System File Checker question [Help and Support]

Prev: Script Error
Next: Faulting application CTFmon.exe (Language Bar)

From: Wesley Vogel on 12 Feb 2007 15:23

You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated service
pack files.

Make sure that ServicePackSourcePath points to C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system. Microsoft
cannot guarantee that you can solve problems that result from using Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type: regedit
| Click OK.
2. Locate the ServicePackSourcePath value under the following key in the
registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following conditions
are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included SP2 as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:539r07F1rcschU1(a)mid.individual.net,
dfrog <dfrog(a)lineone1.net> hunted and pecked:
> Compaq Presario
>
> Win XP Home - SP2 - all critical updates.
>
> I am unable to find the implications of the following and would appreciate
> some help:-
>
> Having run sfc /scannow,
>
> System Event Viewer gives me this >>>>>>>>
>
> Event Type: Information
> Event Source: Windows File Protection
> Event Category: None
> Event ID: 64020
> Date: 11/02/2007
> Time: 20:46:56
> User: N/A
> Computer: ************
> Description:
> Windows File Protection scan found that the system file c:\program
> files\netmeeting\nmasnt.dll has a bad signature. This file was restored to
> the original version to maintain system stability. The file version of
> the system file is 5.1.2600.2180.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Followed immediately by this >>>>>>>>>>>>>>
>
>
> Event Type: Information
> Event Source: Windows File Protection
> Event Category: None
> Event ID: 64004
> Date: 11/02/2007
> Time: 20:46:56
> User: N/A
> Computer: ************
> Description:
> The protected system file c:\program files\netmeeting\nmasnt.dll could not
> be restored to its original, valid version. The file version of the bad
> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
> found.].
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> and similar results for many other files.
>
>
> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
> C:\Windows\ Service Pack Files\i386
>
> I find this on Microsoft site >>
>
> "If the %systemroot%\system32\dllcache folder becomes corrupt or unusable,
> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
> of the Dllcache directory." which makes me (novice) think, that if I run
> 'sfc /scannow' it will repair the contents of Dllcache directory.
>
> I've already had much help from Bert Kinney & Robear Dyer regarding a
> System Restore issue which we were unable to nail down, but which did take
> me through their comprehensive 'cleansing proceedure'
>
> dfrog

From: dfrog on 12 Feb 2007 19:13

Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference, I still have the same System Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could not
be restored to its original, valid version. The file version of the bad file
is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored to its
original valid version?

I have questions popping into my head that are confusing me, hope you can
help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.

"Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message
news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl...
> You have this folder >> C:\Windows\ServicePackFiles\i386
>
> C:\Windows\ServicePackFiles\i386 is normally used instead of
> C:\Windows\system32\dllcache
> for Windows File Protection if the folder exists.
>
> C:\Windows\ServicePackFiles\i386 contains the most recently updated
> service
> pack files.
>
> Make sure that ServicePackSourcePath points to C:\Windows\ServicePackFiles
>
> WARNING: If you use Registry Editor incorrectly, you may cause serious
> problems that may require you to reinstall your operating system.
> Microsoft
> cannot guarantee that you can solve problems that result from using
> Registry
> Editor incorrectly. Use Registry Editor at your own risk.
>
> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
> regedit
> | Click OK.
> 2. Locate the ServicePackSourcePath value under the following key in the
> registry:
>
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
>
> 3. Double-click the ServicePackSourcePath value.
> 4. Enter the new location of the files C:\Windows\ServicePackFiles in
> the Value Data box and click OK.
> 5. Close the Registry Editor.
>
> The ServicePackSourcePath value must point to one level above the I386
> directory because the SetUpAPI call attaches \I386 to the sourcepath.
>
> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
> look for C:\Windows\system32\dllcache.
>
> C:\Windows\ServicePackFiles\i386 folder exists if the following conditions
> are
> true:
> * You installed Windows XP SP2 from a Windows XP SP2 CD that included SP2
> as
> part of the base installation.
> * You downloaded and installed Windows XP SP2 from the Microsoft Web site.
> * Windows XP SP2 was included with the computer.
> from...
> http://support.microsoft.com/kb/916261
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:539r07F1rcschU1(a)mid.individual.net,
> dfrog <dfrog(a)lineone1.net> hunted and pecked:
>> Compaq Presario
>>
>> Win XP Home - SP2 - all critical updates.
>>
>> I am unable to find the implications of the following and would
>> appreciate
>> some help:-
>>
>> Having run sfc /scannow,
>>
>> System Event Viewer gives me this >>>>>>>>
>>
>> Event Type: Information
>> Event Source: Windows File Protection
>> Event Category: None
>> Event ID: 64020
>> Date: 11/02/2007
>> Time: 20:46:56
>> User: N/A
>> Computer: ************
>> Description:
>> Windows File Protection scan found that the system file c:\program
>> files\netmeeting\nmasnt.dll has a bad signature. This file was restored
>> to
>> the original version to maintain system stability. The file version of
>> the system file is 5.1.2600.2180.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Followed immediately by this >>>>>>>>>>>>>>
>>
>>
>> Event Type: Information
>> Event Source: Windows File Protection
>> Event Category: None
>> Event ID: 64004
>> Date: 11/02/2007
>> Time: 20:46:56
>> User: N/A
>> Computer: ************
>> Description:
>> The protected system file c:\program files\netmeeting\nmasnt.dll could
>> not
>> be restored to its original, valid version. The file version of the bad
>> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
>> found.].
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> and similar results for many other files.
>>
>>
>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
>> C:\Windows\ Service Pack Files\i386
>>
>> I find this on Microsoft site >>
>>
>> "If the %systemroot%\system32\dllcache folder becomes corrupt or
>> unusable,
>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
>> of the Dllcache directory." which makes me (novice) think, that if I run
>> 'sfc /scannow' it will repair the contents of Dllcache directory.
>>
>> I've already had much help from Bert Kinney & Robear Dyer regarding a
>> System Restore issue which we were unable to nail down, but which did
>> take
>> me through their comprehensive 'cleansing proceedure'
>>
>> dfrog
>

