sfc /scannow repeatedly stops for graphics card related system files

I debated whether to post this in the Hardware forum or the Windows XP forum. Since my goal is to get System File Checker working properly again (unattended, like it used to) and my display is working fine, the Windows XP forum gets the post.

Last year I replaced my ATI graphics card with an nVIDIA GeForce 6800 based graphics card (XFX brand 128 MB AGP 8x). I foolishly (and probably incorrectly) used "Driver Cleaner PRO" without creating backups. I used Driver Cleaner Pro to remove ATI drivers, registry entries, etc. before installing the nVIDIA drivers. I have updated my nVIDIA drivers a couple times since then.

For several months, I have been frustrated when running sfc/scannow. I am repeatedly prompted to insert my Windows XP CD, even if the CD is already in the drive. (If I cancel to skip the file, SFC quickly pops up another prompt to insert my windows CD.)

Until recently, I always gave up in the middle of the scan. Yesterday, I decided to keep clicking and discovered that I could finally reach the end of the scan. Whew!

This prompt appears for the following (taken from Event Viewer after SFC completed its task).

The system file c:\windows\system32\ati.dll could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ati.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atibt829.sys could not be copied into the DLL cache.
The system file c:\windows\system32\atidrab.dll could not be copied into the DLL cache.
The system file c:\windows\system32\atidvai.dll could not be copied into the DLL cache.
The system file c:\windows\system32\atievxx.exe could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atimpab.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atimtai.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atipcxxx.sys could not be copied into the DLL cache.
The system file c:\windows\system32\atiraged.dll could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atiragem.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atirtcap.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atirtsnd.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atitunep.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atitvsnd.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ativmdcd.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ativttxx.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ativxbar.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atixbar.sys could not be copied into the DLL cache.
The system file c:\windows\system32\nv3.dll could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\nv3.sys could not be copied into the DLL cache.

All of these except for the last two appear to be ATI related. I expect the last two are nVIDIA related.
Blue indicates c:\windows\system32\ files.
Red indicates c:\windows\system32\drivers\ files.

• I have tried pointing the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath registry key to the CD.
• I have tried pointing the SourcePath registry key to C:\ since I have my I386 folder in my root directory (which is the way I was using SFC before the graphics card installation).
• I have tried editing the C:\Windows\inf\fp40ext.inf and ims.inf files as described in http://support.microsoft.com/?kbid=897128 and with a couple other variations.
• I have tried Method 2 in http://support.microsoft.com/?kbid=900910 except I found the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackSourcePath key already was pointing to c:\windows\ServicePackFiles (instead of %windir%\ServicePackFiles) so I didn't make any changes to that registry key.

Would Method 1 in the last list item above likely do the trick? (My Windows XP Home CD is SP1.)
(However, I don't want to create a slipstreamed CD right now if there is a simpler/faster way to get SFC working unattended again.)

If there is a simpler/faster way to get SFC working unattended again, please let me know.

 

Thanks, Pete.

My current ServicePackSourcePath registry key value is c:\windows\ServicePackFiles and that folder contains an i386 folder with file dates ranging from 4/15/2002 to 8/24/2004. The top 3 file dates in my c:\windows\ServicePackFiles\i386 folder are the following dates (in order of decreasing frequency):

• 8/4/2004 (by far, most of the files have this date)
• 7/17/2004
• 3/31/2003

The file dates in my C:\I386 folder are all, of course, 3/31/2003 8:00 AM.

I am hesitant to make my ServicePackSourcePath registry key value match the image you proivided because of this difference in file dates. Would SFC replace newer files with older files if I changed the ServicePackSourcePath value to C:\ as displayed in your image?

The other two values that are highlighted in your image (CDInstall and SourcePath) already match my values.

If I get the go-ahead from you that there is no apparent danger of compromising my system, I'll change the ServicePackSourcePath value to C:\ as shown in your image and give SFC a shot.

EDIT: None of the missing files identified in my first post exist in ANY of my I386 folders so I'm not very optimistic at this time.

