SFC > Windows File Protection Event 64021 for MS FrontPage Related Files

I have not run sfc /scannow for about a year. Today I ran sfc /scannow and had to click "Cancel" several times to skip files.

GOAL: I wish to be able to run sfc /scannow unattended (like I used to be able to do).

What would be the best course of action to achieve my goal without compromising security/stability of my computer?

(Windows XP Home SP2 with all critical updates applied and verified via Secunia's Software Inspector)

==========

ISSUE SPECIFICS:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021

Description:
The system file c:\program files\common files\microsoft shared\web server extensions\40\_vti_bin\_vti_adm\admin.exe could not be copied into the DLL cache.

I had the same Windows File Protection event for the following files.

c:\program files\common files\microsoft shared\web server extensions\40\isapi\_vti_aut\author.dll
c:\program files\common files\microsoft shared\web server extensions\40\_vti_bin\_vti_aut\author.exe
c:\program files\common files\microsoft shared\web server extensions\40\bin\cfgwiz.exe
c:\program files\common files\microsoft shared\web server extensions\40\servsupp\fp4amsft.dll
c:\program files\common files\microsoft shared\web server extensions\40\servsupp\fp4anscp.dll
c:\program files\common files\microsoft shared\web server extensions\40\servsupp\fp4apws.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fp4areg.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fp4atxt.dll
c:\program files\common files\microsoft shared\web server extensions\40\bots\vinavbar\fp4avnb.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fp4avss.dll
c:\program files\common files\microsoft shared\web server extensions\40\servsupp\fp4awebs.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fp4awel.dll
c:\program files\microsoft frontpage\version3.0\bin\fp98sadm.exe
c:\program files\microsoft frontpage\version3.0\bin\fp98swin.exe
c:\program files\common files\microsoft shared\web server extensions\40\_vti_bin\fpcount.exe
c:\program files\common files\microsoft shared\web server extensions\40\bin\fpexedll.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fpmmc.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\1033\fpmmcsat.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fpremadm.exe
c:\program files\common files\microsoft shared\web server extensions\40\isapi\shtml.dll
c:\program files\common files\microsoft shared\web server extensions\40\_vti_bin\shtml.exe
c:\program files\common files\microsoft shared\web server extensions\40\bin\tcptest.exe
c:\program files\common files\microsoft shared\web server extensions\40\bin\1033\tcptsat.dll
c:\program files\common files\microsoft shared\web server extensions\40\admcgi\scripts\fpadmcgi.exe
c:\program files\common files\microsoft shared\web server extensions\40\admisapi\scripts\fpadmdll.dll
c:\program files\common files\microsoft shared\web server extensions\40\bin\fpencode.dll

==========

The red folders are empty.
The blue folder does not exist.

All of the file names identified above do not exist in those locations identified.

All of the file names identified above DO exist in each of the following locations.

• C:\WINDOWS\system32\dllcache\
• C:\WINDOWS\ServicePackFiles\i386\
• C:\I386\FP40EXT.CAB file
  (If I recall correctly, I copied the C:\I386 folder from my SP2 slipstreamed CD.)

I Googled the file names and discovered many (all?) of these files seem to apply to Microsoft FrontPage ( "Microsoft FrontPage 2000 Server Extensions "), and/or Microsoft Office 2000.

• 
  Microsoft KB838018 Description of the FrontPage 2000 Server Extensions from Microsoft hotfix package: June 15, 2004

To the best of my knowledge, I never had FrontPage installed. However, I do have Office 2003 Standard Edition installed.

I HOPE my computer has never had a web server running.

I do have an HP LaserJet 2420dn (network capable) PCL 6 printer (I installed about a year ago, attached via parallel port to a stand-alone computer). The printer has "sever" software for printer management ( "TomcatStartup 2.5" = C:\PROGRAM FILES\HEWLETT-PACKARD\TOOLBOX\HPBPSTTP.EXE) I had installed after I purchased the printer but I recently disabled that "server" software via WinPatrol's startup manager. I do not know yet whether this may be related to my issue or not.

