sfc /scannow repeatedly stops for graphics card related system files

**mailman** · 27th July 2006

I debated whether to post this in the Hardware forum or the Windows XP forum. Since my goal is to get System File Checker working properly again (unattended, like it used to) and my display is working fine, the Windows XP forum gets the post.

Last year I replaced my ATI graphics card with an nVIDIA GeForce 6800 based graphics card (XFX brand 128 MB AGP 8x). I foolishly (and probably incorrectly) used "Driver Cleaner PRO" without creating backups. I used Driver Cleaner Pro to remove ATI drivers, registry entries, etc. before installing the nVIDIA drivers. I have updated my nVIDIA drivers a couple times since then.

For several months, I have been frustrated when running sfc/scannow. I am repeatedly prompted to insert my Windows XP CD, even if the CD is already in the drive. (If I cancel to skip the file, SFC quickly pops up another prompt to insert my windows CD.)

Until recently, I always gave up in the middle of the scan. Yesterday, I decided to keep clicking and discovered that I could finally reach the end of the scan. Whew!

This prompt appears for the following (taken from Event Viewer after SFC completed its task).

The system file c:\windows\system32\ati.dll could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ati.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atibt829.sys could not be copied into the DLL cache.
The system file c:\windows\system32\atidrab.dll could not be copied into the DLL cache.
The system file c:\windows\system32\atidvai.dll could not be copied into the DLL cache.
The system file c:\windows\system32\atievxx.exe could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atimpab.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atimtai.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atipcxxx.sys could not be copied into the DLL cache.
The system file c:\windows\system32\atiraged.dll could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atiragem.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atirtcap.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atirtsnd.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atitunep.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atitvsnd.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ativmdcd.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ativttxx.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\ativxbar.sys could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\atixbar.sys could not be copied into the DLL cache.
The system file c:\windows\system32\nv3.dll could not be copied into the DLL cache.
The system file c:\windows\system32\drivers\nv3.sys could not be copied into the DLL cache.

All of these except for the last two appear to be ATI related. I expect the last two are nVIDIA related.
Blue indicates c:\windows\system32\ files.
Red indicates c:\windows\system32\drivers\ files.

I have tried pointing the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath registry key to the CD.
I have tried pointing the SourcePath registry key to C:\ since I have my I386 folder in my root directory (which is the way I was using SFC before the graphics card installation).
I have tried editing the C:\Windows\inf\fp40ext.inf and ims.inf files as described in http://support.microsoft.com/?kbid=897128 and with a couple other variations.
I have tried Method 2 in http://support.microsoft.com/?kbid=900910 except I found the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackSourcePath key already was pointing to c:\windows\ServicePackFiles (instead of %windir%\ServicePackFiles) so I didn't make any changes to that registry key.

Would Method 1 in the last list item above likely do the trick? (My Windows XP Home CD is SP1.)
(However, I don't want to create a slipstreamed CD right now if there is a simpler/faster way to get SFC working unattended again.)

If there is a simpler/faster way to get SFC working unattended again, please let me know.

**PeteC** · 28th July 2006

mailman

This method has worked for me and many on the Board ...

Copy the i386 folder to the C:\ drive - you have done that,

Open Regedit and navigate to .....

Code:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Set up

and check the settings as shown in the screenshot (Ignore the upper red line - that was for another purpose

).

**mailman** · 28th July 2006

Thanks, Pete.

My current ServicePackSourcePath registry key value is c:\windows\ServicePackFiles and that folder contains an i386 folder with file dates ranging from 4/15/2002 to 8/24/2004. The top 3 file dates in my c:\windows\ServicePackFiles\i386 folder are the following dates (in order of decreasing frequency):

8/4/2004 (by far, most of the files have this date)
7/17/2004
3/31/2003

The file dates in my C:\I386 folder are all, of course, 3/31/2003 8:00 AM.

