Microsoft KB Archive/327101

= Error message: Windows has detected that one or more protected core system files (kernel) on your computer have been modified =

Article ID: 327101

Article Last Modified on 2/1/2007

-

APPLIES TO


 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional

-



This article was previously published under Q327101



SYMPTOMS
When you try to install Windows XP Service Pack 1 or Service Pack 2 (SP1 or SP2), you may receive the following error message:

Windows has detected that one or more protected core system files (kernel) on your computer have been modified. The Service Pack contains updated versions of those files, which work to provide a stable environment for your programs. Due to this modification, the Service Pack will not be installed. For more information, see Knowledge Base article Q327101 at http://support.microsoft.com.



CAUSE
This behavior may occur if your computer has a modified version of the Ntoskrnl.exe file that uses the /KERNEL switch in the Boot.ini file. This condition may exist because your computer has a third-party program installed that customizes the graphics that are displayed when your computer starts up. Third-party programs that can cause this condition include the following:
 * BootXP
 * LogonUI Boot Randomizer



RESOLUTION
To resolve this problem, follow these steps:
 * 1) Click OK to close the error message.
 * 2) Click Start, click Run, and then type appwiz.cpl in the Open box.
 * 3) Click the program that customizes the startup graphics, and then click Remove.
 * 4) Restart your computer, and then try to install the Service Pack again. If the problem persists, go to step 5.
 * 5) On the desktop, right-click My Computer, and then click Properties.
 * 6) Click the Advanced tab, and then click Settings under Startup and Recovery.
 * 7) Under System Startup, click Edit.

The Boot.ini file opens in Notepad.
 * 1) Locate and then delete the /KERNEL= switch.
 * 2) Save and then close the Boot.ini file.
 * 3) Restart your computer.
 * 4) Try to install the Windows XP Service Pack.

Note After you complete the steps to resolve the problem, the Service Pack should install correctly. However, if your computer is running a modified Ntoskrnl.exe file, you may receive a message when you try to install the Service Pack that states that the the Service Pack setup program will replace the modified Ntoskrnl.exe file with an updated version.



STATUS
This behavior is by design.



MORE INFORMATION
For additional information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:

327120 Error Message: Windows Service Pack 1 Has Detected That One or More Protected Core System Files on Your Computer Have Been Modified

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

The error described in the Symptoms section also occurs when trying to install Windows XP SP2.

Additional query words: freeware shareware logon boot screens manager hack

Keywords: kberrmsg kbbug kbnofix kbenv KB327101

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.