System File Checker question
in [Help and Support]
|
From: dfrog on 15 Feb 2007 15:26 Hi Wes, Thanks again. Unfortunately I have 'lots' of files that WFP cannot deal with in the same way, nmasnt.dll was just an example (happened to be the first one in the queue) I think that my fallback plan of wiping the drive and cloning my original smaller drive onto this one (which is what I did quite some time ago) is looking as though it should be 'forefront' plan rather than 'fallback' plan. I still have my original problem of System Restore GUI not showing (on this same drive) which Bert Kinney & Robear Dyer did their best on but we couldn't fix that either. I'm very grateful for your time and effort (now maybe I am like 'gratefulfrog' :-) ) Best regards dfrog "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message news:e3MC2iTUHHA.1636(a)TK2MSFTNGP02.phx.gbl... > Hi dfrog, > > I was hoping that a virus would be the problem myself. > > If nmasnt.dll is the only problem, I wouldn't even worry about it. > NetMeeting is ancient technology and Windows XP is the last version of > Microsoft Windows to include NetMeeting. Even the Microsoft Windows > NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for > Windows > 2000, Copyright 1999. > > See this to remove NetMeeting. > NetMeeting - Run, Remove and Reinstall > http://www.theeldergeek.com/netmeeting.htm > > You will still have C:\Program Files\NetMeeting and whatever is in it > after > removing NetMeeting. I have 21 items there. > > -- > Hope this helps. Let us know. > > Wes > MS-MVP Windows Shell/User > > In news:53hjjjF1pgmejU1(a)mid.individual.net, > dfrog <dfrog(a)lineone1.net> hunted and pecked: >> Hi Wes, >> Thank you some more :-) >> I've been to the EventID site & followed it through, it looked good and >> pertinent. >> I followed the Symantec instructions for the removal of Win32. pinfi >> virus >> but the scan did not identify any infection at all (I must admit to being >> a bit disappointed at that stage - I really did want it to show me >> something wrong) >> So, I'm still at the same stage, but still keen to beat this little >> **&%$$** >> >> dfrog (absolutely no connection to 'gratefulfrog') :-) >> >> >> >> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >> news:%23%236mJ65THHA.1000(a)TK2MSFTNGP05.phx.gbl... >>> Hi dfrog, >>> >>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>> and >>>> re-ran SFC but it made no difference >>> >>> Case does not matter. >>> >>>> Can there be a reason why System Event Viewer should report:- >>> >>> See the link. >>> >>> Event Source: Windows File Protection >>> Event ID: 64004 >>> > http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1 >>> >>> Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to >>> windows 2000. >>> >>> And I am not suggesting that you subscribe to EventID.Net. I am not >>> subscribed, but they occasionally have info where MS does not, like the >>> Event 64004, for example. >>> >>> -- >>> Hope this helps. Let us know. >>> >>> Wes >>> MS-MVP Windows Shell/User >>> >>> In news:53ce5gF1rk77hU1(a)mid.individual.net, >>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>> Thanks Wes, >>>> >>>> I followed your points 1 - 5 exactly & found that the Value Data for >>>> ServicePackSourcePath at that location is already >>>> C:\windows\ServicePackFiles. >>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>> and >>>> re-ran SFC but it made no difference, I still have the same System >>>> Event >>>> Viewer results as before. >>>> So, if this Value is correct and indeed SFC is using >>>> C:\Windows\ServicePackFiles\I386, does this mean that these files are >>>> corrupted? >>>> Can there be a reason why System Event Viewer should report:- >>>> >>>> ********** >>>> Event Type: Information >>>> Event Source: Windows File Protection >>>> Event Category: None >>>> Event ID: 64004 >>>> Date: 13/02/2007 >>>> Time: 00:00:54 >>>> User: N/A >>>> Computer: ************ >>>> Description: >>>> The protected system file c:\program files\netmeeting\nmasnt.dll could >>>> not >>>> be restored to its original, valid version. The file version of the bad >>>> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element >>>> not found.]. >>>> >>>> For more information, see Help and Support Center at >>>> http://go.microsoft.com/fwlink/events.asp. >>>> ************* >>>> >>>> where [Element not found] refers to nmasnt.dll not being found in >>>> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I >>>> misunderstand that bit? >>>> >>>> but then, how would Windows know that this file could not be restored >>>> to >>>> its original valid version? >>>> >>>> I have questions popping into my head that are confusing me, hope you >>>> can help some more. >>>> >>>> dfrog >>>> >>>> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it >>>> became available. >>>> >>>> >>>> >>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>>> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl... >>>>> You have this folder >> C:\Windows\ServicePackFiles\i386 >>>>> >>>>> C:\Windows\ServicePackFiles\i386 is normally used instead of >>>>> C:\Windows\system32\dllcache >>>>> for Windows File Protection if the folder exists. >>>>> >>>>> C:\Windows\ServicePackFiles\i386 contains the most recently updated >>>>> service >>>>> pack files. >>>>> >>>>> Make sure that ServicePackSourcePath points to >>>>> C:\Windows\ServicePackFiles >>>>> >>>>> WARNING: If you use Registry Editor incorrectly, you may cause serious >>>>> problems that may require you to reinstall your operating system. >>>>> Microsoft >>>>> cannot guarantee that you can solve problems that result from using >>>>> Registry >>>>> Editor incorrectly. Use Registry Editor at your own risk. >>>>> >>>>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type: >>>>> regedit >>>>>> Click OK. >>>>> 2. Locate the ServicePackSourcePath value under the following key in >>>>> the registry: >>>>> >>>>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup >>>>> >>>>> 3. Double-click the ServicePackSourcePath value. >>>>> 4. Enter the new location of the files C:\Windows\ServicePackFiles >>>>> in >>>>> the Value Data box and click OK. >>>>> 5. Close the Registry Editor. >>>>> >>>>> The ServicePackSourcePath value must point to one level above the I386 >>>>> directory because the SetUpAPI call attaches \I386 to the sourcepath. >>>>> >>>>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe >>>>> will look for C:\Windows\system32\dllcache. >>>>> >>>>> C:\Windows\ServicePackFiles\i386 folder exists if the following >>>>> conditions are >>>>> true: >>>>> * You installed Windows XP SP2 from a Windows XP SP2 CD that included >>>>> SP2 >>>>> as >>>>> part of the base installation. >>>>> * You downloaded and installed Windows XP SP2 from the Microsoft Web >>>>> site. >>>>> * Windows XP SP2 was included with the computer. >>>>> from... >>>>> http://support.microsoft.com/kb/916261 >>>>> >>>>> -- >>>>> Hope this helps. Let us know. >>>>> >>>>> Wes >>>>> MS-MVP Windows Shell/User >>>>> >>>>> In news:539r07F1rcschU1(a)mid.individual.net, >>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>>> Compaq Presario >>>>>> >>>>>> Win XP Home - SP2 - all critical updates. >>>>>> >>>>>> I am unable to find the implications of the following and would >>>>>> appreciate >>>>>> some help:- >>>>>> >>>>>> Having run sfc /scannow, >>>>>> >>>>>> System Event Viewer gives me this >>>>>>>> >>>>>> >>>>>> Event Type: Information >>>>>> Event Source: Windows File Protection >>>>>> Event Category: None >>>>>> Event ID: 64020 >>>>>> Date: 11/02/2007 >>>>>> Time: 20:46:56 >>>>>> User: N/A >>>>>> Computer: ************ >>>>>> Description: >>>>>> Windows File Protection scan found that the system file c:\program >>>>>> files\netmeeting\nmasnt.dll has a bad signature. This file was >>>>>> restored to >>>>>> the original version to maintain system stability. The file version >>>>>> of the system file is 5.1.2600.2180. >>>>>> >>>>>> For more information, see Help and Support Center at >>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>> >>>>>> >>>>>> Followed immediately by this >>>>>>>>>>>>>> >>>>>> >>>>>> >>>>>> Event Type: Information >>>>>> Event Source: Windows File Protection >>>>>> Event Category: None >>>>>> Event ID: 64004 >>>>>> Date: 11/02/2007 >>>>>> Time: 20:46:56 >>>>>> User: N/A >>>>>> Computer: ************ >>>>>> Description: >>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll >>>>>> could >>>>>> not >>>>>> be restored to its original, valid version. The file version of the >>>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490 >>>>>> [Element not found.]. >>>>>> >>>>>> For more information, see Help and Support Center at >>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>> >>>>>> >>>>>> and similar results for many other files. >>>>>> >>>>>> >>>>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting & >>>>>> C:\Windows\ Service Pack Files\i386 >>>>>> >>>>>> I find this on Microsoft site >> >>>>>> >>>>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or >>>>>> unusable, >>>>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the >>>>>> contents >>>>>> of the Dllcache directory." which makes me (novice) think, that if I >>>>>> run >>>>>> 'sfc /scannow' it will repair the contents of Dllcache directory. >>>>>> >>>>>> I've already had much help from Bert Kinney & Robear Dyer regarding >>>>>> a >>>>>> System Restore issue which we were unable to nail down, but which did >>>>>> take >>>>>> me through their comprehensive 'cleansing proceedure' >>>>>> >>>>>> dfrog >
From: Wesley Vogel on 15 Feb 2007 20:30 Howdy dfrog, Keep this in mind as an alternative. I do not use System Restore, I use ERUNT. Get both of these... NTREGOPT NT Registry Optimizer ERUNT The Emergency Recovery Utility NT http://www.larshederer.homepage.t-online.de/erunt/ ERUNT <quote> Note: The "Export registry" function in Regedit is USELESS (!) to make a complete backup of the registry. Neither does it export the whole registry (for example, no information from the "SECURITY" hive is saved), nor can the exported file be used later to replace the current registry with the old one. Instead, if you re-import the file, it is merged with the current registry, leaving you with an absolute mess of old and new registry keys. <quote> http://www.larshederer.homepage.t-online.de/erunt/erunt.txt NTREGOPT <quote> Similar to Windows 9x/Me, the registry files in an NT-based system can become fragmented over time, occupying more space on your hard disk than necessary and decreasing overall performance. You should use the NTREGOPT utility regularly, but especially after installing or uninstalling a program, to minimize the size of the registry files and optimize registry access. The program works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. Note that the program does NOT change the contents of the registry in any way, nor does it physically defrag the registry files on the drive (as the PageDefrag program from SysInternals does). The optimization done by NTREGOPT is simply compacting the registry hives to the minimum size possible. <quote> http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt Installing & Using ERUNT http://www.silentrunners.org/sr_eruntuse.html To see an illustrated registry restore procedure http://www.silentrunners.org/sr_erdntuse.html Take a complete registry backup using ERUNT http://www.winxptutor.com/regback.htm <quote> Question: Should I disable Windows XP�s System Restore function when using ERUNT? Answer: Yes! Though System Restore backs up more than just the registry, the registry is essentially all you need to revert your system to a previous state. Advantages of ERUNT over System Restore are that each restore folder is standalone and independent of the others, minimizing the risk of restore failures, and that a restore can easily be done from outside Windows. Also, ERUNT backups usually take up less hard drive space than System Restore's restore points and may be individually deleted at any time. (Here is an excellent site about System Restore in case you prefer to leave it enabled.) <quote> ERUNT and NTREGOPT FAQ http://www.larshederer.homepage.t-online.de/erunt/faq.htm This is the excellent site about System Restore, mentioned above. All About System Restore in WinXP http://bertk.mvps.org/ But you're already familiar with Bert Kinney. ;-) -- Hope this helps. Let us know. Wes MS-MVP Windows Shell/User In news:53jtvkF1sgoinU1(a)mid.individual.net, dfrog <dfrog(a)lineone1.net> hunted and pecked: > Hi Wes, > > Thanks again. > Unfortunately I have 'lots' of files that WFP cannot deal with in the same > way, nmasnt.dll was just an example (happened to be the first one in the > queue) > I think that my fallback plan of wiping the drive and cloning my original > smaller drive onto this one (which is what