Deleting protected folders

[RyanVM]

Part of my unattended install involves deleting the xerox, msn gaming zone, microsoft frontpage, and Online Services folders from Program Files. I've got the hacked SFC_OS.dll and applied the registry hack to disable WFP. From what I can tell, the directories get deleted, but when I enable WFP at the end of the batch file, they come back and don't allow me to delete them.

Does anybody know what other files or registry entries I have to delete in order to keep those folders from coming back? They have to be getting told from somewhere to re-appear.

Thanks!

[1chaoticadult]

A good start would be checking windows\system32\dllcache

[RyanVM]

I had the same thoughts. No directories there, though. It's also pertinant to note that the directories get restored, but no files within them do.

[GreenMachine]

I used to have this problem, but it seems to have gone away. I cannot delete the xerox directory, and I would assume it is in use by a fax or imaging service. ComPlus Applications, Online Services go and never come back. (Haven't tried gaming zone - need a little distraction). One thing I do that I have not seen others here do is to clear all the "stubpath" entries in the registry, such as this one:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"StubPath"=hex(2):00,00

These stubpaths are similar to "RunOnce" programs, and do such things as create the Internet Explorer and Outlook Express icons that show up in Start - Programs everytime a new user logs on, or setting up a default account in Outlook Express. Without these entries, the time it takes for a new user to log on the first time is much quicker (and cleaner)

In any event, it is not WFP related, as that does not prevent the deletion of files, that just puts 'em back (behind yo' back..)

[webmedic]

Hm interesting do you hae a list of these and what the do? I would not mind using some of them.

[GreenMachine]

A list of what I do is:

;Get rid of these silly stubs ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
"StubPath"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"StubPath"=hex(2):00,00

I doubt that even the kids that wrote them could tell you what they do ... Look in the registry and there are plenty of clues as to what is going on - it is mostly media player, OE, IE, NetMeeting, etc. I very scientifically found every key named StubPath in the registry, and clear it ...

Again, I am not sure this solves the original problem, but I know it has been a while since I had the directories return, and this is the first thing that comes to mind. These directories are not copied from somewhere, they are created, much as the Media Player and OE icons can sneak their way into the Quick Launch bar (gotta be in some .inf file somewhere, nudge nudge...)

[webmedic]

oh I see go hacking the inf files. Well i do know for a fact that some stuff can be disabled through inf files. Hm maybe at the least I can enable things so that we can uninstall them or keep them from installing in the first place. If anybody knows were to start looking and what inf files to go through I'll start hacking them up for you all. And if not it will just take a little longer to figure out were they are all hiding.

[RyanVM]

Thanks to the recently released SFC_OS.dll, I can at least remove Windows Media Player now

I delete the directory under program files and remove all the files from dllcache that are in there. Like I said before, the directory returns after I re-enable SFC, but with nothing in it

[webmedic]

which files do you delete exactly.

[RyanVM]

Here's all the code from the cleanup section of my batch file (at least the relevant parts):

ECHO Removing Windows Media Player...
REGEDIT /S %systemdrive%\Updates\sfc-off.reg
DEL %systemdrive%\WINDOWS\system32\dllcache\dlimport.exe
DEL %systemdrive%\WINDOWS\system32\dllcache\mplay32.exe
DEL %systemdrive%\WINDOWS\system32\dllcache\mplayer2.exe
DEL %systemdrive%\WINDOWS\system32\dllcache\setup_wm.exe
DEL %systemdrive%\WINDOWS\system32\dllcache\wmplayer.exe
DEL %systemdrive%\WINDOWS\system32\dllcache\np*.dll
rd /s/q "%systemdrive%\Program Files\Windows Media Player"
ECHO.
ECHO Cleaning Registry...
start /wait %systemdrive%\Updates\apps\DELUSER /Q aspnet
REGEDIT /S %systemdrive%\Updates\cleanup.reg
ECHO.
ECHO Cleaning Hard Drive...
DEL %systemroot%\kb*.*
DEL %systemroot%\q*.*
for /f %%i in ('dir %systemroot%\$Nt* /a:d /b /s') do rd /s /q "%%i"
rd /s/q "%systemdrive%\Program Files\xerox"
rd /s/q "%systemdrive%\Program Files\Online Services"
rd /s/q "%systemdrive%\Program Files\msn gaming zone"
rd /s/q "%systemdrive%\Program Files\microsoft frontpage"
REGEDIT /S %systemdrive%\Updates\sfc-on.reg