I am hesitant to make my ServicePackSourcePath registry key value match the image you proivided because of this difference in file dates. Would SFC replace newer files with older files if I changed the ServicePackSourcePath value to C:\ as displayed in your image?

The other two values that are highlighted in your image (CDInstall and SourcePath) already match my values.

If I get the go-ahead from you that there is no apparent danger of compromising my system, I'll change the ServicePackSourcePath value to C:\ as shown in your image and give SFC a shot.

EDIT: None of the missing files identified in my first post exist in ANY of my I386 folders so I'm not very optimistic at this time.

If your suggestion doesn't work for me, I am tempted to create a System Restore point and install some drivers (wxp-j5-30-1-b02.exe) I already have for my old ATI RAGE PRO which is the graphics card I replaced. This file is in my download folder (download date: 10/9/2005). This is the same filename as available from ATI (posted date: 4/2/2002). I may try that unless someone cautions me that I am likely to produce difficult problems by doing so. I no longer have the manufacturer's driver disk(s) for my ATI RAGE PRO card.

Alternatively, I may download and install the ATI Catalyst drivers from Major Geeks if that seems like a good thing to try.

**mattman** · 28th July 2006

Try running this:
http://support.ati.com/ics/support/D...737&deptID=894

Quote:

The Catalyst Uninstaller is an optional download. We recommend using this utility to uninstall any previously installed Catalyst drivers prior to installation.

Matt
(Edit: You have checked in Add/Remove Programs for any ATI software? Something is telling SFC that the Rage Pro is still installed)

**mattman** · 28th July 2006

Quote:

Originally Posted by mailman

I may try that unless someone cautions me that I am likely to produce difficult problems by doing so.

The caution may be that removing the drivers for the ATI adapter may remove some of the files used by the Nvidia card. (See my suggestion above.)

The other side is that if you install the ATI drivers as you have suggested, at the same time you have the Nvidia drivers installed, you may corrupt the Nvidia drivers. You will then need to uninstall the ATI drivers again and it comes back to what I said in the previous paragraph.

You may need to tread very carefully. I might uninstall the Nvidia drivers, then run the ATI uninstaller. If you have any trouble with the Windows Hardware Wizard when you reboot, click Cancel and run the Nvidia drivers installation disk when you get to the desktop.

Matt

**mailman** · 28th July 2006

Thanks for helping out here, Matt. Thanks, Pete, for alerting Matt to this thread. He advised me about my AGP card before I purchased it. (He's not in any way responsible for my current predicament though.)

Quote:

Originally Posted by mattman

Try running this:
http://support.ati.com/ics/support/D...737&deptID=894

Thanks, after I do some more research into this problem, I will probably give this a try following the cautionary instructions you provided in your most recent post.

Quote:

Edit: You have checked in Add/Remove Programs for any ATI software?

I did have such an Add/Remove entry but I couldn't successfully run it because it complained of a necessary missing DLL. (I don't recall which one.) I recently used driver Cleaner Pro to remove the Add/Remove entry (again, without backups) so it's now gone.

Quote:

Something is telling SFC that the Rage Pro is still installed

Thanks, that gives me something to go on. Any ideas where SFC looks in the registry?

I'll search my registry for mentions of ATI, including the specific files listed in my 1st post, and report them here before proceeding. Also, before modifying the registry, I'll create a backup of the entire registry and I'll see if I can find a good registry monitor that will show me a side-by-side comparison of registry changes made (such as with the ATI utility you linked). I recall using such a utility many, many years ago but I can't recall what it was. Suggestions on a good registry monitor for comparing? I'll look around at Major Geeks and see what's available there.

Quote:

You may need to tread very carefully. I might uninstall the Nvidia drivers, then run the ATI uninstaller. If you have any trouble with the Windows Hardware Wizard when you reboot, click Cancel and run the Nvidia drivers installation disk when you get to the desktop.

Thanks for the cautions, suggestions, and insight about what difficulties I might run into. I'm sure I'll create several Restore Points along the way.

