"Windows File Protection" message question

  • Thread starter Thread starter elfa
  • Start date Start date
E

elfa

I'm running W2K with Service Pack 1. I get this message ONLY when I do a virus
scan with Norton AntiVirus Corporate Edition (ver 7.0)

It says that a windows file needs to be reinstalled and to put my CD with
Service Pack 1 in the CD. It makes no mention of the file name and I don't want
to interrupt the scan by following the instructions.

Should I be concerned? I have Service Pack 3 on order from MS as the downloaded
self extracting file won't self extract. I've tried many times.

thanks

elfa
 
Hi Elfa,

Try canceling all Windows File Protection prompts and then looking in Event Viewer
(eventvwr.msc), in the System Log, for the event message(s) with the Source: "Windows
File Protection". Double-click the event and read the description. It will tell you
what file replacement was attempted. Research the file and/or post back with the
information from Event Viewer (Event ID number and Description).

--
Carrie Garth, Microsoft MVP for Windows 2000
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- c x g

: "elfa" <elfa_member AT newsguy DOT com>
: Wrote in message : Sent: Friday, August 29, 2003 10:57 PM
: I'm running W2K with Service Pack 1. I get this message ONLY when I do a virus
: scan with Norton AntiVirus Corporate Edition (ver 7.0)
:
: It says that a windows file needs to be reinstalled and to put my CD with
: Service Pack 1 in the CD. It makes no mention of the file name and I don't want
: to interrupt the scan by following the instructions.
:
: Should I be concerned? I have Service Pack 3 on order from MS as the downloaded
: self extracting file won't self extract. I've tried many times.
:
: thanks
:
: elfa
 
God...there's got to be hundreds of them. They all basically read:

File replacement was attempted on the protected system file
c:\winnt\system32\systray.exe. This file was restored to the original version to
maintain system stability. The file version of the bad file is 5.0.2139.1, the
version of the system file is 5.0.2139.1.

or

The system file c:\winnt\system32\tapi32.dll could not be copied into the DLL
cache. The specific error code is 0x800b0100 [No signature was present in the
subject.
]. This file is necessary to maintain system stability.

or

The protected system file winrep.exe was not restored to its original, valid
version because the Windows File Protection restoration process was cancelled by
user interaction, user name is Administrator. The file version of the bad file
is 5.0.2195.22.

The 'events' have the numbers:

64000
64001
64004
64005
64021

Again, it only happens during a virus scan.

I have SP 3 on order from MS. Will this solve this mystery?

Any advice is appreciated.

elfa
 
Hi Elfa,

All I could find in regards to problems with Windows 2000 SP1, System File Checker,
and Norton is the following Microsoft Knowledge Base Article:

KB272734 - Scanning System32 for Virus Takes Longer After You Apply Windows 2000 SP1
http://support.microsoft.com/?scid=272734

Unfortunately, your symptoms do not match the symptoms in KB272734, so one can not be
certain. However, it is my guess that the cause is the same: "This problem can occur
because some verification operations are not being cached appropriately..."

According to KB272734 you can resolve the issue by installing the latest service
pack. So perhaps installing SP3 will help. And if not, you may want to try posting
to a forum for Norton users.

BTW, please follow all the Windows 2000 Service Pack Readme procedures the explain
how to install a service pack. In particular, the step that tells you to stop any
anti-virus software before installing the service pack.

--
Carrie Garth, Microsoft MVP for Windows 2000
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- c x g

: "elfa" <elfa_member AT newsguy DOT com>
: Wrote in message : Sent: Saturday, August 30, 2003 8:55 PM
:
: God...there's got to be hundreds of them. They all basically read:
:
: File replacement was attempted on the protected system file
: c:\winnt\system32\systray.exe. This file was restored to the original version to
: maintain system stability. The file version of the bad file is 5.0.2139.1, the
: version of the system file is 5.0.2139.1.
:
: or
:
: The system file c:\winnt\system32\tapi32.dll could not be copied into the DLL
: cache. The specific error code is 0x800b0100 [No signature was present in the
: subject.]. This file is necessary to maintain system stability.
:
: or
:
: The protected system file winrep.exe was not restored to its original, valid
: version because the Windows File Protection restoration process was cancelled by
: user interaction, user name is Administrator. The file version of the bad file
: is 5.0.2195.22.
:
: The 'events' have the numbers:
:
: 64000
: 64001
: 64004
: 64005
: 64021
:
: Again, it only happens during a virus scan.
:
: I have SP 3 on order from MS. Will this solve this mystery?
:
: Any advice is appreciated.

