Help 101

Logo Computer First Aid Services

WINDOWS

Sometimes updating your operating system or software and drivers resolves most conflicts and protects you from security threats. Saving your System Information, provides information needed by technicians.

When was the last time you Updated Microsoft Operating System or Office 97/98, ME, 2000, 2003, XP? Your Operating System and or Office components Word, Excel, Access etc. may be vulnerable to data theft.

BIOS Beep Codes/Error Codes - Power On Self Test (POST) - When Booting - Entering Your BIOS

Computer Safety Tips - that save time, money and frustration

Device / Driver Trouble/Conflicts

E-Mail Guidelines and Security Tips

Error Messages - Fatal or Processor Exception Error Messages

First Steps - Protection of your System Configuration and Backup of same

Microsoft Office Updates - Office 97/98, ME, 2000, 2003, XP

Security/Protection of your Files, Personal Information and System whether hard drive failure, viruses from e-mails, backdoor attack by an attacker/hacker or other means as theft or disaster.

Spam and E-Mail - Unsolicited Electronic Mail Act

System File Restore - Windows 95/98/Me/2000/XP

System Information - System history, devices, programs, hardware, utilities and more.

System Resources - does your computer become unstable, icons change appearance, acts weird

The Net: User Guidelines and Netiquette?

Virus Prevention Tips - Protect from Virus's and Hacker's
Although you are Virus Protected and Virus Free - What about protection against a Trojan Horse or other viruses, theft of personal information from back door attacks ?

It is paramount for protection and security to stay current with updates for all software installed. Updates

Security/Protection of your Files, Personal Information and System

Protect not only your personal information, but your system and data/files created as well. Besides accidentally deleting data inputted by yourself, friend or family member, I am sure you are aware of other means such has hard drive failure, viruses, be it from e-mails or a backdoor attack by virus or attacker/hacker that can cause havoc to your system or other means as theft and/or disaster.

First line of defense is daily/weekly updating your virus protection program's definition library and internet security w/ firewalls in place. Another defense measure is updating your computer's operating system (OS), software, and hardware. Microsoft comes out with critical security file updates/downloads for many of your OS components i.e. Outlook, Explorer, etc., that are found to be vulnerable by would be attackers. Many computer users never update their OS of these critical updates or know about the site to visit. If you use XP, make sure in/under System Properties, select the Automatic Updates tab that the items you wish are checked.

The following link provides a system check for updates based on your OS, however it does not work using Netscape.

http://v4.windowsupdate.microsoft.com/en/default.asp

Second line of defense is backing up only the files you created by a program used. How often is up to you, in what you feel comfortable with. Using a removable storage device, i.e. Zip Drive, CD's, DVD's or Hard Drive is a very good alternative to storing on your hard drive only. Now where to store this removable media? Another places, be it a friends house, work, or fire proof safe. As a retired firefighter, many things are stored in the refrigerator/freezer, usually after a fire items in the refrigerator/freezer are untouched. Also, there are those who go on vacation who leave emergency information in the refrigerator/freezer in how to contact them, in the event their home burns while they are gone.

Another place to store your files is if you have a web host (domain), with plenty of storage, FTP (file transfer protocol) to your site these files.

It is paramount for protection and security to stay current with updates for all software installed. Updates

Top

Virus Detection and Prevention Tips - Viruses and Hoaxes

Do not open any files attached to an email from an unknown, suspicious or untrustworthy source.
Do not open any files attached to an email unless you know what it is, even if it appears to come from a dear friend or someone you know. Some viruses can replicate themselves and spread through email. Better be safe than sorry and confirm that they really sent it.
Do not open any files attached to an email if the subject line is questionable or unexpected. If the need to do so is there always save the file to your hard drive before doing so.
Delete chain emails and junk email. Do not forward or reply to any to them. These types of email are considered spam, which is unsolicited, intrusive mail that clogs up the network.
Do not download any files from strangers.
Exercise caution when downloading files from the Internet. Ensure that the source is a legitimate and reputable one. Verify that an anti-virus program checks the files on the download site. If you're uncertain, don't download the file at all or download the file to a floppy and test it with your own anti-virus software.
Update your anti-virus software regularly. Over 500 viruses are discovered each month, so you'll want to be protected. These updates should be at the least the products virus signature files. You may also need to update the product's scanning engine as well.
Back up your files on a regular basis. If a virus destroys your files, at least you can replace them with your back-up copy. You should store your backup copy in a separate location from your work files, one that is preferably not on your computer.
When in doubt, always err on the side of caution and do not open, download, or execute any files or email attachments. Not executing is the more important of these caveats. Check with your product vendors for updates which include those for your operating system web browser, and email. One example is the security site section of Microsoft located at http://www.microsoft.com/security.

