Just a quick after thought - the McAfee real time virus scanner.
Is it possible that the scanner is doing something to system files that triggers WFP in thinking a file has been modified?
WFP would then (attempt) to replace that file and write that info to the event log.
@yippeekaiyay - mate, you could try purging your driver cache (dllcache folder), which will force WFP to rebuild it but with just the files your system actually needs. Have a quick Google for the SFC /purgecache command. I cleaned mine out when this WFP problem started, in the hope that would solve the problem. It didn't as we now suspect McAfee as the underlying problem. DO NOT attempt to manually purge the dllcache folder - let SFC do it for you with the /purgecache parameter.
According to Microsoft Windows File Protection prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs and interesting fact is that Protecting these files prevents problems with programs and the operating system.
If a program uses a different method to replace protected files, WFP restores the original files. The Windows Installer adheres to WFP when installing critical system files and calls WFP with a request to install or replace the protected file instead of trying to install or replace a protected file itself.
And as far in your case – I would suggest running a windows update and install any important update for your windows , that should take care of the issue,
Could you please try the above step and report back the status so as other with this problem gets some info .
Hi Looking at my event log, Windows file protection warnings started appearing on 7/6 and from what I can see, they only appeared after DAT 6369.
Prior to that, I had been in hospital so no other updates, Macfee or Windows had been done, I went from DAT6358.0000 to 6369.0000
Interestingly enough, looking at the log I also have the error- Mcafee Scanner Service Terminated Unexpectedly just prior to the warnings appearing and would appear to have been during the update process.
I will need to look at my other machine later to see if they appear at the same time.
Thanks everyone for the inputs, I had put in SP2 windows xp cd and the pop up disappeared after that. I didnt execute sfc/scanow command. I have rebooted my computer several times and seems like pop up is not appearing any more for me.
There were some more updates from 'Mcafee' today......
I haven't received anymore WFP pop-ups, but looking at my logs from last night's shutdown, there's a WFP warning.
"The protected system file c:\windows\resources\themes\luna\luna.msstyles could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time."
This one has appeared the other times as well. I've run SFC /scannow twice since the problem first started. It doesn't appear to be resolving the issue. It's also the only one I've had since the last security center update and SFC /scannow.
A little off-topic, but regarding this 2011 update, has anyone else with XP noticed if winlogon.exe is using more CPU around the same time mcshield.exe uses CPU? I hadn't seen that before the 2011 update. Several McAfee processes including mcshield.exe load the sfc and sfc_os dlls. Wonder if it's all connected somehow.
I am still seeing the same issue as you.
I want to state again - my XP SP3 PC has run smoothly for the past 7 years and the WFP issues started 11 days ago following the Security Centre update.
I am seeing WFP messages in the Event Log, normally WFP warnings during Windows shut down and WFP success messages during Windws start up. Something is triggering the WFP process, and my suspicions are still with McAfee.
Seems like only folks affected are XP users.
Has McAfee got anything to say on this at all???
Could you please run a windows update in the machine and check if you have an update for the latest service pack or any other important update for windows security patches and let us know the status.
Thanks for replying to me.
I will do as you ask as soon as I get in tonight from work.
Out of interest - is it just me seeing this issue???
No, you are not the only one.
I am struggling with the same issue since 10-Jun (after a McAfee update).
Almost at every shut-down a bunch of the following warnings (ID 64008) is generated in the System Event Viewer:
The protected system file [path\filename] could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.
And from time to time (when the computer is just running) I am asked to insert the Windows XP Professional SP3 CD. Same pop-up as na24 is describing (but in my case SP3 instead of his SP2).
When I do so, the following warnings (ID 64004) are generated:
The protected system file [filename] could not be restored to its original, valid version. The file version of the bad file is [version.] The specific error code is 0x800b0100 [No signature was present in the subject.]
with filename = drmclien.dll and drmstor.dllMessage was edited by: gvr39 on 21/06/11 09:42:08 CDT
Yep - that's the puppy!
Glad it's not just me (in a none nasty way)
Also, so folks can Google this issue, there is a knock on affect that WFP trashes certain ATI driver files.
The upshot is that, when you reboot, your screen will be 640x480 with 4 bit colour. I added this to another thread on this forum - but that seems to be stale.
Hope we get some official feedback on this.