System File Checker question

[dfrog]

Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored to
the original version to maintain system stability. The file version of the
system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could not
be restored to its original, valid version. The file version of the bad file
is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents of
the Dllcache directory." which makes me (novice) think, that if I run 'sfc
/scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[Guest]

The Restore probably took you back to before the last Service Pack install.
Do that service pack again.

 

[Guest]

How would one ever think system restore could possibly fix that problem,the
corrupted .dll still exists......Simply install xp cd,exit the menu,go to
my computer,
open the cdrom with xp cd,search,type in the .dll When it shows in
results,L.click
on it,in the sub-menu select "copy" Copy it to C: hd/windows You may need to
search windows before this to locate where the corrupted .dll file exist,but
usually simply moving it to windows,xp knows were it goes.

 

[dfrog]

Mark,

Thanks for your reply.
It looks as though I've given you insufficient info :-(
The System Restore issue was that System Restore did not work, and still
doesn't (could not get S/R gui to show so that I could use it), and so I
wasn't able to "System Restore" to anywhere, with the danger of taking me
back too far.
dfrog

The Restore probably took you back to before the last Service Pack
install.
Do that service pack again.

--
Mark L. Ferguson

Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored
to
the original version to maintain system stability. The file version of
the
system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file
is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
of
the Dllcache directory." which makes me (novice) think, that if I run
'sfc
/scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[dfrog]

Andrew,
Thanks for your reply.
I'm sorry but it seems I've given unclear info.
The System Restore issue was a seperate issue to this one (although there
may be some connections)
That problem was that System Restore GUI would not show, therefore
preventing me from doing S/R, so the issue then was not to try to correct
this SFC result, rather to get S/R working again.
I do not have an XP disk, the PC is a Compaq Presario with a recovery
partition, so presumably the 'erant' file replacements will be in there
somewhere, or, if the relevent files are there, will the ones in
C:\Windows\Service Pack Files be 'sound and useable'?
I do have the option of wiping this drive and cloning my original (smaller
but clean) drive onto it, but I am keen to learn from this and keen to fix
it if I can.
Hope I did a better job this time
dfrog

How would one ever think system restore could possibly fix that
problem,the
corrupted .dll still exists......Simply install xp cd,exit the menu,go to
my computer,
open the cdrom with xp cd,search,type in the .dll When it shows in
results,L.click
on it,in the sub-menu select "copy" Copy it to C: hd/windows You may need
to
search windows before this to locate where the corrupted .dll file
exist,but
usually simply moving it to windows,xp knows were it goes.

Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored
to
the original version to maintain system stability. The file version of
the
system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file
is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
of
the Dllcache directory." which makes me (novice) think, that if I run
'sfc
/scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[Wesley Vogel]

You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated service
pack files.

Make sure that ServicePackSourcePath points to C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system. Microsoft
cannot guarantee that you can solve problems that result from using Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type: regedit
| Click OK.
2. Locate the ServicePackSourcePath value under the following key in the
registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following conditions
are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included SP2 as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored to
the original version to maintain system stability. The file version of
the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
of the Dllcache directory." which makes me (novice) think, that if I run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[dfrog]

Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference, I still have the same System Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could not
be restored to its original, valid version. The file version of the bad file
is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored to its
original valid version?

I have questions popping into my head that are confusing me, hope you can
help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.

You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system.
Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
| Click OK.
2. Locate the ServicePackSourcePath value under the following key in the
registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following conditions
are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored
to
the original version to maintain system stability. The file version of
the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
of the Dllcache directory." which makes me (novice) think, that if I run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[Wesley Vogel]

Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004
http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference, I still have the same System Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored to
its original valid version?

I have questions popping into my head that are confusing me, hope you can
help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.

You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system.
Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit

Click OK.

2. Locate the ServicePackSourcePath value under the following key in the
registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored
to
the original version to maintain system stability. The file version of
the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents
of the Dllcache directory." which makes me (novice) think, that if I run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[dfrog]

Hi Wes,
Thank you some more
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi virus
but the scan did not identify any infection at all (I must admit to being a
bit disappointed at that stage - I really did want it to show me something
wrong)
So, I'm still at the same stage, but still keen to beat this little **&%$$**

dfrog (absolutely no connection to 'gratefulfrog')

Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004
http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference, I still have the same System Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element not
found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored to
its original valid version?

