How to replace msvcrt.dll?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I'm trying to replace msvcrt.dll in a Windows 2000 Server with SP3. I have disabled the WFP by following the information in http://www.winguides.com/registry/display.php/790. However, msvcrt.dll is used by many processes. I run inuse.exe to replace the dll and reboot the machine. After the rebooting, the dll is still the original one. It seems to me that the OS is getting the file from somewhere. I have replaced msvcrt.dll in all the folders found by searching through the c: drive but the dll in system32 is still the old one after rebooting.

Thank you for any help.
 
Have you tried replacing it in Safe Mode ?

There should be only ONE copy of this DLL and it should be in the "System32".

This DLL destabilizes many Win32 OSs because on *many* systems you can find numerous copies
with numerous versions.

Dave



| I'm trying to replace msvcrt.dll in a Windows 2000 Server with SP3. I have disabled the
WFP by following the information in http://www.winguides.com/registry/display.php/790.
However, msvcrt.dll is used by many processes. I run inuse.exe to replace the dll and
reboot the machine. After the rebooting, the dll is still the original one. It seems to me
that the OS is getting the file from somewhere. I have replaced msvcrt.dll in all the
folders found by searching through the c: drive but the dll in system32 is still the old one
after rebooting.
|
|
| Thank you for any help.
 
David H. Lipman said:
Have you tried replacing it in Safe Mode ?

There should be only ONE copy of this DLL and it should be in the "System32".
Click to expand...

Hi

This is not correct in all cases, e.g. a msvcrt.dll found in the folder
%windir%\ServicePackFiles\i386\ is a legit copy.
 
Yes, thanx. I should have restricted the statement to "c:\program files\" or any other
installed application directory.

I often use that DLL as the basis of a proof of the "Chaos and Complex Systems" in a
computing platform postulate. That DLL is a common source of chaos in the OS because so
many vendors place a copy of the DLL in their respective destination directories instead of
making sure the latest version of the DLL is in the %windir%\system32 for NT based OSs and
%windir%\system in Win9x/ME. The directory %windir%\ServicePackFiles\i386 is not in the
executable path so it doesn't affect current operation but is used for configuration
restorations and should be equal in version to the copy found in %windir%\system32.

Dave



| "David H. Lipman" wrote:
|
| > Have you tried replacing it in Safe Mode ?
| >
| > There should be only ONE copy of this DLL and it should be in the "System32".
|
| Hi
|
| This is not correct in all cases, e.g. a msvcrt.dll found in the folder
| %windir%\ServicePackFiles\i386\ is a legit copy.
|
|
|
| --
| torgeir
| Microsoft MVP Scripting and WMI, Porsgrunn Norway
| Administration scripting examples and an ONLINE version of the 1328 page
| Scripting Guide: http://www.microsoft.com/technet/community/scriptcenter/default.mspx
|
|
 
I have already replaced all the msvcrt.dll, which has the same date/version as the one in system32, with the copy that I want to use. The system32 copy is the one that I need to use inuse.exe to replace it since it is still in use by many windows exe such as winlogon.exe and services.exe. When I run the inuse.exe, it does say that the replacement will take place after the reboot. However, the replacement does not take place after the reboot

I kind of remember that I read in somewhere that some dlls may be extracted from some files (not .dll) and do not even exist in dllcache. However, I wonder whether this special situation whether still applies since WFP is already disabled. If I find the link about this special situation, I will post it here

Thank you for any help.
 
Should be and in fact if the op replaces the dll and an older one is obtained at boot it is coming from C:\WINNT\ServicePavkFiles\i386 or C:\WINNT\system32\dllcache
 
That's funny, I don't have a DLLcache directory ! ? ! ?

Thanx for the additional info. George.

Dave



Should be and in fact if the op replaces the dll and an older one is obtained at boot it is
coming from C:\WINNT\ServicePavkFiles\i386 or C:\WINNT\system32\dllcache
 
Dave

You may want to check whether you have SFCDllCacheDir listed in th

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogo

o

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protectio

Peter
 
Replies are inline...
| Dave,
|
| You may want to check whether you have SFCDllCacheDir listed in the
|
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

No not there...

| or
|
| HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection

Under HKLM\Policies\Microsoft
There is NO "Windows NT" branch.

Dave
 
peterc said:
Dave,

You may want to check whether you have SFCDllCacheDir listed in the

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

or

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection
Click to expand...

Hi

No such value to be found in my registry (Win2k SP2).
 
Yes, its turned on.

Dave



| Dave,
|
| Forget to ask you whether you have turned on folder options to show hidden files and
folders or not. I remember that dllcache is a hidden folder.
|
|
| Peter
 
David H. Lipman said:
That's funny, I don't have a DLLcache directory ! ? ! ?
Click to expand...

Hi

If you are running Windows 2000 or XP and does not have a DllCache
folder, there is something very wrong with your OS installation...

What happens if you from the Start\Run menu, run

"%windir%\system32\dllcache"
 
My mistake -- It WAS there :-(

My bad.

Dave



| "David H. Lipman" wrote:
|
| > That's funny, I don't have a DLLcache directory ! ? ! ?
|
| Hi
|
| If you are running Windows 2000 or XP and does not have a DllCache
| folder, there is something very wrong with your OS installation...
|
| What happens if you from the Start\Run menu, run
|
| "%windir%\system32\dllcache"
|
|
|
| --
| torgeir
| Microsoft MVP Scripting and WMI, Porsgrunn Norway
| Administration scripting examples and an ONLINE version of the 1328 page
| Scripting Guide: http://www.microsoft.com/technet/community/scriptcenter/default.mspx
|
|
 
Dave you must have that folder unless you or someone else has configured Windows 2000 so that it is not there. When you run sfc /purgecache it is the dllcache folder that is effected. I have never seen a system that does not have this folder.
 
The registry entry does not appear by default. %systemroot%\system32\dllcache does get made in a default installation from the Windows 2000 CD-ROM run locally. If it don't then the article does say that it will be made AND populated once you run sfc /scannow. I have never seen a new installation not have this folder.
 
peterc reenable your Windows File protection. I will tell you how to get this file you want in for good. But please reeanble system file protection. You need to do this or what I tell you may not work.

OK so you've renabled system file protection.

Take the dll you want to be used put it in C:\hold. Make this folder if you have to. Now go to dllcache. Rename the file you are going to replace by msvcrt.dl_ Now copy the one you want to be used from C:\Hold into the dllcache folder. Do the same thing with the file in ServicePackFiles\i386. Then do the same thing with the one in system32.

Note you are in a unsupported condition if you do this but that's what you want.
 
It's there, I f**ked up :-(

Dave



Dave you must have that folder unless you or someone else has configured Windows 2000 so
that it is not there. When you run sfc /purgecache it is the dllcache folder that is
effected. I have never seen a system that does not have this folder.
 
Back
Top