winlogon.exe - Bad Image - Can't Access XP!!!

Hello,

Configuration:

Intel Core 2 Duo 2.4 GHz | Leopard 10.5.2
4 GB Ram | 256 MB Video Ram
Parallels 3.0 Build 5608 | Windows XP Home
______________________________

I will try to remember best I can what happened here. I need what seems to be major help and I need it asap as I cannot access ANY of my client's files so I'm pretty desperate for some help. I am new to Mac & Parallels as of about 3 months ago so I really am floundering here.

Hubby had been playing the Chess game that came w/the iMac. When he was done, he left it open (grrrr!) for probably 6-8 hours. When I came to use the computer, the iMac was locked up tight. I had no mouse, no control over anything. I could not reboot/shutdown/force quit - nothing. So, I turned it off using the button on the back of the iMac and when it came back up, all seemed ok. (Yes, I know that's not a good thing to do but I did not seem to have any other choice that I knew of.)

I opened Parallels and found my ZoneAlarm threw me a msg that the Vector thing (forgot the second word) had shut down, did I want to restart? Clicked YES over and over and over again, same window kept popping up and ZoneAlarm would not restart. I tried to reboot Parallels/XP about 4x and it refused to reboot. I tried shutting it down, refused to shut down. I finally did a Force Quit and rebooted my iMac.

When I tried to open Parallels, XP went into a Disk Check, I saw that it deleted a number of things from a corrupted something or other, then recovered a bunch of files and then finished. No I don't know what these all are, it flies by so fast there's no way to write them all down. Now when I try to open my Parallels/XP I get two error msgs, the message is the same but it's two different files involved:

"winlogon.exe - Bad Image

RED X HERE The application or DLL c:\WINDOWS\system32\KBDUS.DLL is not a valid windows image. Please check this against your installation diskette.

OK BUTTON"

I click OK, get the same error but this time with this file: sfc.dll instead of KBDUS.DLL

I have no Taskbar - no icons on the desktop, no START MENU it's all blank. I cannot access ANYTHING.

I remembered that I ignored the Parallels update from a few days ago as I was super busy at that time and couldn't take the time just then to update. So, I did a "check for updates" and downloaded the newest one. It asked me if I wanted Parallels to run the install - I chose yes. It hung up - my cursor circled for I don't know how long but it was a long time and nothing happened. Only way out of this was another Force Quit.

When I tried double clicking the newly downloaded Parallels update .dmg on my desktop, it says it's not recognized/cannot mount. So, I tried a download from the Parallels site and was successful at an install, however I was pretty sure updating Parallels isn't going to replace the bad dll files.

I then tried opening my Parallels/XP again and I have the same issue, no desktop, no taskbar, no START menu. I would be happy to copy over the apparently bad DLL files from the cd but I cannot find the Windows\system32\ folder etc or dll's within Parallels/XP in order to overwrite them. Can't access Windows Explorer anyway to copy from cd over to the system32 folder because I have no taskbar, no START menu - no way to get to it.

I'm totally at a loss as to what to do. I'm afraid if I just re-install XP it's going to trash all my client files and I cannot find a backup of XP or any of my files w/in Parallels on my external drive which backs up via the iMac's Time Machine hourly. Everything seems to be in .app format. I don't seem to be able to see into anything like I could on XP via Windows Explorer. A right click on an .app to "Show Contents" does not show me what I need.

I tried "Revert to Snapshot" and got "there is no snapshot."

Your help would be GREATLY appreciated, thank you.

Deb

 

Fro the fist sight it is disk corruption on Mac OS,
So steps:
1. fsck in Single mode http://support.apple.com/kb/TS1417
2. Permissions repair Applications/Utilities/Disk Utility permissions repair
3. Backup VM as described in Parallels Desktop for Mac user guide from http://www.parallels.com/en/download/file/doc/Parallels_Desktop_for_Mac_User_Guide.pdf on page 243
4. Windows repair http://kb.parallels.com/en/5223

 

Hi John,

First, THANK YOU for responding! Next I have a few questions - this is all new to me so before proceeding I'd like to verify some things.

1) Is performing any part of your instructions going to lose MY data & programs that's w/in XP? This is VERY important because all my most important client info is in there and I can't seem to figure out how to get at it from the Time Machine external backup drive. The term "fsck" reminds me of the Windows FDisk and if used, as I recall you wind up wiping your drive clean losing everything, so it's a scary term for me.

2) I'm confused by the instructions between you and the web page you gave for step (1) you say use fsck but the instructions say use Disk Utility because I'm on OS X 10.5.3.

3) When using Parallels is the XP portion considered to be the same as a "volume" a "disk" or an "image" ??? I'm asking which term fits or if they're all one in the same interchangeable terms? This answer will help me understand some of the instructions better. I only know the Parallels/XP as a "virtual drive."

Thank you.
Deb

 

Basically before any operations which involve data, it is highly recommended to perform backup, so you start with step 3

fsck in Single mode, is more preferred, than using disk verify from Dick Utilities, less effects from OS and software installed in Mac OS

As for Windows Xp,
image is any following
CD ripped to disk file for example ISO image
volume hoep this article gives more in- depth explanation http://www.petri.co.il/difference_between_basic_and_dynamic_disks_in_windows_xp_2000_2003.htm
disk in this context is virtual representation of physical disk device

 

Hi John,

I'd love to do a backup, however, reading the instructions from the PDF document it seems like I'd need to be IN the XP in order to back it up and I can't get into it: "Copy the Virtual Machine files manually." Will cloning work since I can't get into the XP?