I did quite some time ago) is > looking as though it should be 'forefront' plan rather than 'fallback' > plan. I still have my original problem of System Restore GUI not showing > (on this same drive) which Bert Kinney & Robear Dyer did their best on > but we couldn't fix that either. > I'm very grateful for your time and effort (now maybe I am like > 'gratefulfrog' :-) ) > > Best regards > > dfrog > > > > > "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message > news:e3MC2iTUHHA.1636(a)TK2MSFTNGP02.phx.gbl... >> Hi dfrog, >> >> I was hoping that a virus would be the problem myself. >> >> If nmasnt.dll is the only problem, I wouldn't even worry about it. >> NetMeeting is ancient technology and Windows XP is the last version of >> Microsoft Windows to include NetMeeting. Even the Microsoft Windows >> NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for >> Windows >> 2000, Copyright 1999. >> >> See this to remove NetMeeting. >> NetMeeting - Run, Remove and Reinstall >> http://www.theeldergeek.com/netmeeting.htm >> >> You will still have C:\Program Files\NetMeeting and whatever is in it >> after >> removing NetMeeting. I have 21 items there. >> >> -- >> Hope this helps. Let us know. >> >> Wes >> MS-MVP Windows Shell/User >> >> In news:53hjjjF1pgmejU1(a)mid.individual.net, >> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>> Hi Wes, >>> Thank you some more :-) >>> I've been to the EventID site & followed it through, it looked good and >>> pertinent. >>> I followed the Symantec instructions for the removal of Win32. pinfi >>> virus >>> but the scan did not identify any infection at all (I must admit to >>> being a bit disappointed at that stage - I really did want it to show me >>> something wrong) >>> So, I'm still at the same stage, but still keen to beat this little >>> **&%$$** >>> >>> dfrog (absolutely no connection to 'gratefulfrog') :-) >>> >>> >>> >>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>> news:%23%236mJ65THHA.1000(a)TK2MSFTNGP05.phx.gbl... >>>> Hi dfrog, >>>> >>>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>>> and >>>>> re-ran SFC but it made no difference >>>> >>>> Case does not matter. >>>> >>>>> Can there be a reason why System Event Viewer should report:- >>>> >>>> See the link. >>>> >>>> Event Source: Windows File Protection >>>> Event ID: 64004 >>>> >> http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1 >>>> >>>> Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to >>>> windows 2000. >>>> >>>> And I am not suggesting that you subscribe to EventID.Net. I am not >>>> subscribed, but they occasionally have info where MS does not, like the >>>> Event 64004, for example. >>>> >>>> -- >>>> Hope this helps. Let us know. >>>> >>>> Wes >>>> MS-MVP Windows Shell/User >>>> >>>> In news:53ce5gF1rk77hU1(a)mid.individual.net, >>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>> Thanks Wes, >>>>> >>>>> I followed your points 1 - 5 exactly & found that the Value Data for >>>>> ServicePackSourcePath at that location is already >>>>> C:\windows\ServicePackFiles. >>>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>>> and >>>>> re-ran SFC but it made no difference, I still have the same System >>>>> Event >>>>> Viewer results as before. >>>>> So, if this Value is correct and indeed SFC is using >>>>> C:\Windows\ServicePackFiles\I386, does this mean that these files are >>>>> corrupted? >>>>> Can there be a reason why System Event Viewer should report:- >>>>> >>>>> ********** >>>>> Event Type: Information >>>>> Event Source: Windows File Protection >>>>> Event Category: None >>>>> Event ID: 64004 >>>>> Date: 13/02/2007 >>>>> Time: 00:00:54 >>>>> User: N/A >>>>> Computer: ************ >>>>> Description: >>>>> The protected system file c:\program files\netmeeting\nmasnt.dll could >>>>> not >>>>> be restored to its original, valid version. The file version of the >>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490 >>>>> [Element not found.]. >>>>> >>>>> For more information, see Help and Support Center at >>>>> http://go.microsoft.com/fwlink/events.asp. >>>>> ************* >>>>> >>>>> where [Element not found] refers to nmasnt.dll not being found in >>>>> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I >>>>> misunderstand that bit? >>>>> >>>>> but then, how would Windows know that this file could not be restored >>>>> to >>>>> its original valid version? >>>>> >>>>> I have questions popping into my head that are confusing me, hope you >>>>> can help some more. >>>>> >>>>> dfrog >>>>> >>>>> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it >>>>> became available. >>>>> >>>>> >>>>> >>>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>>>> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl... >>>>>> You have this folder >> C:\Windows\ServicePackFiles\i386 >>>>>> >>>>>> C:\Windows\ServicePackFiles\i386 is normally used instead of >>>>>> C:\Windows\system32\dllcache >>>>>> for Windows File Protection if the folder exists. >>>>>> >>>>>> C:\Windows\ServicePackFiles\i386 contains the most recently updated >>>>>> service >>>>>> pack files. >>>>>> >>>>>> Make sure that ServicePackSourcePath points to >>>>>> C:\Windows\ServicePackFiles >>>>>> >>>>>> WARNING: If you use Registry Editor incorrectly, you may cause >>>>>> serious problems that may require you to reinstall your operating >>>>>> system. Microsoft >>>>>> cannot guarantee that you can solve problems that result from using >>>>>> Registry >>>>>> Editor incorrectly. Use Registry Editor at your own risk. >>>>>> >>>>>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type: >>>>>> regedit >>>>>>> Click OK. >>>>>> 2. Locate the ServicePackSourcePath value under the following key in >>>>>> the registry: >>>>>> >>>>>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup >>>>>> >>>>>> 3. Double-click the ServicePackSourcePath value. >>>>>> 4. Enter the new location of the files C:\Windows\ServicePackFiles >>>>>> in >>>>>> the Value Data box and click OK. >>>>>> 5. Close the Registry Editor. >>>>>> >>>>>> The ServicePackSourcePath value must point to one level above the >>>>>> I386 directory because the SetUpAPI call attaches \I386 to the >>>>>> sourcepath. >>>>>> >>>>>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe >>>>>> will look for C:\Windows\system32\dllcache. >>>>>> >>>>>> C:\Windows\ServicePackFiles\i386 folder exists if the following >>>>>> conditions are >>>>>> true: >>>>>> * You installed Windows XP SP2 from a Windows XP SP2 CD that included >>>>>> SP2 >>>>>> as >>>>>> part of the base installation. >>>>>> * You downloaded and installed Windows XP SP2 from the Microsoft Web >>>>>> site. >>>>>> * Windows XP SP2 was included with the computer. >>>>>> from... >>>>>> http://support.microsoft.com/kb/916261 >>>>>> >>>>>> -- >>>>>> Hope this helps. Let us know. >>>>>> >>>>>> Wes >>>>>> MS-MVP Windows Shell/User >>>>>> >>>>>> In news:539r07F1rcschU1(a)mid.individual.net, >>>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>>>> Compaq Presario >>>>>>> >>>>>>> Win XP Home - SP2 - all critical updates. >>>>>>> >>>>>>> I am unable to find the implications of the following and would >>>>>>> appreciate >>>>>>> some help:- >>>>>>> >>>>>>> Having run sfc /scannow, >>>>>>> >>>>>>> System Event Viewer gives me this >>>>>>>> >>>>>>> >>>>>>> Event Type: Information >>>>>>> Event Source: Windows File Protection >>>>>>> Event Category: None >>>>>>> Event ID: 64020 >>>>>>> Date: 11/02/2007 >>>>>>> Time: 20:46:56 >>>>>>> User: N/A >>>>>>> Computer: ************ >>>>>>> Description: >>>>>>> Windows File Protection scan found that the system file c:\program >>>>>>> files\netmeeting\nmasnt.dll has a bad signature. This file was >>>>>>> restored to >>>>>>> the original version to maintain system stability. The file version >>>>>>> of the system file is 5.1.2600.2180. >>>>>>> >>>>>>> For more information, see Help and Support Center at >>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>> >>>>>>> >>>>>>> Followed immediately by this >>>>>>>>>>>>>> >>>>>>> >>>>>>> >>>>>>> Event Type: Information >>>>>>> Event Source: Windows File Protection >>>>>>> Event Category: None >>>>>>> Event ID: 64004 >>>>>>> Date: 11/02/2007 >>>>>>> Time: 20:46:56 >>>>>>> User: N/A >>>>>>> Computer: ************ >>>>>>> Description: >>>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll >>>>>>> could >>>>>>> not >>>>>>> be restored to its original, valid version. The file version of the >>>>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490 >>>>>>> [Element not found.]. >>>>>>> >>>>>>> For more information, see Help and Support Center at >>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>> >>>>>>> >>>>>>> and similar results for many other files. >>>>>>> >>>>>>> >>>>>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting & >>>>>>> C:\Windows\ Service Pack Files\i386 >>>>>>> >>>>>>> I find this on Microsoft site >> >>>>>>> >>>>>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or >>>>>>> unusable, >>>>>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the >>>>>>> contents >>>>>>> of the Dllcache directory." which makes me (novice) think, that if I >>>>>>> run >>>>>>> 'sfc /scannow' it will repair the contents of Dllcache directory. >>>>>>> >>>>>>> I've already had much help from Bert Kinney & Robear Dyer regarding >>>>>>> a >>>>>>> System Restore issue which we were unable to nail down, but which >>>>>>> did take >>>>>>> me through their comprehensive 'cleansing proceedure' >>>>>>> >>>>>>> dfrog
From: dfrog on 16 Feb 2007 14:16 Wes, What can I say? I gave you a message saying "thanks for your help but I think I'm gonna give in on this one", and you come back with more help and advice. I have seen and read about ERUNT and NTREGOPT before, but was reluctant to 'mess about' in this area just in case the two weren't what they were made out to be. And I suppose if I think about it, I was waiting for someone I trusted to give me the good word. Now I consider that you have just done that. I'm not going to dive into this tonight (head is spinning and not only from PC 'delights') and it may take me some short time to get to using these, but believe me I will. Thanks again for everything dfrog "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message news:eT1l2nWUHHA.4744(a)TK2MSFTNGP02.phx.gbl... > Howdy dfrog, > > Keep this in mind as an alternative. I do not use System Restore, I use > ERUNT. > > Get both of these... > > NTREGOPT NT Registry Optimizer > ERUNT The Emergency Recovery Utility NT > http://www.larshederer.homepage.t-online.de/erunt/ > > ERUNT > <quote> > Note: The "Export registry" function in Regedit is USELESS (!) to > make a complete backup of the registry. Neither does it export the whole > registry (for example, no information from the "SECURITY" hive is > saved), nor can the exported file be used later to replace the current > registry with the old one. Instead, if you re-import the file, it is > merged with the current registry, leaving you with an absolute mess of > old and new registry keys. > <quote> > http://www.larshederer.homepage.t-online.de/erunt/erunt.txt > > NTREGOPT > <quote> > Similar to Windows 9x/Me, the registry files in an NT-based > system can become fragmented over time, occupying more space on your hard > disk than necessary and decreasing overall performance. You should > use the NTREGOPT utility regularly, but especially after installing > or uninstalling a program, to minimize the size of the registry files > and optimize registry access. > > The program works by recreating each registry hive "from scratch", > thus removing any slack space that may be left from previously > modified or deleted keys. > > Note that the program does NOT change the contents of the registry in > any way, nor does it physically defrag the registry files on the drive > (as the PageDefrag program from SysInternals does). The optimization > done by NTREGOPT is simply compacting the registry hives to the > minimum size possible. > <quote> > http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt > > Installing & Using ERUNT > http://www.silentrunners.org/sr_eruntuse.html > > To see an illustrated registry restore procedure > http://www.silentrunners.org/sr_erdntuse.html > > Take a complete registry backup using ERUNT > http://www.winxptutor.com/regback.htm > > <quote> > Question: Should I disable Windows XP�s System Restore function when using > ERUNT? > > Answer: Yes! Though System Restore backs up more than just the registry, > the > registry is essentially all you need to revert your system to a previous > state. Advantages of ERUNT over System Restore are that each restore > folder > is standalone and independent of the others, minimizing the risk of > restore > failures, and that a restore can easily be done from outside Windows. > Also, > ERUNT backups usually take up less hard