Windows File Protection

[Zoofield]

Windows file protection pop up is much improved with 9.9.9 and so is Nlite hooyah!!!

As far as the insert CD dialog it only occurs once as apposed to every time with previous.

I’m curious how much more it would take to not have this dialog at all. I have 3 files that are added to dllcache.

usbstor.sys

mouclass.sys

i8042.sys

I achieved this by using at the command prompt “dir /b >>c:\nameOfile.txt”

Once before

Once after install of driver or simply USB device and reboot, then a diff with vim.

At the moment I have no way to monitor reg so hmmm.. don’t know what those changes are.

I am curious about what others have experienced seems very close to being resolved.

Ohh…. By the way with windows file protection enabled install is much much longer.. whoooooo

[rgreen83]

I know you meant close in you title as in "near" but i think maybe ppl will think you are requesting the thread be closed and not look into your thread.

[doberman.pk]

I get the insert cd dialogue every few boots now or when I install any new software from a cd.

[Synomenon]

This only happens with my nLited Windows XP Pro. w/ SP2 and it seems to only happen when I'm installing new hardware + drivers for the hardware. Is there any way to keep these annoying boxes from popping up? Is there an option in NLite to prevent this?

[Thinkster]

I'm wondering the same thing as with my previous custom XP build, I never got those WFP error pop ups...

[mkk]

You could simply disable file protection altogether if you never want to bump into it. I've only had it work against me anyway.

[maniaq]

maybe I;m wrong, but try to selest this, it should stop the WFP messeging.it no longer bugs me

[pinion]

I too have the same problem with WFP popping up everytime I need to perform a driver install. It happened first with just plugging in a USB thumb drive, something that doesn't even require a driver install per se (it should've already been included in Windows). And then again with Nvidia driver install for a Quadro 3400 and Intel drivers for PRO1000.

I used to create my own SP2-slipstream discs (manually) and never had problems with WFP. I stumbled upon nLite while searching for a list of all post-SP2 hotfixes for XP. I found RyanVM's hotfix pack website and that led me to nLite. Funny because I been to MSFN many times before for help when doing my own slipstream discs, never noticed nLite I guess. Anyway, I decided to use nLite since it would allow me to easily use RyanVM's hotfix pack and also integrate the Adaptec CERC 2s HostRAID and PRO1000 drivers onto the disc saving me the F6 during install and giving me immediate network access following setup. As I started using it I was impressed with the other things it could do. Maybe I got a little carried away with all the options it gave me but I KNOW nothing was removed that I'd need (I errored on the side of caution for those I wasn't sure about).

My question is, does anyone know WHY installations from nLite-created CDs exhibit these WFP warnings? Is it a specific action (e.g. removing components, tweaks, service modification, etc.) that is responsible for causing this? I would be happy to skip whatever is to blame if it would just let me create a CD (containing all the hotfixes from RyanVM's pack and my RAID/network drivers) which I could use to setup new systems without having to deal with the annoying WFP warnings. I don't want to disable WFP. I didn't modify anything on the 'General' tab except renaming the Administrator account.

If this is just a shortcoming of nLite, the CDs it creates will always have this problem, I will just return to making my slipstream CDs manually but could someone explain to me how I can integrate my drivers? I already know how to do RyanVM's update pack manually (it's on his site). Or is RyanVM's pack responsible for the WFP warnings? If this is the case I'll integrate the hotfixes manually one-by-one.

[Javaddiction]

I've got a similar issue. I created a a cd with the most recent hotfixes for the end of May using nLite (don't recall specific version, not 1.0 yet, but recent at the time). It was a pretty straight forward configuration: hotfixes, one or two customization options, strip some languages. Any modification to the original install at all was done from nLite. Installed it on my laptop without a hitch.

Everything seems to be running just as it should, but I am still plagued by the occasional "Windows File Protection" alert whenever I plug in my USB mouse, install a program with system libraries, etc. Actually using the CD to restore the "system" files doesn't seem to do much good and canceling doesn't really fix the problem either. I even got the alert several times when I was installing a few updates from Windows Update!!

any ideas on how to fix this on my running system, or reinstall with a specific config? (i'm not about to turn off WFP since security is an issue)

[nuhi]

If you applied usbport patch then rewrite usbport.sys with original in system32\drivers folder.

[aaron818]

I am getting the exact same problem. Doing a manual slipstream of SP2 and patches does not make XP behave this way.

I want to use Nlite sooooooooo bad but this is a deal breaker for me. I was hoping this issue was fixed with the newest version, nope

What really bugs me is that not everyone is having this issue.

[Davelicious]

I also facing the same problem here with nLite 1.0b1 & 1.0b2

No one found a solution yet?