If your suggestion doesn't work for me, I am tempted to create a System Restore point and install some drivers (wxp-j5-30-1-b02.exe) I already have for my old ATI RAGE PRO which is the graphics card I replaced. This file is in my download folder (download date: 10/9/2005). This is the same filename as available from ATI (posted date: 4/2/2002). I may try that unless someone cautions me that I am likely to produce difficult problems by doing so. I no longer have the manufacturer's driver disk(s) for my ATI RAGE PRO card.

Alternatively, I may download and install the ATI Catalyst drivers from Major Geeks if that seems like a good thing to try.

 

Try running this:
http://support.ati.com/ics/support/...ef109fff37cbb40aaf28&accountID=737&deptID=894

Matt
(Edit: You have checked in Add/Remove Programs for any ATI software? Something is telling SFC that the Rage Pro is still installed)

 

The caution may be that removing the drivers for the ATI adapter may remove some of the files used by the Nvidia card. (See my suggestion above.)

The other side is that if you install the ATI drivers as you have suggested, at the same time you have the Nvidia drivers installed, you may corrupt the Nvidia drivers. You will then need to uninstall the ATI drivers again and it comes back to what I said in the previous paragraph.

You may need to tread very carefully. I might uninstall the Nvidia drivers, then run the ATI uninstaller. If you have any trouble with the Windows Hardware Wizard when you reboot, click Cancel and run the Nvidia drivers installation disk when you get to the desktop.

Matt

 

Thanks for helping out here, Matt. Thanks, Pete, for alerting Matt to this thread. He advised me about my AGP card before I purchased it. (He's not in any way responsible for my current predicament though.)

Thanks, after I do some more research into this problem, I will probably give this a try following the cautionary instructions you provided in your most recent post.

I did have such an Add/Remove entry but I couldn't successfully run it because it complained of a necessary missing DLL. (I don't recall which one.) I recently used driver Cleaner Pro to remove the Add/Remove entry (again, without backups) so it's now gone.

Thanks, that gives me something to go on. Any ideas where SFC looks in the registry?

I'll search my registry for mentions of ATI, including the specific files listed in my 1st post, and report them here before proceeding. Also, before modifying the registry, I'll create a backup of the entire registry and I'll see if I can find a good registry monitor that will show me a side-by-side comparison of registry changes made (such as with the ATI utility you linked). I recall using such a utility many, many years ago but I can't recall what it was. Suggestions on a good registry monitor for comparing? I'll look around at Major Geeks and see what's available there.

Thanks for the cautions, suggestions, and insight about what difficulties I might run into. I'm sure I'll create several Restore Points along the way.

 

Using Lavasoft's RegHance v2.1, I searched my entire registry for each of the files listed in my 1st post.

The search options I used were as follows:

• Keys (checked)
• Values (checked)
• Data (checked)
• Match whole string only (unchecked)
• Case sensitive (unchecked)
• Log search results (checked)

Here's a summary of the results.

Session started on 7/28/2006,1:30:33 PM
1:54:36 PM Search for "ati.dll" returned 3 matches.
1:55:34 PM Search for "ati.sys" returned 3 matches.
1:56:16 PM Search for "atibt829.sys" returned 0 matches.
1:56:59 PM Search for "atidrab.dll" returned 3 matches.
1:57:43 PM Search for "atidvai.dll" returned 3 matches.
1:58:25 PM Search for "atievxx.exe" returned 0 matches.
1:59:24 PM Search for "atimpab.sys" returned 3 matches.
2:01:13 PM Search for "atimtai.sys" returned 3 matches.
2:01:58 PM Search for "atipcxxx.sys" returned 0 matches.
2:02:42 PM Search for "atiraged.dll" returned 3 matches.
2:03:26 PM Search for "atiragem.sys" returned 3 matches.
2:04:11 PM Search for "atirtcap.sys" returned 0 matches.
2:05:02 PM Search for "atirtsnd.sys" returned 0 matches.
2:06:01 PM Search for "atitunep.sys" returned 0 matches.
2:06:45 PM Search for "atitvsnd.sys" returned 0 matches.
2:07:22 PM Search for "ativmdcd.sys" returned 0 matches.
2:07:59 PM Search for "ativttxx.sys" returned 0 matches.
2:08:39 PM Search for "ativxbar.sys" returned 0 matches.
2:09:39 PM Search for "atixbar.sys" returned 0 matches.
2:10:16 PM Search for "nv3.dll" returned 3 matches.
2:10:54 PM Search for "nv3.sys" returned 0 matches.

