[verfee]

Just wanted to know what Nlite does to disable Windows file protection so I can enable it again, I know it sets "SFCDisable" to equal "ffffff9d" in the registry but there is more to it because changing this value and restarting has no effect.

[bledd]

http://www.msfn.org/...showtopic=71095

look at the bottom..

[rehbar]

you can renable it by setting it to 0 rether then ffffff9d

[verfee]

bledd, on Mar 30 2006, 10:13 PM, said:

http://www.msfn.org/...showtopic=71095

look at the bottom..

No, I want to enable it.

I want to know what nlite does to disable file protection, I see the single registry entry there but there seems to be more to it, hence why I'm here.

rehbar, on Mar 30 2006, 11:17 PM, said:

you can renable it by setting it to 0 rether then ffffff9d

I can't understand what you're saying.

[andrewpayne]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:00000000


Copy and paste the above to a text file and rename with 'reg' extension - double click to apply the new setting.

[verfee]

Bledd I found what you were referring to, you could have explained a little better considering there wasn't any description of the app and if it's capable of re-enabling WFP. Suffice to say it doesn't work because it thinks WFP is enabled when it isn't, I made sure by renaming a protected file (calc.exe) to another name and waiting for a replacement by windows, it doesn't.

andrewpayne, on Mar 31 2006, 12:38 AM, said:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:00000000


Copy and paste the above to a text file and rename with 'reg' extension - double click to apply the new setting.

That won't work because it isn't a registry script.

This post has been edited by verfee: 30 March 2006 - 08:54 AM

[bledd]

my appologies for the link to that app, didn't open it, but have now..

should be called SFC Disabler, not SFC Switcher...

[dontasciime]

You would need to get the older version of sfc_os.dll file, search on google, as you have to patch the dll file, it shows you which bytes need patching , more importantly for you it show you the original values, so you could patch them back to normal, then use the registry, although i am not sure how nlite does it, maybe get my sfc and replace yours in safe mode, though mine ends in 0 and not 2160, though mine is def from a sp1 install which is what your supposed to have and not the sp2 one whos file version ends in 2180.

Attached File(s)

•  sfc_os.zip (53.4K)
  Number of downloads: 21

[Falcon4]

I needed some help with this too. Turns out that every single computer in my house has a disabled SFC, and I needed to run sfc /scannow on one of my computers. I thought disabling SFC only disabled "active scanning" and you still had the option to run it. Guess not.
(I got an error, saying "The specific error code is 0x000006ba" and that the RPC service could not be contacted - in case someone like me goes searching for this solution.)

I fixed it by running the patch program in the first reply; it thought my SFC was enabled so I allowed it to "re-patch" it, then I immediately turned around and had it un-patch SFC. Rebooted, and now SFC is performing a scan just fine.

edit: Attached the file I'm referring to.

edit edit: Correction. Now it's constantly asking for the Windows XP CD, saying I don't have it inserted (I even put in my completely-official CD and it denied it). Something's majorly screwed up...

Attached File(s)

•  WFPswitch.exe (30.51K)
  Number of downloads: 41

This post has been edited by Falcon4: 11 April 2006 - 01:55 AM

[jaclaz]

verfee said:

I know it sets "SFCDisable" to equal "ffffff9d" in the registry but there is more to it because changing this value and restarting has no effect.

The above applies ONLY to elder versions, with a patched SFCx.DLL:
http://www.winguides...isplay.php/790/
but it is inconvenient, as every newish SP will change the address to be patched.

Read these:
http://pubs.logicalexpressions.com/Pub0009...icle.asp?ID=290
http://pubs.logicalexpressions.com/pub0009...icle.asp?ID=510


The "new" method is derived from an idea of Damian Bakowsky:
http://www.d--b.webp...l/index2_en.htm
http://www.d--b.webp...everse04_en.htm
(making an EMPTY sfcfiles.dll)

I passed the info to Fred Vorck:
http://www.vorck.com/remove-ie.html
who bettered the coding and the method found it's way into Nuhi's Nlite:

Quote

A friend who wishes to go uncredited for making "our" versions of SETUPAPI.DLL and SFCFILES.DLL, as well as Control Panel Wrapper, SLEEP, REBOOT, and CHMDUMP
Nuhi, for introducing himself, and for the back-and-forth ideas that help both our projects
TommyP for HFSLIP and his efforts to keep it compatable with my files
Timo, for details describing the SETUPDLL hack that I used in the SETUPAPI hack I implement
Damian Bakowski for the initial idea of an empty SFCFILES.DLL

jaclaz

[Falcon4]

I got a headache trying to read all that information.