Anyone tried installing xp with WFS disabled & enabling it after installation?

[koitsu]

If you applied usbport patch then rewrite usbport.sys with original in system32\drivers folder.

<{POST_SNAPBACK}>

And if we didn't?

There are those of us who use nLite to do NOTHING MORE than slipstream SP2 + add third-party drivers (Dell 2405FPW monitor profile, 3Com 3C940 NIC, and HP printer INFs). We do not apply or adjust ANY OTHER SETTINGS in nLite... yet we get WFP notifications.

Again, this is not a case of people picking wild-wacky-action-options -- this is an issue of nLite doing something it shouldn't be doing, and therefore inducing WFP.

This did not happen a couple versions back, which implies something is going on behind the scenes inside nLite. Please shed some light on this, and do not post "one-liners" asking us to start replacing random .sys files in \System32. :-)

Edited June 13, 2005 by koitsu

[koitsu]

I've begun to try and research this problem. I'll post to this thread with my findings, which for everyone's information, could be red herrings. nuhi will have to figure out what's really going on. (For those not familiar with this term in English, "red herring" means something that distracts or takes away focus from the real problem; people also use it to mean "false alarm").

The first thing I did was use nLite 1.0b2 to make an ISO of XP + slipstreamed SP2. Then I made another ISO of XP + slipstreamed SP2 + custom driver installation (but DID NOT add any drivers!). I then mounted each ISO, and took a directory listing using DIR /O:N /B /S, and saved the output to a file. Finally, I ran diff -ruN against each directory listing. Here's the results:

06/13/2005  09:10           161,950 sp2+emptydrivers.txt
06/13/2005  09:10           161,927 sp2.txt

D:\>diff -ruN sp2.txt sp2+emptydrivers.txt
--- sp2.txt     Mon Jun 13 09:10:36 2005
+++ sp2+emptydrivers.txt        Mon Jun 13 09:10:56 2005
@@ -4732,6 +4732,7 @@
 F:\I386\SYSRESTW.CH_
 F:\I386\SYSSETUP.DL_
 F:\I386\SYSSETUP.IN_
+F:\I386\SYSSETUPO.DL_
 F:\I386\SYSTEM.AD_
 F:\I386\SYSTEM.CH_
 F:\I386\SYSTEM.DR_

What this means is that nLite, when you choose "Integrate Drivers", adds a file to your XP installation called SYSSETUPO.DLL.

Again: remember, I did not add ANY DRIVERS. I just chose the "Integrate Drivers" option. :-)

I then looked on the host system (which was installed using nLite 1.0b1), and found the following:

06/05/2005  11:09           984,576 syssetup.dll
08/04/2004  00:56           984,576 syssetupo.dll

Now, despite these DLLs being the same size, they are *NOT* the same:

D:\>fc /b C:\windows\system32\syssetup.dll C:\windows\system32\syssetupo.dll
Comparing files C:\WINDOWS\SYSTEM32\syssetup.dll and C:\WINDOWS\SYSTEM32\SYSSETUPO.DLL
00000148: C5 1A
00000149: F7 92
00033694: 33 56
00033695: C0 56
00033696: EB 56
00033697: 29 56
0003393D: 33 8B
0003393E: C0 FF
0003393F: C2 55
00033940: 04 8B
00033941: 00 EC

Is this DLL the problem?

What I'm trying to figure out is if nLite is breaking Windows (re: WFP notifications) due to a) the driver integration part of nLite, or B) the slipstreaming process.

I'm going to try using AutoStreamer to slipstream SP2, and compare nLite's XP+SP2 slipstream ISO to AutoStreamer's XP+SP2 slipstream ISO.

Edited June 13, 2005 by koitsu

[koitsu]

Hmm, nope, the only differences between nLite and AutoStreamer for slipstreaming are that nLite chooses to leave boot.bin and boot.catalog on the CD.

(Sorry, I had to change my method of output in the .txt files between my last post and now; it seems DIR /O:N /S does not recursively sort directories alphabetically, as one would think. I had to use DIR /S /B /L | SORT...):

D:\>diff -ruN sp2_nlite.txt sp2_autostreamer.txt
--- sp2_nlite.txt       Mon Jun 13 10:03:02 2005
+++ sp2_autostreamer.txt        Mon Jun 13 10:03:18 2005
@@ -1,6 +1,4 @@
 f:\autorun.inf
-f:\boot.bin
-f:\boot.catalog
 f:\cmpnents
 f:\cmpnents\netfx
 f:\cmpnents\netfx\i386

So, the problem we're experiencing with WFP isn't related to the Slipstreaming process in nLite.