If it can find it's own seriel.sys it will replace it. In fact it is the
file operation that includes this name that triggers the change.
XP monitors a set list of files (I have a program that tells you what
exactly the files are). If there is a file operation involving that file
name, XP looks in the driver cache, and if not found there, the original
install media and copies it's original file over. If you copy XP's own
serial.sys into system32, this triggers a change notification and XP
replaces the file if it can. Even though it is replacing the same file with
an exact copy. It all depends on name not versions.
This feature cannot be turned off (unless you want to hook a computer up to
a external debugger - then you can turn off for next boot only).
So any file operation involving c:\windows\system32\serial.sys will trigger
a replace if it can find a file to replace it. If it can't find it, then if
a limited user is loged on it does nothing and if an admin is logged on it
pops up a dialog to browse to the install media (which you can turn off this
dialog for admins).
So if you can hide the original files from XP at the moment you make the
change it will try to fix and fail and give up trying.
If you ever run various repair facility then this will also trigger a fix.
XP and ME are not designed to have their system files replaced. ME is a
configurable list but XP it is not.
Make sure that serial.sys is not in c:\windows\system32\dllcache (first
place it looks) and that the path used to install XP doesn't have XP
available (eg remove the XP CD from the CDRom drive).
