cancel
Showing results for 
Search instead for 
Did you mean: 
georgieb
Level 7
Report Inappropriate Content
Message 81 of 265

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

Have been reading through the many, many pages of this thread & figured I'd just post this comment at this end, as a postscript?. Who knew that my "network connectivity" problem reported 2 months back on a separate thread (caused by WFP) was actually caused by McAfee; well yes, it was suspected as it surfaced with Security Centre 11. It was never actually resolved, I just found a "weekly" workaround that requires me to reinstall my network driver, after WFP replaces it, after McAfee has updated. No, I didn't plan to live this way forever but was monitoring for  current "issues" re. McAfee & Halleluiah ! here's the one that matters I Fortunately I have had mostly "file could not be verified as WFC is shutting down" messages, as opposed to the "file replacement" damage experienced by many quoted here. The level of WFP activity I was observing, while trying to figure out this network problem, however is now understood, sort of, not really, not clear exactly what McAfee is actually doing & "why/".

At this point I am conflicted. My Subscription runs out in one week; I must decide about renewing; I am being asked to pay 50% more than I paid last year for a service which is responsible for the bulk of my PC investigating/debugging activity (on Software which is supposed to do some of that work for me) & much more than I had ever planned to expend. Is this "thing" close to resolved (or even understood) ? Informed feedback would be appreciated. Tx. GB

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

Hello all,

I am another WIN XP user with Windows File Protection problem. It started with a McAfee update on 08/08/2011. My system is as follows:

Dell XPS 410

Win XP Media Center Edition, Ver 2002, SP 3

Dell Dimension DXP061

Intel Core 2 CPU, 6600 @ 2.40 GHz, 2.39 GHz

3.0 Gb RAM,   926 Gb Disk Drive

All windows updates are current.  I have 3-User McAfee Internet Security. I only run VirusScan. I do not run any other McAfee add-on, firewall, anti-spam, etc....Here is my "about" box:

McAfee Security Center

Version 11.0

Build 11.0.572

Affid: 716

Lang: en-us

Last Update 8/5/2011

- - - - - - - - - -

McAfee VirusScan

Version 15.0

Build 15.0.291

Last Update: 8/17/2011

DAT Ver: 6440

DAT Creation Date: 8/16/2011

Boot DAT Version: 6432.000

Boot DAT Creation Date: 8/8/2011

Engine Version: 5400.1158

- - - - - - - - - -

More details about my problem:

As stated, this started on 08/08/2011. My McAfee update is set to "Download updates but notify me before installing".

I saw the update notice, clicked to install the update, and after it said that computer required a re-start.

I chose restart later, dismissed the dialog, and turned off the computer.

THe next day, upon startup I started to get the Windows File Protection messages. I found this forum thread several days ago, and have read all of the content in here.

I have taken a MER log, I have a 1.9 MB TGZ file available if the moderator wants it.

Today I also became aware that like others, that the Windows File Protection messages occur on the re-start following a McAfee update.  After the second re-start, the computer seems happy. I also observed the string of 64008 events on the shutdown immediately after the McAfee update

I ran the SFC /SCANNOW and it kicked the following into my event log. A bunch of 64021, then 64020 and 64005 on ehtray.exe, and a final 64021

- - - - - - - -

SFC /SCANNOW results in Event Log

Event ID: 64021

Description: The system file <filename> could not be copied into the DLL cache.

The specific error code is 0x000004c7 [The operation was canceled by the user.]

This file is necessary to maintain system stability.

c:\program files\windows media player\mplayer2.exe

c:\program files\windows media player\npdsplay.dll

c:\program files\windows media player\npwmsdrm.dll

c:\program files\windows media player\npdrmv2.dll

c:\program files\windows media player\wmpns.dll

c:\windows\ehome\ehcircl.dll

c:\windows\ehome\zh-chs\ehepgdat.resources.dll

c:\windows\ehome\de\ehepgdat.resources.dll

c:\windows\ehome\fr\ehepgdat.resources.dll

c:\windows\ehome\ja\ehepgdat.resources.dll

c:\windows\ehome\ko\ehepgdat.resources.dll

c:\windows\ehome\ehiepg.dll

c:\windows\ehome\ehituner.dll

Event ID: 64020

Windows File Protection scan found that the system file <filename> has a bad signature.

This file was restored to the original version to maintain system stability.

c:\windows\ehome\ehtray.exe The file version of the system file is 5.1.2715.2765.

Event ID: 64005

The protected system file <filename> was not restored to its original, valid version

because the Windows File Protection restoration process was cancelled by user interaction,

user name is <my login ID>.

c:\windows\ehome\ehtray.exe The file version of the bad file is 5.1.2715.2765.

Event ID: 64021

c:\windows\ehome\snchk.exe

- - - - - - - -

Today, after an Update, I saw the following string of 64008 in the Event Log at shutdown

Event ID: 64008

The protected system file <filename> could not be verified as valid

because Windows File Protection is terminating.