In each case where there were 3 matches, they were located in the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Nls\MUILanguages\RCV2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2

I'm puzzled that several of the filename searches produced 0 results. Where else might SFC be looking? Perhaps SFC reads the hexadecimal values of the registry keys for those filenames and uses those values to try to retrieve the files that showed up as 0 matches.

Matt, it's looking like it might be best to try the ATI uninstaller via your cautionary instructions in your most recent post in this thread.

Please look over my procedure outlined below and advise.

• Create System Restore Point
• Uninstall the Nvidia drivers via Add/Remove Programs, NOT Driver Cleaner Pro
• Reboot???
• Run the ATI uninstaller
• Reboot: any trouble with the Windows Hardware Wizard, click Cancel
• Run the Nvidia drivers installation disk* when you get to the desktop
• If things go well (including SFC), create another System Restore Point.

* I have nVidia's latest drivers for GeForece 6800 (v91.31 v9.1.3.1 according to Device Manager) that I downloaded (and have currently installed). Since nVidia recommends uninstalling existing nVidia drivers before installing newer drivers, do you think it would be ok to just skip installing from the installation disk and install my downloaded drivers instead?

 

Interesting. I don't have a "dllcache" folder in C:\WINDOWS\system32. (I do have "Show hidden files and folders" enabled in Windows explorer.)

I agree. I will certainly uninstall/delete it when this troubleshooting is over.

I just tried that, got a popup and cancelled SFC. Event Viewer shows several "64021" event ID errors about being unable to copy files (different files than in my first post) to the DLL cache but they didn't produce popups. ???

The first of those errors:
The system file c:\program files\common files\microsoft shared\web server extensions\40\isapi\_vti_adm\admin.dll could not be copied into the DLL cache. The specific error code is 0x800b0100 [No signature was present in the subject.]. This file is necessary to maintain system stability.

For now, I changed the ServicePackSourcePath registry key back to c:\windows\ServicePackFiles.

THANKS, I'll use it.

OK, I'll consider that after I hear back from Matt. There are LOTS of registry keys that contain the string "ati" though so I'm pretty hesitant to try that before trying Matt's suggestion.

 

Aha! Thanks, Pete! I did have that box unchecked at one time. Apparently I had re-checked that box some time ago and forgot. (Since I like to tinker, I must have decided keep those out of sight...even if they are in blue.)

I downloaded Macecraft's jv16 PowerTools 2006 (with handbook).

I noticed there is also a jv16 PowerTools 1.4 on Macecraft's Downloads page but I didn't see any comparison between that and the 2006 version. Perhaps v1.4 is simply an older version that they still make available. The only comparison table I found compares jv16 PowerTools 2006, RegSupreme Pro, and Regsupreme.

I also downloaded RegSeeker 1.45 Beta and I'll give that a run too (without making any changes for now).

Thanks again for your pointers, Pete. I'll explore these programs for awhile (without editing the registry) while I wait to hear from Matt.

 

First note I would make is that those ATI files are only found in my \i386\driver.cab file. I have an Nvidia card.

Yes, and beating myself with a stick

I have seen registry key removal apparently work on all occasions (at least those people that have used them have not complained later). I still try reinstalling/uninstalling first and have not had to use the deletion method. The Catalyst Uninstaller is a purpose built program that should, in theory, do the job correctly.