**PeteC** · 28th July 2006

I've been out today - just catching up.....

My two pennyworth (cents to some

) ....

The ati files SFC noted are in a standard install of XP - system32\dllcache AFAIK. My system has never had an Ati card installed and they are there. They do not exist in the i386 folder, but there are a number of compressed inf files relating to Ati.

Quote:

Would SFC replace newer files with older files if I changed the ServicePackSourcePath value to C:\ as displayed in your image?

No it should not - it will look also in the ServicePackFiles and will always ensure that the latest file is in system32. This is how it copes with new .dll's issued with critical updates.

DriveCleaner Pro may have a lot to answer for

I do not believe that your system would be compromised by changing the registry entries to those I suggested.

Matt loves Ati drivers

and his advice is sound as always.

Quote:

Suggestions on a good registry monitor for comparing?

I use the Registry Monitor in jv16 Power Tools - 30 day trial available. Take a snapshot before and after and compare.

**mailman** · 28th July 2006

Using Lavasoft's RegHance v2.1, I searched my entire registry for each of the files listed in my 1st post.

The search options I used were as follows:

Keys (checked)
Values (checked)
Data (checked)
Match whole string only (unchecked)
Case sensitive (unchecked)
Log search results (checked)

Here's a summary of the results.

Session started on 7/28/2006,1:30:33 PM
1:54:36 PM Search for "ati.dll" returned 3 matches.
1:55:34 PM Search for "ati.sys" returned 3 matches.
1:56:16 PM Search for "atibt829.sys" returned 0 matches.
1:56:59 PM Search for "atidrab.dll" returned 3 matches.
1:57:43 PM Search for "atidvai.dll" returned 3 matches.
1:58:25 PM Search for "atievxx.exe" returned 0 matches.
1:59:24 PM Search for "atimpab.sys" returned 3 matches.
2:01:13 PM Search for "atimtai.sys" returned 3 matches.
2:01:58 PM Search for "atipcxxx.sys" returned 0 matches.
2:02:42 PM Search for "atiraged.dll" returned 3 matches.
2:03:26 PM Search for "atiragem.sys" returned 3 matches.
2:04:11 PM Search for "atirtcap.sys" returned 0 matches.
2:05:02 PM Search for "atirtsnd.sys" returned 0 matches.
2:06:01 PM Search for "atitunep.sys" returned 0 matches.
2:06:45 PM Search for "atitvsnd.sys" returned 0 matches.
2:07:22 PM Search for "ativmdcd.sys" returned 0 matches.
2:07:59 PM Search for "ativttxx.sys" returned 0 matches.
2:08:39 PM Search for "ativxbar.sys" returned 0 matches.
2:09:39 PM Search for "atixbar.sys" returned 0 matches.
2:10:16 PM Search for "nv3.dll" returned 3 matches.
2:10:54 PM Search for "nv3.sys" returned 0 matches.

In each case where there were 3 matches, they were located in the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Nls\MUILanguages\RCV2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2

I'm puzzled that several of the filename searches produced 0 results. Where else might SFC be looking? Perhaps SFC reads the hexadecimal values of the registry keys for those filenames and uses those values to try to retrieve the files that showed up as 0 matches.

Matt, it's looking like it might be best to try the ATI uninstaller via your cautionary instructions in your most recent post in this thread.

Please look over my procedure outlined below and advise.

Create System Restore Point
Uninstall the Nvidia drivers via Add/Remove Programs, NOT Driver Cleaner Pro
Reboot???
Run the ATI uninstaller
Reboot: any trouble with the Windows Hardware Wizard, click Cancel
Run the Nvidia drivers installation disk* when you get to the desktop
If things go well (including SFC), create another System Restore Point.

* I have nVidia's latest drivers for GeForece 6800 (v91.31 v9.1.3.1 according to Device Manager) that I downloaded (and have currently installed). Since nVidia recommends uninstalling existing nVidia drivers before installing newer drivers, do you think it would be ok to just skip installing from the installation disk and install my downloaded drivers instead?