It is paramount for protection and security to stay current with updates for all software installed. Updates

System Abruptly Stops/Shuts Down - Windows File Protection - System File Checker

System stops unexpectedly

You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings might also prevent you from completing this procedure.

1. Open System in Control Panel.

2. On the Advanced tab, under Startup and Recovery, click Settings.

3. Under System Failure, select the check boxes that correspond to the actions you want Windows to perform if a Stop error occurs:

Write an event to the system log specifies that event information will be recorded in the system log.
Send an administrative alert specifies that your system administrator will be notified.
Automatically reboot specifies that Windows will automatically restart your computer.

4. Under Write Debugging Information, choose the type of information you want Windows to record when the system stops unexpectedly:

Small Memory Dump records the smallest amount of information that will help identify the problem. This option requires a paging file of at least 2 MB on the boot volume of your computer and specifies that Windows will create a new file each time the system stops unexpectedly. A history of these files is stored in the directory listed under Small Dump Directory.
Kernel Memory Dump records only kernel memory, which speeds up the process of recording information in a log when the system stops unexpectedly. Depending on the amount of RAM in your computer, you must have 50 MB to 800 MB available for the paging file on the boot volume. The file is stored in the directory listed under Dump File.
Complete Memory Dump records the entire contents of system memory when the system stops unexpectedly. If you choose this option you must have a paging file on the boot volume large enough to hold all of the physical RAM plus one megabyte (MB). The file is stored in the directory listed under Dump File.

Notes

To open System, click Start, point to Settings, click Control Panel, and then double-click System.
You must have at least a 2-MB paging file on the computer's boot volume if you select Write an event to the system log or Send an administrative alert.
If you choose either Kernel Memory Dump or Complete Memory Dump and select the Overwrite any existing file check box, Windows always writes to the same file name. To save individual dump files, clear the Overwrite any existing file check box and change the file name after each Stop error.
You can save some memory if you clear the Write an event to the system log and Send an administrative alert check boxes. The memory saved depends on the computer, but typically about 60 KB to 70 KB are required by these features.
If you contact Microsoft Product Support Services about a Stop error, they might ask for the system-memory dump file generated by the Write Debugging Information option.

Top

Windows File Protection

The Windows File Protection "concept" was first introduced by Microsoft into the Windows Millennium operating system, as a way of stabilizing the software.

In Windows XP we have a much better version of this service and this article has been written to inform the reader of it's benefits.

For those of you who remember using Windows 95 and 98 computers, a frequent problem was the operating system become erratic or just completely freezing for no apparent reason.

Well, the often underlying cause of these woes was the unprotected system files being overwritten, corrupted or even deleted!

This led to most of the support issues and was often referred to as "DLL HELL" because things could get so bad...

Now with the Windows File Protection service in place technical support is much easier!

What is windows file protection...

The windows file protection service is an "invisible" service that is enabled by default and runs constantly in the background after a successful logon. (It does not load in safe mode.)

ALL SYS, DLL, EXE, and OCX files that ship on the Windows XP CD are protected. True Type fonts--Micross.ttf, Tahoma.ttf, and Tahomabd.ttf - are also protected. They are all "backed up" to a special folder called dllcache. The location of this file is:

%SYSTEMROOT%\system32\dllcache

The dllcache folder is extremely important so Windows XP hides it from you! To view it go to: My Computer > Tools > Folder Options > View > "uncheck" Hide protected operating system files. This will also reveal other hidden system files so be careful! e.g. pagefile.sys

Windows File Protection works by detecting the replacement/overwriting of these system files. It then scans the file in question against several catalogue files it has access to (nt5.cat, nt5inf.cat etc...). Should the file not be the correct digitally signed version it is expecting, Windows File Protection will then replace it with the cached version stored in the %SYSTEMROOT%\system32\dllcache folder, or in cases where no cached version exists you may be prompted for the Windows XP CD in order to restore the file with a supported version.

(NB - In my separate article on the scannow sfc utility I show you how to get around this annoying request for the XP CD.)

