This is how you can fight WFP
-
Those of you who read my recent post about WFP hell are probably waiting for an update to the story :-O Here is what I found. 1. I could not disable Windows File Protection by just updating registry settings. Windows always silently restored the files I tried to delete. (I did not try using kernel debugger via null modem though, I believe in software methods :) ). 2. WFP is disabled if you boot W2K in safe mode (press F8 while starting Windows). 3. Then you can do with system files whatever you want. If you really mean to update them and you know what you're doing, update them in two places: Windows stores backup copies in "dllcache" directory inside WinNT\System32. Having said that, I must admit just updating hh.exe, hhctrl.dll and itss.dll did not solve my problem. My HTML Help still crashes on start. I guess I'll end up with "FORMAT C:" :(( Vagif Abilov COM+/ATL/MFC Developer Oslo, Norway
-
Those of you who read my recent post about WFP hell are probably waiting for an update to the story :-O Here is what I found. 1. I could not disable Windows File Protection by just updating registry settings. Windows always silently restored the files I tried to delete. (I did not try using kernel debugger via null modem though, I believe in software methods :) ). 2. WFP is disabled if you boot W2K in safe mode (press F8 while starting Windows). 3. Then you can do with system files whatever you want. If you really mean to update them and you know what you're doing, update them in two places: Windows stores backup copies in "dllcache" directory inside WinNT\System32. Having said that, I must admit just updating hh.exe, hhctrl.dll and itss.dll did not solve my problem. My HTML Help still crashes on start. I guess I'll end up with "FORMAT C:" :(( Vagif Abilov COM+/ATL/MFC Developer Oslo, Norway
Windows File Protection is there for a very good reason. DLL Hell was a major annoyance to anyone that's written and distributed windows software, and it makes systems lock up. Before you do anything drastic, just uninstall the IE 6 and MSXML 4 betas from your computer. They both (I think MSXML does -- I'm positive that IE 6 does) let you uninstall MSXML and restore the IE 5.5 configuration. Do this, and HTML Help should work again. Microsoft Visual Studio.NET insists on installing the IE 6 beta, but I go to banks' sites online to check on my accounts, and lots of sites with the 'https://' urls just don't work with IE 6, so I did an 'ix-nay on the hombre' with IE 6, and had it roll-back to IE 5.5. MS VS.NET still works with IE 5.5 just fine. My 2¢... Sincerely Yours, Brian Hart "And that's the news from Lake Wobegon, where all the women are strong, the men are good-looking, and the children are above-average." - Garrison Keillor
-
Windows File Protection is there for a very good reason. DLL Hell was a major annoyance to anyone that's written and distributed windows software, and it makes systems lock up. Before you do anything drastic, just uninstall the IE 6 and MSXML 4 betas from your computer. They both (I think MSXML does -- I'm positive that IE 6 does) let you uninstall MSXML and restore the IE 5.5 configuration. Do this, and HTML Help should work again. Microsoft Visual Studio.NET insists on installing the IE 6 beta, but I go to banks' sites online to check on my accounts, and lots of sites with the 'https://' urls just don't work with IE 6, so I did an 'ix-nay on the hombre' with IE 6, and had it roll-back to IE 5.5. MS VS.NET still works with IE 5.5 just fine. My 2¢... Sincerely Yours, Brian Hart "And that's the news from Lake Wobegon, where all the women are strong, the men are good-looking, and the children are above-average." - Garrison Keillor
No, I am not questioning WFP advantages. I do agree it was too easy to corrupt system file set in old versions of Windows. What I was quesioning is why should it be so extremely difficult to temporarily disable WFP for a person who knows what he's doing (or at least prepared for consequences). Read one of the replies to my other post: some people found a way to fool WFP by replacing system files both in system and dllcache directories quickly enough! Also, the situation which I encountered shows that forcing latest version of DLLs is not always the best. Perhaps Windows could create several dllcache directories and store several "last good" versions of system files, so users could them rollback. Vagif Abilov COM+/ATL/MFC Developer Oslo, Norway
-
Those of you who read my recent post about WFP hell are probably waiting for an update to the story :-O Here is what I found. 1. I could not disable Windows File Protection by just updating registry settings. Windows always silently restored the files I tried to delete. (I did not try using kernel debugger via null modem though, I believe in software methods :) ). 2. WFP is disabled if you boot W2K in safe mode (press F8 while starting Windows). 3. Then you can do with system files whatever you want. If you really mean to update them and you know what you're doing, update them in two places: Windows stores backup copies in "dllcache" directory inside WinNT\System32. Having said that, I must admit just updating hh.exe, hhctrl.dll and itss.dll did not solve my problem. My HTML Help still crashes on start. I guess I'll end up with "FORMAT C:" :(( Vagif Abilov COM+/ATL/MFC Developer Oslo, Norway