I have questions popping into my head that are confusing me, hope you can
help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.

You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system.
Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key in the
registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles
in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe will
look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was restored
to
the original version to maintain system stability. The file version of
the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[Wesley Vogel]

Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes,
Thank you some more
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi virus
but the scan did not identify any infection at all (I must admit to being
a bit disappointed at that stage - I really did want it to show me
something wrong)
So, I'm still at the same stage, but still keen to beat this little
**&%$$**

dfrog (absolutely no connection to 'gratefulfrog')

Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004
http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it and
re-ran SFC but it made no difference, I still have the same System Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored to
its original valid version?

I have questions popping into my head that are confusing me, hope you
can help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.



You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system.
Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key in
the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles
in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
will look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was
restored to
the original version to maintain system stability. The file version
of the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[dfrog]

Hi Wes,

Thanks again.
Unfortunately I have 'lots' of files that WFP cannot deal with in the same
way, nmasnt.dll was just an example (happened to be the first one in the
queue)
I think that my fallback plan of wiping the drive and cloning my original
smaller drive onto this one (which is what I did quite some time ago) is
looking as though it should be 'forefront' plan rather than 'fallback' plan.
I still have my original problem of System Restore GUI not showing (on this
same drive) which Bert Kinney & Robear Dyer did their best on but we
couldn't fix that either.
I'm very grateful for your time and effort (now maybe I am like
'gratefulfrog' )

Best regards

dfrog

Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for
Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it
after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes,
Thank you some more
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi
virus
but the scan did not identify any infection at all (I must admit to being
a bit disappointed at that stage - I really did want it to show me
something wrong)
So, I'm still at the same stage, but still keen to beat this little
**&%$$**

dfrog (absolutely no connection to 'gratefulfrog')

Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004
http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference, I still have the same System
Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the bad
file is 5.1.2600.2180 The specific error code is 0x00000490 [Element
not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored
to
its original valid version?

I have questions popping into my head that are confusing me, hope you
can help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.



You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system.
Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key in
the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles
in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the I386
directory because the SetUpAPI call attaches \I386 to the sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
will look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was
restored to
the original version to maintain system stability. The file version
of the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding
a
System Restore issue which we were unable to nail down, but which did
take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[Wesley Vogel]

Howdy dfrog,

Keep this in mind as an alternative. I do not use System Restore, I use
ERUNT.

Get both of these...

NTREGOPT NT Registry Optimizer
ERUNT The Emergency Recovery Utility NT
http://www.larshederer.homepage.t-online.de/erunt/

ERUNT
<quote>
Note: The "Export registry" function in Regedit is USELESS (!) to
make a complete backup of the registry. Neither does it export the whole
registry (for example, no information from the "SECURITY" hive is
saved), nor can the exported file be used later to replace the current
registry with the old one. Instead, if you re-import the file, it is
merged with the current registry, leaving you with an absolute mess of
old and new registry keys.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

NTREGOPT
<quote>
Similar to Windows 9x/Me, the registry files in an NT-based
system can become fragmented over time, occupying more space on your hard
disk than necessary and decreasing overall performance. You should
use the NTREGOPT utility regularly, but especially after installing
or uninstalling a program, to minimize the size of the registry files
and optimize registry access.

The program works by recreating each registry hive "from scratch",
thus removing any slack space that may be left from previously
modified or deleted keys.

Note that the program does NOT change the contents of the registry in
any way, nor does it physically defrag the registry files on the drive
(as the PageDefrag program from SysInternals does). The optimization
done by NTREGOPT is simply compacting the registry hives to the
minimum size possible.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt

Installing & Using ERUNT
http://www.silentrunners.org/sr_eruntuse.html

To see an illustrated registry restore procedure
http://www.silentrunners.org/sr_erdntuse.html

Take a complete registry backup using ERUNT
http://www.winxptutor.com/regback.htm

<quote>
Question: Should I disable Windows XP’s System Restore function when using
ERUNT?

