dobbelina

http://www.bitsum.com/wfpreplace.php Consider my problem solved, works wonders on sp3.

I only had limited time today, but i did some quick work with Process Monitor. XPlite indeed query the sfc_os.dll a lot, but doesn't write/change it. Will do some more snooping tomorrow. Just found this little gem http://www.bitsum.com/wfpreplace.php Don't know if it works on SP3...

If it were that simple i'd stumble on it while googling.

Here's the SHA1 for Greek XPPRO Retail SP3 Official MSDN release: SHA1: 254A501BABF9716F9B3C9C73CADC4900A21FB73C Find that, and you're a happy camper

I've been running some reg/file snapshot utilities, in order to find out how XPlite disables WFP "On the fly" (No restart neccesary) the way it does, but haven't been able to figure it out? What's most impressive/confusing is the fact that sfc_os.dll and the other sfc files aren't touched either. Simply replicating the added registry entries created by XPlite doesn't work. There's something else, BUT WHAT ? If there's a similar smaller utility that does this on SP3, preferrably one that can be scripted in command line, i would like to know about it. Not interested in ones that changes systemfiles, as i assume XPlite doesn't. Any suggestions ?