**PeteC** · 28th July 2006

mailman

I would use RegSeeker to search for registry strings containing ati and delete them - first ensure that the backup before deletion box is checked

**mailman** · 28th July 2006

Quote:

Originally Posted by PeteC

The ati files SFC noted are in a standard install of XP - system32\dllcache AFAIK. My system has never had an Ati card installed and they are there.

Interesting. I don't have a "dllcache" folder in C:\WINDOWS\system32.

(I do have "Show hidden files and folders" enabled in Windows explorer.)

Quote:

Driver Cleaner Pro may have a lot to answer for

I agree. I will certainly uninstall/delete it when this troubleshooting is over.

Quote:

I do not believe that your system would be compromised by changing the registry entries to those I suggested.

I just tried that, got a popup and cancelled SFC. Event Viewer shows several "64021" event ID errors about being unable to copy files (different files than in my first post) to the DLL cache but they didn't produce popups. ???

The first of those errors:
The system file c:\program files\common files\microsoft shared\web server extensions\40\isapi\_vti_adm\admin.dll could not be copied into the DLL cache. The specific error code is 0x800b0100 [No signature was present in the subject.]. This file is necessary to maintain system stability.

For now, I changed the ServicePackSourcePath registry key back to c:\windows\ServicePackFiles.

Quote:

I use the Registry Monitor in jv16 Power Tools - 30 day trial available. Take a snapshot before and after and compare.

THANKS, I'll use it.

Quote:

I would use RegSeeker to search for registry strings containing ati and delete them - first ensure that the backup before deletion box is checked

OK, I'll consider that after I hear back from Matt. There are LOTS of registry keys that contain the string "ati" though so I'm pretty hesitant to try that before trying Matt's suggestion.

**PeteC** · 28th July 2006

Quote:

I don't have a "dllcache" folder in C:\WINDOWS\system32

You do - uncheck 'Hide protected operating system files' just below Hide/show hidden ....

Quote:

There are LOTS of registry keys that contain the string "ati"

You may need to check each one before marking for deletion - running the Ati cleaner Matt suggested shoukd do the job in the registry I guess.

**mailman** · 28th July 2006

Aha! Thanks, Pete! I did have that box unchecked at one time. Apparently I had re-checked that box some time ago and forgot. (Since I like to tinker, I must have decided keep those out of sight...even if they are in blue.)

I downloaded Macecraft's jv16 PowerTools 2006 (with handbook).

I noticed there is also a jv16 PowerTools 1.4 on Macecraft's Downloads page but I didn't see any comparison between that and the 2006 version. Perhaps v1.4 is simply an older version that they still make available. The only comparison table I found compares jv16 PowerTools 2006, RegSupreme Pro, and Regsupreme.

I also downloaded RegSeeker 1.45 Beta and I'll give that a run too (without making any changes for now).

Thanks again for your pointers, Pete. I'll explore these programs for awhile (without editing the registry) while I wait to hear from Matt.

**mattman** · 29th July 2006

First note I would make is that those ATI files are only found in my \i386\driver.cab file. I have an Nvidia card.

Quote:

Matt loves Ati drivers

Yes, and beating myself with a stick

I have seen registry key removal apparently work on all occasions (at least those people that have used them have not complained later). I still try reinstalling/uninstalling first and have not had to use the deletion method. The Catalyst Uninstaller is a purpose built program that should, in theory, do the job correctly.

I think SFC may read information in files like .dll's (Dynamic Link Libraries) that "link to" all those files quoted (or maybe .inf files that have setup information for drivers), but I have not studied closely. Since it is a "File Checker", it may not be reading the registry at all.

It seems apparent that Drive Cleaner Pro cannot deal with these complex drivers, and graphics drivers are the most complex in the system. DCP may be able to deal with simple drivers, but ATI interweave things like Control Panels and "Hydravision". Manufacturers include GPU "Overclocking" programs. Deleting the driver files (which DCP has done) is going to cause (big?) headaches in this case.