From: Wesley Vogel on 13 Feb 2007 13:42

Hi dfrog,

> I noted that my Value was a 'lower case w' for Windows so changed it and
> re-ran SFC but it made no difference

Case does not matter.

> Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004
http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:53ce5gF1rk77hU1(a)mid.individual.net,
dfrog <dfrog(a)lineone1.net> hunted and pecked:
> Thanks Wes,
>
> I followed your points 1 - 5 exactly & found that the Value Data for
> ServicePackSourcePath at that location is already
> C:\windows\ServicePackFiles.
> I noted that my Value was a 'lower case w' for Windows so changed it and
> re-ran SFC but it made no difference, I still have the same System Event
> Viewer results as before.
> So, if this Value is correct and indeed SFC is using
> C:\Windows\ServicePackFiles\I386, does this mean that these files are
> corrupted?
> Can there be a reason why System Event Viewer should report:-
>
> **********
> Event Type: Information
> Event Source: Windows File Protection
> Event Category: None
> Event ID: 64004
> Date: 13/02/2007
> Time: 00:00:54
> User: N/A
> Computer: ************
> Description:
> The protected system file c:\program files\netmeeting\nmasnt.dll could not
> be restored to its original, valid version. The file version of the bad
> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
> found.].
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> *************
>
> where [Element not found] refers to nmasnt.dll not being found in
> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
> misunderstand that bit?
>
> but then, how would Windows know that this file could not be restored to
> its original valid version?
>
> I have questions popping into my head that are confusing me, hope you can
> help some more.
>
> dfrog
>
> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
> became available.
>
>
>
> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message
> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl...
>> You have this folder >> C:\Windows\ServicePackFiles\i386
>>
>> C:\Windows\ServicePackFiles\i386 is normally used instead of
>> C:\Windows\system32\dllcache
>> for Windows File Protection if the folder exists.
>>
>> C:\Windows\ServicePackFiles\i386 contains the most recently updated
>> service
>> pack files.
>>
>> Make sure that ServicePackSourcePath points to
>> C:\Windows\ServicePackFiles
>>
>> WARNING: If you use Registry Editor incorrectly, you may cause serious
>> problems that may require you to reinstall your operating system.
>> Microsoft
>> cannot guarantee that you can solve problems that result from using
>> Registry
>> Editor incorrectly. Use Registry Editor at your own risk.
>>
>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
>> regedit
>>> Click OK.
>> 2. Locate the ServicePackSourcePath value under the following key in the
>> registry:
>>
>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
>>
>> 3. Double-click the ServicePackSourcePath value.
>> 4. Enter the new location of the files C:\Windows\ServicePackFiles in
>> the Value Data box and click OK.
>> 5. Close the Registry Editor.
>>
>> The ServicePackSourcePath value must point to one level above the I386
>> directory because the SetUpAPI call attaches \I386 to the sourcepath.
>>
>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
>> look for C:\Windows\system32\dllcache.
>>
>> C:\Windows\ServicePackFiles\i386 folder exists if the following
>> conditions are
>> true:
>> * You installed Windows XP SP2 from a Windows XP SP2 CD that included SP2
>> as
>> part of the base installation.
>> * You downloaded and installed Windows XP SP2 from the Microsoft Web
>> site.
>> * Windows XP SP2 was included with the computer.
>> from...
>> http://support.microsoft.com/kb/916261
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:539r07F1rcschU1(a)mid.individual.net,
>> dfrog <dfrog(a)lineone1.net> hunted and pecked:
>>> Compaq Presario
>>>
>>> Win XP Home - SP2 - all critical updates.
>>>
>>> I am unable to find the implications of the following and would
>>> appreciate
>>> some help:-
>>>
>>> Having run sfc /scannow,
>>>
>>> System Event Viewer gives me this >>>>>>>>
>>>
>>> Event Type: Information
>>> Event Source: Windows File Protection
>>> Event Category: None
>>> Event ID: 64020
>>> Date: 11/02/2007
>>> Time: 20:46:56
>>> User: N/A
>>> Computer: ************
>>> Description:
>>> Windows File Protection scan found that the system file c:\program
>>> files\netmeeting\nmasnt.dll has a bad signature. This file was restored
>>> to
>>> the original version to maintain system stability. The file version of
>>> the system file is 5.1.2600.2180.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Followed immediately by this >>>>>>>>>>>>>>
>>>
>>>
>>> Event Type: Information
>>> Event Source: Windows File Protection
>>> Event Category: None
>>> Event ID: 64004
>>> Date: 11/02/2007
>>> Time: 20:46:56
>>> User: N/A
>>> Computer: ************
>>> Description:
>>> The protected system file c:\program files\netmeeting\nmasnt.dll could
>>> not
>>> be restored to its original, valid version. The file version of the bad
>>> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
>>> not found.].
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> and similar results for many other files.
>>>
>>>
>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
>>> C:\Windows\ Service Pack Files\i386
>>>
>>> I find this on Microsoft site >>
>>>
>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or
>>> unusable,
>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
>>> of the Dllcache directory." which makes me (novice) think, that if I run
>>> 'sfc /scannow' it will repair the contents of Dllcache directory.
>>>
>>> I've already had much help from Bert Kinney & Robear Dyer regarding a
>>> System Restore issue which we were unable to nail down, but which did
>>> take
>>> me through their comprehensive 'cleansing proceedure'
>>>
>>> dfrog

