1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

sfc /scannow -> 48 event ID's: 64021 (error code: 0x0000000d [The data is invalid.])

Discussion in 'Windows XP' started by mailman, 2005/08/16.

  1. 2005/08/16
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    I just ran sfc /scannow and it prompted me to insert my XP CD. (Apparently, it has to be placed in the CD drive letter that was originally used to install XP). After two tries in the wrong CD drive I placed my XP (SP1) CD into the "correct" drive (I think) and sfc ran its course.

    Upon opening Event Viewer, I found 48 :eek: lines with ID 64021 which all their popups state: "The system file c:\windows\system32\drivers\filename.ext could not be copied into the DLL cache. The specific error code is 0x0000000d [The data is invalid.]. This file is necessary to maintain system stability. "

    I found a couple old (over a year ago) threads here via a search for error code 0x0000000d and found some info but I'm not sure how to proceed. The threads I found read didn't really have any closure in regards to the issue.

    A Google search for "0x0000000d" xp sfc doesn't really help either.

    The "For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp." link in the event popup doesn't help ( "no additional information available ").

    Perhaps some memory resident process is getting in the way of these DLL cache files and I should try running sfc /scannow in safe mode. Perhaps I should try inserting my SP2 CD I got in the mail from Microsoft instead of my original XP install CD (XP Home SP1). (I never used the SP2 CD since I have always used Windows Update.)

    Perhaps I should just leave my computer alone (i.e., if it works, don't fix it ") since it seems to be working OK in spite of the 48 DLL cache files necessary for system stability. :) (I prefer to quickly get to the root of the cause though.)

    If you need a list of all the DLL cache files, I'll be happy to post it.

    Does anyone know about any quick remedies or will I have to resort to troubleshooting?

    Should I get QFecheck.exe from MS that was discussed in one of the old threads on the error code 0x0000000d MS and their "catalog" mentioned in a KB article and see what's up? I'm guessing I might DL QFecheck from here and also get the "Updated Sp2.cat Available to Resolve Versioning Issues with Post Service Pack 1 Hotfixes" from here.

    However those articles discuss Windows 2000 issues instead of Windows XP, so I'm certainly not going to try that without further direction. :)

    My machine is updated with all windows update fixes AFIK.

    I have Norton Systemworks 2005 Pro (including NAV resident in memory), anti-spyware (Ewido's guard, Lavasoft's Ad-Watch, Spyware Blaster, Spyware Guard, Spybot S&D, ZonaAlarm Pro 6) installed with whatever resident processes running that they offer. I also have MS AS on this too but without realtime-protection enabled.
     
    Last edited: 2005/08/16
    mailman,
    #1
  2. 2005/08/16
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    Last edited: 2005/08/16
    mailman,
    #2


  3. to hide this advert.

  4. 2005/08/16
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Maybe unwise for the sake of a few Kb, but of no relevance here. I think.

    I have not come across the error messages you posted before in relation to SFC.

    Windows is smart enough to know that SP2 is installed when you run SFC using an XP SP1 CD and you do need the OS CD - the MS SP2 CD you mention will not be accepted - that is merely a series of updates.

    My guess is that you have the specified dll files in System32 and the dll cache. It would be helpful if you could post the names of 2 or 3 of the dll files which turned up in the Event Viewer messages and also check to see if they are in Windows\system32 and post which versions they are. We can then check these against a known good install of XP.
     
    PeteC,
    #3
  5. 2005/08/16
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    Maybe unwise for the sake of a few Kb
    Thanks for being diplomatic :) I feel rather stupid anyway right now for doing so.

    The first (earliest) one SFC logged:
    c:\windows\system32\drivers\es56hpi.sys (missing...A Search of my HD turns up nothing.)

    Google turns up a few sites with info. Perhaps it's a modem driver. It appears one of those sites Google pulled up sells DLLs via PayPal for $9.95 but that seems like a shady proposition to me. I'd reformat and install Windows from scratch before doing that. :)

    Here are the rest in the order they occured when I ran SFC. I searched my HD for several filenames and found none.

    c:\windows\system32\drivers\es56tpi.sys
    c:\windows\system32\drivers\ess.sys
    c:\windows\system32\esucm.dll
    c:\windows\system32\esuimg.dll
    c:\windows\system32\esuni.dll
    c:\windows\system32\esunib.dll
    c:\windows\system32\drivers\ex10.sys
    c:\windows\system32\drivers\exabyte2.sys
    c:\windows\system32\drivers\f3ab18xi.sys
    c:\windows\system32\drivers\f3ab18xj.sys
    c:\windows\system32\drivers\fa312nd5.sys
    c:\windows\system32\drivers\fa410nd5.sys
    c:\windows\system32\drivers\fem556na.sys
    c:\windows\system32\drivers\fem556nb.sys
    c:\windows\system32\drivers\fem556ni.sys
    c:\windows\system32\kousd.dll
    c:\windows\system32\drivers\ktc111.sys
    c:\windows\system32\drivers\lanepic5.sys
    c:\windows\system32\drivers\lit220p.sys
    c:\windows\system32\drivers\lmndis3.sys
    c:\windows\system32\drivers\lne100.sys
    c:\windows\system32\drivers\lne100tx.sys
    c:\windows\system32\drivers\loop.sys
    c:\windows\system32\drivers\ltck000c.sys
    c:\windows\system32\m3091dc.dll
    c:\windows\system32\m3092dc.dll
    c:\windows\system32\drivers\maestro.sys
    c:\windows\system32\drivers\mammoth.sys
    c:\windows\system32\drivers\mdgndis5.sys
    c:\windows\system32\drivers\memcard.sys
    c:\windows\system32\memgrp.dll
    c:\windows\system32\mgaud.dll
    c:\windows\system32\drivers\ne2000.sys
    c:\windows\system32\neo20xx.dll
    c:\windows\system32\drivers\neo20xx.sys
    c:\windows\system32\drivers\netflx3.sys
    c:\windows\system32\drivers\ngrpci.sys
    c:\windows\system32\tridxp.dll
    c:\windows\system32\drivers\tridxpm.sys
    c:\windows\system32\drivers\twotrack.sys
    c:\windows\system32\um34scan.dll
    c:\windows\system32\um54scan.dll
    c:\windows\system32\umaxcam.dll
    c:\windows\system32\umaxp60.dll
    c:\windows\system32\drivers\usr1801.sys

    I did a cursory search in Google for several filenames. A few, such as f3ab18xi.sys (apparently from the Net4.cab file, according to this Microsoft page) appear Windows ME related.