I had the same thing happen to me with the MSDN help crashing with the message "hh.exe caused access violation". Unfortunately I can't remember what I did to fix it. : ( There was some kind of file type I had to delete and it was not a protected file. I believe somebody in one of the forums somewhere (here or somewhere else) told me how to fix it. Look around more before reformating.
-
Those of you who read my recent post about WFP hell are probably waiting for an update to the story :-O Here is what I found. 1. I could not disable Windows File Protection by just updating registry settings. Windows always silently restored the files I tried to delete. (I did not try using kernel debugger via null modem though, I believe in software methods :) ). 2. WFP is disabled if you boot W2K in safe mode (press F8 while starting Windows). 3. Then you can do with system files whatever you want. If you really mean to update them and you know what you're doing, update them in two places: Windows stores backup copies in "dllcache" directory inside WinNT\System32. Having said that, I must admit just updating hh.exe, hhctrl.dll and itss.dll did not solve my problem. My HTML Help still crashes on start. I guess I'll end up with "FORMAT C:" :(( Vagif Abilov COM+/ATL/MFC Developer Oslo, Norway
I believe that the explorer.exe process is the enforcer for WFP. If you kill it, the WFP stuff is temporarily disabled. There is a knowledge base article Q222473 on microsoft.com about some registry settings. In addition search the archives at www.ntbugtraq.com for even more hacker level information. The behavior of explorer.exe is sort of interesting. It is the process that displays the Start Menu and taskbar stuff. Normally when you as a user run it, it shows up as the typical directory and file explorer view. If you look at the process list in Task Manager, only one instance of explorer.exe is ever running. If you kill it, your Start Menu and taskbar will disappear, as will all of the file views. Then, if you restart it (CTRL-ALT-DEL, press Task Manager, use File > New Task, type "explorer", press OK), your taskbar and start stuff automatically reappears. If anyone decides to experiment and kill explorer.exe, you may want to first log out, then log back in order to save any changes it may have pending. Except for the WFP "feature", this behavior is the same as it was in NT 4.0. Raul Based in sunny San Diego, California C/C++/MFC/ATL - Expert bugstomper/troubleshooter Embedded (TI DSPs) and Windows programming - 10+ years
-
I believe that the explorer.exe process is the enforcer for WFP. If you kill it, the WFP stuff is temporarily disabled. There is a knowledge base article Q222473 on microsoft.com about some registry settings. In addition search the archives at www.ntbugtraq.com for even more hacker level information. The behavior of explorer.exe is sort of interesting. It is the process that displays the Start Menu and taskbar stuff. Normally when you as a user run it, it shows up as the typical directory and file explorer view. If you look at the process list in Task Manager, only one instance of explorer.exe is ever running. If you kill it, your Start Menu and taskbar will disappear, as will all of the file views. Then, if you restart it (CTRL-ALT-DEL, press Task Manager, use File > New Task, type "explorer", press OK), your taskbar and start stuff automatically reappears. If anyone decides to experiment and kill explorer.exe, you may want to first log out, then log back in order to save any changes it may have pending. Except for the WFP "feature", this behavior is the same as it was in NT 4.0. Raul Based in sunny San Diego, California C/C++/MFC/ATL - Expert bugstomper/troubleshooter Embedded (TI DSPs) and Windows programming - 10+ years
just a note... on NT4 at least, even killing explorer is not enough. NT will relaunch it after a small delay. to prevent this relaunching, you have to tweak a registry setting (set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = 0) -c ------------------------------ Smaller Animals Software, Inc. http://www.smalleranimals.com
-
I had the same thing happen to me with the MSDN help crashing with the message "hh.exe caused access violation". Unfortunately I can't remember what I did to fix it. : ( There was some kind of file type I had to delete and it was not a protected file. I believe somebody in one of the forums somewhere (here or somewhere else) told me how to fix it. Look around more before reformating.
