1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Windows File Protection Error message

Discussion in 'Windows XP' started by psylock, Dec 19, 2012.

Thread Status:
Not open for further replies.
Advertisement
  1. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    I have been getting the following pop up screen since Sunday(12/16/2012) Windows File Protection: Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. Insert your Windows XP Professional Service Pack 3 CD now. And in the event viewer log there is a whole list of system files that could not be copied into the DLL cache. So far I have not inserted the CD I have just restarted my computer. But yesterday I scanned my computer with Norton Power Eraser and removed the Swrort.d trojan. I thought the error message was related to the virus but according to Mcafee virus removal it is a problem with the operating system, please help....
     
  2. Sponsor

  3. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    Hi, does your Pc still start up and reach the desktop?
    If yes - check and post
    TSG System Information Utility - found here.
    http://library.techguy.org/wiki/TSG_Valuable_links
    ------
    Download Security Check by screen317
    http://screen317.spywareinfoforum.org/
    Save it to your Desktop.

    Double click the install icon.
    A command Prompt window will open.
    Let it scan the Pc - press any key when asked.
    It should now open in Notepad - and will save a log called checkup.txt.
    Post the result of the scan here.
     
  4. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    Hello, thank you for helping me.

    Tech Support Guy System Info Utility version 1.0.0.2
    OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
    Processor: Genuine Intel(R) CPU T2400 @ 1.83GHz, x86 Family 6 Model 14 Stepping 8
    Processor Count: 2
    RAM: 1015 Mb
    Graphics Card: Mobile Intel(R) 945 Express Chipset Family, 224 Mb
    Hard Drives: C: Total - 57238 MB, Free - 23465 MB;
    Motherboard: Hewlett-Packard, 30AD
    Antivirus: McAfee Anti-Virus and Anti-Spyware, Updated: Yes, On-Demand Scanner: Enabled

    and here is the result of the checkup scan:

    Results of screen317's Security Check version 0.99.56
    Windows XP Service Pack 3 x86
    Internet Explorer 8
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    McAfee Anti-Virus and Anti-Spyware
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    SUPERAntiSpyware
    Java(TM) 6 Update 35
    Java 7 Update 9
    Adobe Flash Player 11.5.502.135
    Adobe Reader 10.1.4 Adobe Reader out of Date!
    Mozilla Firefox (17.0.1)
    ````````Process Check: objlist.exe by Laurent````````
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C:: 12% Defragment your hard drive soon! (Do NOT defrag if SSD!)
    ````````````````````End of Log``````````````````````

    what is SSD?
     
  5. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
  6. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    We need to check that the Swrort.d trojan has gone.
    You already have SuperAntiSpyware installed.

    Start SuperAntiSpyware - Allow it to update.
    Select the Quick Scan option.
    Click Scan your Computer.
    Any infections or problems will be highlighted in red.
    After the scan is finished.
    Click Continue.
    Check that everything is listed.
    Click Remove Threats.
    Click OK - then click Finish
    You may be prompted to restart to finish the removal process.
    If Yes - restart your Pc.

    Start SuperAntiSpyware again.
    Click View Scan Logs.
    Highlight the scan log entry.
    Click - View Selected Log.
    The scan log will appear in Notepad.
    Copy and paste in your next post.
    -----
    Download MalwareBytes
    MalwareBytes

    Once downloaded to your desktop.
    Close all open browser windows.
    MalwareBytes
    Click on the Install icon - allow it to update during the install process.
    Start Malwarebytes Anti-Malware.
    Click on Scanner > then quick scan > then Scan.
    Any infections or problems will be highlighted in red.
    After the scan is finished - Click - Show Results.
    Check that all entries are selected.
    Click - Remove Selected.
    You may be prompted to restart to finish the removal process.
    If Yes - restart your Pc.

    Start Malwarebytes again.
    Click on the Logs Tab.
    Highlight the scan log entry.
    Click - Open.
    The scan log will appear in Notepad.
    Copy and paste it in your next post.