From: dfrog on 14 Feb 2007 18:17

Hi Wes,
Thank you some more :-)
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi virus
but the scan did not identify any infection at all (I must admit to being a
bit disappointed at that stage - I really did want it to show me something
wrong)
So, I'm still at the same stage, but still keen to beat this little **&%$$**

dfrog (absolutely no connection to 'gratefulfrog') :-)

"Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message
news:%23%236mJ65THHA.1000(a)TK2MSFTNGP05.phx.gbl...
> Hi dfrog,
>
>> I noted that my Value was a 'lower case w' for Windows so changed it and
>> re-ran SFC but it made no difference
>
> Case does not matter.
>
>> Can there be a reason why System Event Viewer should report:-
>
> See the link.
>
> Event Source: Windows File Protection
> Event ID: 64004
> http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1
>
> Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
> windows 2000.
>
> And I am not suggesting that you subscribe to EventID.Net. I am not
> subscribed, but they occasionally have info where MS does not, like the
> Event 64004, for example.
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:53ce5gF1rk77hU1(a)mid.individual.net,
> dfrog <dfrog(a)lineone1.net> hunted and pecked:
>> Thanks Wes,
>>
>> I followed your points 1 - 5 exactly & found that the Value Data for
>> ServicePackSourcePath at that location is already
>> C:\windows\ServicePackFiles.
>> I noted that my Value was a 'lower case w' for Windows so changed it and
>> re-ran SFC but it made no difference, I still have the same System Event
>> Viewer results as before.
>> So, if this Value is correct and indeed SFC is using
>> C:\Windows\ServicePackFiles\I386, does this mean that these files are
>> corrupted?
>> Can there be a reason why System Event Viewer should report:-
>>
>> **********
>> Event Type: Information
>> Event Source: Windows File Protection
>> Event Category: None
>> Event ID: 64004
>> Date: 13/02/2007
>> Time: 00:00:54
>> User: N/A
>> Computer: ************
>> Description:
>> The protected system file c:\program files\netmeeting\nmasnt.dll could
>> not
>> be restored to its original, valid version. The file version of the bad
>> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
>> found.].
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> *************
>>
>> where [Element not found] refers to nmasnt.dll not being found in
>> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
>> misunderstand that bit?
>>
>> but then, how would Windows know that this file could not be restored to
>> its original valid version?
>>
>> I have questions popping into my head that are confusing me, hope you can
>> help some more.
>>
>> dfrog
>>
>> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
>> became available.
>>
>>
>>
>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message
>> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl...
>>> You have this folder >> C:\Windows\ServicePackFiles\i386
>>>
>>> C:\Windows\ServicePackFiles\i386 is normally used instead of
>>> C:\Windows\system32\dllcache
>>> for Windows File Protection if the folder exists.
>>>
>>> C:\Windows\ServicePackFiles\i386 contains the most recently updated
>>> service
>>> pack files.
>>>
>>> Make sure that ServicePackSourcePath points to
>>> C:\Windows\ServicePackFiles
>>>
>>> WARNING: If you use Registry Editor incorrectly, you may cause serious
>>> problems that may require you to reinstall your operating system.
>>> Microsoft
>>> cannot guarantee that you can solve problems that result from using
