NT 4.0 Blue screen on startup

[Pops109]

On boot up of one of our NT 4 SP6 Workstations, we get the blue screen of death with the following message:

STOP: c0000135 {Unable to Locate DLL}
The dynamic link library winsrv could not be found in the specified path Default Load Path.
Beginning dump of physical memory.
Physical memory dump complete, contact your system administrator or technical support group.

I have tried to reboot several times and get the same message. It is a Gateway GP350, Windows NT 4.0 service pack 6, and 356 MB of memory.

We tried booting from a Emer Repair Disk and it brings us to the same place.
We removed the hard drive and installed it as a slave in another machine. Ran a virus scan (nothing found) and adaware (removed some spyware). Didn't help.
Then I copied and pasted the winsrv.dll file from another workstation of same make into the winnt/system32 folder (File size and date were identical to the one on the problem machine). Still no help.
Any suggestions would be much appreciated.

 

[ustcurious]

That sounds like a boot sector virus. Is it possible your virus scanner missed it?

This type of virus hasn't been very prevalent for several years and a lot of people have either forgotten about them or just don't know about them. If you don't know how to clean a boot sector virus, try this....

Get your hands on a DOS boot disk that you know for sure is virus free. Any version of DOS will do and make sure you have fdisk.exe on the diskette as well.

If you don't have any DOS boot disks around, you can get a good image at

http://www.bootdisks.com

Cold boot the system with the diskette and once it is has booted into DOS, run FDISK /MBR at the command prompt. This will replace your boot sector with a clean copy from the diskette. Fdisk will run for a half a second or so and then just return to the prompt. No output, no messages. Don't worry about it. That is what it is supposed to do.

Now power the system off, remove the diskette and power up again.

Hope this helps.

 

[mattjurado]

1. There is an NT Workstation forum.
2. When did this start? What changes were made? Your Windows NT Workstation install disks, what SP are they?

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[ustcurious]

I posted the wrong URL earlier. It should have been bootdisk.com not bootdisks.com

 

[itsp1965]

I have seen this before. The software hive in your registry has been corrupted. Try loading an alternate instance of Windows NT on the same machine to see if you can access the Software registry key. This is documented on Technet