SFC doesn't replace files

[bullhlms]

When I run SFC I am requested to insert the CD and all goes smoothly with "SFC completed successfully" in my event viewer upon conclusion. If I immediately run sfc again I am soon requested to insert the CD. Checking "cancel" and subsequently the event viewer indicates the same file(s) are missing/corrupted each time I run SFC. I am using the slipstreamed CD from which the XPPRO SP2 was installed.
Any idea why SFC doesn't replace the files?

TIA.

Bill

 

[linney]

No idea, just some general information here.

Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)

http://support.microsoft.com/default.aspx?scid=kb;en-us;310747&FR=1&PA=1&SD=HSCH

SFC leaves a report in the Event Viewer (System).
Event Type: Information
Event Source: Windows File Protection

222193 - Description of the Windows File Protection Feature

http://support.microsoft.com/default.aspx?scid=kb;en-us;222193&FR=1&PA=1&SD=HSCH

You receive a "Windows File Protection: Files that are required for windows to run properly have been replaced by unknown versions" error in Windows Server 2003, Windows XP, or Windows 2000

http://support.microsoft.com/default.aspx?scid=kb;en-us;904677&FR=1&PA=1&SD=HSCH

Disable Windows File Protection

http://www.winguides.com/registry/display.php/790/

 

[bullhlms]

Thanks for the reply, Linney.

I followed the one link I hadn't seen before to no avail. I noticed the files in dllcache are compressed. Maybe that's why they don't compare? or are they always compressed? and that the dir has about 5000 (not 2700) files. Over 2000 are tmp files. They are all oldnnnn.tmp where nnnn is a 4 digit hex number. My install is an upgrade from XP home.

 

[linney]

The System32/dllcache folder is compressed by design and so are the contained files. There are however no *.tmp inside, on the machines I checked. The number of files can vary from machine to machine, I imagine, depending on what you have installed, 5000 seem excessive however. The machine I checked had 3400.

Have a look at that slipstreamed SP2 CD of yours just to make sure that somewhere on it inside the i386 folder you have not created a heap of *.tmp files.

You could try running Disk Cleanup to see if that has any effect on the folder, or just delete them (after a backup).
SFC /Purgecache: "Purges the file cache and scans all protected system files immediately. This command may require access to the Windows installation source files.

 

[bullhlms]

Thanks, Linney
I ran a cleanup, which had no effect. Then I moved the *.tmp's and started a scan which immediately requested the CD so I did a purgecache. That deleted all but about 25 files from the folder. SFC did not appear to operate then, so I did sfc/scanonce and re-booted. The CD was immediately requested. Scan took 25 minutes. Now dllcache has 4454 objects, 1061 of which are *.tmp's. The CD has no tmp or tm_ files. A spot check of the new tmp's vs the old does not show "old" with same names. All tmp's were "accessed" when sfc was run, but only about half of the dll, exe, etc which were placed into dllcache were.

 

[linney]

Are you running any third party recovery or restore programs similar to "Go Back" that might be saving old files?


Perhaps using a program like these will show you what is going on with SFC, they allow you to monitor the file changes as they occur.


Filemon for Windows.

http://www.sysinternals.com/Utilities/Filemon.html

FileChangeAlarm

http://www.capimonitor.nl/File Change Alarm/_loadurl.php?filename=filechangealarm.php

 

[bullhlms]

Thanks, Linney.
No 3rd party "restores".
My concern is not the tmp's, rather that SFC doesn't appear to fix anything. That is it needs the same files every time it's run even when immediately repeated.

 

[linney]

For obvious reasons, SFC is not something I run often, so this is from memory, and also the reason I suggested those file monitoring programs. As I remember, when you run SFC /Scannow it replaces every, or most files, in the DllCache folder and not too much, if any, in the System32 folder. I always assume that at some stage any corrupt files in the System32 folder are later replaced by the new and non-corrupt files in the DllCache folder as organized by the Windows File Protection.

I don't know whether you have turned off System Restore, but if you haven't, your restore points will be increasing by approx. 500MB every time you run SFC /Scannow. You might like to check that out. You will need to be an Administrator, and give yourself access permissions to this hidden or system folder folder, "System Volume Information" in the root of the drive.

Perhaps you could also supply a list (if it is not hundreds or thousands of them) of the missing or corrupts files you are talking about?

I am concerned about all those *.tmp files as I have not heard of that before. If they are all zero byte in size, I would look at the permissions on that folder too. Which prompts me to ask if you are running SFC as an Administrator?

 

[bullhlms]

Linney,
As I understand SFC it should only replace missing or corrupted files; before I upgraded to pro I ran it many times without a CD being requested. I am the sole user of this machine, and am always logged on as administrator.

I have system restore turned on as I have had occasion to use it in the past. My recollection (from years ago) is that it was differential, only storing small amounts on each occasion. I am able to see the folder System Volume Information, but unable to view the contents The folder is shown as empty.

My system restore seems to be working now, but has recently lost all points before today--strange, I had about 15 a few weeks ago and have done nothing to delete them. When I looked this morning, there was only one, yesterday, and when I created one today yesterday's was deleted. I have 2490MB reserved for restore, so it isn't a matter of no space (The C: drive is 80G with 34G free.) I did a test "restore" and it appeared to go normally.

None of the *.tmp is zero size--median is 39K, largest 13MB, and smallest 2.62KB.

Some of the files replaced are "admin.dll admin.exe admwprox.dll adsiis.dll author.dll author.exe certmap.ocx certwiz.ocx " in the order they were requested.

