[compprob1]

I'm unable to get into Windows XP Professional on my computer. After the XP Welcome screen loads, instead of the desktop appearing, it just shows a black screen with a movable white mouse cursor. I can't get into SafeMode or any other option under F8 to access XP.

My computer is a generic no-name PC that was given to me by a friend. It has 2 physical drives and 3 drive partitions:

C: drive - Windows 2000 Professional SP4
D: drive - some Adobe applications
F: drive - Windows XP Professional SP3

I can log in normally to the C drive (Windows 2000) partition, see all the other drives, and access the data on all the drives. I'm using the Windows 2000 partition now to access the Internet and write this message.


I saw what I think is the problem I'm experiencing discussed here:
http://forums.techguy.org/windows-xp...startup-2.html

Ackbar found that Microsoft patch kb971486 was causing the problem and found that by booting to an XP Install disc and uninstalling the patch using the recovery console solved the problem.

I was really hopeful when I saw this thread, as I think that's exactly what has happened in my situation, too. I could not get into XP beginning about the same time (10/19/09).

I don't have the install disc for Windows XP Professional, as the computer is a hand-me-down. Some of the other posters in the thread above suggested that any Windows XP install disc should work, as just the recovery console needs to be accessed. So, I borrowed an install disc from a neighbor that is made by Dell for "Windows XP media Center Version 2005 with Update Rollup."

I followed the instructions:

boot off your windows xp cd
press r for recovery console
select your windows install (1 in my case)

and that is where I got confused. The Windows install options were listed as:

1. C:\WINNT
2. E:\Windows

But the C drive is Windows 2000 Professional and the E drive is the Dell Windows XP install disc in the CD drive. Why doesn't the F drive installation (my computer's Windows XP Prof installation) appear? Have I done something wrong? Is there a way to access the F drive Windows XP Prof installation so I can uninstall the patch?

Could someone please help? I feel like I'm so close to resolving this issue. Thanks very much for your help.

[irdaneel]

Most of Dells installation disks are proprietary, and will only setup the OS exactly how Dell planned the computer. You really need a "Plain Jane" installation disk, not one from HP, Dell, Compaq, etc.

Also, your F8 options are available prior to your OS selection screen on your multiboot system. (Windows 2000 and Windows XP) Try before your OS selection screen appears, then shoot for "Safe Mode" of your Windows XP installation.

[Rich-M]

I would bet XP is the "E" drive as setup often messes up the drive letters and the cd drive would not show as Windows.

[irdaneel]

Oh, and Rich-M is right about drive letter changes.

[compprob1]

Thank you, irdaneel and Rich-M, for your replies and suggestions.

I went back to the Recovery Console, and selected the E:\WINDOWS option (option 2). When it asked me for my administrator password, I entered my xp password and it then displayed the E:\windows prompt.

I entered Ackbar's suggested fix commands at the E:\windows prompt to uninstall the patch:

cd $ntuninstallkb971486$
cd spuninst
batch spuninst.txt

The computer then displayed the following lines several times:

"The system cannot find the file or directory specified."
"The system cannot find the file specified."

Even though I was at E:\windows, and XP is installed on the F drive, I think I was accessing XP on my computer, as the administrator password I used is the one for the XP installation on my computer. However, the commands did not find the directory or the files???

I tried it a second time just to make sure I had not mis-typed the commands, and the same error lines displayed.

Do you know what might be happening?

Is it possible, like irdaneel mentioned, that a "plain jane" version of the XP install disc is required, that only such a version would correctly allow the recovery console to access and uninstall the patch? I am trying to get access to a "plain jane" copy of the XP install disc, and am hopeful I will be able to, but it wouldn't be until next week at the earliest.

Is there anything else I can potentially try in the meantime to get the patch uninstalled?

Thanks again for your help.

p.s., irdaneel, I tried to use SafeMode and all the other F8 options to get into XP, but they each result in the same error (black screen with moveable white mouse cursor).

[compprob1]

I got what I think is a "plain jane" version of Windows XP recovery console, entered the suggested fix commands at the E:\windows prompt, and the same errors occurred (directories and files not found).

I ran a "dir" command in the recovery console at the E:\windows prompt, and the XP directories, including the uninstall patches, appeared (which makes sense, as the change directory commands worked in the suggested fix).

I ran a "map" command in the recovery console at the E:\windows prompt, and this is what appeared:

C: NTFS 38154 MB \Device\Harddisk0\Partition1
E: NTFS 38154 MB \Device\Harddisk0\Partition2
D: NTFS 38163 MB \Device\Harddisk1\Partition1
A: \Device\Floppy0
F: \Device\CdRom0

The XP installation appears on the E drive in the recovery console, but shows as the F drive when I log into Windows 2000 on the C drive and double-click on My Computer.