I think SFC may read information in files like .dll's (Dynamic Link Libraries) that "link to" all those files quoted (or maybe .inf files that have setup information for drivers), but I have not studied closely. Since it is a "File Checker ", it may not be reading the registry at all.

It seems apparent that Drive Cleaner Pro cannot deal with these complex drivers, and graphics drivers are the most complex in the system. DCP may be able to deal with simple drivers, but ATI interweave things like Control Panels and "Hydravision ". Manufacturers include GPU "Overclocking" programs. Deleting the driver files (which DCP has done) is going to cause (big?) headaches in this case.

I've spent hours putting in and taking out graphics drivers when these clashes occur. They have all turned out OK, but Windows or the way the drivers need to be set up may lead to some dead ends. Win XP is stricter on how drivers are installed compared to previous versions, although once you find the correct "path" they install easily.

I'll just modify those steps to what I would term "the safest way ". This may avoid any blank screens or having to change the graphics adapter to a "standard" type in Safe Mode:

I have more experience with previous versions of Windows, but as I said, when you find the correct path with Win XP, it all falls into place quickly and easily.

I change graphics cards a lot with the older versions of Windows. The reactivation of Win XP means I only change when necessary. Those steps are my best guess as to how to fix those drivers, on your computer Windows may react a little differently. To the best of my knowledge all should go smoothly, but as I said, these are a very complex part of the system. If you happen to come across a blank screen, don't panic, you can always change the graphics adapter to standard type in Safe Mode, go to normal mode and install or uninstall drivers there (with the graphics, it is best to install in normal mode and uninstall in Safe Mode).

Sorry about the "disclaimers ", but if Windows reacts differently to the way I expect, you may need to backtrack a little and take a different path.

See what you think. I feel it would be safer to do the uninstall/reinstall method rather than the "find everything" and try to delete it method. I doubt everything connected with ATI is going to have ATI in the title.

Back up your system. Microsoft say this in all their troubleshooting information. They cannot say how each individual computer is going to react to the steps.

Something I would do is to make a backup of the registry (if it has not been mentioned). Run Regedit and go to File -> Export (make a note of where you save it). System Restore may get corrupted for some reason (it is not an absolute backup).

Matt
Edit: don't discount that the remnants of the ATI software (that you said you could not uninstall) are causing SFC to keep looking for the ATI drivers. It may be that you need to do the install/uninstall on those. Maybe the Cataylst Uninstaller will remove them, maybe not.

 

Matt, thanks a LOT for your help.

Over the next few days I'll see if I can backup my C:\ drive to tape. It's been a long time since I've done that so this seems like a good time to backup. I might go ahead and get an external USB drive and give that a shot for backing up too.

Then I'll print your message above and I'll be sure to back up my registry and use the Registry Monitor feature of jv16 PowerTools to create snapshots while performing the graphics drivers uninstall/install. Seems like that might be a good utility to fall back on in case System Restore fails.

I'll let y'all know how it goes, of course...one way or the other. If I don't post for a few weeks, you'll know I hosed my system.



Pete, thanks a LOT for your help too.

While reading through the PDF manual for jv16 PowerTools, I was pleasantly surprised to see the following in regards to its History Manager:

I laughed about that. That's the first time I've seen exclusive support for Firefox. Usually I've seen support for only IE and Netscape in such utilities. I'm a Firefox enthisuast so I'm pretty happy about it.

Thanks for pointing me to this app! It's a VERY robust set of utilities. However, many of its features I would use are ones I already use in other apps (especially Norton SystemWorks), so I'll just play with jv PowerTools for my trial period. We'll see how I feel when the registration nag screens start popping up.

I tried using RegSeeker to search my registry for "ati" and cancelled it after it had found over 2000 matches...most in the word application. I tried jv16 PowerTools' Registry Finder using the ^ati Regular Expression search to look for only items that start with "ati ". I came up with much faster and more accurate results. Still, as Matt suggests, the find/delete method of solving this SFC issue seems like it might be a last resort.

