Jump to content

Windows File Protection


Zoofield

Recommended Posts

  • 2 weeks later...

  • 2 months later...

Davelicious,

I realize it's been almost 10 months since your post, but I was wondering If you could help with the WFP popups. We're you able to get rid of the popups with your solution?

I edited winlogon file in the registry from 0 to 4 (enabled, with popups disabled). But how do you edit the SFC_OS.DLL file so that WFP is enabled but the popups are disabled. Also should I edit both the SFC_OS.DLL file in my system 32 folder and in my system 32/ dllcache folder?

Any help you (or anyone else) can give would be greatly appreciated. Thanks! :thumbup

I also still get WFP popups, when I insert any USB device it asks for the windows CD, but the strange thing is it doesn't recover any files?

And the usb device is working perfectly.

(Even if I cancel the popup window it works perfectly and the popup doesn't reappear)

So what I did now is suppressed the WFS popups:

System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Value Name: SFCDisable

Data Type: REG_DWORD (DWORD Value)

Value Data: 0 = enabled (default)

Value Data: 1 - disabled, prompt at boot to re-enable

Value Data: 2 - disabled at next boot only, no prompt to re-enable

Value Data: 4 - enabled, with popups disabled

Value Data: ffffff9d = disabled

NOTE:

Changing the SFCDisable parameter in the registry is not enough

(like most sites mentioning) at least not enough for XP+SP2.

This switch is disabled by "SFC_OS.DLL".

By changing "SFC_OS.DLL" it can be enabled again.

NOTE2:

if you want to imbed this into your installation CD (like I did)

don't forget to modify the checksum of "SFC_OS.DLL"

and modify the regkey "SFCDisable" in "HIVESFT.INF"

For XP+SP2 See:

http://www.wown.com/articles_tutorials/Twe...ection-SP2.html

For older versions

http://www.winguides.com/registry/display.php/790/

P.S. for all the monitoring freaks you can still check the WFS behaviour in the eventviewer

(nuhi: maybe suppressing the popups would be a nice extension for the patch section of nLite)

For those who want to know more about WFS & SFC check this link:

http://www.petri.co.il/what's_windows_..._protection.htm

Link to comment
Share on other sites

I usually only get a WFP pop up if I install third party drivers. If you click "Cancel", it's fine.

Yes, but it's annoying. And it happens too frequently for me.

Quite frankly there should have been a fix for this incorporated into nLite long before this. There should be an option to keep WFP enabled but stop the pop ups from occuring. You shouldn't have to disbale WFP or jump through hoops to supress the pop ups. Hundreds of people seem to be complaining about this, it's been over a year since this post started, and several versions have come out since then. When is the fix coming? :realmad:

Edited by joemama1969
Link to comment
Share on other sites

Yeah I would like to get this fixed but there are two things:

1. it's veeeerry complicated since you are asking to remove half windows and keep sfc, it requires some serious hacking and it's being done quite well, except those few files which popup every now and then

2. it's boring since I never use SFC, thus it's hard for me to concentrate on this problem while there are many others more critical.

Going to check it for next version, after rc8.

Link to comment
Share on other sites

After all, what's the advantage of having WFP? I know about several instances where viruses/worms have been able to completely bypass it (overwriting the Windows Update files to redirect the user to a website which allegedly would fix their present problems). If you want to remain 'safe' - as in the M$ terminology - don't use nlite at all.

Link to comment
Share on other sites

Two cents:

As per Nuhi's suggestion, I also disable SFC at install, re-enable post-install (after I'm through cleaning house with XPLite, but before I install a lot of apps), and have had no porblems by this method, which I've always used since the SFC tweak was available.

Link to comment
Share on other sites

Nuhi: if I were to have problems, what would they be? (I presume you were addressing me...?) It's just that I've always done this. Well, here's the latest variation in mthof: I'm using the update to Aserone's add-on, which covers both the SFC and the OOBE as hacks, so I'm not using the actual SFC disabling in the nLite interface (because it was producing similar problems that people were having above)--so it's a twin add-on hack. Yet, I leave the toggle for SFC in nLite Enabled ... Would you consider this incorrect? It's the only compromise I've come up with, for now, that seems to not produce errors.

Link to comment
Share on other sites

That is fine, you see I was stating that when you disable SFC in nlite it wont filter out removed files from protection while you are using addon nlite things that sfc is left enabled and thus it's ok.

Link to comment
Share on other sites

Windows File Protection Error Fix: I believe I've found a fix for the WFP popups, so you can keep WFP enabled, but kill those annoying pop up messages. :thumbup Try this fix and report your findings.

Props go to Davelicious because I never would have figured it out without reading all his posts!

1) Run Windows File Protection Switcher 1.0 patch and restart PC.

2) Run Regedit to edit the following registry key to 4 (enabled with pop ups disabled) and restart PC.

System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Value Name: SFCDisable

Data Type: REG_DWORD (DWORD Value)

Value Data: 0 = enabled (default)

Value Data: 1 - disabled, prompt at boot to re-enable

Value Data: 2 - disabled at next boot only, no prompt to re-enable

Value Data: 4 - enabled, with popups disabled

Value Data: ffffff9d = disabled

Windows File Protection Switcher:

http://fileforum.betanews.com/detail/Windo...er/1106499902/1

Yeah I would like to get this fixed but there are two things:

1. it's veeeerry complicated since you are asking to remove half windows and keep sfc, it requires some serious hacking and it's being done quite well, except those few files which popup every now and then

2. it's boring since I never use SFC, thus it's hard for me to concentrate on this problem while there are many others more critical.

Going to check it for next version, after rc8.

Sorry to jump all over you. THe WFP/SFC pop ups are the one major rant I have with nLite. If you could include this fix into nLite in future release it would be very much appreciated!

Otherwise it's a truly GREAT product. You have succeeded where Microsoft has failed. Microsoft wants users to run the Windows they think we should run. :no: You have allowed users to run the Windows we actually want to run. And for that I'm grateful! :D

After all, what's the advantage of having WFP? I know about several instances where viruses/worms have been able to completely bypass it (overwriting the Windows Update files to redirect the user to a website which allegedly would fix their present problems). If you want to remain 'safe' - as in the M$ terminology - don't use nlite at all.

That's like saying you know of several instances where people we're killed wearing seatbelts and by airbags in their cars. Does that mean you should remove your seatbelts and airbags in your car so you can be safer too? I don't think so.

To be sure WFP protection doesn't catch everything. Neither does any single Anti-Virus, Firewall, or Anti-Spyware software. But it's much better than no protection. Without WFP any piece of software, driver, or any user could delete any Windows file at any time without any restrictions. Sounds like a recipe for disaster.

IMHO nLite itself doesn't make your PC less safe at all. I think the modifications I've made in XP have made it safer by removing services I don't use which can be exploited: eg Outlook Express/Address Book, Windows Messenger/MSN Messenger, Remote Registry, Remote Assistance turned off, Netmeeting, System Restore. :whistle:

Edited by joemama1969
Link to comment
Share on other sites

  • 4 weeks later...

Hey thanks for your work on this, however, wouldnt having WFP enabled but popups disable be exactly the same as having WFP disable?

Because you are just automating the pressing of the cancel button, so essentialy you are automaticaly leaving any changed windows files?

Cheers

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...