Answer: Yes! Though System Restore backs up more than just the registry, the
registry is essentially all you need to revert your system to a previous
state. Advantages of ERUNT over System Restore are that each restore folder
is standalone and independent of the others, minimizing the risk of restore
failures, and that a restore can easily be done from outside Windows. Also,
ERUNT backups usually take up less hard drive space than System Restore's
restore points and may be individually deleted at any time. (Here is an
excellent site about System Restore in case you prefer to leave it enabled.)
<quote>
ERUNT and NTREGOPT FAQ
http://www.larshederer.homepage.t-online.de/erunt/faq.htm

This is the excellent site about System Restore, mentioned above.
All About System Restore in WinXP
http://bertk.mvps.org/

But you're already familiar with Bert Kinney. ;-)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes,

Thanks again.
Unfortunately I have 'lots' of files that WFP cannot deal with in the same
way, nmasnt.dll was just an example (happened to be the first one in the
queue)
I think that my fallback plan of wiping the drive and cloning my original
smaller drive onto this one (which is what I did quite some time ago) is
looking as though it should be 'forefront' plan rather than 'fallback'
plan. I still have my original problem of System Restore GUI not showing
(on this same drive) which Bert Kinney & Robear Dyer did their best on
but we couldn't fix that either.
I'm very grateful for your time and effort (now maybe I am like
'gratefulfrog' )

Best regards

dfrog

Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for
Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it
after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes,
Thank you some more
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi
virus
but the scan did not identify any infection at all (I must admit to
being a bit disappointed at that stage - I really did want it to show me
something wrong)
So, I'm still at the same stage, but still keen to beat this little
**&%$$**

dfrog (absolutely no connection to 'gratefulfrog')



Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004

http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference, I still have the same System
Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do I
misunderstand that bit?

but then, how would Windows know that this file could not be restored
to
its original valid version?

I have questions popping into my head that are confusing me, hope you
can help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when it
became available.



You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause
serious problems that may require you to reinstall your operating
system. Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key in
the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles
in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the
I386 directory because the SetUpAPI call attaches \I386 to the
sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
will look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was
restored to
the original version to maintain system stability. The file version
of the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting &
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer regarding
a
System Restore issue which we were unable to nail down, but which
did take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[dfrog]

Wes,

What can I say?
I gave you a message saying "thanks for your help but I think I'm gonna give
in on this one", and you come back with more help and advice.
I have seen and read about ERUNT and NTREGOPT before, but was reluctant to
'mess about' in this area just in case the two weren't what they were made
out to be. And I suppose if I think about it, I was waiting for someone I
trusted to give me the good word.
Now I consider that you have just done that.
I'm not going to dive into this tonight (head is spinning and not only from
PC 'delights') and it may take me some short time to get to using these, but
believe me I will.
Thanks again for everything

dfrog

Howdy dfrog,

Keep this in mind as an alternative. I do not use System Restore, I use
ERUNT.

Get both of these...

NTREGOPT NT Registry Optimizer
ERUNT The Emergency Recovery Utility NT
http://www.larshederer.homepage.t-online.de/erunt/

ERUNT
<quote>
Note: The "Export registry" function in Regedit is USELESS (!) to
make a complete backup of the registry. Neither does it export the whole
registry (for example, no information from the "SECURITY" hive is
saved), nor can the exported file be used later to replace the current
registry with the old one. Instead, if you re-import the file, it is
merged with the current registry, leaving you with an absolute mess of
old and new registry keys.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

NTREGOPT
<quote>
Similar to Windows 9x/Me, the registry files in an NT-based
system can become fragmented over time, occupying more space on your hard
disk than necessary and decreasing overall performance. You should
use the NTREGOPT utility regularly, but especially after installing
or uninstalling a program, to minimize the size of the registry files
and optimize registry access.

The program works by recreating each registry hive "from scratch",
thus removing any slack space that may be left from previously
modified or deleted keys.