Use the SFC utility to verify the integrity of the file at a later time.

c:\windows\system32\mfc42.dll

c:\windows\system32\sclgntfy.dll

c:\windows\system32\drprov.dll

c:\windows\system32\ntlanman.dll

c:\windows\system32\ntlanman.dll

c:\windows\system32\netui1.dll

c:\windows\system32\netrap.dll

c:\windows\system32\davclnt.dll

c:\windows\system32\kbdus.dll

c:\windows\resources\themes\luna\luna.msstyles

- - - - - - - -

My system seems to work fine when I dismiss the WFP dialogs. Usually at startup it is ehtray.exe file validation messages in the Event Log. I agree with the others, that this is pathetic that McAfee could release code that would bungle up the XP system to this extent.

Moderators, please contact me if you want my MER log

Reliable Contributor Peacekeeper
Reliable Contributor
Report Inappropriate Content
Message 83 of 265

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

At this time I think they have enough logs. I cannot see why some have heaps of errors and I have 2 screen saver errors . Strange.

Will keep all updated if I hear anything

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

Has anyone tried turning off Real Time Scanning, rebooting, and checking the Event logs for the WFP errors disappearing?

Thanks,

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

Hi Doug

I am in-between recieving updates now, so my WFP messages and event log is quiet.

I just did disable real-time scanning and did a reboot.  As expected, nothing in event log.  I will re-post after I have completed an update and let you know what happened.

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

Hey Doug

After your note last nite, I did disable real-time scanning, and did a re-boot.  Later on in the evening, there was a McAfee update waiting.  I clicked to install the update, waited about 5 minutes, then shut down the computer.

THis morning, I started it up, and checked event log.  There were no 64008 at shut down last night (or after startup this AM), and (obviously) this morning there are no WFP popup dialogs showing either.

To be clear, (for me) the WFP problems all occur on the single cycle of shut down then restart AFTER receiving the updates.

1) computer (event log) happy

2) click to install McAfee update (I have update set to "download & notify, but do not install")

3) Dont see WFP messages until 64008 in event log during shutdown

4) Next start-up I will see WFP popups, and matching entries in event log

5) All subsequent shut-down and re-start the computer seems happy, no WFP activity in event log.

regards,

Larry

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

An interesting observation about my setup - I do not think I saw any comments about this in the discussion, but my problem definitely started after taking an update on 8/8/2011.  My McAfee ABOUT information contains this:

Boot DAT Version: 6432.000

Boot DAT Creation Date: 8/8/2011

Is this fishy or interesting to debug or problem-solve the issue?

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

I was able to reproduce it once, but now my XP machine no longer gets the messages. Seems like there is a 3rd variable to the equation.

When I reproduced it, Windows was applying 103 updates and had a bunch of stuff in pendingfilerenames.

Once Windows finished updates all reboots afterwards come back with no Event ID 64008.

Since I have it on VMWare I will try to go back to an old snapshot and hopefully relive it.

Thanks,

Greens
Level 9
Report Inappropriate Content
Message 89 of 265

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

Doug.....When you get to the bottom of this and can hopefully put a stop to the 64008 errors on shutdown.....I'm wondering if you will also be able to come up with a fix for those of us who are also missing system files?  Many of us don't have the CD needed to replace them and SFC is requesting it.  I am running Windows MCE 2002 SP3 but my system came preinstalled with MCE 2002 SP2.  I have an OEM version of the MCE 2002 SP2 which I got with my computer when I bought it.  From what I understand, my OEM CD (on 1 disk, not 2 like some MCE 's have) cannot be streamlined to be brought up to date with the SP3 that I got via a big download on the internet.  I have experienced the 64008 errors on shut down and am missing system files.  My problems began after August 8.  I am missing many of the same files that have been mentioned by two other posters.  One is for Windows Media Player and the others relate to MCE.  The 64008 errors point to a luna.dll and a kbdus.dll, mentioned by other posters.  Other 64008 errors pop up from time to time on shut down but those are the main two.  I don't know if this will be of any help to you in solving this or not but I thought I'd toss it in.

Highlighted
georgieb
Level 7
Report Inappropriate Content
Message 90 of 265

Re: Files that are required for Windows to run properly have been replaced by unrecognised versions. To maintain system stability Windows must restore the original versions of these files.

Jump to solution

I have seen Aug 8th mentionned in more than one post. I want to point out that I have been experencing this issue since June 16th (2 months ago) when I posted a separate item here re. loss of network connectivity (caused by WFP replacing a file) after Security Centre updated to Version 11. I have had numerous 64008 warnings then & since, always related to the 2 files you mention (luna.dll & kbdus.dll); the 64001 message telling me that my Network Driver has been replaced, needless to say, causes the most grief.

There appears to be some type of pattern here (re. the above 2 aforementinned files). I've seen much feedback here re. investigation but haven't run across anything yet that explains (unless I missed it in the many, many pages of this post). I am anxious to understand (read be reassured), as my subscription is about to expire.

Why or how is McAfee causing this to happen ? Any answer that makes sense would be appreciated. GB.