: > Carrie Garth (MVP)"
: > Wrote in message : > Sent: Saturday, August 30, 2003 6:38 AM
: >
: > Try canceling all Windows File Protection prompts and then looking in Event
: > Viewer (eventvwr.msc), in the System Log, for the event message(s) with the
: > Source: "Windows File Protection". Double-click the event and read the
: > description. It will tell you what file replacement was attempted. Research the
: > file and/or post back with the information from Event Viewer (Event ID number
: > and Description).

: >: "elfa" <elfa_member AT newsguy DOT com>
: >: Wrote in message : >: Sent: Friday, August 29, 2003 10:57 PM
: >:
: >: I'm running W2K with Service Pack 1. I get this message ONLY when I do a
: >: virus scan with Norton AntiVirus Corporate Edition (ver 7.0)
: >:
: >: It says that a windows file needs to be reinstalled and to put my CD with
: >: Service Pack 1 in the CD. It makes no mention of the file name and I don't
: > want to interrupt the scan by following the instructions.
: >:
: >: Should I be concerned? I have Service Pack 3 on order from MS as the
: > downloaded self extracting file won't self extract. I've tried many times.
 
Carrie....
Many thanks for your research. I should get the pack from MS in CD form in
several days.

thanks again....

elfa

Hi Elfa,

All I could find in regards to problems with Windows 2000 SP1, System File
Checker,
and Norton is the following Microsoft Knowledge Base Article:

KB272734 - Scanning System32 for Virus Takes Longer After You Apply Windows 2000
SP1
http://support.microsoft.com/?scid=272734

Unfortunately, your symptoms do not match the symptoms in KB272734, so one can
not be
certain. However, it is my guess that the cause is the same: "This problem can
occur
because some verification operations are not being cached appropriately..."

According to KB272734 you can resolve the issue by installing the latest service
pack. So perhaps installing SP3 will help. And if not, you may want to try
posting
to a forum for Norton users.

BTW, please follow all the Windows 2000 Service Pack Readme procedures the
explain
how to install a service pack. In particular, the step that tells you to stop
any
anti-virus software before installing the service pack.

--
Carrie Garth, Microsoft MVP for Windows 2000
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- c x g

: "elfa" <elfa_member AT newsguy DOT com>
: Wrote in message : Sent: Saturday, August 30, 2003 8:55 PM
:
: God...there's got to be hundreds of them. They all basically read:
:
: File replacement was attempted on the protected system file
: c:\winnt\system32\systray.exe. This file was restored to the original version
to
: maintain system stability. The file version of the bad file is 5.0.2139.1, the
: version of the system file is 5.0.2139.1.
:
: or
:
: The system file c:\winnt\system32\tapi32.dll could not be copied into the DLL
: cache. The specific error code is 0x800b0100 [No signature was present in the
: subject.]. This file is necessary to maintain system stability.
:
: or
:
: The protected system file winrep.exe was not restored to its original, valid
: version because the Windows File Protection restoration process was cancelled
by
: user interaction, user name is Administrator. The file version of the bad
file
: is 5.0.2195.22.
:
: The 'events' have the numbers:
:
: 64000
: 64001
: 64004
: 64005
: 64021
:
: Again, it only happens during a virus scan.
:
: I have SP 3 on order from MS. Will this solve this mystery?
:
: Any advice is appreciated.

: > Carrie Garth (MVP)"
: > Wrote in message : > Sent: Saturday, August 30, 2003 6:38 AM
: >
: > Try canceling all Windows File Protection prompts and then looking in Event
: > Viewer (eventvwr.msc), in the System Log, for the event message(s) with the
: > Source: "Windows File Protection". Double-click the event and read the
: > description. It will tell you what file replacement was attempted.
Research the
: > file and/or post back with the information from Event Viewer (Event ID
number
: > and Description).

: >: "elfa" <elfa_member AT newsguy DOT com>
: >: Wrote in message : >: Sent: Friday, August 29, 2003 10:57 PM
: >:
: >: I'm running W2K with Service Pack 1. I get this message ONLY when I do a
: >: virus scan with Norton AntiVirus Corporate Edition (ver 7.0)
: >:
: >: It says that a windows file needs to be reinstalled and to put my CD with
: >: Service Pack 1 in the CD. It makes no mention of the file name and I don't
: > want to interrupt the scan by following the instructions.
: >:
: >: Should I be concerned? I have Service Pack 3 on order from MS as the
: > downloaded self extracting file won't self extract. I've tried many times.
 
Back
Top