 

Hi, Matt and Pete.

OK, I think I'm ready to give this a shot (to repair my graphics driver situation to get SFC working flawlessly again).

I wasn't successful with backing up to my tape drive (IDE Seagate Travan TR5 20GB STT220000A). Last time I used this is when I had Win98SE installed.

I manually installed Microsoft's Backup via VALUEADD\MSFT\NTBACKUP\NTBACKUP.MSI on my Windows XP Home CD. After rebooting (like I usually do after an install) and while running Microsoft's backup utility I tried to perform a backup. However, it prompted me to use blank media. I could not find a way to erase the existing data from the tape. I have an old copy of Seagate's Backup Exec but I decided not to install it because it is a pre-Win XP CD. I haven't purchased a blank tape or checked Seagate's site for a suitable download yet.

Instead, I did the following in this order, I think:

• downloaded/installed Acronis True Image 9.0
• rebooted
• created an Acronis Rescue boot CD [tested via reboot]
• created an Acronis Rescue boot USB flash drive as additional precaution [tested via reboot using BIOS boot device setting: "USB (FDD)" -took several minutes to pull the info from the thumb drive but the Acronis menu finally came up]
• activated Acronis Startup Recovery Manager
• created an Acronis Safe Zone partition (FAT32) on my C:\ drive (auto-rebooted twice during the process)
  This created a FAT32 partition on my C:\ drive that is invisible to Windows.
  I assume Acronis is intelligent enough to restore from its FAT32 Safe Zone to my C:\ (which is NTFS).
• backed up my C:\ drive to the Safe Zone
• verified the Safe Zone backup

With that in mind, would you recommend I uninstall my current nVidia drivers via safe mode as well? Then my steps would be:

• Create System Restore Point
• Reboot into Safe Mode
• Uninstall the Nvidia drivers via Add/Remove Programs
• Reboot into Safe Mode.
• Run the ATI uninstaller
• Reboot: any trouble with the Windows Hardware Wizard, click Cancel
• Run the Nvidia drivers installation disk* when you get to the desktop
• Test over several boots. Run some graphics intensive programs. If things go well (including SFC), create another System Restore Point.

* You didn't answer this earlier in this thread:
I have nVidia's latest drivers for GeForece 6800 (v91.31 v9.1.3.1 according to Device Manager) that I downloaded (and have currently installed). Since nVidia recommends uninstalling existing nVidia drivers before installing newer drivers, do you think it would be ok to just skip installing from the installation disk and install my downloaded drivers instead?


I apologize for these lengthy posts. I just want to be sure I'm following what is perceived to be the best course of action.

Not a problem. I hereby absolve everyone, except myself, of any responsibility if I muck things up.

 

An excellent step-wise approach. You seem to have everything covered (that I can see). Having the system backed up should give you peace of mind, not only for this work, but any other eventuallity in the future.

No, I don't recommend installing the Nvidia drivers in Safe Mode. They are made to be installed in normal mode. The point about uninstalling in Safe Mode is because Windows is running on a standard set of drivers and the drivers that you wish to remove are not being used. In normal mode the drivers are in use and may not get uninstalled correctly (some files may need to be replaced by previous or even more advanced versions to bring the system back to a "pre-install" state).

A little hard to say. The original drivers on the CD will make the graphics run acceptably. The new version, if they have been recommended by the manufacturer of the graphics card should run better. If you have an aging card and use very modern drivers, it will probably run worse. When a graphics chipset is released the drivers are the best they have at that time, you generally find that drivers released a few months later will be "ideal ", when they are slightly modified. If you are not running graphics intensive programs, the original drivers should be fine. If you want a little "extra" from your graphics, try a version or two later (graphics chipsets are released before the drivers are at their "pinnacle ").

I hope this answers your questions.

Matt

 

Thanks again, guys, for your valuable input.

Well, I have some good news and bad news.

First the bad news...

I tried the method above and, although it appeared to go smoothly, it didn't fix the SFC problem. SFC still tripped up on the same files.