>>> Registry
>>> Editor incorrectly. Use Registry Editor at your own risk.
>>>
>>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
>>> regedit
>>>> Click OK.
>>> 2. Locate the ServicePackSourcePath value under the following key in the
>>> registry:
>>>
>>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
>>>
>>> 3. Double-click the ServicePackSourcePath value.
>>> 4. Enter the new location of the files C:\Windows\ServicePackFiles
>>> in
>>> the Value Data box and click OK.
>>> 5. Close the Registry Editor.
>>>
>>> The ServicePackSourcePath value must point to one level above the I386
>>> directory because the SetUpAPI call attaches \I386 to the sourcepath.
>>>
>>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
>>> look for C:\Windows\system32\dllcache.
>>>
>>> C:\Windows\ServicePackFiles\i386 folder exists if the following
>>> conditions are
>>> true:
>>> * You installed Windows XP SP2 from a Windows XP SP2 CD that included
>>> SP2
>>> as
>>> part of the base installation.
>>> * You downloaded and installed Windows XP SP2 from the Microsoft Web
>>> site.
>>> * Windows XP SP2 was included with the computer.
>>> from...
>>> http://support.microsoft.com/kb/916261
>>>
>>> --
>>> Hope this helps. Let us know.
>>>
>>> Wes
>>> MS-MVP Windows Shell/User
>>>
>>> In news:539r07F1rcschU1(a)mid.individual.net,
>>> dfrog <dfrog(a)lineone1.net> hunted and pecked:
>>>> Compaq Presario
>>>>
>>>> Win XP Home - SP2 - all critical updates.
>>>>
>>>> I am unable to find the implications of the following and would
>>>> appreciate
>>>> some help:-
>>>>
>>>> Having run sfc /scannow,
>>>>
>>>> System Event Viewer gives me this >>>>>>>>
>>>>
>>>> Event Type: Information
>>>> Event Source: Windows File Protection
>>>> Event Category: None
>>>> Event ID: 64020
>>>> Date: 11/02/2007
>>>> Time: 20:46:56
>>>> User: N/A
>>>> Computer: ************
>>>> Description:
>>>> Windows File Protection scan found that the system file c:\program
>>>> files\netmeeting\nmasnt.dll has a bad signature. This file was restored
>>>> to
>>>> the original version to maintain system stability. The file version of
>>>> the system file is 5.1.2600.2180.
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>>
>>>> Followed immediately by this >>>>>>>>>>>>>>
>>>>
>>>>
>>>> Event Type: Information
>>>> Event Source: Windows File Protection
>>>> Event Category: None
>>>> Event ID: 64004
>>>> Date: 11/02/2007
>>>> Time: 20:46:56
>>>> User: N/A
>>>> Computer: ************
>>>> Description:
>>>> The protected system file c:\program files\netmeeting\nmasnt.dll could
>>>> not
>>>> be restored to its original, valid version. The file version of the bad
>>>> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
>>>> not found.].
>>>>
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>
>>>>
>>>> and similar results for many other files.
>>>>
>>>>
>>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
>>>> C:\Windows\ Service Pack Files\i386
>>>>
>>>> I find this on Microsoft site >>
>>>>
>>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or
>>>> unusable,
>>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
>>>> contents
>>>> of the Dllcache directory." which makes me (novice) think, that if I
>>>> run
>>>> 'sfc /scannow' it will repair the contents of Dllcache directory.
>>>>
>>>> I've already had much help from Bert Kinney & Robear Dyer regarding a
>>>> System Restore issue which we were unable to nail down, but which did
>>>> take
>>>> me through their comprehensive 'cleansing proceedure'
>>>>
>>>> dfrog
>