    Depending on what shows up in your Malware logs - we may need a Malware expert to check the logs and run other scans
     
  7. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    Hello,

    After typing in sfc(space)/scannow in the command prompt I got two pop up windows.

    --The first said: Windows File Protection: Please Wait while Windows verifies that all protected Windows files are intact and in their original versions

    --The second said: Windows File Protection: Files that are required for Windows to run properly must be copied to the DLL Cache. Insert your Windows XP Professional Service Pack 3 CD now.

    I just need to verify that I should insert the CD at this point, I do not want to make a mistake and harm my PC so I 'm going step by step. The CD that I have says the following: Windows XP Professional For Refurbished PCs (my PC is refurbished) Includes Service Pack 3

    Also, will all of my files be gone? Will I need to reinstall everything? I just want to be sure that I know what will happen. Also will I be able to access the internet? The computer that I'm using to contact you is the one in question.

    Thank you
     
  8. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    The Cd that you would need to use is a Windows XP Professional Service Pack 3 CD.
    The Cd for 'Refurbished' Pcs - will re-install Xp and all files and data will be lost.

    Is there a Manufacturers name on the Cd - what does it say apart from 'Windows XP Professional For Refurbished PCs?'

    When was Win Xp installed on the Pc?
     
  9. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    The CD says: For distribution only with a Refurbished PC. Product support for this software is available from Microsoft. Please visit http://support.microsoft.com, c2008 Microsoft Corporation, Part No. X14-66865

    The CD case has a sheet of paper that says the following: Use the enclosed genuine version of Windows XP Professional only with a Refurbished PC. The refurbisher must have preinstalled the software on the PC. Use the enclosed CD only for your back-up purposes.

    I have had the PC since 2010, it came with a battery and AC power supply, the Windows XP Professional CD for Refurbished PCs, and the Master Recovery CD.


    Thank you
     
  10. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    To copy files to the DLL Cache - you will need the Windows XP Professional Service Pack 3 CD not the "Refurbished Cd".

    At start up does it give you an Event ID - something like this?
    Windows File Protection Error message
    Source: Windows File Protection
    Event ID: 64033
    Description: Windows File Protection could not be initialized. The specific error code is 0xc000000f.

    Check Event Viewer.
    Start button - Run -Type
    eventvwr.msc

    Click on System [left hand column]
    Scroll down to the first mention of Windows File Protection - it will show under Source.
    Right click Windows File Protection > Properties.
    Write down what it says under Description.
     
  11. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    At start up there are no error messages, it starts up normally and runs fine. I do not know what is causing the Windows File Protection pop ups. So far today there are no pop ups.


    So far today there is no mention of Window File Protection in the event viewer, the last incident was yesterday so I'll give you the information for the first mention of it yesterday:

    Date: 12/19/2012 Source: Windows File Protection
    Time: 8:53:51 AM Category: None
    Type: Information Event ID: 64021
    User: N/A
    Computer: (My computer name)

    Description:

    The system file c\windows\system32\c_863 nls could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.] This file is necessary to maintain system stability.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

    Here is the list of all the other files that could not be copied in the order that they appeared in the event viewer (they all start with c:\windows\system32\...

    c_865.nls
    c_866.nls
    c_869.nls
    c_874.nls
    c_875.nls
    c_932.nls
    c_936.nls
    c_949.nls
    c_950.nls
    d3d8.dll
    ddeml.dll
    d3dim.dll
    d3dpmesh.dll
    d3dramp.dll
    dbnetlib.dll
    dcomcnfg.dll
    ddeshare.exe
    debug.exe
    defrag.exe
    dfrgres.dll
    dfrgui.dll
    dgnet.dll
    dgrpsetu.dll
    dgsetup.dll
    dhcpmon.dll
    dhcpqec.dll
    dhcpsapi.dll
    diantz.exe
    dimap.dll
    dimsroam.dll
    dmdskres.dll
    diskpart.exe
    diskperf.exe

    ...and they all have the same error code: 0x00000000

    -----------

    I just noticed there is another event that was logged yesterday that had not been logged previously:

    Date: 12/19/2012 Source: SideBySide
    Time: 9:54:12 AM Category: None
    Type: Error Event ID: 36
    User: N/A
    Computer: (My computer name)

    Description:

    The assembly x86 Microsoft Windows Networking RtcRes_6595b64144ccf1df_5.2.2.3_en_16124bc0 has missing or invalid files; recovery of this assembly failed.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

    there is a list of these as well, here is the list in order that they appeared in event viewer:

    All of the following start with: The assembly x86 Microsoft Windows Networking...