drive space than System Restore's > restore points and may be individually deleted at any time. (Here is an > excellent site about System Restore in case you prefer to leave it > enabled.) > <quote> > ERUNT and NTREGOPT FAQ > http://www.larshederer.homepage.t-online.de/erunt/faq.htm > > This is the excellent site about System Restore, mentioned above. > All About System Restore in WinXP > http://bertk.mvps.org/ > > But you're already familiar with Bert Kinney. ;-) > > -- > Hope this helps. Let us know. > > Wes > MS-MVP Windows Shell/User > > In news:53jtvkF1sgoinU1(a)mid.individual.net, > dfrog <dfrog(a)lineone1.net> hunted and pecked: >> Hi Wes, >> >> Thanks again. >> Unfortunately I have 'lots' of files that WFP cannot deal with in the >> same >> way, nmasnt.dll was just an example (happened to be the first one in the >> queue) >> I think that my fallback plan of wiping the drive and cloning my original >> smaller drive onto this one (which is what I did quite some time ago) is >> looking as though it should be 'forefront' plan rather than 'fallback' >> plan. I still have my original problem of System Restore GUI not showing >> (on this same drive) which Bert Kinney & Robear Dyer did their best on >> but we couldn't fix that either. >> I'm very grateful for your time and effort (now maybe I am like >> 'gratefulfrog' :-) ) >> >> Best regards >> >> dfrog >> >> >> >> >> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >> news:e3MC2iTUHHA.1636(a)TK2MSFTNGP02.phx.gbl... >>> Hi dfrog, >>> >>> I was hoping that a virus would be the problem myself. >>> >>> If nmasnt.dll is the only problem, I wouldn't even worry about it. >>> NetMeeting is ancient technology and Windows XP is the last version of >>> Microsoft Windows to include NetMeeting. Even the Microsoft Windows >>> NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for >>> Windows >>> 2000, Copyright 1999. >>> >>> See this to remove NetMeeting. >>> NetMeeting - Run, Remove and Reinstall >>> http://www.theeldergeek.com/netmeeting.htm >>> >>> You will still have C:\Program Files\NetMeeting and whatever is in it >>> after >>> removing NetMeeting. I have 21 items there. >>> >>> -- >>> Hope this helps. Let us know. >>> >>> Wes >>> MS-MVP Windows Shell/User >>> >>> In news:53hjjjF1pgmejU1(a)mid.individual.net, >>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>> Hi Wes, >>>> Thank you some more :-) >>>> I've been to the EventID site & followed it through, it looked good and >>>> pertinent. >>>> I followed the Symantec instructions for the removal of Win32. pinfi >>>> virus >>>> but the scan did not identify any infection at all (I must admit to >>>> being a bit disappointed at that stage - I really did want it to show >>>> me >>>> something wrong) >>>> So, I'm still at the same stage, but still keen to beat this little >>>> **&%$$** >>>> >>>> dfrog (absolutely no connection to 'gratefulfrog') :-) >>>> >>>> >>>> >>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>>> news:%23%236mJ65THHA.1000(a)TK2MSFTNGP05.phx.gbl... >>>>> Hi dfrog, >>>>> >>>>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>>>> and >>>>>> re-ran SFC but it made no difference >>>>> >>>>> Case does not matter. >>>>> >>>>>> Can there be a reason why System Event Viewer should report:- >>>>> >>>>> See the link. >>>>> >>>>> Event Source: Windows File Protection >>>>> Event ID: 64004 >>>>> >>> > http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1 >>>>> >>>>> Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to >>>>> windows 2000. >>>>> >>>>> And I am not suggesting that you subscribe to EventID.Net. I am not >>>>> subscribed, but they occasionally have info where MS does not, like >>>>> the >>>>> Event 64004, for example. >>>>> >>>>> -- >>>>> Hope this helps. Let us know. >>>>> >>>>> Wes >>>>> MS-MVP Windows Shell/User >>>>> >>>>> In news:53ce5gF1rk77hU1(a)mid.individual.net, >>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>>> Thanks Wes, >>>>>> >>>>>> I followed your points 1 - 5 exactly & found that the Value Data for >>>>>> ServicePackSourcePath at that location is already >>>>>> C:\windows\ServicePackFiles. >>>>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>>>> and >>>>>> re-ran SFC but it made no difference, I still have the same System >>>>>> Event >>>>>> Viewer results as before. >>>>>> So, if this Value is correct and indeed SFC is using >>>>>> C:\Windows\ServicePackFiles\I386, does this mean that these files are >>>>>> corrupted? >>>>>> Can there be a reason why System Event Viewer should report:- >>>>>> >>>>>> ********** >>>>>> Event Type: Information >>>>>> Event Source: Windows File Protection >>>>>> Event Category: None >>>>>> Event ID: 64004 >>>>>> Date: 13/02/2007 >>>>>> Time: 00:00:54 >>>>>> User: N/A >>>>>> Computer: ************ >>>>>> Description: >>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll >>>>>> could >>>>>> not >>>>>> be restored to its original, valid version. The file version of the >>>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490 >>>>>> [Element not found.]. >>>>>> >>>>>> For more information, see Help and Support Center at >>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>> ************* >>>>>> >>>>>> where [Element not found] refers to nmasnt.dll not being found in >>>>>> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do >>>>>> I >>>>>> misunderstand that bit? >>>>>> >>>>>> but then, how would Windows know that this file could not be restored >>>>>> to >>>>>> its original valid version? >>>>>> >>>>>> I have questions popping into my head that are confusing me, hope you >>>>>> can help some more. >>>>>> >>>>>> dfrog >>>>>> >>>>>> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when >>>>>> it >>>>>> became available. >>>>>> >>>>>> >>>>>> >>>>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>>>>> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl... >>>>>>> You have this folder >> C:\Windows\ServicePackFiles\i386 >>>>>>> >>>>>>> C:\Windows\ServicePackFiles\i386 is normally used instead of >>>>>>> C:\Windows\system32\dllcache >>>>>>> for Windows File Protection if the folder exists. >>>>>>> >>>>>>> C:\Windows\ServicePackFiles\i386 contains the most recently updated >>>>>>> service >>>>>>> pack files. >>>>>>> >>>>>>> Make sure that ServicePackSourcePath points to >>>>>>> C:\Windows\ServicePackFiles >>>>>>> >>>>>>> WARNING: If you use Registry Editor incorrectly, you may cause >>>>>>> serious