HI,

I'm trying to remive the ussles folders 'xerox' and 'microsoft frontpage' from the 'C.\Program Files' folder.

Disabling the SFC/WFP and removeing this folders works but as soon as i enable SFC/WFP again the folders are being new created by SFC/WFP.

Does anyone know what to modify to stop SFC/WFP from creating this folders?

Edited January 5, 201511 yr by Mike88

HI,

I'm trying to remive the ussles folders 'xerox' and 'microsoft frontpage' from the 'C.\Program Files' folder.

Disabling the SFC/WFP and removeing this folders works but as soon as i enable SFC/WFP again the folders are being new created by SFC/WFP.

Does anyone know what to modify to stop SFC/WFP from creating this folders?

You mean *like* removing the related files from SFC/WFP?

Here:

http://www.msfn.org/board/topic/172917-integrating-patched-system-files-without-wfp-problems/

 

jaclaz

Not quite, the 'xerox' and 'microsoft frontpage' are empty folders and if they get deleting then SFC/WFP will create this empty folders again.

To delete a protected file you only have to remove the file name from the layout.inf file but that doesn't for the protected folders.

Edited January 5, 201511 yr by Mike88

Hmmm:

http://www.msfn.org/board/topic/33081-remove-wfp-on-a-per-filedir-bases-wfp-still-on/

 

jaclaz

Interesting.

Do you also know a free tool to modify this "sfcfiles.dll" file? I google around but i didn't found a tool that opened this .dll file with readable text.

Edited January 6, 201511 yr by Mike88

Interesting.

Do you also know a free tool to modify this "sfcfiles.dll" file? I google around but i didn't found a tool that opened this .dll file with readable text.

You don't "open" a binary file with readable text (particularly as this .dll uses mainly Unicode for the characters).

But you may "peek" in it by extracting strings from it, like you know:

http://www.mcafee.com/it/downloads/free-tools/bintext.aspx

Still you will need a hex editor (or a hex capable patcher like the mentioned on the other thread gsar) to edit the file.

And then you will need to re-create the checksum, if I recall correctly.

 

jaclaz

Edited January 6, 201511 yr by jaclaz

If i would like to remove this lines below listed in the bintext.exe tool from the sfcfiles.dll file how would you do this?

000000097EE8   000066798CE8      0   %ProgramFiles%\Microsoft FrontPage\version3.0\bin\fp98sadm.exe000000097F80   000066798D80      0   %ProgramFiles%\Microsoft FrontPage\version3.0\bin\fp98swin.exe000000002600   000066703400      0   %ProgramFiles%\Microsoft FrontPage\version3.0\bin\fp98sadm.exe

I also find this lines with the XVI32 (Hex Editor) but i'm not sure if i should remove them or replace them with  "00", and if that's also all i have to do.

I'm not a pro in this kind of stuff more like a baby in diapers.

Edited January 6, 201511 yr by Mike88

I'm not a pro in this kind of stuff more like a baby in diapers. 

I would think that the initially given resource:

http://www.msfn.org/board/topic/172917-integrating-patched-system-files-without-wfp-problems/

is simple enough, now that it also contains a practical example, detailed verbally AND in Hex / gsar syntax

http://www.msfn.org/board/topic/172917-integrating-patched-system-files-without-wfp-problems/?p=1089478

What is the issue you are having with it?

 

Your mission, should you accept it, is to change in those lines:

%P

to

\(00)

 

or, if you prefer (in a Hex editor):

25005000

to

5C000000

 

Then (this is what I am not too sure about ) you need to recreate the checksum of sfcfiles.dll, or at least this is what ElTorqiro suggested: 

http://www.msfn.org/board/topic/98306-wfp-app-for-removing-individual-files-from-monitoring/

 

ModifyPE:

http://unattended.msfn.org/unattended.xp/view/web/16/#modpe

though nowadays pechecksum is advised:

http://www.msfn.org/board/topic/171814-posready-2009-updates-ported-to-windows-xp-sp3-enu/page-3#entry1078428

 

jaclaz

Thanks this is now worked without a problem.

Only sad that nLite has abandon this and only disabled the SFC/WFP when remove some components.

Edited January 7, 201511 yr by Mike88

Thanks this is now worked without a problem.

Good to have contributed to another happy bunny:

http://www.msfn.org/board/topic/128727-cant-access-repair-my-pc-option-via-f8-startup/?p=828512

Only sad that nLite has abandon this and only disabled the SFC/WFP when remove some components.

Well, with all due respect to your opinion, you have to understand how nlite is an "advanced" but "generic" tweaking/reducing/whatever tool, while people may have every kind of *needs* or *wishes* making them all happy through nlite would have further complicated the tool, the interface would have become more like a spreadsheet than anything else as you would have hundreds or thousands of possible chioices/settings.

jaclaz

The funny thing is that nLite had this already included but it was done with "00" instead with "\" but then it was completely removed.

And ElTorqiro removed his tool that checked the nLite WinXP source directory and added an "\" behind the file names path in the sfcfiles.dll file if a file name was not found in the nLite WinXP source directory.

Edited January 7, 201511 yr by Mike88