Note that the program does NOT change the contents of the registry in
any way, nor does it physically defrag the registry files on the drive
(as the PageDefrag program from SysInternals does). The optimization
done by NTREGOPT is simply compacting the registry hives to the
minimum size possible.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt

Installing & Using ERUNT
http://www.silentrunners.org/sr_eruntuse.html

To see an illustrated registry restore procedure
http://www.silentrunners.org/sr_erdntuse.html

Take a complete registry backup using ERUNT
http://www.winxptutor.com/regback.htm

<quote>
Question: Should I disable Windows XP’s System Restore function when using
ERUNT?

Answer: Yes! Though System Restore backs up more than just the registry,
the
registry is essentially all you need to revert your system to a previous
state. Advantages of ERUNT over System Restore are that each restore
folder
is standalone and independent of the others, minimizing the risk of
restore
failures, and that a restore can easily be done from outside Windows.
Also,
ERUNT backups usually take up less hard drive space than System Restore's
restore points and may be individually deleted at any time. (Here is an
excellent site about System Restore in case you prefer to leave it
enabled.)
<quote>
ERUNT and NTREGOPT FAQ
http://www.larshederer.homepage.t-online.de/erunt/faq.htm

This is the excellent site about System Restore, mentioned above.
All About System Restore in WinXP
http://bertk.mvps.org/

But you're already familiar with Bert Kinney. ;-)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes,

Thanks again.
Unfortunately I have 'lots' of files that WFP cannot deal with in the
same
way, nmasnt.dll was just an example (happened to be the first one in the
queue)
I think that my fallback plan of wiping the drive and cloning my original
smaller drive onto this one (which is what I did quite some time ago) is
looking as though it should be 'forefront' plan rather than 'fallback'
plan. I still have my original problem of System Restore GUI not showing
(on this same drive) which Bert Kinney & Robear Dyer did their best on
but we couldn't fix that either.
I'm very grateful for your time and effort (now maybe I am like
'gratefulfrog' )

Best regards

dfrog

Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for
Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it
after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Hi Wes,
Thank you some more
I've been to the EventID site & followed it through, it looked good and
pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi
virus
but the scan did not identify any infection at all (I must admit to
being a bit disappointed at that stage - I really did want it to show
me
something wrong)
So, I'm still at the same stage, but still keen to beat this little
**&%$$**

dfrog (absolutely no connection to 'gratefulfrog')



Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004

http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like
the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference, I still have the same System
Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files are
corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do
I
misunderstand that bit?

but then, how would Windows know that this file could not be restored
to
its original valid version?

I have questions popping into my head that are confusing me, hope you
can help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when
it
became available.



You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause
serious problems that may require you to reinstall your operating
system. Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key in
the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files C:\Windows\ServicePackFiles
in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the
I386 directory because the SetUpAPI call attaches \I386 to the
sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
will look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that
included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft Web
site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was
restored to
the original version to maintain system stability. The file
version
of the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting
&
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if
I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer
regarding
a
System Restore issue which we were unable to nail down, but which
did take
me through their comprehensive 'cleansing proceedure'

dfrog

 

[Wesley Vogel]

dfrog, sometimes I just can't shut up, as it were. ;-) Keep having fun.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wes,

What can I say?
I gave you a message saying "thanks for your help but I think I'm gonna
give in on this one", and you come back with more help and advice.
I have seen and read about ERUNT and NTREGOPT before, but was reluctant to
'mess about' in this area just in case the two weren't what they were made
out to be. And I suppose if I think about it, I was waiting for someone I
trusted to give me the good word.
Now I consider that you have just done that.
I'm not going to dive into this tonight (head is spinning and not only
from PC 'delights') and it may take me some short time to get to using
these, but believe me I will.
Thanks again for everything

dfrog

Howdy dfrog,

Keep this in mind as an alternative. I do not use System Restore, I use
ERUNT.

Get both of these...

NTREGOPT NT Registry Optimizer
ERUNT The Emergency Recovery Utility NT
http://www.larshederer.homepage.t-online.de/erunt/

ERUNT
<quote>
Note: The "Export registry" function in Regedit is USELESS (!) to
make a complete backup of the registry. Neither does it export the whole
registry (for example, no information from the "SECURITY" hive is
saved), nor can the exported file be used later to replace the current
registry with the old one. Instead, if you re-import the file, it is
merged with the current registry, leaving you with an absolute mess of
old and new registry keys.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

NTREGOPT
<quote>
Similar to Windows 9x/Me, the registry files in an NT-based
system can become fragmented over time, occupying more space on your hard
disk than necessary and decreasing overall performance. You should
use the NTREGOPT utility regularly, but especially after installing
or uninstalling a program, to minimize the size of the registry files
and optimize registry access.