    RtcDll_6595b64144ccf1df_5.2.3-x-ww_d6bd8d95
    Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7
    GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13
    CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d03
    CPlusPlusRuntime_6595b64144ccf1d_7.0.0.0_x-ww_2726e76a
    Common-Controls_6595b64144ccf1d_6.0.2600.5512_x-ww_35d4ce83
    Common-Controls_6595b64144ccf1d_6.0.0.0_x-ww_1382d70a
    GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c

    This las one start with: The assembly x86 Microsoft Tools. VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1d_6.0.0.0_x-ww_ff9986d7

    ...and they all end with: has missing or invalid files; recovery of this assembly failed.

    ---------

    While going through the event viewer log I notice that there is another error message that appears at every start up, I will record the details of the first instance of it's appearance here:


    Date: 12/15/2012 Source: Service Control Manager
    Time: 1:17:08 PM Category: None
    Type: Error Event ID: 7026
    User: N/A
    Computer: (My computer name)

    Description:

    The following boot-start or system-start driver(s) failed to load: PCIIde

    For more information see Help and Support Center....

    So far today the only error message in the event viewer log is the one about the missing driver

    Thank you
     
  12. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    Ok before we try and deal with the Windows File Protection errors.

    Download MalwareBytes and SuperAntiSpyware as suggested in post # 5.
    And then post the log files.
     
  13. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    Here are the log files:

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 12/20/2012 at 11:12 AM

    Application Version : 5.6.1014

    Core Rules Database Version : 9771
    Trace Rules Database Version: 7583

    Scan type : Quick Scan
    Total Scan Time : 00:09:32

    Operating System Information
    Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
    Administrator

    Memory items scanned : 536
    Memory threats detected : 0
    Registry items scanned : 32878
    Registry threats detected : 0
    File items scanned : 7340
    File threats detected : 0


    -----------------------

    Malwarebytes Anti-Malware (Trial) 1.65.1.1000
    www.malwarebytes.org

    Database version: v2012.12.20.10

    Windows XP Service Pack 3 x86 NTFS
    Internet Explorer 8.0.6001.18702
    user :: USER-FF3E04ECC0 [administrator]

    Protection: Enabled

    12/20/2012 11:31:14 AM
    mbam-log-2012-12-20 (11-31-14).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 196519
    Time elapsed: 10 minute(s), 7 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 6
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{5BE1ED16-E6DD-4C4E-A596-6CFD5EE7C1EE} (PUP.LivingPlay) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5BE1ED16-E6DD-4C4E-A596-6CFD5EE7C1EE} (PUP.LivingPlay) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.BHO (PUP.Codec.PR) -> Quarantined and deleted successfully.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)

    Thank you
     
  14. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    Without the Windows XP Professional Service Pack 3 CD I cannot see how you can replace these files.
    .
    As the Windows File Protection error states.
    "Files required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files"

    I will keep checking for other solutions.
     
  15. psylock

    psylock Thread Starter

    Joined:
    Dec 19, 2012
    Messages:
    166
    I did a search in Windows explorer and I have all on these files, for some reason they are not being recognized, also I have not gotten any Windows File Protection error messages so far today.

    Thank you
     
  16. blues_harp28

    blues_harp28 Trusted Advisor

    Joined:
    Jan 9, 2005
    Messages:
    18,417
    Did you make any hardware or software changes to your Pc - that may have altered the files listed above?
     
  17. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1081605

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice