"Same old stuff" included hex-editing the sfc.dll in recent service packs. The file has changed, though, so you can't do it without knowing what needs to be changed (i.e. where the equivalent to the old x6211 '8B 6C' is located now)..
I didn't even know people hex edited anything. I meant ways around it like replacing the file in the /servicepackfiles/i386/ then the actual file so that when file protection tries to replace the file, it uses the file you just put there. Sorry for not catching on to what you mean =\
The modding page has info on the necessary actions for the later service packs - there's info on the hexediting at the bottom.
The replacing the file thing works fine, but it doesn't really help you if you want to make some more wide-ranging changes, e.g. removing netmeeting and outlook express entirely. And, in fact, getting rid of the dllcache entirely as well (I know you can do this, but it's less hassle to just disable it and delete the whole lot).
For OE: on the XP box here its under add/remove -> set program access and defaults. From there you can untick the "Allow access to program" and the shortcuts to OE *should* disappear. At least, thats what I've read should happen. I use OE so I'm not going to untick it just in case
For FrontPage: Can't you just change your office setup and tell it to go away?
I can get rid of the shortcut, I just deleted it from everywhere, default user included. As for Frontpage, well either it was installed with Win2K (I reinstalled the other day) or reinstalled with the service pack; either way, it's not letting me get rid of it.
I'm kind of with joh6nn on this, anyhow - if the program isn't being used and is undesired it should be removable from the hard drive. MS has made this impossible in the name of security, when to be honest none of these have any real reason to be protected. My cynical side says they're preventing you deleting them in the hope you'll use them.
Muh, anyway, my original query still stands... if anyone knows how to *completely* disable WFP in SP4, please let me know.
Well, well, and indeed... well. Seem to have solved this little problem.
You need to do the same as with Service Pack 2 - information listed here - but instead of the offset x6211 the bytes '8B 6C' are now located at x62DB. Replace this with '90 90' as per the instructions, replace the files, and Bob's yer uncle.
Rename it to sfc.new, then place it in C:\WINNT\ServicePackFiles\i386 and C:\WINNT\system32 (also C:\WINNT\system32\DLLCache if possible)
Open TaskManager (CTRL+SHIFT+ESC) and click on Processes.
Then click on Explorer.EXE and click End Process and Yes.
Now click Applications and New Task Type in cmd and press OK/Enter. (a DOS-like box will come up)
Type in the box SP4_sfc.bat and press Enter. (After downloading This batch file).
If all goes well, Windows File Protection should be patched, and you won't have to worry about it again.
This probably isn't the right place for a "How-To", for people running WFP, but I'm tired/bored, and had some spare time.
I know this is an old post, but:
Why is everyone hex editing their sfc.dll ?
I just turned WFP off...it's a reg value that you can set to off. Is there another reason to edit the sfc.dll? I am running SP3 on 2k, and it worked perfectly, changed one rev value and no more WFP at all.
I imagine this would work fine on sp4 as well. But again, maybe I'm not understanding something here that would require a more complicated patch.
If you're running later than SP1 and can *completely remove* all the files without hexediting the sfc.dll file, then I"m not sure what you've managed to do but it's more than most people. Generally you can use the registry modification to have it let you "remove" it, but it doesn't really remove it, it just leaves the files there and you can't delete them.
Please log-in to post.
You need to be logged in to post. To log-in, or to register an account go -there.