Could this explain why the uninstall of the XP patch is not working in the recovery console?

Is there a way to change the mapping of the drives either in the recovery console or by logging in through the Windows 2000 partition? (e.g., swap the E and F drives, so the CD drive is the E drive and the XP install is the F drive)

I found this Microsoft article:

How to restore the system/boot drive letter in Windows
http://support.microsoft.com/kb/223188/

Would the steps it discusses to change the mounted drive letters help to resolve the situation? Or just make it worse?

Thank you for your help. Any suggestions would be really appreciated.

If you think I should start a new thread to ask this drive mapping question, please just let me know, and I will do so.

[managed]

Edit the spuninst.txt file and change each C: to E:

[compprob1]

Thank you, managed, for your suggestion.

I went to the spuninst.txt file for the patch, and here is what it says:

DEL "f:\windows\$hf_mig$\kb971486\sp2qfe\ntkrnlmp.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp2qfe\ntkrnlpa.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp2qfe\ntkrpamp.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp2qfe\ntoskrnl.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3gdr\ntkrnlmp.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3gdr\ntkrnlpa.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3gdr\ntkrpamp.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3gdr\ntoskrnl.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3qfe\ntkrnlmp.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3qfe\ntkrnlpa.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3qfe\ntkrpamp.exe"
DEL "f:\windows\$hf_mig$\kb971486\sp3qfe\ntoskrnl.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrnlmp.exe" "f:\windows\driver cache\i386\ntkrnlmp.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrnlpa.exe.000" "f:\windows\driver cache\i386\ntkrnlpa.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrpamp.exe" "f:\windows\driver cache\i386\ntkrpamp.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntoskrnl.exe.000" "f:\windows\driver cache\i386\ntoskrnl.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrnlpa.exe" "f:\windows\system32\ntkrnlpa.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntoskrnl.exe" "f:\windows\system32\ntoskrnl.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrnlmp.exe" "f:\windows\system32\dllcache\ntkrnlmp.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrnlpa.exe.000" "f:\windows\system32\dllcache\ntkrnlpa.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntkrpamp.exe" "f:\windows\system32\dllcache\ntkrpamp.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\ntoskrnl.exe.000" "f:\windows\system32\dllcache\ntoskrnl.exe"
COPY "F:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.txt" "F:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.tag"


So, it looks like the spuninst.txt is referencing the F drive. When I log into the Windows 2000 partition and click on "My Computer," it shows XP installed on the F drive and Windows 2000 installed on the C drive.

When I use the recovery console, it shows XP installed on the E drive and Windows 2000 installed on the C drive, and no F drive.

Earlier tonight, when I tried to copy the backup files from the $NtUninstallKB971486$ directory on the E drive manually one-by-one, e.g.:

COPY "E:\WINDOWS\$NtUninstallKB971486$\ntkrnlmp.exe" "E:\windows\driver cache\i386\ntkrnlmp.exe"

it didn't work.

But I think I just realized why. I didn't include the quotes around the path names. (I was confused by the space in "driver cache." I thought DOS paths couldn't have spaces.)

Anyway, your suggestion is much more elegant. If I just edit the spuninst.txt file and replace F drive with E drive, it should work, right?

[compprob1]

Managed, thank you again for your suggestion to edit the drive names in the spuninst.txt file. That worked. The uninstall files for patch 971486 were copied over to the E drive in the recovery console.

Unfortunately, when I try to start XP in SafeMode, the black screen and white moveable cursor still appear.

Patch 971486 was one of several (12) patches installed by Windows update on 10/15/09. They start at 8:35pm and finish at 8:39pm. Patch 971486 was the 5th patch installed during that time period.

A question to everyone:

Is it safe to try to uninstall the other Windows update patches that were installed on 10/15? If so, is there a particular order that I should do them in? Would I start with the last installed patch and work backwards?

Thanks again for your help.

[compprob1]

I was finally able to get into XP. The fix was to restore the registry hive files from a recent backup. PCS Tech provided the suggested fix here (October 16, 2009 11:06 PM post):

http://social.technet.microsoft.com/...1-80f7e31a8628

Since I have a dual-OS boot machine, I was able to go in through the Win 2000 side, access an XP restore point prior to the 10/15 Microsoft Windows updates, and copy over the registry to the \windows\system32\config directory as described in the link above.

I still need to check for malware, which appears to be the root cause.

Thanks again to everyone here who replied to my questions. I really appreciate it.