The program works by recreating each registry hive "from scratch",
thus removing any slack space that may be left from previously
modified or deleted keys.

Note that the program does NOT change the contents of the registry in
any way, nor does it physically defrag the registry files on the drive
(as the PageDefrag program from SysInternals does). The optimization
done by NTREGOPT is simply compacting the registry hives to the
minimum size possible.
<quote>
http://www.larshederer.homepage.t-online.de/erunt/ntregopt.txt

Installing & Using ERUNT
http://www.silentrunners.org/sr_eruntuse.html

To see an illustrated registry restore procedure
http://www.silentrunners.org/sr_erdntuse.html

Take a complete registry backup using ERUNT
http://www.winxptutor.com/regback.htm

<quote>
Question: Should I disable Windows XP’s System Restore function when
using ERUNT?

Answer: Yes! Though System Restore backs up more than just the registry,
the
registry is essentially all you need to revert your system to a previous
state. Advantages of ERUNT over System Restore are that each restore
folder
is standalone and independent of the others, minimizing the risk of
restore
failures, and that a restore can easily be done from outside Windows.
Also,
ERUNT backups usually take up less hard drive space than System Restore's
restore points and may be individually deleted at any time. (Here is an
excellent site about System Restore in case you prefer to leave it
enabled.)
<quote>
ERUNT and NTREGOPT FAQ
http://www.larshederer.homepage.t-online.de/erunt/faq.htm

This is the excellent site about System Restore, mentioned above.
All About System Restore in WinXP
http://bertk.mvps.org/

But you're already familiar with Bert Kinney. ;-)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hi Wes,

Thanks again.
Unfortunately I have 'lots' of files that WFP cannot deal with in the
same
way, nmasnt.dll was just an example (happened to be the first one in the
queue)
I think that my fallback plan of wiping the drive and cloning my
original smaller drive onto this one (which is what I did quite some
time ago) is looking as though it should be 'forefront' plan rather
than 'fallback' plan. I still have my original problem of System
Restore GUI not showing (on this same drive) which Bert Kinney & Robear
Dyer did their best on but we couldn't fix that either.
I'm very grateful for your time and effort (now maybe I am like
'gratefulfrog' )

Best regards

dfrog




Hi dfrog,

I was hoping that a virus would be the problem myself.

If nmasnt.dll is the only problem, I wouldn't even worry about it.
NetMeeting is ancient technology and Windows XP is the last version of
Microsoft Windows to include NetMeeting. Even the Microsoft Windows
NetMeeting 3 Readme (C:\Program Files\NetMeeting\netmeet.htm) is for
Windows
2000, Copyright 1999.

See this to remove NetMeeting.
NetMeeting - Run, Remove and Reinstall
http://www.theeldergeek.com/netmeeting.htm

You will still have C:\Program Files\NetMeeting and whatever is in it
after
removing NetMeeting. I have 21 items there.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Hi Wes,
Thank you some more
I've been to the EventID site & followed it through, it looked good
and pertinent.
I followed the Symantec instructions for the removal of Win32. pinfi
virus
but the scan did not identify any infection at all (I must admit to
being a bit disappointed at that stage - I really did want it to show
me
something wrong)
So, I'm still at the same stage, but still keen to beat this little
**&%$$**

dfrog (absolutely no connection to 'gratefulfrog')



Hi dfrog,

I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference

Case does not matter.

Can there be a reason why System Event Viewer should report:-

See the link.

Event Source: Windows File Protection
Event ID: 64004

http://www.eventid.net/display.asp?eventid=64004&eventno=1171&source=Windows File Protection&phase=1

Ignore M816197 (http://support.microsoft.com/kb/816197) it applies to
windows 2000.