==========

NOTES ABOUT SOME OF THE FOLDERS LISTED ABOVE:

c:\program files\common files\microsoft shared\web server extensions\40\_vti_bin\ contains only FOLDERS: _vti_adm and _vti_aut

c:\program files\common files\microsoft shared\web server extensions\40\bin\ contains only FOLDER: 1033
c:\program files\common files\microsoft shared\web server extensions\40\bin\1033\ contains only FPEXT.MSG

c:\program files\common files\microsoft shared\web server extensions\40\bots\ contains only FOLDER: vinavbar

==========

Here is FileAlyzer information regarding the first file listed above (admin.exe).

Code:

********************************************************************
FileAlyzer © 2003-2006 Safer Networking Ltd. All Rights Reserved.
********************************************************************


File: C:\WINDOWS\ServicePackFiles\i386\admin.exe
Date: 1/12/2008 7:37:12 PM


***** General ******************************************************
           Location: C:\WINDOWS\ServicePackFiles\i386\
               Size: 16439
            Version: 4.0.2.7523
             CRC-32: 0252A33A
                MD5: 09FA7C05D56C0C8001F4AC53C790FB44
               SHA1: 9568C2BC4D50287BED919E0FB30E2D070E31ECB9
          Read only: No
             Hidden: No
        System file: No
          Directory: No
            Archive: No
      Symbolic link: No
         Time stamp: Wednesday, August 04, 2004 2:56:47 AM
           Creation: Wednesday, August 04, 2004 2:56:48 AM
        Last access: Saturday, January 12, 2008 7:37:02 PM
         Last write: Wednesday, August 04, 2004 2:56:48 AM


File: C:\WINDOWS\system32\dllcache\admin.exe
Date: 1/12/2008 7:38:17 PM


***** General ******************************************************
           Location: C:\WINDOWS\system32\dllcache\
               Size: 16439
            Version: 4.0.2.7523
             CRC-32: 0252A33A
                MD5: 09FA7C05D56C0C8001F4AC53C790FB44
               SHA1: 9568C2BC4D50287BED919E0FB30E2D070E31ECB9
          Read only: No
             Hidden: No
        System file: No
          Directory: No
            Archive: Yes
      Symbolic link: No
         Time stamp: Wednesday, August 04, 2004 2:56:47 AM
           Creation: Wednesday, August 04, 2004 2:56:48 AM
        Last access: Saturday, January 12, 2008 7:38:12 PM
         Last write: Wednesday, August 04, 2004 2:56:48 AM


File: C:\I386\FP40EXT.CAB/admin.exe [B][COLOR="Red"]extracted to D:\Data\Temp\09\[/COLOR][/B]
Date: 1/12/2008 10:01:20 PM


***** General ******************************************************
           Location: D:\Data\Temp\09\
               Size: 16439 [B][COLOR="Red"]<--same size
[/COLOR][/B]            Version: 4.0.2.7523 [B][COLOR="Red"]<--same version[/COLOR][/B]
             CRC-32: DF353877 [B][COLOR="Red"]<--different checksum[/COLOR][/B]
                MD5: 64F04CCD27271961B8E4A5DA12B54EB6 [B][COLOR="Red"]<--different checksum[/COLOR][/B]
               SHA1: 20CB4AEE41A90FB7240EC674A7F87F0E5ACEB729 [B][COLOR="Red"]<--different checksum[/COLOR][/B]
          Read only: No
             Hidden: No
        System file: No
          Directory: No
            Archive: Yes
      Symbolic link: No
         Time stamp: Monday, March 24, 2003 4:52:04 PM [B][COLOR="Red"]<--different date[/COLOR][/B]
           Creation: Monday, March 24, 2003 4:52:04 PM [B][COLOR="Red"]<--different date[/COLOR][/B]
        Last access: Saturday, January 12, 2008 10:01:18 PM
         Last write: Monday, March 24, 2003 4:52:04 PM [B][COLOR="Red"]<--different date[/COLOR][/B]

NOTE: While the size and version of the C:\I386\FP40EXT.CAB/admin.exe match the C:\WINDOWS\ServicePackFiles\i386\admin.exe and C:\WINDOWS\system32\dllcache\admin.exe, the checksums and dates do NOT match.

I was thinking I might create a c:\program files\microsoft frontpage\version3.0\bin\ folder and copy the files from my dllcache to the paths identified by SFC. Seems that would stop SFC from complaining. However, the checksum/date mismatches have me confused about how I should proceed.

Suggestions or requests for further details are welcome.

 

Hi, Steve.

I had a few "hiccups" with my computer recently.

