Major problem after XP GDI patch (KB833987)

After applying the Sept 2004 GDI patch (KB833987)
http://www.microsoft.com/technet/sec.../MS04-028.mspx

http://www.microsoft.com/downloads/d...0C1-63BD-4213-
82C1-20266FDFD735&displaylang=en

my very stable and patched (not SP2)
XP PC suddenly showed erratic behaviour
(detected a "new" NVidia card an urged me to install it - my MX440 card
was never moved in 2 years)

I made the major error to use "system restore" -
(I should have removed the MS update)

Well, the system still boots past the Win Logo but shows a black,
100% empty
desktop with a moving mouse pointer, that's all.

Tried:
last-known-good, Safe mode, recovery console - nothing.

MS support
suggested
1 - a second XP install on a 2nd partition to recover some data from C:
(which I did, works for some files, but it's a 120 GB drive...)
2 - a repair of the first XP install on C:

Problem:
after I follow the instructions from
http://www.michaelstevenstech.com/XPrepairinstall.htm
(Full XP home disk, but OEM bios locked)
I cannot Repair C:
- when I start the repair install *there is no R option,
only a clean (destructive) install.

I know that
"OEM Restore disks will not work for the Repair Install." -
but my Medion PC came with a full XP disk,
only bios-locked.

* Is there any way to perform a repair XP install on C? (it's a 120 GB
drive...)
* Are there any known problems with this MS patch?
(the uninstall string is still visible on my C partition, which won't
boot as it should)
* Is there any other way to undo the damage this patch caused?

BTW: I turned off automatic updates:
this was one bridge too far.


Thank you.

>-----Original Message-----
>After applying the Sept 2004 GDI patch (KB833987)
>http://www.microsoft.com/technet/sec...bulletin/MS04-
028.mspx
>
etc. ....

Ok !
You applied the patch and boom. video driver problem.
used system restore.
You could boot the c: part. past the logo, end up blank
screen, mouse pointer working. Did a second xp install on
second partion.
Questions...
a) what do you mean " nothing " when you say tried last
known, safe mode recovery console ?
all don't work ?
Did you try enable vga mode ? this bypasses your cards
video driver.

b) CAN YOU READ THE C:\ PARTITION DO YOU HAVE ACCESS TO IT?

c) now that you have two xp install I assume that it
boots from the second install, yes, no ?
if yes does it give you somewhere the choice of booting
from the first or second install , before you end up on
the second? this is important.

d)did you try chkdsk c: /f ?
this is important it will check your drive for errors.
please check your disk now !

I replied between the quotes

"jm" <> schreef in bericht
news:16f401c4a987$bbe54360$...
>
> >-----Original Message-----
> >After applying the Sept 2004 GDI patch (KB833987)
> >http://www.microsoft.com/technet/sec...bulletin/MS04-
> 028.mspx
> >
> etc. ....
>
> Ok !
> You applied the patch and boom. video driver problem.
> used system restore.
> You could boot the c: part. past the logo, end up blank
> screen, mouse pointer working. Did a second xp install on
> second partion.
> Questions...
> a) what do you mean " nothing " when you say tried last
> known, safe mode recovery console ?

Under supervision of a MS support tech I started safe mode
(visible in the 4 corner, also with a working mouse pointer,
no icons, black screen)

MS Tech ruled out a video driver problem
(VGA mode is used in safe mode)

"Last known good" just shows the XP screen,
stops the notmal boot sequence before I can choose a log-on profile
and shows the mose pointer.

The recovery console showed (using chkdsk) a normal HD

> all don't work ?

That is correct,
the boot sequence leaves me with a black screen and a
mouse pointer, at the point where I normally click my name to log on.


> Did you try enable vga mode ? this bypasses your cards
> video driver.

I did, unfortunately it
made no difference - the MS tech
assumed a non-driver problem,
and finally advised a repair Install (which is not an option when
I use the XP OEM CD)


> b) CAN YOU READ THE C:\ PARTITION DO YOU HAVE ACCESS TO IT?

I can read the C: partition and have complete access from the
2nd install of XP on D:

The video driver is working fine.