And I am not suggesting that you subscribe to EventID.Net. I am not
subscribed, but they occasionally have info where MS does not, like
the
Event 64004, for example.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Thanks Wes,

I followed your points 1 - 5 exactly & found that the Value Data for
ServicePackSourcePath at that location is already
C:\windows\ServicePackFiles.
I noted that my Value was a 'lower case w' for Windows so changed it
and
re-ran SFC but it made no difference, I still have the same System
Event
Viewer results as before.
So, if this Value is correct and indeed SFC is using
C:\Windows\ServicePackFiles\I386, does this mean that these files
are corrupted?
Can there be a reason why System Event Viewer should report:-

**********
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 13/02/2007
Time: 00:00:54
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of the
bad file is 5.1.2600.2180 The specific error code is 0x00000490
[Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
*************

where [Element not found] refers to nmasnt.dll not being found in
C:\Windows\ServicePackFiles\I386 (when I can see it in there), or do
I
misunderstand that bit?

but then, how would Windows know that this file could not be
restored to
its original valid version?

I have questions popping into my head that are confusing me, hope
you can help some more.

dfrog

PS - I installed XP SP2 from a Microsoft SP2 CD that I ordered when
it
became available.



You have this folder >> C:\Windows\ServicePackFiles\i386

C:\Windows\ServicePackFiles\i386 is normally used instead of
C:\Windows\system32\dllcache
for Windows File Protection if the folder exists.

C:\Windows\ServicePackFiles\i386 contains the most recently updated
service
pack files.

Make sure that ServicePackSourcePath points to
C:\Windows\ServicePackFiles

WARNING: If you use Registry Editor incorrectly, you may cause
serious problems that may require you to reinstall your operating
system. Microsoft
cannot guarantee that you can solve problems that result from using
Registry
Editor incorrectly. Use Registry Editor at your own risk.

1. Start the Registry Editor (Regedit.exe). Start | Run | Type:
regedit
Click OK.
2. Locate the ServicePackSourcePath value under the following key
in the registry:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup

3. Double-click the ServicePackSourcePath value.
4. Enter the new location of the files
C:\Windows\ServicePackFiles in
the Value Data box and click OK.
5. Close the Registry Editor.

The ServicePackSourcePath value must point to one level above the
I386 directory because the SetUpAPI call attaches \I386 to the
sourcepath.

If the Value Data for ServicePackSourcePath is C:\, WFP and SFC.exe
will look for C:\Windows\system32\dllcache.

C:\Windows\ServicePackFiles\i386 folder exists if the following
conditions are
true:
* You installed Windows XP SP2 from a Windows XP SP2 CD that
included
SP2
as
part of the base installation.
* You downloaded and installed Windows XP SP2 from the Microsoft
Web site.
* Windows XP SP2 was included with the computer.
from...
http://support.microsoft.com/kb/916261

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In dfrog <[email protected]> hunted and pecked:
Compaq Presario

Win XP Home - SP2 - all critical updates.

I am unable to find the implications of the following and would
appreciate
some help:-

Having run sfc /scannow,

System Event Viewer gives me this >>>>>>>>

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
Windows File Protection scan found that the system file c:\program
files\netmeeting\nmasnt.dll has a bad signature. This file was
restored to
the original version to maintain system stability. The file
version
of the system file is 5.1.2600.2180.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Followed immediately by this >>>>>>>>>>>>>>


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 11/02/2007
Time: 20:46:56
User: N/A
Computer: ************
Description:
The protected system file c:\program files\netmeeting\nmasnt.dll
could
not
be restored to its original, valid version. The file version of
the bad file is 5.1.2600.2180 The specific error code is
0x00000490 [Element not found.].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and similar results for many other files.


A system scan shows nmasnt.dll in both C:\Program Files\Netmeeting
&
C:\Windows\ Service Pack Files\i386

I find this on Microsoft site >>

"If the %systemroot%\system32\dllcache folder becomes corrupt or
unusable,
use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the
contents
of the Dllcache directory." which makes me (novice) think, that if
I
run
'sfc /scannow' it will repair the contents of Dllcache directory.

I've already had much help from Bert Kinney & Robear Dyer
regarding
a
System Restore issue which we were unable to nail down, but which
did take
me through their comprehensive 'cleansing proceedure'

dfrog