problems that may require you to reinstall your operating >>>>>>> system. Microsoft >>>>>>> cannot guarantee that you can solve problems that result from using >>>>>>> Registry >>>>>>> Editor incorrectly. Use Registry Editor at your own risk. >>>>>>> >>>>>>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type: >>>>>>> regedit >>>>>>>> Click OK. >>>>>>> 2. Locate the ServicePackSourcePath value under the following key in >>>>>>> the registry: >>>>>>> >>>>>>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup >>>>>>> >>>>>>> 3. Double-click the ServicePackSourcePath value. >>>>>>> 4. Enter the new location of the files C:\Windows\ServicePackFiles >>>>>>> in >>>>>>> the Value Data box and click OK. >>>>>>> 5. Close the Registry Editor. >>>>>>> >>>>>>> The ServicePackSourcePath value must point to one level above the >>>>>>> I386 directory because the SetUpAPI call attaches \I386 to the >>>>>>> sourcepath. >>>>>>> >>>>>>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe >>>>>>> will look for C:\Windows\system32\dllcache. >>>>>>> >>>>>>> C:\Windows\ServicePackFiles\i386 folder exists if the following >>>>>>> conditions are >>>>>>> true: >>>>>>> * You installed Windows XP SP2 from a Windows XP SP2 CD that >>>>>>> included >>>>>>> SP2 >>>>>>> as >>>>>>> part of the base installation. >>>>>>> * You downloaded and installed Windows XP SP2 from the Microsoft Web >>>>>>> site. >>>>>>> * Windows XP SP2 was included with the computer. >>>>>>> from... >>>>>>> http://support.microsoft.com/kb/916261 >>>>>>> >>>>>>> -- >>>>>>> Hope this helps. Let us know. >>>>>>> >>>>>>> Wes >>>>>>> MS-MVP Windows Shell/User >>>>>>> >>>>>>> In news:539r07F1rcschU1(a)mid.individual.net, >>>>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>>>>> Compaq Presario >>>>>>>> >>>>>>>> Win XP Home - SP2 - all critical updates. >>>>>>>> >>>>>>>> I am unable to find the implications of the following and would >>>>>>>> appreciate >>>>>>>> some help:- >>>>>>>> >>>>>>>> Having run sfc /scannow, >>>>>>>> >>>>>>>> System Event Viewer gives me this >>>>>>>> >>>>>>>> >>>>>>>> Event Type: Information >>>>>>>> Event Source: Windows File Protection >>>>>>>> Event Category: None >>>>>>>> Event ID: 64020 >>>>>>>> Date: 11/02/2007 >>>>>>>> Time: 20:46:56 >>>>>>>> User: N/A >>>>>>>> Computer: ************ >>>>>>>> Description: >>>>>>>> Windows File Protection scan found that the system file c:\program >>>>>>>> files\netmeeting\nmasnt.dll has a bad signature. This file was >>>>>>>> restored to >>>>>>>> the original version to maintain system stability. The file >>>>>>>> version >>>>>>>> of the system file is 5.1.2600.2180. >>>>>>>> >>>>>>>> For more information, see Help and Support Center at >>>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>>> >>>>>>>> >>>>>>>> Followed immediately by this >>>>>>>>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Event Type: Information >>>>>>>> Event Source: Windows File Protection >>>>>>>> Event Category: None >>>>>>>> Event ID: 64004 >>>>>>>> Date: 11/02/2007 >>>>>>>> Time: 20:46:56 >>>>>>>> User: N/A >>>>>>>> Computer: ************ >>>>>>>> Description: >>>>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll >>>>>>>> could >>>>>>>> not >>>>>>>> be restored to its original, valid version. The file version of the >>>>>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490 >>>>>>>> [Element not found.]. >>>>>>>> >>>>>>>> For more information, see Help and Support Center at >>>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>>> >>>>>>>> >>>>>>>> and similar results for many other files. >>>>>>>> >>>>>>>> >>>>>>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting >>>>>>>> & >>>>>>>> C:\Windows\ Service Pack Files\i386 >>>>>>>> >>>>>>>> I find this on Microsoft site >> >>>>>>>> >>>>>>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or >>>>>>>> unusable, >>>>>>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the >>>>>>>> contents >>>>>>>> of the Dllcache directory." which makes me (novice) think, that if >>>>>>>> I >>>>>>>> run >>>>>>>> 'sfc /scannow' it will repair the contents of Dllcache directory. >>>>>>>> >>>>>>>> I've already had much help from Bert Kinney & Robear Dyer >>>>>>>> regarding >>>>>>>> a >>>>>>>> System Restore issue which we were unable to nail down, but which >>>>>>>> did take >>>>>>>> me through their comprehensive 'cleansing proceedure' >>>>>>>> >>>>>>>> dfrog >
From: Wesley Vogel on 16 Feb 2007 16:57
dfrog, sometimes I just can't shut up, as it were. ;-) Keep having fun. -- Hope this helps. Let us know. Wes MS-MVP Windows Shell/User In news:53me7mF1t3smvU1(a)mid.individual.net, dfrog <dfrog(a)lineone1.net> hunted and pecked: > Wes, > > What can I say? > I gave you a message saying "thanks for your help but I think I'm gonna > give in on this one", and you come back with more help and advice. > I have seen and read about ERUNT and NTREGOPT before, but was reluctant to > 'mess about' in this area just in case the two weren't what they were made > out to be. And I suppose if I think about it, I was waiting for someone I > trusted to give me the good word. > Now I consider that you have just done that. > I'm not going to dive into this tonight (head is spinning and not only > from PC 'delights') and it may take me some short time to get to using > these, but believe me I will. > Thanks again for everything > > dfrog > > "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message > news:eT1l2nWUHHA.4744(a)TK2MSFTNGP02.phx.gbl... >> Howdy dfrog, >> >> Keep this in mind as an alternative. I do not use System Restore, I use >> ERUNT. >> >> Get both of these... >> >> NTREGOPT NT Registry Optimizer >> ERUNT The Emergency Recovery Utility NT >> http://www.larshederer.homepage.t-online.de/erunt/ >> >> ERUNT >> <quote> >> Note: The "Export registry" function in Regedit is USELESS (!) to >> make a complete backup of the registry. Neither does it export the whole >> registry (for example, no information from the "SECURITY" hive is >> saved), nor can the exported file be used later to replace the current >> registry with the old one. Instead, if you re-import the file, it is >> merged with the current registry, leaving you with an absolute mess of >> old and new registry keys. >> <quote> >> http://www.larshederer.homepage.t-online.de/erunt/erunt.txt >> >> NTREGOPT >> <quote> >> Similar to Windows 9x/Me, the registry files in an NT-based >> system can become fragmented over