Windows File System 'Unrecognised Versions'

[Rob Allen]

Occasionally on start up I get a message saying something
along the lines of:

Windows File System - Some files have been replaced by
unrecognised versions please insert your W2000 CD to
restore them

I insert the CD and the Splash screen opens and the only
thing to do then is hit exit.

This doesn't happen on every boot up but more often than
not.
Any suggestions?

 

[Mark Zbikowski \(MSFT\)]

What apparently has happened is that some utility you've
run (inadvertantly or not) or some installation script you've
run (inadvertantly or not) has modified or replaced some files
that have been deemed critical to the operation of the OS.
When this is detected, Windows 2000 (and later) will try
to restore the "known good" version.

When you insert the CD, two things are happening. First, the
fixup-changed-file process looks for the good version and
copies it off. Second, the shell receives the PnP notification of
something in the CD drive and then autoplays it (hence the
splash).

If you go to the event viewer (EVENTVWR), you could look
in the system event log for events that will tell you what files
were replaced.

HTH

 

[Mark Zbikowski \(MSFT\)]

One of two things is at work:
1. A virus is actively trying to change things even in
the cached (i.e., good) version. Run a virus scanner with
up-to-date virus tables.
2. The internal tables that are used to describe what is
a "good" version may be damaged. I don't know how to
fix that, but I'll ask around.

--
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

I have now worked out how to Interpret the Event Viewer
and I am getting loads of entries such as:

The protected system file c:\winnt\system32\gpkrsrc.dll
could not be restored to its original, valid version. The
file version of the bad file is 5.0.2144.1 The specific
error code is 0x800b0100 [No signature was present in the
subject].

and

The system file c:\winnt\ime\imejp\imejpcus.dll could not
be copied into the DLL cache. The specific error code is
0x800b0100 [No signature was present in the subject].

What has happened, is it a virus or something?

-----Original Message-----
What apparently has happened is that some utility you've
run (inadvertantly or not) or some installation script you've
run (inadvertantly or not) has modified or replaced some files
that have been deemed critical to the operation of the OS.
When this is detected, Windows 2000 (and later) will try
to restore the "known good" version.

When you insert the CD, two things are happening. First, the
fixup-changed-file process looks for the good version and
copies it off. Second, the shell receives the PnP notification of
something in the CD drive and then autoplays it (hence the
splash).

If you go to the event viewer (EVENTVWR), you could look
in the system event log for events that will tell you what files
were replaced.

HTH

--
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.







.