Re: System File Checker question

Wes,

What can I say?
I gave you a message saying "thanks for your help but I think I'm gonna give
in on this one", and you come back with more help and advice.
I have seen and read about ERUNT and NTREGOPT before, but was reluctant to
'mess about' in this area just in case the two weren't what they were made
out to be. And I suppose if I think about it, I was waiting for someone I
trusted to give me the good word.
Now I consider that you have just done that.
I'm not going to dive into this tonight (head is spinning and not only from
PC 'delights') and it may take me some short time to get to using these, but
believe me I will.
Thanks again for everything

dfrog

"Wesley Vogel" <123WVogel955@xxxxxxxxxxx> wrote in message
news:eT1l2nWUHHA.4744@xxxxxxxxxxxxxxxxxxxxxxx
Howdy dfrog,

Keep this in mind as an alternative. I do not use System Restore, I use
ERUNT.

Get both of these...

NTREGOPT NT Registry Optimizer
ERUNT The Emergency Recovery Utility NT
http://www.larshederer.homepage.t-online.de/erunt/

ERUNT
<quote>
Note: The "Export registry" function in Regedit is USELESS (!) to
make a complete backup of the registry. Neither does it export the whole
registry (for example, no information from the "SECURITY" hive is
saved), nor can the exported file be used later to replace the current
registry with the old one. Instead, if you re-import the file, it is
merged with the current registry, leaving you with an absolute mess of
old and new registry keys.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

NTREGOPT
<quote>
Similar to Windows 9x/Me, the registry files in an NT-based
system can become fragmented over time, occupying more space on your hard
disk than necessary and decreasing overall performance. You should
use the NTREGOPT utility regularly, but especially after installing
or uninstalling a program, to minimize the size of the registry files
and optimize registry access.

The program works by recreating each registry hive "from scratch",
thus removing any slack space that may be left from previously
modified or deleted keys.

Note that the program does NOT change the contents of the registry in
any way, nor does it physically defrag the registry files on the drive
(as the PageDefrag program from SysInternals does). The optimization
done by NTREGOPT is simply compacting the registry hives to the
minimum size possible.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt

Installing & Using ERUNT
http://www.silentrunners.org/sr_eruntuse.html

To see an illustrated registry restore procedure
http://www.silentrunners.org/sr_erdntuse.html

Take a complete registry backup using ERUNT
http://www.winxptutor.com/regback.htm

<quote>
Question: Should I disable Windows XP?s System Restore function when using
ERUNT?

Answer: Yes! Though System Restore backs up more than just the registry,
the
registry is essentially all you need to revert your system to a previous
state. Advantages of ERUNT over System Restore are that each restore
folder
is standalone and independent of the others, minimizing the risk of
restore
failures, and that a restore can easily be done from outside Windows.
Also,
ERUNT backups usually take up less hard drive space than System Restore's
restore points and may be individually deleted at any time. (Here is an
excellent site about System Restore in case you prefer to leave it
enabled.)
<quote>
ERUNT and NTREGOPT FAQ
http://www.larshederer.homepage.t-online.de/erunt/faq.htm

This is the excellent site about System Restore, mentioned above.
All About System Restore in WinXP
http://bertk.mvps.org/

But you're already familiar with Bert Kinney. ;-)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:53jtvkF1sgoinU1@xxxxxxxxxxxxxxxxxx,
dfrog <dfrog@xxxxxxxxxxxx> hunted and pecked:
Hi Wes,

Thanks again.
Unfortunately I have 'lots' of files that WFP cannot deal with in the
same
way, nmasnt.dll was just an example (happened to be the first one in the
queue)
I think that my fallback plan of wiping the drive and cloning my original
smaller drive onto this one (which is what I did quite some time ago) is
looking as though it should be 'forefront' plan rather than 'fallback'
plan. I still have my original problem of System Restore GUI not showing
(on this same drive) which Bert Kinney & Robear Dyer did their best on
but we couldn't fix that either.
I'm very grateful for your time and effort (now maybe I am like
'gratefulfrog' :-) )

Best regards

dfrog




"Wesley Vogel" <123WVogel955@xxxxxxxxxxx> wrote in message
news:e3MC2iTUHHA.1636@xxxxxxxxxxxxxxxxxxxxxxx
Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for
Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it
after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:53hjjjF1pgmejU1@xxxxxxxxxxxxxxxxxx,
dfrog <dfrog@xxxxxxxxxxxx> hunted and pecked:
Hi Wes,
Thank you some more :-)
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi
virus
but the scan did not identify any infection at all (I must admit to
being a bit disappointed at that stage - I really did want it to show
me
something wrong)
So, I'm still at the same stage, but still keen to beat this little
**&%$$**

dfrog (absolutely no connection to 'gratefulfrog') :-)



"Wesley Vogel" <123WVogel955@xxxxxxxxxxx> wrote in message
news:%23%236mJ65THHA.1000@xxxxxxxxxxxxxxxxxxxxxxx
Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004


http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like
the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:53ce5gF1rk77hU1@xxxxxxxxxxxxxxxxxx,
dfrog <dfrog@xxxxxxxxxxxx> hunted and pecked:
Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference, I still have the same System
Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do
I
misunderstand that bit?

but then, how would Windows know that this file could not be restored
to
its original valid version?

I have questions popping into my head that are confusing me, hope you
can help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when
it
became available.



"Wesley Vogel" <123WVogel955@xxxxxxxxxxx> wrote in message
news:OPw0GOuTHHA.3996@xxxxxxxxxxxxxxxxxxxxxxx
You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause
serious problems that may require you to reinstall your operating
system. Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key in
the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles
in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the
I386 directory because the SetUpAPI call attaches \I386 to the
sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
will look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that
included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:539r07F1rcschU1@xxxxxxxxxxxxxxxxxx,
dfrog <dfrog@xxxxxxxxxxxx> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was
restored to
the original version to maintain system stability. The file
version
of the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting
&
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if
I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer
regarding
a
System Restore issue which we were unable to nail down, but which
did take
me through their comprehensive 'cleansing proceedure'

dfrog



.

Relevant Pages

  • Re: System File Checker question
    ... Howdy dfrog, ... NTREGOPT NT Registry Optimizer ... Similar to Windows 9x/Me, the registry files in an NT-based ... Should I disable Windows XP’s System Restore function when using ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: XP Registry is Overwritten on Cold Boot
    ... allowing Windows to properly shutdown/restart? ... Weekly the PC resets via a simple power cycle (rather than shutdown). ... My problem is that when XP reboots the registry is reloaded to old values. ... I figure this has something to do with System Restore or Last Known Good ...
    (microsoft.public.windowsxp.basics)
  • Re: System restore Gone?
    ... Norton Anti-virus interferes with System restore. ... Registry cleaning programs are *all* snake oil. ... Running Windows XP professional Version 2002 Service Pack 3 ...
    (microsoft.public.windowsxp.general)
  • Re: Appls wont open until shutdown
    ... Tips Fixes & FAQs - System Restore opens to a blank window: ... How to Perform a Windows XP Repair Install by Michael Stevens MS-MVP: ... Bert Kinney MS-MVP Shell/User ... I suspect registry corruption of some kind. ...
    (microsoft.public.windowsxp.general)
  • Re: System File Checker question
    ... dfrog, sometimes I just can't shut up, as it were. ... NTREGOPT NT Registry Optimizer ... Similar to Windows 9x/Me, the registry files in an NT-based ... To see an illustrated registry restore procedure ...
    (microsoft.public.windowsxp.help_and_support)
Loading