Then tried plan B: I dug out my old ATI Rage Pro card, uninstalled the nVidia drivers again (via Add/Remove in Safe Mode), replaced the nVidia card with the ATI card, installed the only ATI drivers I have in my ATI downloads folder (still can't find the ATI install disk). SFC still tripped up on the same files.

Then I tried plan C: I used jv16 PowerToools 2006's Registry Cleaner to look for registry errors. It found a BUNCH and reported my computer health as 1/100 (very poor health). [Norton Windoctor apparently doesn't fix the registry as well as I thought it did.] I took a chance since I had already exported the registry to backup files in two different places (2 different drives). I allowed the Registry Cleaner to automatically fix all entries it found...even though they stated "NOT RECOMMENDED ". After that, I rechecked my registry and my computer's health was 100/100...though there were a few remaining entries that Registry Cleaner said were pobably safe to remove. Therefore, I did. After rebooting, SFC still tripped up on the same files (although I'm happy to say that my system is running smoothly...so far...even seems to boot up quicker).

[SIZE= "4"]THE GOOD NEWS:[/SIZE]

I fixed part of the SFC problem [with the two nVidia files (nv3.sys and nv3.dll)]. I searched my C:\ drive for the files and found they already exist in the dllcache folder so I simply copied nv3.sys from the dllcache folder to the system32\drivers folder and nv3.dll from the dllcache folder to the system32 folder. (However, I searched for a few of the ati files and none were found, so I didn't bother searching for the rest of them.)

I Googled ati.sys download and luckily found a forum post on the Driver Cleaner Pro's website where someone had ALMOST EXACTLY the same problem as me. The only difference: (s)he was also missing atidrae.dll and atimpae.sys
[SIZE= "3"]EDIT:[/SIZE] My SFC now also flags atidrae.dll as missing.
[SIZE= "3"]EDIT #2:[/SIZE] I fixed this by copying atidrae.dll from my dllcache folder to my system32 folder.

This is a link to the Driver Cleaner Pro author's reply with an explanation.

Therefore, it appears my driver.cab file has been irreversibly modified (since I didn't back-up anything before or during my run of Driver Cleaner Pro's "Cab Cleaner ". (I count this as good news because I think I have a better understanding of why I'm getting the SFC errors.)

At the top of the same Google ati.sys download search results, I found a web site (http://www.windll.com/) that has all of my missing .SYS and .DLL files. However, they charge a fee for downloading those files and/or 1 hour of 24/7 support. The only price they state is EUR 9.95 (http://www.windll.com/paypal.php) and I can't determine if that's per file or just a one-shot payment...it's too vague. The filenames are hyperlinked to PayPal so I didn't click on them. The site seems fishy to me. Is that site legitimate or is it just another scam on the net? Are they contracted/endorsed by Microsoft? McAfee's SiteAdvisor classifies it as a "green" site (which I know doesn't necessarily mean they're on the level) and they link to several green sites, including Microsoft.com.

The only missing file I haven't tried to locate yet is atievxx.exe.

Does anyone know how I might legally be able to obtain my missing files (preferably for free) or how I might be able to extract them from my Windows HP Home CD...or even better, replace my apparently modified driver.cab with the default Windows XP driver.cab?

I haven't reviewed Microsoft's license agreement or spoken with Microsoft about my predicament, so...
[SIZE= "4"]
If[/SIZE] it's legal for one of the WindowsBBS staff to send those particular files to me in a ZIP file (or simply send their driver.cab file), I would be deeply indebted. I'd be happy to provide my email address in a PM to a WindowsBBS staff member. Just send me a PM and I will reply with my e-mail. (I'm sorry, I will not accept offers from regular members. I want to be certain the files are legitimate.)

If I can get these files, I want to place them appropriately in my system32 and system32\drivers folders. I have a hunch this may cure my SFC problem. (Maybe not though...since they are also apparently nonexistent in my dllcache folder.)

Thanks, once again.