was degenerating -- the capacitors were leaking wax. The technician thought the problem was entirely physical, since he could find no virus. So now I have a new MB, memory, even a faster chip. Everything seems to work okay so far.

But now I am concerned to be prepared should my system ever get an MBR virus. I have a non-standard set-up; that is, partitions greater than 1024 and also more than four partitions on the 0 drive. Therefore if I use Windows recovery console (which uses fdisk /mbr) it will mess everything up. There is a Microsoft knowledge base article #166997 that is about using Norton Disk Edit to back up the MBR. Is there a better way to do this? Does the Emergency Recovery Disk in Norton Systemworks back up the MBR?

Links
http://mbrwizard.securityorg.net/docs.htm
http://www.globalshareware.com/Utilities/Backup/Backup-3.htm
http://www.diydatarecovery.nl/~tkuurstra/backupmbr.htm