Thanks! I've found and fixed the problem. That was - as you suspected - non-protected file. The file is called hh.dat. Unfortunately it had "hidden" attribute, and my Explorer was configured not to show hidden files, so I did not find the file before. Thanks for your help. Vagif Abilov COM+/ATL/MFC Developer Oslo, Norway
-
just a note... on NT4 at least, even killing explorer is not enough. NT will relaunch it after a small delay. to prevent this relaunching, you have to tweak a registry setting (set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = 0) -c ------------------------------ Smaller Animals Software, Inc. http://www.smalleranimals.com
There's another way to end explorer.exe - without being restarted automatically: Select Start->Shutdown in the dialog hold down Ctrl-Alt-Shift and press Cancel -> The Explorer Shell is gone and doesn't restart. Pretty handy for debugging shell extensions and the like. -Chris
-
There's another way to end explorer.exe - without being restarted automatically: Select Start->Shutdown in the dialog hold down Ctrl-Alt-Shift and press Cancel -> The Explorer Shell is gone and doesn't restart. Pretty handy for debugging shell extensions and the like. -Chris
> Select Start->Shutdown in the dialog hold > down Ctrl-Alt-Shift and press Cancel Sounds like a combo move from street fighter or mortal kombat. I'll try to remember it though, because it will be useful. If explorer.exe handles WFP and I am using an alternate shell (GeoShell. Uses COM for the plugin modules. I like it.), does that mean that WFP just does not work? Not that it really matters anyway ever since I got really pissed off when WFP automatically replaced a dll with a bad version (I think it was actually missing a fn -- entry point 'whatever' not found in ...). It was really hideous. I know some of you will be appalled, but I just deleted the dllcache folder :-O -- freeing up 300 megs or so and I haven't had any problems since. I guess I'd rather help myself than be 'helped' by something pushy like WFP -- it's a good idea, but it should ask before replacing files (would that be so hard?). "das leid schlaft in der maschine" -Einstürzende Neubauten
-
> Select Start->Shutdown in the dialog hold > down Ctrl-Alt-Shift and press Cancel Sounds like a combo move from street fighter or mortal kombat. I'll try to remember it though, because it will be useful. If explorer.exe handles WFP and I am using an alternate shell (GeoShell. Uses COM for the plugin modules. I like it.), does that mean that WFP just does not work? Not that it really matters anyway ever since I got really pissed off when WFP automatically replaced a dll with a bad version (I think it was actually missing a fn -- entry point 'whatever' not found in ...). It was really hideous. I know some of you will be appalled, but I just deleted the dllcache folder :-O -- freeing up 300 megs or so and I haven't had any problems since. I guess I'd rather help myself than be 'helped' by something pushy like WFP -- it's a good idea, but it should ask before replacing files (would that be so hard?). "das leid schlaft in der maschine" -Einstürzende Neubauten
>Sounds like a combo move from street fighter or mortal kombat. Didn' you know that Windows is just Minesweeper with some added tools...?;) "If you are not living on the edge, you are wasting too much space !"