I've spent hours putting in and taking out graphics drivers when these clashes occur. They have all turned out OK, but Windows or the way the drivers need to be set up may lead to some dead ends. Win XP is stricter on how drivers are installed compared to previous versions, although once you find the correct "path" they install easily.

Quote:

* Create System Restore Point
* Uninstall the Nvidia drivers via Add/Remove Programs, NOT Driver Cleaner Pro
* Reboot???
* Run the ATI uninstaller
* Reboot: any trouble with the Windows Hardware Wizard, click Cancel
* Run the Nvidia drivers installation disk* when you get to the desktop
* If things go well (including SFC), create another System Restore Point.

I'll just modify those steps to what I would term "the safest way". This may avoid any blank screens or having to change the graphics adapter to a "standard" type in Safe Mode:

Quote:

* Create System Restore Point
* Uninstall the Nvidia drivers via Add/Remove Programs, NOT Driver Cleaner Pro
* Reboot into Safe Mode.
* Run the ATI uninstaller
* Reboot: any trouble with the Windows Hardware Wizard, click Cancel
* Run the Nvidia drivers installation disk* when you get to the desktop
* Test over several boots. Run some graphics intensive programs. If things go well (including SFC), create another System Restore Point.

I have more experience with previous versions of Windows, but as I said, when you find the correct path with Win XP, it all falls into place quickly and easily.

I change graphics cards a lot with the older versions of Windows. The reactivation of Win XP means I only change when necessary. Those steps are my best guess as to how to fix those drivers, on your computer Windows may react a little differently. To the best of my knowledge all should go smoothly, but as I said, these are a very complex part of the system. If you happen to come across a blank screen, don't panic, you can always change the graphics adapter to standard type in Safe Mode, go to normal mode and install or uninstall drivers there (with the graphics, it is best to install in normal mode and uninstall in Safe Mode).

Sorry about the "disclaimers", but if Windows reacts differently to the way I expect, you may need to backtrack a little and take a different path.

See what you think. I feel it would be safer to do the uninstall/reinstall method rather than the "find everything" and try to delete it method. I doubt everything connected with ATI is going to have ATI in the title.

Back up your system. Microsoft say this in all their troubleshooting information. They cannot say how each individual computer is going to react to the steps.

Something I would do is to make a backup of the registry (if it has not been mentioned). Run Regedit and go to File -> Export (make a note of where you save it). System Restore may get corrupted for some reason (it is not an absolute backup).

Matt
Edit: don't discount that the remnants of the ATI software (that you said you could not uninstall) are causing SFC to keep looking for the ATI drivers. It may be that you need to do the install/uninstall on those. Maybe the Cataylst Uninstaller will remove them, maybe not.

**mailman** · 29th July 2006

Matt, thanks a LOT for your help.

Over the next few days I'll see if I can backup my C:\ drive to tape. It's been a long time since I've done that so this seems like a good time to backup.

I might go ahead and get an external USB drive and give that a shot for backing up too.

Then I'll print your message above and I'll be sure to back up my registry and use the Registry Monitor feature of jv16 PowerTools to create snapshots while performing the graphics drivers uninstall/install. Seems like that might be a good utility to fall back on in case System Restore fails.

I'll let y'all know how it goes, of course...one way or the other. If I don't post for a few weeks, you'll know I hosed my system.

Pete, thanks a LOT for your help too.

While reading through the PDF manual for jv16 PowerTools, I was pleasantly surprised to see the following in regards to its History Manager:

Quote:

The History Manager currently supports only the Firefox web browser. Support for other browsers might be added in the future.

I laughed about that. That's the first time I've seen exclusive support for Firefox.

Usually I've seen support for only IE and Netscape in such utilities. I'm a Firefox enthisuast so I'm pretty happy about it.