From: Wesley Vogel on 15 Feb 2007 14:38

Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:53hjjjF1pgmejU1(a)mid.individual.net,
dfrog <dfrog(a)lineone1.net> hunted and pecked:
> Hi Wes,
> Thank you some more :-)
> I've been to the EventID site & followed it through, it looked good and
> pertinent.
> I followed the Symantec instructions for the removal of Win32. pinfi virus
> but the scan did not identify any infection at all (I must admit to being
> a bit disappointed at that stage - I really did want it to show me
> something wrong)
> So, I'm still at the same stage, but still keen to beat this little
> **&%$$**
>
> dfrog (absolutely no connection to 'gratefulfrog') :-)
>
>
>
> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message
> news:%23%236mJ65THHA.1000(a)TK2MSFTNGP05.phx.gbl...
>> Hi dfrog,
>>
>>> I noted that my Value was a 'lower case w' for Windows so changed it and
>>> re-ran SFC but it made no difference
>>
>> Case does not matter.
>>
>>> Can there be a reason why System Event Viewer should report:-
>>
>> See the link.
>>
>> Event Source: Windows File Protection
>> Event ID: 64004
>>
http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows%20File%20Protection&phase=1
>>
>> Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
>> windows 2000.
>>
>> And I am not suggesting that you subscribe to EventID.Net. I am not
>> subscribed, but they occasionally have info where MS does not, like the
>> Event 64004, for example.
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:53ce5gF1rk77hU1(a)mid.individual.net,
>> dfrog <dfrog(a)lineone1.net> hunted and pecked:
>>> Thanks Wes,
>>>
>>> I followed your points 1 - 5 exactly & found that the Value Data for
>>> ServicePackSourcePath at that location is already
>>> C:\windows\ServicePackFiles.
>>> I noted that my Value was a 'lower case w' for Windows so changed it and
>>> re-ran SFC but it made no difference, I still have the same System Event
>>> Viewer results as before.
>>> So, if this Value is correct and indeed SFC is using
>>> C:\Windows\ServicePackFiles\I386, does this mean that these files are
>>> corrupted?
>>> Can there be a reason why System Event Viewer should report:-
>>>
>>> **********
>>> Event Type: Information
>>> Event Source: Windows File Protection
>>> Event Category: None
>>> Event ID: 64004
>>> Date: 13/02/2007
>>> Time: 00:00:54
>>> User: N/A
>>> Computer: ************
>>> Description:
>>> The protected system file c:\program files\netmeeting\nmasnt.dll could
>>> not
>>> be restored to its original, valid version. The file version of the bad
>>> file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
>>> not found.].
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> *************
>>>
>>> where [Element not found] refers to nmasnt.dll not being found in
>>> C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
>>> misunderstand that bit?
>>>
>>> but then, how would Windows know that this file could not be restored to
>>> its original valid version?
>>>
>>> I have questions popping into my head that are confusing me, hope you
>>> can help some more.
>>>
>>> dfrog
>>>
>>> PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
>>> became available.
>>>
>>>
>>>
>>> "Wesley Vogel" <123WVogel955(a)comcast.net> wrote in message
>>> news:OPw0GOuTHHA.3996(a)TK2MSFTNGP04.phx.gbl...
>>>> You have this folder >> C:\Windows\ServicePackFiles\i386
>>>>
>>>> C:\Windows\ServicePackFiles\i386 is normally used instead of
>>>> C:\Windows\system32\dllcache
>>>> for Windows File Protection if the folder exists.
>>>>
>>>> C:\Windows\ServicePackFiles\i386 contains the most recently updated
>>>> service
>>>> pack files.
>>>>
>>>> Make sure that ServicePackSourcePath points to
>>>> C:\Windows\ServicePackFiles
>>>>
>>>> WARNING: If you use Registry Editor incorrectly, you may cause serious
>>>> problems that may require you to reinstall your operating system.
>>>> Microsoft
>>>> cannot guarantee that you can solve problems that result from using