    Upon seeing the Net4.cab reference, I immediately think "network" so here are a couple things that might be related.

    (1) I have hooked up a Windows ME machine to my router via CAT5 cable and played a little networking between that machine and this one. I can't remember if I did that before or after upgrading to XP. I used to run Win98SE but I finally broke down a few years ago, purchased a full XP SP1 CD (not the upgrade version), and installed fresh on a clean new HD while I left my Win98 installation on the other HD.

    (2) At one time I installed the .NET (for Passport, I think) via Windows Update but later decided to uninstall that update. My Windows Update history shows I installed the .NET Framework v1.1 in January 2003. I think that's the one I uninstalled later. Perhaps I didn't do that properly.

    I will do a more thorough search of Google and/or the MS KB this evening/tonight and see if I can ascertain any patterns from the files in the list above or information relating Net4.cab with .NET.

    If I discover anything, I'll post back.
     
    mailman,
    #4
  6. 2005/08/16
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    These are all Win XP files and are present in C:\WINDOWS\system32\dllcache\ and C:\WINDOWS\Driver Cache\i386\driver.cab\ on my machine. I haven't checked the lot, but the results I am getting suggest that this is the case.

    I am at a loss to explain why they are not in the dll cache in the first place and why they will not copy there - unless one of your resident programs is preventing it.
     
    PeteC,
    #5
  7. 2005/08/16
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    Thanks, Pete.

    [Edit:] I found the radio button that allows me to view protected files and I confirmed the dllcache folder is there. (Handy to have the folder and contents displayed in blue.) I will post back the version and MD5 hash of a few of the files in the Event Viewer error list in case that may help.

    I found the driver.cab file, viewed the contents, and confirmed several of the files from my list above are indeed there (although, I did not check for all of them). All the files in the cabinet are either 7/21/2001 or 8/17/2001 Modified dates.

    I will enable system restore to create a restore point. Then I'll create a dllcache folder in the system32 folder and give SFC a go again to see what happens.

    [Edit:]I tried exiting out of all apps that I could in the tool tray and ran SFC again. Same error results in Event Viewer. SFC doesn't appear to run in safe mode (no popup window opens).

    [Edit:] message stuff deleted upon discovering XP SP1 reinstall will remove my current SP2
     
    Last edited: 2005/08/16
    mailman,
    #6
  8. 2005/08/16
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    [EDIT:] (deleted unnecessary stuff in message now that I found the dllcache folder)

    [Edit:] I am going to hold off on reinstalling the OS for now because I don't want to lose my settings, etc. since my OS CD is an older version than SP2.

    I tried exiting out of all apps that I could in the tool tray and ran SFC again. Same error results in Event Viewer. SFC doesn't appear to run in safe mode (no popup window opens).

    I will try "closing all programs, background porgrams, etc. per instructions at     http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199712495221 and running SFC again.
     
    Last edited: 2005/08/16
    mailman,
    #7
  9. 2005/08/17
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    After trying the options above without success (except reinstalling the OS) and I wasn't able to get some of the Symantec processes to stop (even after stopping them in Services).

    I did some poking around with WE and found that the dllcache folder properties indicate the folder is "Read Only ". Is this typical?

    In any event, I'm confused by the Event Viewer stating "[The data is invalid.] ". Exactly what data does it mean is invalid? The data in the driver.cab file?

    HEY!...I think I just found the problem as I was preparing to post driver.cab version/MD5 info! I tried to extract the contents of the driver.cab file with WinZip and it stopped extracting at...guess where? :)

    Here are the last two lines of the details reported by WinZip:

    Extracting es56hpi.sys
    CAB file driver.cab is corrupt

    I'll see if I can create a backup of the driver.cab file and then replace it from the OS CD.
     
    Last edited: 2005/08/17
    mailman,
    #8
  10. 2005/08/17
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I think you've pinpointed the source of the problem - great news :D

    Our of interest I used Win Zip to extract the files from my driver.cab to an empty partition - ran through without a problem, so that does confirm your findings.

    BTW - The dll cache folder is 'read only'.
     
    PeteC,
    #9
  11. 2005/08/17
    mailman Lifetime Subscription

    mailman Geek Member Thread Starter

    Joined:
    2004/01/17
    Messages:
    1,901
    Likes Received:
    11
    Problem RESOLVED! :))))

    <mailman smacked himself in the forehead (after typing the above)>

    Sometimes, the solution seems so obvious. :rolleyes:

    (No need to answer my question about "exactly what data" is invalid.)

    I'll remember this for awhile, I'm sure.

    Thanks again, Pete. I should have tried to get the version info from the cab file right away and I would have discovered the solution YESTERDAY. :)
     
    Last edited: 2005/08/17
    mailman,
    #10
  12. 2005/08/17
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Delighted to hear that the problem is solved :) To be honest the thought of a corrupted .cab file had not crossed my mind during this thread :( We all live and learn.
     
    PeteC,
    #11

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...