Thanks for pointing me to this app! It's a VERY robust set of utilities. However, many of its features I would use are ones I already use in other apps (especially Norton SystemWorks), so I'll just play with jv PowerTools for my trial period. We'll see how I feel when the registration nag screens start popping up.

I tried using RegSeeker to search my registry for "ati" and cancelled it after it had found over 2000 matches...most in the word application.

I tried jv16 PowerTools' Registry Finder using the ^ati Regular Expression search to look for only items that start with "ati". I came up with much faster and more accurate results. Still, as Matt suggests, the find/delete method of solving this SFC issue seems like it might be a last resort.

**mailman** · 1st August 2006

Hi, Matt and Pete.

OK, I think I'm ready to give this a shot (to repair my graphics driver situation to get SFC working flawlessly again).

I wasn't successful with backing up to my tape drive (IDE Seagate Travan TR5 20GB STT220000A). Last time I used this is when I had Win98SE installed.

I manually installed Microsoft's Backup via VALUEADD\MSFT\NTBACKUP\NTBACKUP.MSI on my Windows XP Home CD. After rebooting (like I usually do after an install) and while running Microsoft's backup utility I tried to perform a backup. However, it prompted me to use blank media. I could not find a way to erase the existing data from the tape. I have an old copy of Seagate's Backup Exec but I decided not to install it because it is a pre-Win XP CD. I haven't purchased a blank tape or checked Seagate's site for a suitable download yet.

Instead, I did the following in this order, I think:

downloaded/installed Acronis True Image 9.0
rebooted
created an Acronis Rescue boot CD [tested via reboot]
created an Acronis Rescue boot USB flash drive as additional precaution [tested via reboot using BIOS boot device setting: "USB (FDD)" -took several minutes to pull the info from the thumb drive but the Acronis menu finally came up]
activated Acronis Startup Recovery Manager
created an Acronis Safe Zone partition (FAT32) on my C:\ drive (auto-rebooted twice during the process)
This created a FAT32 partition on my C:\ drive that is invisible to Windows.
I assume Acronis is intelligent enough to restore from its FAT32 Safe Zone to my C:\ (which is NTFS).
backed up my C:\ drive to the Safe Zone
verified the Safe Zone backup

Quote:

* Create System Restore Point
* Uninstall the Nvidia drivers via Add/Remove Programs, NOT Driver Cleaner Pro
* Reboot into Safe Mode.
* Run the ATI uninstaller
* Reboot: any trouble with the Windows Hardware Wizard, click Cancel
* Run the Nvidia drivers installation disk* when you get to the desktop
* Test over several boots. Run some graphics intensive programs. If things go well (including SFC), create another System Restore Point.

Quote:

Originally Posted by mattman

(with the graphics, it is best to install in normal mode and uninstall in Safe Mode).

With that in mind, would you recommend I uninstall my current nVidia drivers via safe mode as well? Then my steps would be:

Create System Restore Point
Reboot into Safe Mode
Uninstall the Nvidia drivers via Add/Remove Programs
Reboot into Safe Mode.
Run the ATI uninstaller
Reboot: any trouble with the Windows Hardware Wizard, click Cancel
Run the Nvidia drivers installation disk* when you get to the desktop
Test over several boots. Run some graphics intensive programs. If things go well (including SFC), create another System Restore Point.

* You didn't answer this earlier in this thread:
I have nVidia's latest drivers for GeForece 6800 (v91.31 v9.1.3.1 according to Device Manager) that I downloaded (and have currently installed). Since nVidia recommends uninstalling existing nVidia drivers before installing newer drivers, do you think it would be ok to just skip installing from the installation disk and install my downloaded drivers instead?

I apologize for these lengthy posts. I just want to be sure I'm following what is perceived to be the best course of action.

Quote:

Sorry about the "disclaimers", but if Windows reacts differently to the way I expect, you may need to backtrack a little and take a different path.

Not a problem. I hereby absolve everyone, except myself, of any responsibility if I muck things up.