How do you re-enable it?! :-(

I seem to have it half-enabled. It still doesn't detect my CD, and because of that I'm stuck with a half-baked SFC that's causing me nothing but problems.

nLite's #1 problem is that 100% of its options are completely irreversible. Unlike many nLite users, I like keeping my OS installed for more than a week at a time. I don't want to have to reinstall Windows every time I need a little insignificant piece of s*** I removed back with nLite! =\

This post has been edited by Falcon4: 11 April 2006 - 04:12 AM

[Camarade_Tux]

Many things are reversible and I'm trying to make a list of things that can.
See my sig.
It is quite short right now, but I'm expanding it as often as I can.
(I should add BITS btw)

[Wesmosis]

plz SIMPLE SIGNIFICANT way to re-enable the WFP in order to let the sfc /scannow working?

[Kiki Burgh]

hi! although not directly related (/) i hope that by sharing this, it would help clarify a few things ... allow me to quote:

fdv, on Apr 11 2006, 08:09 AM, said:

On a different subject... SFCFILES.DLL by the way works on ALL versions of Windows, just to clear that up. SFC.DLL and SFC_OS.DLL are different matters entirely. You can use SFCFILES.DLL and no other modified binaries and SFC will be disabled. To recap, for the confused

To shut Windows File Protection off:
Use a modified SFC.DLL in Windows 2000
Use a modified SFC_OS.DLL in Windows XP and Windows 2003
No need for a modified SFCFILES.DLL

To disable Windows File Protection causing it to check an empty list:
Use a modified SFCFILES.DLL in ANY version of Windows
No need for a modified SFC*.DLL

For complete overkill, so that Windows File Protection is shut off AND has an empty list which it doesn't even check:
Use a modified SFC.DLL in Windows 2000
Use a modified SFC_OS.DLL in Windows XP and Windows 2003
AND Use a modified SFCFILES.DLL in ANY version of Windows

fdv, took the liberty of sharing this there is an English fileset where the above files may be extracted from ... it used to be downloadable as a separate files ... i think though the above file should do the trick, is this right, fdv? this is his site: http://www.vorck.com/remove-ie.html ... i am pretty certain, fdv will be happy to answer any inquiry ...

This post has been edited by Kiki Burgh: 06 December 2006 - 04:05 PM

[Kiki Burgh]

some additional info ... from: http://www.vorck.com/hfslip.html

Quote

SETUPAPI.DLL
This is optional, you do not have to have it. … Here is how to edit SETUPAPI.DLL to shut off setup file checking to allow you to edit system files such as LAYOUT.INF. Svajunas points out that "for Xp (SP1, SP2) and W2k3 (SP1), search for sequence 55 8B EC 8B 45 2C and replace with 33 C0 C2 30 00 2C. This should work and for future Xp and W2k3 versions."

SFC_OS.DLL (OR USE AN EMPTY SFCFILES.DLL)
This is optional, you do not have to shut off WFP. … Here is how to edit SFC_OS.DLL to shut off Windows File Protection (link coming, for now use Google). A quick word about Windows File Protection. It was designed not to thwart you, but to prevent software from changing your DLLs on you. WFP is a good thing 95% of the time. Also, if you're setting up a system for someone else, and WFP is off, how long do you think it would be before they were on the phone with you telling you that their system is "acting weird?" Alternately, instead of hacking SFC_OS.DLL, you can leave it alone and use a version of SFCFILES.DLL that is empty. Download this new SFCFILES.DLL .... I got the idea here, but there were several errors in the approach, so a programmer friend re-wrote the DLL for me. Here is the source.

and from: http://www.vorck.com/2ksp5.html

Quote

STEP SIXTEEN. (advanced. FYI only.)
Windows File Protection, Part I.
STEP SEVENTEEN. (advanced. FYI only.)
Windows File Protection, Part II.