|
Note! If you're now running Windows XP with SP2, see this article:
Disabling System File Protection in Windows XP with Service Pack 2 Installed
This is not an article to explain how System
File Protection works in Windows XP, but on how to disable this feature
(which is enabled by default), if you need or want to. There is some
misinformation on the net on how to do this. This article will show you
the right way that works with no need for any third party program. Many
system files such as dlls, exes ,ocx, sys and other file
types as well, are designated as protected system files which means they
cannot be deleted or replaced. You can easily tell if a file is protected
by deleting it and seeing if it comes back. If it does, that file is protected.
Why Disable File Protection?
First of all, I want to make it clear that
I am not recommending that everyone should disable Windows File
Protection, but there are situations where killing this protection may be
useful.
Here are some examples:
- You want to
replace a certain dll or exe file with one of a different version.
A recent example from my Wintips group is a post by a user who couldn't
even replace a game file in XP with one from 98. Or you want
to replace Notepad with your own text editor with the same name but no
way can you do so. These two examples illustrate the extreme reach of
Windows File Protection. Not even such simple non critical files can
be modified, replaced or deleted. More commonly, however, it is a more
essential file that you need to replace with a valid different version.
Yet another example is from someone who could not replace a problem dll
in Internet Explorer.
- You install some new program or
drivers and the install fails—your computer may freeze or hang—because Windows XP was unable to update some system protected
files with the versions needed by the program.
- You are a power
user who likes to customize the Windows GUI (modify icons, dialog boxes,
strings, etc) on your own by editing system files, such as shell32.dll.
Those are just a few common examples. The
most common reason is probably a valid need or desire to replace a system
file.
You will definitely know when Windows File
Protection is preventing you from replacing a file; because, if
you try to delete such a file, it will magically reappear (a replacement
is made from the dll cache directory; or, if the file doesn't exist
there, you may be prompted to insert your Windows XP CD). If you
would like to test this, try deleting notepad.exe (back it up if
this worries you). You will see that it always comes back after deletion.
This method assumes a basic understanding
of registry editing, hex editing, and working at a command prompt.
However, I will keep the newbie in mind
and show how to hex edit the necessary file using UltraEdit.
- Locate the file SFC_OS.DLL which should
be in your System32 folder.
- Copy it and name it SFC_OS.BAK. Now open
this .bak file using a hex editor—UltraEdit
is the one I will use in this article, but you can use any hex editor.
If you don't have one, just do an internet search for free hex editors. This is an extremely
simple edit and does not require any editor with advanced features.
All we need to do is change two values.
- The location of these values will vary,
depending if you are using Windows XP without the Service Pak or Windows
XP with Service Pack One (SP1), but the actual hex values to change will
be the same.
For Windows XP with no Service Pack installed:
Go to offset 0000E2B8 (E2B8 hex)
For Windows XP with SP1:
Go to offset 0000E3BB (E3BB hex)
At those offsets, change the hex values
8BC6 to 9090.
Note! Depending on
your hex editor, you may see the value separated by a space as 8B
C6)
If you can't find the values, do not proceed.
It could be that your version of XP is different. This edit as described
here only applies to English retail versions of Windows XP.
Here's an example for the newbie on how
to edit SFC_OS.DLL
in Windows XP using UltraEdit, which you can download here: http://www.ultraedit.com/downloads/ (45
day free trial).
With the file opened in UltraEdit, click
Search > Goto Line/Page and type:
0xE2B8
(if you are using
Windows XP with no service pack)
Or...
0xE3BB
(if you are using
Windows XP with SP1)
Click OK.
This will take you directly to the values
to edit—8B and C6
Then click Search > Replace. Enter 8BC6
in the "Find What" field and 9090 in
the "Replace With" field.
Click Find Next (not Replace) to be sure
it takes you to the correct values which it should highlight.
Once you see the correct values selected,
click Replace.
As you can see 8B and C6 have now been replaced
with 90 90.
Close and Save the
file.
Now you must replace the original sfc_os.dll files with your edited ones.
You may have to use the recovery console
to do this or you can try closing Explorer and using the command window.
For instructions
on how to do this, see this article: http://personal-computer-tutor.com/abc3/v31/vic31.htm.
The easiest way would be to have
a dual boot with XP and 9x, both on FAT systems.
Then you can just do a copy-paste right from Windows 9x. Personally, I used the recovery console
when I first tested this.
The file exists in two directories—system32 and dllcache. You must replace both files.
Command Prompt Method
This assumes Windows XP is installed on
the c: drive and that the file you edited is named sfc_os.bak and is in your
System32 folder.
At the C: prompt, first switch to the system32
directory.
C:\> CD WINDOWS\SYSTEM32
Then type:
copy sfc_os.bak sfc_os.dll
Next type
copy sfc_os.bak dllcache\sfc_os.dll
Once copied, reboot.
Next Step is the Registry Editing
Click Start > Run and
type regedit.
Go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon
In the right hand pane, if it doesn't exist,
create a new Dword value named:
SFCDisable
Double click it and for value data, enter
FFFFFF9D
Then reboot.
This will now disable system file protection
permanently and allow you to edit, delete or replace system files normally
protected by the System File Protection feature.
To re-enable, just change the value data
to 0.
P.S. I wrote a related article for ABC
that shows how you can delete problem avi and other files in Windows
XP.
You can read it here:
http://personal-computer-tutor.com/abc3/v31/vic31.htm
|