>>>> Registry
>>>> Editor incorrectly. Use Registry Editor at your own risk.
>>>>
>>>> 1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
>>>> regedit
>>>>> Click OK.
>>>> 2. Locate the ServicePackSourcePath value under the following key in
>>>> the registry:
>>>>
>>>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
>>>>
>>>> 3. Double-click the ServicePackSourcePath value.
>>>> 4. Enter the new location of the files C:\Windows\ServicePackFiles
>>>> in
>>>> the Value Data box and click OK.
>>>> 5. Close the Registry Editor.
>>>>
>>>> The ServicePackSourcePath value must point to one level above the I386
>>>> directory because the SetUpAPI call attaches \I386 to the sourcepath.
>>>>
>>>> If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
>>>> will look for C:\Windows\system32\dllcache.
>>>>
>>>> C:\Windows\ServicePackFiles\i386 folder exists if the following
>>>> conditions are
>>>> true:
>>>> * You installed Windows XP SP2 from a Windows XP SP2 CD that included
>>>> SP2
>>>> as
>>>> part of the base installation.
>>>> * You downloaded and installed Windows XP SP2 from the Microsoft Web
>>>> site.
>>>> * Windows XP SP2 was included with the computer.
>>>> from...
>>>> http://support.microsoft.com/kb/916261
>>>>
>>>> --
>>>> Hope this helps. Let us know.
>>>>
>>>> Wes
>>>> MS-MVP Windows Shell/User
>>>>
>>>> In news:539r07F1rcschU1(a)mid.individual.net,
>>>> dfrog <dfrog(a)lineone1.net> hunted and pecked:
>>>>> Compaq Presario
>>>>>
>>>>> Win XP Home - SP2 - all critical updates.
>>>>>
>>>>> I am unable to find the implications of the following and would
>>>>> appreciate
>>>>> some help:-
>>>>>
>>>>> Having run sfc /scannow,
>>>>>
>>>>> System Event Viewer gives me this >>>>>>>>
>>>>>
>>>>> Event Type: Information
>>>>> Event Source: Windows File Protection
>>>>> Event Category: None
>>>>> Event ID: 64020
>>>>> Date: 11/02/2007
>>>>> Time: 20:46:56
>>>>> User: N/A
>>>>> Computer: ************
>>>>> Description:
>>>>> Windows File Protection scan found that the system file c:\program
>>>>> files\netmeeting\nmasnt.dll has a bad signature. This file was
>>>>> restored to
>>>>> the original version to maintain system stability. The file version
>>>>> of the system file is 5.1.2600.2180.
>>>>>
>>>>> For more information, see Help and Support Center at
>>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>>
>>>>>
>>>>> Followed immediately by this >>>>>>>>>>>>>>
>>>>>
>>>>>
>>>>> Event Type: Information
>>>>> Event Source: Windows File Protection
>>>>> Event Category: None
>>>>> Event ID: 64004
>>>>> Date: 11/02/2007
>>>>> Time: 20:46:56
>>>>> User: N/A
>>>>> Computer: ************
>>>>> Description:
>>>>> The protected system file c:\program files\netmeeting\nmasnt.dll could
>>>>> not
>>>>> be restored to its original, valid version. The file version of the
>>>>> bad file is 5.1.2600.2180 The specific error code is 0x00000490
>>>>> [Element not found.].
>>>>>
>>>>> For more information, see Help and Support Center at
>>>>> http://go.microsoft.com/fwlink/events.asp.
>>>>>
>>>>>
>>>>> and similar results for many other files.
>>>>>
>>>>>
>>>>> A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
>>>>> C:\Windows\ Service Pack Files\i386
>>>>>
>>>>> I find this on Microsoft site >>
>>>>>
>>>>> "If the %systemroot%\system32\dllcache folder becomes corrupt or
>>>>> unusable,
>>>>> use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
>>>>> contents
>>>>> of the Dllcache directory." which makes me (novice) think, that if I
>>>>> run
>>>>> 'sfc /scannow' it will repair the contents of Dllcache directory.
>>>>>
>>>>> I've already had much help from Bert Kinney & Robear Dyer regarding a
>>>>> System Restore issue which we were unable to nail down, but which did
>>>>> take
>>>>> me through their comprehensive 'cleansing proceedure'
>>>>>
>>>>> dfrog

First | Prev | Next | Last
Pages: 1 2 3
Prev: Script Error
Next: Faulting application CTFmon.exe (Language Bar)