To test this go to the dllcache folder yourself (probably C:\WINDOWS\system32\dllcache on your computer) and rename the file acctres.dll to acctress.dll

Close the explorer window and reopen at the same location. You will now see the windows file protection service has replaced the file acctres.dll (now delete acctress.dll)

This action is recorded in the system Log (via Event Viewer):
---------------------------------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 28/12/2003
Time: 15:37:42
User: N/A
Computer: MARCXP
Description:
File replacement was attempted on the protected system file acctres.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2600.0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------------------------------------------

Is Windows File Protection a good thing...

YES it IS!

It exists to protect the Windows system files from being modified, whether accidentally or otherwise. As a network administrator I am VERY pleased with this feature – no more running around fixing machines due to someone installing/deleting something they shouldn’t have. You’d be surprised what people are told to delete in these email virus hoaxes that are being sent around. Another important reason for having this service running is Trojan/viruses that try to overwrite system files to then pass on information on your machine. If this happens windows file protection will kick in!

For software vendors writing software for Windows XP, they can no longer replace files on your PC as part of the install process. Part of the certification process to get the XP logo for their software products means vendors now have to follow strict rules about how software is installed. This is a GOOD thing!

What about when system files are updated by Microsoft...

If Windows File Protection protects system files then how exactly can they be updated with newer versions?

Well Microsoft has made the following methods Windows File Protection "aware" Meaning the newer files will replace the old system files and a copy of the new file will be stored in the dllcache folder. The security catalogues are also updated so the Windows File Protection service always knows what version of the digitally signed file is current!

Replacement of protected system files is supported using the following mechanisms:

• Windows Service Pack installation (UPDATE.EXE) e.g. XP SP2

• Hotfix distributions installed using (HOTFIX.EXE) e.g. KB825035

• Operating system upgrade (WINNT32.EXE)

• Windows Update Website

• Windows Device Installer

Can I turn off Windows File Protection...

The official answer form Microsoft is NO and this is be design. (The only exception is if you are using a kernel debugger.)

However, there is a way to do it, BUT I can think of no reason for you to do so!!!

On a close inspection of the system file sfc.dll it is possible to see a reference, in part of the code, that checks the value of the SFCDisable in the WinLogon key... (Something we talk about in a moment!)

This key is: 0ffffff9dh

This is NOT a documented feature from Microsoft and should NOT be used unless you REALLY are sure you need to disable the service!

(NB - It is interesting to note that the virus "W32/CodeRed.D", that caused so much mayhem by shutting down Internet Servers in the summer of 2002, used this very same undocumented setting to stop the Windows File protection service from running. The virus could then release its Trojan payload to do damage and replicate itself around the Internet!

The registry key to change is:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable

By default, SFCDisable is set to 0, which means Windows File Protection is active.

Setting SFCDisable to 1 will disable Windows File Protection . Setting SFCDisable to 2 will disable Windows File Protection for the next system restart only (without a prompt to re-enable).

Important: You must have a kernel debugger attached to the system via null modem cable to use SFCDisable = 1 or SFCDisable = 2.

After Windows File Protection is disabled using the SFCDisable = 1 setting, the following message will appear after logon:

Warning! Windows File Protection is not active on this system. Would you like to enable Windows File Protection now? This will enable Windows File Protection until the next system restart. <Yes> <No>.

Clicking Yes will reactivate Windows File Protection until the next system restart. This message will appear at every successful logon until SFCDisable is set to 0.

NOTE: The above message will only be presented to Administrators.

To verify that Windows File Protection has been disabled after rebooting click on Start menu > Control Panel > Administrative Tools > Event Viewer.

An event will be logged to indicate Windows File Protection is disabled on the PC. If this event hasn’t been logged in Event Viewer then the service has NOT been disabled...

Customizing Windows File Protection...

The Windows File Protection service can be customized in several ways with the simplest way of modifying the options being through the Group Policy Editor.

Click on Start Menu > Run box > type in gpedit.msc and hit the Ok button.

Expand Computer Configuration > Administrative Templates > System

then select the Windows File Protection folder...

ANY changes made here will update the registry keys at:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Windows File Protection

Administrators PLEASE note:

When Windows XP starts up, the Windows File Protection service synchronizes (copies) the Windows File Protection settings from the following registry key:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Windows File Protection

to the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Therefore, if any of the following values are present in the HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Windows File Protection key, they will take precedence over the same values under the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key.

Other edits include:

All registry settings for this service are located in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

By default, only Administrators and System will be able to modify these settings.

SFCScan (REG_DWORD)
0 = do not scan protected files at boot (default).
1 = scan protected files at every boot.
2 = scan protected files once.