I took ownership of the files in "my documents" on C:


> c) now that you have two xp install I assume that it
> boots from the second install, yes, no ?

Correct

> if yes does it give you somewhere the choice of booting
> from the first or second install , before you end up on
> the second? this is important.

It gives me the choice: it looks like a normal dual-boot screen now
(with 2x XP Home)

But when I start the non-functional C boot
XP immediately warns me that this install has a problem
(general warning)
and
offers the regular F8 choices
(and that doesn' t help)



> d)did you try chkdsk c: /f ?
> this is important it will check your drive for errors.
> please check your disk now !

I did, chkdsk found no problems.

Well, I'm really lost now-
I hope you or anyone else can offer further suggestions.

Thank you.

>-----Original Message-----
>
>Well, I'm really lost now-
>I hope you or anyone else can offer further suggestions.
>
>Thank you.
>
Me again
Ok I think you have a problem with the lsass.exe or
msgina.dll files
could missing or corrupted or you may have a virus.
If you have an anti-virus program please try to scan drive
c:


lsass.exe" is the Local Security Authentication Server. It
verifies the validity of user logons to your PC/Server. It
generates the process responsible for authenticating users
for the Winlogon service. This process is performed by
using authentication packages such as the default
Msgina.dll. If authentication is successful, Lsass
generates the user's access token, which is used to launch
the initial shell. Other processes that the user initiates
inherit this token.

You should have a copy of that file in c:\windows\system32
if not find , copy one from the
c:\windows\servicepackfiles\i386 folder

sometimes in
C:\Windows\System32\dllcache\lsass.exe

but remember that it has to be the same version xp or sp1
or sp2 that is installed on c:\.

do the same for MSGINA.DLL

if you have sp1 ot sp2 on the c: drive don't use the one
from the new installtion unless it's the same version

Attn: it could be the sasser worm !!!
So scan the computer to make sure !


Microsoft teams have confirmed that the Sasser worm
(W32.Sasser.A and its variants) is currently circulating
on the Internet. Microsoft has verified that the worm
exploits the Local Security Authority Subsystem Service
(LSASS) issue that was addressed by the security update
released on April 13 in conjunction with Microsoft
Security Bulletin MS04-011.

>-----Original Message-----
>
see also
Microsoft Knowledge Base Article - 310396
http://support.microsoft.com/?kbid=310396
When you start your computer, the Microsoft Windows XP
startup screen appears, and then the computer MAY restart.
The Windows XP logon screen does not appear.

This issue may occur if the Kernel32.dll file is missing
or damaged.

replace with same version.

Thank you both for all suggestions and assistance,
I will try them asap and post the results here
(I'm in a different time zone)


<> schreef in bericht
news:3b9c01c4a9aa$d7115bb0$...
>
> >-----Original Message-----
> >
> see also
> Microsoft Knowledge Base Article - 310396
> http://support.microsoft.com/?kbid=310396
> When you start your computer, the Microsoft Windows XP
> startup screen appears, and then the computer MAY restart.
> The Windows XP logon screen does not appear.
>
> This issue may occur if the Kernel32.dll file is missing
> or damaged.
>
> replace with same version.

Thank you for your time.

I have both mailserver virus scanning+
an updated Norton.
An additional virusscan gave an all-clear.

Both msgina.dll and lsass.exe are on the unbootable C: drive-partition,
in the
C:\Windows\system32 folders,
with correct file dates/times.

*Is there a work-around to perform a XP repair-install
from my OEM XP disk? (it only offers a clean install,
erasing a 60 GB partition...)

Would buying an retail XP upgrade CD allow me to to
perform an XP repair install and potentially solve the problem?





