Microsoft added a new feature to Windows 2000 and XP (all builds) called
Windows File Protection (WFP), part of System File Checker (SFC). The WFP role
is to protect the OS by preventing "misbehaved" applications and unexperienced
users from replacing vital system files with older or incompatible versions.
On the downside, WFP also blocks valid system files replacements, which in
normal conditions do not threaten OS integrity.
FYI: This applies ONLY to the U.S. English final (Gold/RTM) Windows 2000 + XP
releases, NOT beta/RCx, and CAN be achieved EXACTLY as described below,
contrary to this TweakHound article:
http://www.tweakhound.com/xp/xptweaks/supertweaks5.htm
which unfortunately tries to convince you of the opposite.
WARNING: By modifying Microsoft copyrighted files you will BREAK the EULA,
VOID your software warranty and FORFEIT your right to benefit from tech
support!
DO THIS AT YOUR OWN RISK!
MAKE A FULL BACKUP OF YOUR WINDOWS 2000/XP SYSTEM BEFORE GOING ANY FURTHER!
To disable WFP in Windows 2000/XP, just follow these 2 steps:
1. First you need to manually "patch" (hex-edit) BOTH SFC.DLL (Win2000 with
SP2) or SFC_OS.DLL (WinXP with or without SP1) files from the
%\systemroot%\System32 folder (default is C:\Windows\System32) AND from
%\systemroot%\System32\Dllcache to effectively disable WFP.
Windows XP Service Pack 1 (SP1):
http://www.microsoft.com/windowsxp/p...vicepacks/sp1/
Windows 2000 Service Pack 2 (SP2):
http://www.microsoft.com/windows2000...vicepacks/sp2/
Here we go:
- Load SFC.DLL (or SFC_OS.DLL) into your favorite hex editor.
I recommend the excellent XVI32 (freeware):
http://www.chmaas.handshake.de/delph...vi32/xvi32.htm
- SFC.DLL from Win2000 SP2: go to physical offset 00006211 (6211 hex) and
change the 8BC6 bytes to read 9090.
- SFC_OS.DLL from WinXP retail: go to physical offset 0000E2B8 (E2B8 hex) and
change the 8BC6 bytes to read 9090.
- SFC_OS.DLL from WinXP SP1: go to physical offset 0000E3BB (E3BB hex) and
change the 8BC6 bytes to read 9090.
WARNING: If the actual bytes found in your DLL file DO NOT MATCH these values
EXACTLY DO NOT make ANY changes!
- Save your work and exit the hex editor.
- See "MS IE 5.5 SP2 + 6.0 FIX" step 6. SOLUTION in MYTIPS95.TXT (included)
to learn how to replace Windows 2000/XP system files already in use.
- Reboot when done.
2. Modify the "SFCDisable" Registry Value: this step is MANDATORY for BOTH
Windows XP (with or without SP1) AND Windows 2000 (with or without SP2):
A. Manual FIX [courtesy of Franklin (
[email protected])]:
"To disable WFP, start Regedit or Regedt32 and go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Add/modify the "SFCDisable" DWORD [REG_DWORD] Binary entry to read FFFFFF9D.
Reboot when done.
To (re)enable WFP modify "SFCDisable" to read 0."
These are all allowed "SFCDisable" values:
- 0 = enable WFP/SFC.
- 1 = disable WFP/SFC with nag prompt at (re)boot to reenable it.
- 2 = disable WFP/SFC without nag prompt at (re)boot to reenable it.
- 4 = enable WFP/SFC but disable all popups.
- FFFFFF9D = disable WFP/SFC completely.
B. Automatic FIX: get WfpAdmin for Windows 2000/XP (shareware):
http://www.collakesoftware.com/CSdow...m#Undocumented Win32 Information and Examples
More info:
- MSKB: Registry Settings for Windows File Protection:
http://support.microsoft.com/?id=222473
- Collake Software: Disable Sfc Guide:
http://www.collakesoftware.com/files/sfcinfo.txt
- Collake Software: Sfc Patch Guide:
http://www.collakesoftware.com/sfcpatch.htm
- Ars Technica: Managing + Disabling Windows File Protection:
http://www.arstechnica.com/tweak/win...ble_sfp-1.html
- Overclockers Club: Disable System File Checker In Windows XP:
http://www.overclockersclub.com/disa...echecker.shtml
- MSKB: Verify That Windows File Protection Is Running in Windows 2000:
http://support.microsoft.com/?id=318767