SFCQuota (REG_DWORD)
n = size (in megabytes) of dllcache quota.
FFFFFFFF = all files.

If you don't know hex, here's some samples:

00000099 = 153 (MB).
0000004b = 75 (MB).
00000032 = 50 (MB).
0000000a = 10 (MB).

SFCShowProgress (REG_DWORD)
0 = System File Checker progress meter is not displayed.
1 = System File Checker progress meter is displayed (default).

SFCDllCacheDir (REG_EXPAND_SZ)
Path = local location of dllcache directory (default is %Systemroot%\system32\dllcache).

By now you should have a greater understanding of Windows File Protection in Windows XP and how it works.

Please read my separate article on the scannow sfc command line utility that allows you to manually use the Windows File protection service on your PC.

Disclaimer: Modifying the registry can cause serious problems that may require you to reinstall your operating system. I cannot guarantee that problems resulting from modifications to the registry can be solved. Use the information provided at your own risk.

Top

Windows File Protection

By default, Windows File Protection is always enabled and allows Windows
digitally signed files to replace existing files safely. Currently, signed files are distributed
through:

# Windows Service Packs

# Hotfix distributions

# Operating system upgrades

# Windows Update

# Windows Device Manager

If you introduce a file replacement in any other way, Windows File protection will overwrite your file!

An important part of Windows File Protection is the command line utility:

System File Checker (sfc.exe)

You will often see references to scannow sfc in online newsgroups etc. This is a great tool for troubleshooting Windows XP problems.

How to use scannow sfc...

The main reason for using this utility is when you suspect there may be a problem with a Windows XP system file.

Perhaps you get a dialog box appear informing you of a problem with a .dll file, or your program will just not load! It is therefore worth checking to see if there are any corrupt system files using scannow sfc.

To do this simply go to the Run box on the Start Menu and type in:

sfc /scannow

This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

The following should appear to give an indication of how long the process is taking.

scannow sfc

In an ideal world that would be the end of the story... Any corrupt, missing or incorrect files would be replaced by this process.

However, things can go wrong and the following guide should help!

The #1 complaint with scannow sfc is the following dialog box appearing:

scannow sfc image

Why does this happen?

Well, in your computer's registry, are several settings that are checked when you run scannow sfc.

As mentioned earlier in this article, the Windows File Protection service constantly monitors for any changes to the main system files. Well Windows XP keeps a cache (copy) of these essential files at the following location:

C:WINDOWS\System32\Dllcache (assuming C: is your system root which it probably is.)

NB - The dllcache folder is extremely important so Windows XP hides it from you! To view it go to: My Computer > Tools > Folder Options > View > "uncheck" Hide protected operating system files.

If that's the case on your computer then there is normally no need for the original XP CD to be inserted as your computer has a "copy" it can get hold of in this cache...

But, if the Dllcache folder, or part of it, has become corrupted for some reason then you will be prompted for the XP CD - so your computer can get a clean copy!

Having said that not ALL installations of Windows XP have ALL the system files cached into this folder! You may only have around 50MB of files in this folder under Windows XP depending on the quota settings in the registry. (Under Windows 2003 Server the default is 300MB of system files!)

Annoying, YES!

Is there a workaround YES!

As well as having a cache of all the system files on your PC, I like to have the I386 folder from the XP CD installed on the computer as well. After doing this I then modify the registry to tell it the source path for these files... Why? Well not only does this prevent 99% of request for the the XP CD with Windows File Protection. But the I386 folder also contains many other files that are sometimes needed by the operating system and this stops those requests for the XP CD too!

NB - With today's large hard drives you are not going to notice this 475 MB folder on your computer, but older systems may not have the space for this...

Step 1

You will need to get your XP CD and locate the folder called:

I386

This is a major folder and should be one of the first you see, now copy this onto your hard drive into the system root. For most of you that is going to be C:\ so you should end up with a folder that looks like: C:\I386

-----------------------------

Step 2

Now you will need to tell your computer you now have the files on your PC. We do this is the registry (type regedit in the Run box on the start menu) by navigating to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Setup

You will see various entries here on the right hand side. The one we want is called:

SourcePath

It probably has an entry pointing to your CD-ROM drive, and that is why it is asking for the XP CD. All we need to do is change it to:

C:\

Simply double click the SourcePatch setting and a new box will pop up allowing you to make the change.

Now restart your computer and try scannow sfc again!

------------------------------