Error Message: Windows Service Pack 1 Has Detected That One or More Protected Core System Files on Your Computer Have Been Modified

This article was previously published under Q327120
This article has been archived. It is offered "as is" and will no longer be updated.
When you install Windows XP Service Pack 1 (SP1) on your computer, you may receive the following error message:
Windows Service Pack 1 has detected that one or more protected files on your computer have been modified. The Service Pack contains updated versions of those files, which work to provide a stable environment for your programs.

If you click Yes, the updated versions will overwrite the current files and you might lose certain customizations created by third-party programs, especially those that affect the graphic displayed when your computer starts up.

If you click No, the computer might fail or stop responding.

For more information, see Knowledge Base article <Q327120> at

Do you want to overwrite the files?
You receive this error message if the computer has a modified version of the Ntoskrnl.exe file. Windows XP SP1 contains an updated version of this file. If the SP1 installer detects a modified version of the Ntoskrnl.exe file, it generates this error message. You can then either overwrite the file or to continue installing SP1 without replacing the file. If you click No, the computer might not work correctly or might stop responding (hang).
Click OK in the error message dialog box to permit the SP1 installer to overwrite the modified Ntoskrnl.exe file with an updated version.
This behavior is by design.

Article ID: 327120 - Last Review: 02/27/2014 21:14:31 - Revision: 1.2

  • Microsoft Windows XP Professional SP1
  • Microsoft Windows XP Home Edition SP1
  • kbnosurvey kbarchive kberrmsg kbprb KB327120