"jm" <> schreef in bericht
news:25e801c4a9a2$7909d4a0$...
>
> >-----Original Message-----
> >
> >Well, I'm really lost now-
> >I hope you or anyone else can offer further suggestions.
> >
> >Thank you.
> >
> Me again
> Ok I think you have a problem with the lsass.exe or
> msgina.dll files
> could missing or corrupted or you may have a virus.
> If you have an anti-virus program please try to scan drive
> c:
>
>
> lsass.exe" is the Local Security Authentication Server. It
> verifies the validity of user logons to your PC/Server. It
> generates the process responsible for authenticating users
> for the Winlogon service. This process is performed by
> using authentication packages such as the default
> Msgina.dll. If authentication is successful, Lsass
> generates the user's access token, which is used to launch
> the initial shell. Other processes that the user initiates
> inherit this token.
>
> You should have a copy of that file in c:\windows\system32
> if not find , copy one from the
> c:\windows\servicepackfiles\i386 folder
>
> sometimes in
> C:\Windows\System32\dllcache\lsass.exe
>
> but remember that it has to be the same version xp or sp1
> or sp2 that is installed on c:\.
>
> do the same for MSGINA.DLL
>
> if you have sp1 ot sp2 on the c: drive don't use the one
> from the new installtion unless it's the same version

Hello again !

a) Buying a cd.
I have a dell oem and it does give me the r option.
(remember you have to boot from the cd right after the
bios. and
not from the window intallation itself.)
Will it ? maybe maybe not.
I have never tried it. You got to remember that in order
to use the R option setup has to DETECT
that particular installation, if not, it only gives you a
choice the full install.
Now that you built an other installation did you try again
to see if you have an R option .
If you do, and it's only the second one odds are that it
can't detect the first one and a new cd won't help.
Second thing, will a cd with a different "serial
validation" do a repair (oem).( never tried)

b) I would replace the lsass.exe anyway and try that.then
try the kernell32.dll

c)The only other sugg. I can can give you is to replace
the registry files manually and try that.
these files are located in : c:\windows\system32\config
they are security,software,system,default,sam ( with no
extentions)

you could find in this directory or in the \windows\repair
dir the same files but with an extention. (bak or sav)
they are usable but you have to remove the extentions.
( on drive part c:\)
Best instruction Q307545.
http://support.microsoft.com/default.aspx?scid=kb;en-
us;307545
You don't have to use recovery console.

Other than that FORMAT. NEW install as the M$ said.

No more suggestions I am afraid.
Good luck !

Thank you for all your advice and suggestions.

Well, I followed all instructions (also from MS), and
unfortunately there is never a R option for the troubled C windows install
when I boot from CD...
(only a R option for the recovery console - no R(epair) once I choose the
install option and select the unbootable partition/XP install, only
a destructive install)

Right now XP immediately comes up with an "appologies" page (cute)
explaining that XP (on C) cannot be started due to a recent hard (no) or
software install (yes, a MS patch) and offers all the unusable F8 options.

* Does anyone know whether a retail XP will allow me
to R(epair) a damaged XP OEM install?





"jim" <> schreef in bericht
news:2dec01c4aa3d$0f949820$...
>
> Hello again !
>
> a) Buying a cd.
> I have a dell oem and it does give me the r option.
> (remember you have to boot from the cd right after the
> bios. and
> not from the window intallation itself.)
> Will it ? maybe maybe not.
> I have never tried it. You got to remember that in order
> to use the R option setup has to DETECT
> that particular installation, if not, it only gives you a
> choice the full install.
> Now that you built an other installation did you try again
> to see if you have an R option .
> If you do, and it's only the second one odds are that it
> can't detect the first one and a new cd won't help.
> Second thing, will a cd with a different "serial
> validation" do a repair (oem).( never tried)
>
> b) I would replace the lsass.exe anyway and try that.then
> try the kernell32.dll
>
> c)The only other sugg. I can can give you is to replace
> the registry files manually and try that.
> these files are located in : c:\windows\system32\config
> they are security,software,system,default,sam ( with no
> extentions)
>
> you could find in this directory or in the \windows\repair
> dir the same files but with an extention. (bak or sav)
> they are usable but you have to remove the extentions.
> ( on drive part c:\)
> Best instruction Q307545.
> http://support.microsoft.com/default.aspx?scid=kb;en-
> us;307545
> You don't have to use recovery console.
>
> Other than that FORMAT. NEW install as the M$ said.
>
> No more suggestions I am afraid.
> Good luck !
>
>