Norton Internet Security / Norton AntiVirus

[crisoco8722]

---------------------------------------------------------------------------

System File Checker sfc /scannow

---------------------------------------------------------------------------

I tried running a scan from Start / Run / Open / sfc /scannow and this answers my question regarding what CD it requires as it ran, but 20% in asked for the Windows XP Home SP3 CD. I inserted it but then it said it was the wrong CD! I skipped that and then again at 60% it again asked for the same CD. I aborted it at that stage.

From researching the internet it looks like the Windows XP SP3 CD has to slipstreamed along with the original installation disc to make one combined disc. It looks like it is a very complicated and difficult process and I have no idea what is the best way to go about it.

---------------------------------------------------------------------------

Chkdsk

---------------------------------------------------------------------------

After adding a prefix to the Path in Environmental Variables I managed to get the chkdsk to run again and all it does each time is keep cleaning the unused entries. There were only 14 in each category this time.

[lmacri Super Phishing Phryer]

Hi crisoco8722:

I'm still uncertain from your previous two posts if you were able to get chkdsk and scannow /verifiyonly to run correctly from a command prompt or if you're running everything from the Run command on your Start menu, so please ignore the following comments if they aren't relevant.

When you try to run the chkdsk /f /r command from your command prompt, are you using an elevated command prompt with Administrator rights (see instructions in message # 47)?  Does the sfc /verifyonly command work from an elevated command prompt when you start your computer in Safe Mode as described here in the article Microsoft Windows XP - Start the Computer in Safe Mode (link provided in message # 47)  If commands aren't running from your command prompt then you should be receiving an error message (e.g., insufficient privileges) or even a valid exit code as long as you're giving them sufficient time to finish.  The article here titled How to Perform Disk Error Checking in WIndows XP includes descriptions of the chkdsk exit codes (link provided in message # 47).

Were you able to extract details of your scannow session from the Windows CBS.log file as described in the article here titled How to Analyze the Log File Entries That the Microsoft Windows Resource Checker (SFC.exe) Program Generates in Windows Vista (link provided in message # 49).  Instead of searching for the "[SR]" tag for scannow entries you can search for any string in CSB.log (e.g., for "2011-05-27" to check for all CBS.log entries created 27-May-2011).  If the Vista instructions in that support article don't work you might be able to find similar XP instructions by searching the MS Support site.

I'm not certain, but in your case I think a slipstream CD would only work if your PC came from the manufacturer with XP SP2 installed and the SP3 CD you have is the "partial" version with updated system files that were included in the SP3 service pack (i.e., similar to the download you would receive if you installed the SP3 service pack XP via Windows Update).  There is also a "full" SP3 CD/DVD that includes all previously released updates for the XP OS including SP1, SP2 and SP3 that is over 300 MB (I believe the correct link for the installation file required to create your own DVD is here) that might eliminate the need to create a slipstream CD.

I'm not familiar enough with Win XP to be of any help to you at this point.  Maybe someone else following this thread will jump in with further suggestions.

If you don't feel that any of your problems are related to Administrator rights after reading the article here titled Error Message When You Use Windows Update or Microsoft Update Web Sites to Install Updates on Windows 2000, Windows XP, and Windows Server 2003: 0x80070005 (link provided in message # 49) but you still have concerns about your Win XP installation, I would recommend that you create a new post in the BleepingComputer Windows XP support forum or the WhatTheTech MS Windows support forum as I suggested in message # 33  and see if they can help you.  Perhaps someone there can provide a fresh perspective.

Be sure to post back and let everyone know how you're progressing.
-------------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[crisoco8722]

Hi Imacri

---------------------------------------------------------------------------

I'm still uncertain from your previous two posts if you were able to get chkdsk and scannow /verifiyonly to run correctly from a command prompt or if you're running everything from the Run command on your Start menu

---------------------------------------------------------------------------

chkdsk will run from the command prompt just fine.

---------------------------------------------------------------------------

Were you able to extract details of your scannow session from the Windows CBS.log file as described in the article here titled How to Analyze the Log File Entries 

---------------------------------------------------------------------------

Unfortunately this is the only thing I am struggling with at the moment. I cannot find any log files for sfc /scannow in Windows/Logs/CBS. There are no file / folder for CBS. I ran the scan from Start / Run but it will run from the command prompt. See below.

---------------------------------------------------------------------------

I'm not certain, but in your case I think a slipstream CD would only work if your PC came from the manufacturer with XP SP2 installed and the SP3 CD you have is the "partial" version .....

---------------------------------------------------------------------------

I had the original OEM SP2 CD and managed to slipstream my SP3 CD (544mb) using nLite and finally got sfc scannow running from Start / Run using that slipstream CD. It all ran smoothly and obviously files had been extracted from the CD but I want to find the log of the scan to find out exactly what changes have been made. I believe that it should be in Windows/logs/cbs/cbs.log/sfcdetails.txt but its not there. I do not seem to have a cbs folder at all.

---------------------------------------------------------------------------

If you don't feel that any of your problems are related to Administrator rights after reading the article here ....

---------------------------------------------------------------------------

I do not have any errors like this and for now I am happy to continue with the modifications I have made. Thank you for all the informative links.

---------------------------------------------------------------------------

Thank you for all your help and I will report back when I have any further news.

If you able to help me source my sfc /scannow log file it would be much appreciated.

[lmacri Super Phishing Phryer]

---

crisoco8722 wrote:

If you able to help me source my sfc /scannow log file it would be much appreciated.

---

Hi crisoco8722:

Sorry, I haven't been able to find a definitive answer for XP yet.

