Windows File Protection is Broken

[Goldencat]

The Windows File Protection feature is broken on my computer. I was wondering if you could help me reenable this feature.

Background information:

It's my fault that it broke. I was screwing around with it extensively.

Originally I was attempting to delete a system file in a way that would make it never come back (as it normally would with Windows File Protection). I acheived the effect I wanted by deleting the file and immedietely overwriting its filename with a dummy file, then using cacls to restrict the computer's access to it. This worked, but after about six seconds, it produced an annoying "Windows File Protection" popup box with information saying something along the lines of "system files are corrupted", and it prompted me to insert my Windows XP install disc to fix the problem.

My mission then became to disable the Windows File Protection popup box from appearing whenever my file switching actions took place. I researched the Windows File Protection feature extensively. I tried editing a registry key under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon with the name "SFCDisable", but that had no effect upon the popup box. I switched SFCDisable back to it's original value (0), and researched some more.

I learned that the bulk of the Windows File Protection application was contained in three .dll files under the %systemroot%\system32 folder. The first is sfc.dll, which is 5kb and serves no purpose other than to call the other, more important files. I did not screw with sfc.dll. The second file is the main program behind Windows File Protection, sfc_os.dll. This file is 137kb, and presumably contains all the WFP functionality. The third file is sfcfiles.dll, which is a 1.5Mb file that contains a list of all the files that are to be protected under WFP.

Originally, I read about ways you can edit the dlls with a hexadecimal editor to disable WFP, but I couldn't find the strings that the research told me to look for, so I abandoned that idea.

I turned instead to attacking the sfc files with the same techniques that I had used to attack regular system files -- deleting them and replacing them with dummy files. First I tried attacking sfc_os.dll, but the file could not be deleted because it was currently in use by the computer. I then attacked sfcfiles.dll, which could be deleted and replaced. I can't recall if this solved the popup-box problem, because as soon as I replaced it, I had an immediate change of heart and attempted to get it back. I think I just deleted the dummy file and sfcfiles.dll replaced itself with the good file.

I thought I hadn't done any damage, until I was again screwing with system files, and to my surprise, the files were deleted permanently. Windows File Protection wasn't working.

-- End background information --

I need Windows File Protection to begin working again. Without it, my computer is in danger to forces other than myself. I tried using the command-line tool "Simple File Checker" to examine and correct corrupted system files, but when I typed in "sfc /SCANNOW" into my command prompt, I received the following error: "error 0x00006ba" RPC Server is unavailable".

I tried enabling rpc by typing into the command prompt "net start rpcss", but that came back with an error that rpc was already running. Uh-oh.

So I need your help in re-enabling my Windows File Protection service. Any help will be greatly appreciated. Thank you.

[Esquire]

Don't know if this is already too late, but there is a tool that allows WFP to be enabled/disabled (preferrably in Safe Mode)

TechConnect Magazine Windows File Protection Switcher 1.0

[McTavish]

Handy little app Esquire, I do it with XPlite but it’s nice to know of a free tool for the job.

Sorry I can’t help GoldenCat other than suggest a repair install. You should consider learning how to make and restore an image of your OS so you can restore without reinstalling. There is an excellent free imager available at the moment which probably won’t be free forever. Get it while you can. It comes included on the UBCD4Win, which is almost a must have anyway.

[Goldencat]

I got WFP to work again. I booted into safe mode and ran the program that Esquire reccomended to turn WFP off, restarted into regular mode, restarted into safe mode again, turned WFP back on, restarted again into regular windows mode, and tried deleting solitare. To my delight, it came right back, meaning that WFP was working again. Thanks for the help.

[MGadAllah]

Goldencat...I think it is the time to start think about a recovery tool