time, occupying more space on your hard >> disk than necessary and decreasing overall performance. You should >> use the NTREGOPT utility regularly, but especially after installing >> or uninstalling a program, to minimize the size of the registry files >> and optimize registry access. >> >> The program works by recreating each registry hive "from scratch", >> thus removing any slack space that may be left from previously >> modified or deleted keys. >> >> Note that the program does NOT change the contents of the registry in >> any way, nor does it physically defrag the registry files on the drive >> (as the PageDefrag program from SysInternals does). The optimization >> done by NTREGOPT is simply compacting the registry hives to the >> minimum size possible. >> <quote> >> http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt >> >> Installing & Using ERUNT >> http://www.silentrunners.org/sr_eruntuse.html >> >> To see an illustrated registry restore procedure >> http://www.silentrunners.org/sr_erdntuse.html >> >> Take a complete registry backup using ERUNT >> http://www.winxptutor.com/regback.htm >> >> <quote> >> Question: Should I disable Windows XP�s System Restore function when >> using ERUNT? >> >> Answer: Yes! Though System Restore backs up more than just the registry, >> the >> registry is essentially all you need to revert your system to a previous >> state. Advantages of ERUNT over System Restore are that each restore >> folder >> is standalone and independent of the others, minimizing the risk of >> restore >> failures, and that a restore can easily be done from outside Windows. >> Also, >> ERUNT backups usually take up less hard drive space than System Restore's >> restore points and may be individually deleted at any time. (Here is an >> excellent site about System Restore in case you prefer to leave it >> enabled.) >> <quote> >> ERUNT and NTREGOPT FAQ >> http://www.larshederer.homepage.t-online.de/erunt/faq.htm >> >> This is the excellent site about System Restore, mentioned above. >> All About System Restore in WinXP >> http://bertk.mvps.org/ >> >> But you're already familiar with Bert Kinney. ;-) >> >> -- >> Hope this helps. Let us know. >> >> Wes >> MS-MVP Windows Shell/User >> >> In news:53jtvkF1sgoinU1(a)mid.individual.net, >> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>> Hi Wes, >>> >>> Thanks again. >>> Unfortunately I have 'lots' of files that WFP cannot deal with in the >>> same >>> way, nmasnt.dll was just an example (happened to be the first one in the >>> queue) >>> I think that my fallback plan of wiping the drive and cloning my >>> original smaller drive onto this one (which is what I did quite some >>> time ago) is looking as though it should be 'forefront' plan rather >>> than 'fallback' plan. I still have my original problem of System >>> Restore GUI not showing (on this same drive) which Bert Kinney & Robear >>> Dyer did their best on but we couldn't fix that either. >>> I'm very grateful for your time and effort (now maybe I am like >>> 'gratefulfrog' :-) ) >>> >>> Best regards >>> >>> dfrog >>> >>> >>> >>> >>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>> news:e3MC2iTUHHA.1636(a)TK2MSFTNGP02.phx.gbl... >>>> Hi dfrog, >>>> >>>> I was hoping that a virus would be the problem myself. >>>> >>>> If nmasnt.dll is the only problem, I wouldn't even worry about it. >>>> NetMeeting is ancient technology and Windows XP is the last version of >>>> Microsoft Windows to include NetMeeting. Even the Microsoft Windows >>>> NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for >>>> Windows >>>> 2000, Copyright 1999. >>>> >>>> See this to remove NetMeeting. >>>> NetMeeting - Run, Remove and Reinstall >>>> http://www.theeldergeek.com/netmeeting.htm >>>> >>>> You will still have C:\Program Files\NetMeeting and whatever is in it >>>> after >>>> removing NetMeeting. I have 21 items there. >>>> >>>> -- >>>> Hope this helps. Let us know. >>>> >>>> Wes >>>> MS-MVP Windows Shell/User >>>> >>>> In news:53hjjjF1pgmejU1(a)mid.individual.net, >>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>> Hi Wes, >>>>> Thank you some more :-) >>>>> I've been to the EventID site & followed it through, it looked good >>>>> and pertinent. >>>>> I followed the Symantec instructions for the removal of Win32. pinfi >>>>> virus >>>>> but the scan did not identify any infection at all (I must admit to >>>>> being a bit disappointed at that stage - I really did want it to show >>>>> me >>>>> something wrong) >>>>> So, I'm still at the same stage, but still keen to beat this little >>>>> **&%$$** >>>>> >>>>> dfrog (absolutely no connection to 'gratefulfrog') :-) >>>>> >>>>> >>>>> >>>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>>>> news:%23%236mJ65THHA.1000(a)TK2MSFTNGP05.phx.gbl... >>>>>> Hi dfrog, >>>>>> >>>>>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>>>>> and >>>>>>> re-ran SFC but it made no difference >>>>>> >>>>>> Case does not matter. >>>>>> >>>>>>> Can there be a reason why System Event Viewer should report:- >>>>>> >>>>>> See the link. >>>>>> >>>>>> Event Source: Windows File Protection >>>>>> Event ID: 64004 >>>>>> >>>> >> http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1 >>>>>> >>>>>> Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to >>>>>> windows 2000. >>>>>> >>>>>> And I am not suggesting that you subscribe to EventID.Net. I am not >>>>>> subscribed, but they occasionally have info where MS does not, like >>>>>> the >>>>>> Event 64004, for example. >>>>>> >>>>>> -- >>>>>> Hope this helps. Let us know. >>>>>> >>>>>> Wes >>>>>> MS-MVP Windows Shell/User >>>>>> >>>>>> In news:53ce5gF1rk77hU1(a)mid.individual.net, >>>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>>>> Thanks Wes, >>>>>>> >>>>>>> I followed your points 1 - 5 exactly & found that the Value Data for >>>>>>> ServicePackSourcePath at that location is already >>>>>>> C:\windows\ServicePackFiles. >>>>>>> I noted that my Value was a 'lower case w' for Windows so changed it >>>>>>> and >>>>>>> re-ran SFC but it made no difference, I still have the same System >>>>>>> Event >>>>>>> Viewer results as before. >>>>>>> So, if this Value is correct and indeed SFC is using >>>>>>> C:\Windows\ServicePackFiles\I386, does this mean that these files >>>>>>> are corrupted? >>>>>>> Can there be a reason why System Event Viewer should report:- >>>>>>> >>>>>>> ********** >>>>>>> Event Type: Information >>>>>>> Event Source: Windows File Protection >>>>>>> Event Category: None >>>>>>> Event ID: 64004 >>>>>>> Date: 13/02/2007 >>>>>>> Time: 00:00:54 >>>>>>> User: N/A >>>>>>> Computer: ************ >>>>>>> Description: >>>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll >>>>>>> could >>>>>>> not >>>>>>> be restored to its original, valid version. The file version of the >>>>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490 >>>>>>> [Element not found.]