Error message when you try to install a service pack in Windows XP: "Windows has detected that one or more protected core system files (kernel) on your computer have been modified"

When you try to install a Windows XP service pack on a computer, you may receive an error message that resembles the following:

This behavior may occur if the computer has a modified version of the Ntoskrnl.exe file that uses the /KERNEL switch in the Boot.ini file. This condition may exist because the computer has a third-party program installed that customizes the graphics that are displayed when your computer starts. Third-party programs that can cause this condition include the following:

• BootXP
• LogonUI Boot Randomizer

To resolve this problem, you must remove the third-party program that is causing the problem.

Warning The following procedure includes steps that will modify the Boot.ini file. Improper configuration of the Boot.ini file can leave the computer in an unbootable state. We recommend that you back up the Boot.ini file before you make these changes. For more information about how to backup and edit the boot.ini file, click on the following article number to view the article in the Microsoft Knowledge Base:

1. Click OK to close the error message.
2. Click Start, click Run, type appwiz.cpl, and then click OK.
3. Click the program that customizes the startup graphics, and then click Remove.
4. Restart the computer, and then try to install the service pack again. If the problem persists, go to step 5.
5. On the desktop, right-click My Computer, and then click Properties.
6. Click the Advanced tab, and then click Settings under Startup and Recovery.
7. Under System Startup, click Edit.
   
   The Boot.ini file opens in Notepad.
8. Locate and then delete the /KERNEL=filename switch.
   
   Note The /KERNEL=filename switch is an optional parameter. Typically, it is only used by third-party programs that modify the kernel. It is safe to delete the entire switch parameter, which may resemble /kernel=kernel.exe. The following is a sample Boot.ini file from a Windows XP Professional-based computer that contains a /KERNEL=filename switch:

   [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 
   [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /kernel=ntkrnlmp.exe

   After you delete the /KERNEL=filename switch, the sample boot.ini file resembles the following:

   [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 
   [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect 

   For more information about switch options, click the following article number to view the article in the Microsoft Knowledge Base:
   833721  (http://support.microsoft.com/kb/833721/ ) Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files
9. Save and then close the Boot.ini file.
10. Restart the computer.
11. Try to install the Windows XP service pack.

Note After you complete the steps to resolve the problem, the service pack is installed correctly. However, if the computer is running a modified Ntoskrnl.exe file, you may receive a message when you try to install the service pack. The message states that the service pack Setup program will replace the modified Ntoskrnl.exe file by using an updated version. For more information, see the "More Information" section.

This behavior is by design.

For more information about what occurs when you are using a modified Ntoskrnl.exe file, click the following article number to view the article in the Microsoft Knowledge Base:
The error that is described in the "Symptoms" section of Microsoft Knowledge Base article 327120 can also occur when you try to install Windows XP Service Pack 2 (SP2) or Windows XP Service Pack 3 (SP3).

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.