I have compared (using FC) the "bad" file with it's "good" replacenment and found no difference, which is probably why, on immediate re-try of SFC it is "replaced" again. I'm willing to clarify any questions, or if you want to go offline at bllhlms @ sbcglobal.net.

 

[linney]

Have you run ChkDsk on your machine to see if that turns up any errors? Right click your Drive icon/ Properties/ Tools/ Error Checking, try it with both checking boxes selected.

Your hard drive manufacturer will also have free diagnostic software to thoroughly check the condition of your drive.



After SFC all that is left to run before head for a clean install is a repair install, but only if you consider it necessary.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

Microsoft Windows XP System Restore
Bobbie Harder
Microsoft Corporation

http://msdn.microsoft.com/library/d...y/en-us/dnwxp/html/windowsxpsystemrestore.asp

 

[bullhlms]

Thanks, Linney.
Ran an uneventful chkdsk:

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 42 unused index entries from index $SII of file 0x9.
Cleaning up 42 unused index entries from index $SDH of file 0x9.
Cleaning up 42 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

50576368 KB total disk space.
14509484 KB in 101099 files.
58392 KB in 6236 indexes.
0 KB in bad sectors.
319808 KB in use by the system.
65536 KB occupied by the log file.
35688684 KB available on disk.

4096 bytes in each allocation unit.
12644092 total allocation units on disk.
8922171 allocation units available on disk.

Many seem to run repair installs casually. Are they really safe?

 

[linney]

Many seem to run repair installs casually. Are they really safe?"

The short answer is yes they are very safe to run. Do however read the warnings throughout and at the bottom of the article and take extra precautions if you are worried by backing up what you can't afford to lose.

 

[bullhlms]

FWIW: The chkdsk apparently deleted the *.tmp files--they are gone. Began another SFC and it immediately requested the first four files it had previously needed, so I aborted and am now running it with the CD.

 

[bullhlms]

SFC "created" 1057 (146MB)*.tmp files while running. 4 of them were "accessed" (old 640, 643, 6da, and 6df) along with 3 *.dll's (hwxcht, hwxjpn, and hwxkor) and netwlan5.sys.

 

[linney]

How to Remove Windows XP Service Pack 1 Folders

http://support.microsoft.com/default.aspx?scid=kb;en-us;329260&FR=1&PA=1&SD=HSCH

Probably applies to SP2 too.

Do you have any ServicePack files at this location %systemroot%\Servicepackfiles?

That folder contains files that are required when you add or remove optional Windows components. That folder is also used by Windows File Protection (WFP) to replace damaged or changed protected system files.

What have you at this location?
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion

Have a look at the Value for SourcePath and see what it says.

Check both locations mentioned and make sure (again) that there are no *.tmp files being inserted from somewhere.

 

[bullhlms]

Linney,
There is nothing at this location %systemroot%\Servicepackfiles. There is %systemroot%\SP2 which has a 266MB self extracting cabinet. There exists %systemroot%\windows\Servicepackfiles which is empty.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\sourcepath is e:\ (the location of my CD player)

A search of my whole machine including 3HD's and the CD turned up 9 64?.tmp files; 4 in old dllcache (where I had saved them), and 5 in dllcache. Two pair had the same name, but radically different sizes.

Do I want to remove service pack folders?

Thanks again.

 

[bullhlms]

Sorry about my misunderstanding, now cleared up , of %systemroot%. There are in %systemroot% about 100 folders (300MB) of the general form $uninstallKBnnnnnn$ where n is an Arabic digit. Some have a Q instead of the KB. They are mostly populated with *.dll files, one to several per folder, which a spot check revealed to also exist in a newer version in dllcache and system32. One (spot-checked) dll exists in 4 versions in 5 of these folders.

 

[linney]

$uninstallKBnnnnnn$ are uninstall files for installed Windows Updates, used by Windows, in case you ever want to uninstall faulty updates.

SourcePath on my machine points to the CD drive/ I386 folder.

"%systemroot%\SP2 which has a 266MB self extracting cabinet", sounds like a download of SP2 being stored there for some reason. My slipstreamed SP2 does not have this folder.

How to Remove Windows XP Service Pack 1 Folders

http://support.microsoft.com/default.aspx?scid=kb;en-us;329260&FR=1&PA=1&SD=HSCH

The above is the guide as to what is safe and not safe to remove. If you correctly slipstreamed SP2 and installed it clean, not as a repair or upgrade installation, you probably would have none of the mentioned folders anyway.

 

[bullhlms]

Thanks for the info on $uninstallKBnnnnnn$.
I changed the SourcePath pointer on my machine after verifying that is the location on CD, re-booted, and ran SFC----no change.
installed XPPROSP2 was installed as an upgrade to XPHOMESP2.
The folder Service Pack is empty. The other two referred to in the link are not in my %systemroot%.

 

[linney]

I am using the slipstreamed CD from which the XPPRO SP2 was installed."

"installed XPPROSP2 was installed as an upgrade to XPHOMESP2."

Can you clarify your situation, these two comments are a bit confusing.

Did you upgrade XP Home to XP Pro somewhere along the way. If as I assume you have XP Pro, does that include SP2 embedded, or did you make a slipstream CD of XP Pro, and is this the CD giving you trouble with SFC?

Perhaps the sort of thing you are seeing is a result of mis-matched versions. It would be a solution to clean install XP Pro (SP2), at least all the file versions would be correct. You can use any CD with an older operating system on it as a Qualifying Product, this enables you to install XP Pro as a clean install even if you only have an Upgrade version of Pro.

Otherwise as I said before you may have to live with your SFC problem.