I found the Parallels PDF for the Clone Virtual Assistant, however I do not seem to have a Parallels Management Console. I have not re-installed Parallels Tools after upgrading because when I go to do that, I get a message that says I must be logged in and the machine running. Since all I get is a blank desktop, I am not sure I am logged in OR running. I do NOT have a login set up for this as I don't need one.

Deb

PS: Would it work to make a backup copy of the winxp.hdd from within the Mac environment? As in copy that over to my Time Machine external for safekeeping?

 

The simple way is to copy VM folder from Documents/Parallels

 

Ok, hmmmm .... I should already have numerous backups of that on my Time Machine, I'll check. What if I go back to one of the backups dated/timed prior to this problem occuring and do a RESTORE of that folder? More trouble or not?

Deb

 

let us see problems with TM backup
The main problem with Time Machine is that by default it takes snapshots every hour.
There are third party plugins which allows to change this behavior to once a day.
What is the problem.
Let say Time Machine is backing up Parallels Desktop
and example file order is
Snapshot.xml
VirtualMachine.pvs
--etc
winxp.hdd

There is some seconds between Snapshot.xml or DiskDescriptor.xml has been backed up, and to go to the winxp.hdd file and during those seconds you write some data to disk
After that you turn off your Mac, not waiting to the next hour data will be synchronized
And some how disk failed
If you restore you will not be able to start VM, as there is difference between data in Snapshot.xml and in real snapshot file, the same is correct for DiskDesciptor.xml file in winxp.hdd bundle

Microsoft Windows use Volume Shadow Copy for such situations, but Mac doesn't and this is the main problem we recommend to use our tools for backup purposes.

 

Ok then scratch that idea. I went to look for the VM folder you mentioned and this is what I came up with:

My WinXP seems to be located here:

Users/Username/Applications/Microsoft Windows XP

In that folder I have:

Microsoft Windows XP.mem
Microsoft Wndows XP.pvs
Microsoft Windows XP.sav
unattended.fdd
(Folder) Windows Applications
(Folder) Windows Disks
winxp.hdd

None of that is located in a folder called Parallels. The Parallels folder I found (other than an empty one) has the following in it:
LICENSE.txt
Quick Start Guide.pdf
Mac User Guide.pdf
Parallels Desktop.app
parallels Explorer User Guide.pdf
Parallels Explorer.app
Parallels Image Tool User Guide.pdf
parallels Image Tool.app
parallels Transporter User Guide.pdf
Parallels Transporter.app
Release Notes.pdf

So, is the Microsoft XP folder the one I'd want to copy over to the external?

 

you just selected different location

Users/Username/Applications/Microsoft Windows XP backup this folder

 

Ok, folder is copied over to my external. I should then proceed w/Steps 1, 2 and 4 per your original instructions and in that order, correct? After that I hopefully will be able to reinstall the Parallels tools and then should find the Management Console I would imagine so that I can back it up per Parallels Clone instructions. Do I have that all correct?

Deb

 

yes, it is correct, let us keep fingers crossed

 

You got that right! I will not be able to do this until tonight as I have to leave now - will let you know how it goes after 9 or 10pm CST.

Deb

 

SUCCESS!!!!!!!!!! I never thought Windows could look so pretty, LOL! I still have to do the Parallels backup.

There so far seems to be one issue that is now coming up when going into Windows. I am now getting the same error message that I started with except now it's this file: VSUTIL.dll

So you don't have to scroll up here's the original error msg, just replace the filename below with VSUTIL.dll

"winlogon.exe - Bad Image

The application or DLL c:\WINDOWS\system32\KBDUS.DLL is not a valid windows image. Please check this against your installation diskette.

OK BUTTON"

However, this new error msg is not preventing me from getting into Windows, thank goodness. I hope there's an easier way to fix it than going through this entire process again. Any ideas?

UPDATE: I *think* I have solved the VSUTIL.dll problem. For anyone else who has this problem, if you are using the ZoneAlarm firewall this is where it seems my issue stems from. ZA uses vsutil.dll but their are multiple files of the same name. You need to do a thorough search of all files and folders to find all references to it. You should then be able to determine which ones are owned by ZA/True Vector by hovering your mouse over the filename or right clicking it and go to Properties. The one I had that was NOT owned by ZA/True Vector is located here:

C:\windows\system32\vsutil.dll

It showed a file size of 0 (zero). I renamed this file vsutil.dll.OLD and this seems to have cleared up the error and after following some uninstall and reinstall instructions for Zone Alarm, it's now working and the vsutil.dll is still gone and so far my VM has not crashed.

WARNING: I am not a computer expert. I'm pretty good with Windows stuff, but DO THIS AT YOUR OWN RISK. I do not take responsibility if something goes wrong with your computer after following these instructions.

To John: THANK YOU - you definitely are my Hero of the Day! I'm now cloning my VM per your Parallels instructions and it's being cloned to my external drive and will also be added to my online backup service files. I have two more questions:

1) The cloned VM is now showing as a mounted drive on my desktop. Should I leave it there? I ask because it seems seasoned Mac users are quite adamant about not having to much stuff on the desktop but this seems awful handy if my main VM should go down again. It looks like by doing this if I do regular backups of it, that I could then work from the clone until I had time to fix the original VM.

2) It seems there is not a way to automate the backup (clone) so that it backs up on it's own at some set interval. Am I missing something?

 

1.hm, not sure why it is showing, I suppose ou either double clicked disk, try to unmout it from Finder
2. Yes, we are thinking about backup procedure