. >>>>>>> >>>>>>> For more information, see Help and Support Center at >>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>> ************* >>>>>>> >>>>>>> where [Element not found] refers to nmasnt.dll not being found in >>>>>>> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do >>>>>>> I >>>>>>> misunderstand that bit? >>>>>>> >>>>>>> but then, how would Windows know that this file could not be >>>>>>> restored to >>>>>>> its original valid version? >>>>>>> >>>>>>> I have questions popping into my head that are confusing me, hope >>>>>>> you can help some more. >>>>>>> >>>>>>> dfrog >>>>>>> >>>>>>> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when >>>>>>> it >>>>>>> became available. >>>>>>> >>>>>>> >>>>>>> >>>>>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message >>>>>>> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl... >>>>>>>> You have this folder >> C:\Windows\ServicePackFiles\i386 >>>>>>>> >>>>>>>> C:\Windows\ServicePackFiles\i386 is normally used instead of >>>>>>>> C:\Windows\system32\dllcache >>>>>>>> for Windows File Protection if the folder exists. >>>>>>>> >>>>>>>> C:\Windows\ServicePackFiles\i386 contains the most recently updated >>>>>>>> service >>>>>>>> pack files. >>>>>>>> >>>>>>>> Make sure that ServicePackSourcePath points to >>>>>>>> C:\Windows\ServicePackFiles >>>>>>>> >>>>>>>> WARNING: If you use Registry Editor incorrectly, you may cause >>>>>>>> serious problems that may require you to reinstall your operating >>>>>>>> system. Microsoft >>>>>>>> cannot guarantee that you can solve problems that result from using >>>>>>>> Registry >>>>>>>> Editor incorrectly. Use Registry Editor at your own risk. >>>>>>>> >>>>>>>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type: >>>>>>>> regedit >>>>>>>>> Click OK. >>>>>>>> 2. Locate the ServicePackSourcePath value under the following key >>>>>>>> in the registry: >>>>>>>> >>>>>>>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup >>>>>>>> >>>>>>>> 3. Double-click the ServicePackSourcePath value. >>>>>>>> 4. Enter the new location of the files >>>>>>>> C:\Windows\ServicePackFiles in >>>>>>>> the Value Data box and click OK. >>>>>>>> 5. Close the Registry Editor. >>>>>>>> >>>>>>>> The ServicePackSourcePath value must point to one level above the >>>>>>>> I386 directory because the SetUpAPI call attaches \I386 to the >>>>>>>> sourcepath. >>>>>>>> >>>>>>>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe >>>>>>>> will look for C:\Windows\system32\dllcache. >>>>>>>> >>>>>>>> C:\Windows\ServicePackFiles\i386 folder exists if the following >>>>>>>> conditions are >>>>>>>> true: >>>>>>>> * You installed Windows XP SP2 from a Windows XP SP2 CD that >>>>>>>> included >>>>>>>> SP2 >>>>>>>> as >>>>>>>> part of the base installation. >>>>>>>> * You downloaded and installed Windows XP SP2 from the Microsoft >>>>>>>> Web site. >>>>>>>> * Windows XP SP2 was included with the computer. >>>>>>>> from... >>>>>>>> http://support.microsoft.com/kb/916261 >>>>>>>> >>>>>>>> -- >>>>>>>> Hope this helps. Let us know. >>>>>>>> >>>>>>>> Wes >>>>>>>> MS-MVP Windows Shell/User >>>>>>>> >>>>>>>> In news:539r07F1rcschU1(a)mid.individual.net, >>>>>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked: >>>>>>>>> Compaq Presario >>>>>>>>> >>>>>>>>> Win XP Home - SP2 - all critical updates. >>>>>>>>> >>>>>>>>> I am unable to find the implications of the following and would >>>>>>>>> appreciate >>>>>>>>> some help:- >>>>>>>>> >>>>>>>>> Having run sfc /scannow, >>>>>>>>> >>>>>>>>> System Event Viewer gives me this >>>>>>>> >>>>>>>>> >>>>>>>>> Event Type: Information >>>>>>>>> Event Source: Windows File Protection >>>>>>>>> Event Category: None >>>>>>>>> Event ID: 64020 >>>>>>>>> Date: 11/02/2007 >>>>>>>>> Time: 20:46:56 >>>>>>>>> User: N/A >>>>>>>>> Computer: ************ >>>>>>>>> Description: >>>>>>>>> Windows File Protection scan found that the system file c:\program >>>>>>>>> files\netmeeting\nmasnt.dll has a bad signature. This file was >>>>>>>>> restored to >>>>>>>>> the original version to maintain system stability. The file >>>>>>>>> version >>>>>>>>> of the system file is 5.1.2600.2180. >>>>>>>>> >>>>>>>>> For more information, see Help and Support Center at >>>>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>>>> >>>>>>>>> >>>>>>>>> Followed immediately by this >>>>>>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> Event Type: Information >>>>>>>>> Event Source: Windows File Protection >>>>>>>>> Event Category: None >>>>>>>>> Event ID: 64004 >>>>>>>>> Date: 11/02/2007 >>>>>>>>> Time: 20:46:56 >>>>>>>>> User: N/A >>>>>>>>> Computer: ************ >>>>>>>>> Description: >>>>>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll >>>>>>>>> could >>>>>>>>> not >>>>>>>>> be restored to its original, valid version. The file version of >>>>>>>>> the bad file is 5.1.2600.2180 The specific error code is >>>>>>>>> 0x00000490 [Element not found.]. >>>>>>>>> >>>>>>>>> For more information, see Help and Support Center at >>>>>>>>> http://go.microsoft.com/fwlink/events.asp. >>>>>>>>> >>>>>>>>> >>>>>>>>> and similar results for many other files. >>>>>>>>> >>>>>>>>> >>>>>>>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting >>>>>>>>> & >>>>>>>>> C:\Windows\ Service Pack Files\i386 >>>>>>>>> >>>>>>>>> I find this on Microsoft site >> >>>>>>>>> >>>>>>>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or >>>>>>>>> unusable, >>>>>>>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the >>>>>>>>> contents >>>>>>>>> of the Dllcache directory." which makes me (novice) think, that if >>>>>>>>> I >>>>>>>>> run >>>>>>>>> 'sfc /scannow' it will repair the contents of Dllcache directory. >>>>>>>>> >>>>>>>>> I've already had much help from Bert Kinney & Robear Dyer >>>>>>>>> regarding >>>>>>>>> a >>>>>>>>> System Restore issue which we were unable to nail down, but which >>>>>>>>> did take >>>>>>>>> me through their comprehensive 'cleansing proceedure' >>>>>>>>> >>>>>>>>> dfrog |