A couple days ago, I had a "File System" BSOD that occurred before Windows loaded. Didn't write down the error code (0x22 if I recall correctly) and parameters. There is no .dmp file to match the crash.

• My WinXP Home SP2 is using NTFS.

A couple times during the past week (since the Patch Tuesday updates?) my computer would not complete it's boot. Only a couple icons would show up in the system tray. I pressed the Reset button to reboot.

A couple weeks ago, I had some annoying "monitor crashes" (for lack of a better term) over a period of a couple days. My mouse would intermittently freeze and then my monitor would go blank (black screen) and shut down (blinking power light on the monitor). If I recall correctly, the display showed its normal alternating Analog/Digital graphic in the upper left corner that always displays during boot until the digital signal is recognized. I think the DVI signal was lost. Had to reboot to bring the monitor back to life. I have also made sure the cable is firmly plugged in.

• Monitor = Samsung SyncMaster 940BX connected via DVI
  Settings: 1280x1024, 32-bit color, 96DPI, 60Hz Refresh Rate
  Everest Info:
  

I purchased a replacement GPU card but I have not uninstalled the old GPU and installed the new GPU yet. I have not had "monitor crashes" for the last several days but I am considering replacing the GPU anyway.

• Currently Installed GPU = XFX Brand GeForce 6800 (AGP 8x)
  Driver Provider: NVIDIA
  Driver Date: 10/29/2004
  Driver Version: 6.6.9.3
  Adapter BIOS Information: Version 5.40.02.12.08
  Everest Info:
  

Replacement GPU (not yet installed) from Newegg = "Recertified: EVGA 128-A8 N343-RX GeForce 6800 128MB 256-bit DDR AGP 4x/8x Video Card "

I was considering replacing the GPU this weekend (and I was thinking of just replacing the card without uninstalling/installing graphics drivers because I purchased a card that I think might "match" as far as the OS is concerned.)

I ran SFC to be sure all is well with my system files before embarking on the task. Besides, I simply like SFC to run unattended.

 

I copied all files mentioned in my first post from the dllcache to the specified locations. (Also turns out I do already have the "microsoft frontpage" folder and its subfolders in my "program files" folder. I guess I overlooked it when I submitted my first post in this thread.)

I almost have sfc /scannow running unattended. I was prompted to insert my Windows XP SP2 CD twice near the beginning of the scan (even with my slipstreamed CD already inserted). After clicking "Retry" both times the scan continued from there unattended.

There are no Event Viewer events associated with the two times I was prompted to insert my Windows XP SP2 CD.

I ran sfc /scannow twice and the same behavior occured both times.

I also still do not know why the checksums I mentioned in my first post differ. If anyone has ideas or finds similar discrepancies with their computers, I would appreciate it if you let me know. Perhaps the checksum discrepancies have something to do with the prompts to insert the CD.


EDIT: BTW, I have replaced my graphics card. I also have not had any BSODs since the one I mentioned above. These are possibly unrelated to my issue but I thought I should follow up about those too anyway.

 

Code:

********************************************************************
FileAlyzer © 2003-2006 Safer Networking Ltd. All Rights Reserved.
********************************************************************


File: D:\Data\Temp\11\admin.exe 
[B][COLOR="Red"](extracted from my slipstreamed CD's \I386\FP40EXT.CAB file)[/COLOR][/B]
Date: 2/10/2008 12:30:11 PM


***** General ******************************************************
           Location: D:\Data\Temp\11\
               Size: 16439
            Version: 4.0.2.7523
             CRC-32: DF353877
                MD5: 64F04CCD27271961B8E4A5DA12B54EB6
               SHA1: 20CB4AEE41A90FB7240EC674A7F87F0E5ACEB729
          Read only: No
             Hidden: No
        System file: No
          Directory: No
            Archive: Yes
      Symbolic link: No
         Time stamp: Monday, March 24, 2003 4:52:04 PM
           Creation: Monday, March 24, 2003 4:52:04 PM
        Last access: Sunday, February 10, 2008 12:29:44 PM
         Last write: Monday, March 24, 2003 4:52:04 PM

As I expected, the checksums and dates/times from my slipstreamed CD admin.exe are the same as the one in my C:\I386\FP40EXT.CAB and they are different from the checksums and dates/times for admin.exe in my dllcache.

Does anyone care to take the time to make comparisons with their files to let me know what they discover?