There is a good article here describing how the Windows File Protection (WFP) and System File Checker (SFC) work in XP but no mention of what log file, if any, is used to store the SFC scan results in XP.  For future reference, it's probably possible to run SFC from a command prompt and redirect the scan output to a readable text file using the ">"  in the command (see here for a tutorial), but that won't help you find the results of the scan you ran yesterday.

On my Vista SP2 computer the CBS.log file is found at C:\Windows\Logs\CBS\cbs.log. This is not a hidden system file but the contents are encoded and cannot be read in Notepad or other text editors - hence the Vista instructions here on how to extract SFC scan results from CBS.log to a text file.

It's remotely possible that the SFC results are accessible in XP from the Event Viewer.  In Vista, the Custom Views | Administrative Events is the most informative view, but you could also create your own custom view (click Create Custom View in the Actions panel) or custom filter to compile a list of all the events that occurred around the time of your SFC scan and see if anything stands out.

This is just a suggestion, but if NIS 2012 seems to be working better now that you've repaired your Win XP OS with chkdsk and SFC you might want to consider moving your Solution tag to a later post.
--------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[crisoco8722]

Hi Imacri.

---------------------------------------------------------------------------

Sorry, I haven't been able to find a definitive answer for XP yet. (location of sfc scannow log)

---------------------------------------------------------------------------

Because I did not abort any file replacement during the sfc scannow an event log was not made. See next comment.

---------------------------------------------------------------------------

There is a good article here describing how the Windows File Protection (WFP) and System File Checker (SFC) work in XP

---------------------------------------------------------------------------

That was an interesting article and the following extract seems to indicate that a log is only made in the Event Viewer if a file replacement attempt is skipped.

If the file is found in dllcache or the install source is auto-located, WFP replaces the file without prompting the user and moves on. If the file cannot be found, WFP displays a dialog box that prompts the user to either insert distribution media or cancel the restore operation.
WFP also logs an event to the system event log, noting the file replacement attempt. If the administrative user cancels the WFP file restoration, an event noting the cancellation is logged.

---------------------------------------------------------------------------

...... you should mark one of the posts as the Solution

---------------------------------------------------------------------------

I have already done that but a lot as happened since and I am not sure that message 16 is quite the appropriate solution any longer. I have looked at changing it to another message but it only seems possible to change message 16 to 'Not the Solution' rather than being able to change it to another one. If that is the way Norton allows for revoking that message as the solution then I will do that and try to find a more appropriate solution but I do not want to mess things up.

It is difficult to be objective when marking a solution because there are so many solutions to the various problems and some of the solutions are not exactly applicable to what someone might be looking for when reading the Subject heading.

The Help File says ...... To revoke an accepted solution: Choose Options > Unmark as Accepted Solution.
You can choose another solution or leave the question unsolved.

Is Unmark as Accepted Solution the same as Not the Solution? If it is then the help file should be amended.

[lmacri Super Phishing Phryer]

---

crisoco8722 wrote:

That was an interesting article and the following extract seems to indicate that a log is only made in the Event Viewer if a file replacement attempt is skipped.

If the file is found in dllcache or the install source is auto-located, WFP replaces the file without prompting the user and moves on. If the file cannot be found, WFP displays a dialog box that prompts the user to either insert distribution media or cancel the restore operation.
WFP also logs an event to the system event log, noting the file replacement attempt. If the administrative user cancels the WFP file restoration, an event noting the cancellation is logged.

---

Hi crisoco8722:

I actually interpret that to mean that the user is not prompted to insert the Win XP CD if the missing or corrupted file can be found in the hidden "backup" Windows folder on the hard drive in C:Windows\System32\Dllcache (see my comment in section D of message # 47), and that SFC creates a system log any time a file repair is attempted, regardless of whether the user cancels or proceeds with the repair. You may still luck out and find something in the Event Viewer.

Users are only prompted to insert their CD during a SFC scan when backup files in the \Dllcache folder are also missing or corrupted, which is why I was a bit dismayed that this actually happened to you. Marc Liron posted a workaround for a corrupted \Dllcache folder here in his XPUpdate blog but it still requires that you have a working Win XP CD, and this workaround is primarily intended to save you from having to insert your Win XP CD every time SFC has to repair a file.  This really isn't a great concern if the slipstream CD you created worked correctly, but you may still be interested in reading this article - especially the section on Windows Updates, service packs and hotfixes.  Updated system files could be missing in both your main C:Windows\System32 and backup C:Windows\System32\Dllcache folders if Windows Update failed during a service pack or hotfix delivery (I recall you mentioning problems with the SP2 update), but if something is wrong with the permissions in your user account or a C:\Windows subfolder(s) then Windows Update might not be able to copy updated .dll files into one or both of these folders.

And yes, that was me harping about Administrator rights again.  If I were a dog I'd be chewing a bone now.
-------------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

[crisoco8722]

Hi Imacri,

---------------------------------------------------------------------------

SFC creates a system log any time a file repair is attempted, regardless of whether the user cancels or proceeds with the repair. You may still luck out and find something in the Event Viewer.

---------------------------------------------------------------------------

You could well be right but we may have to agree to disagree on this point. I have done a detailed system search and no log exists in either the Event Viewer or Windows Logs. Thank you though for your concern.

---------------------------------------------------------------------------

Users are only prompted to insert their CD during a SFC scan when backup files in the \Dllcache folder are also missing or corrupted

---------------------------------------------------------------------------

Everything was apparently fixed during the slipstream CD update.

---------------------------------------------------------------------------

.... if Windows Update failed during a service pack or hotfix delivery (I recall you mentioning problems with the SP2 update) ....

---------------------------------------------------------------------------

Windows has never failed in the delivery of any update.

In message 43 I mentioned that a part of the Administration Rights (scheduled tasks) had been messed up while installing an SP2 update, not that the update itself had failed. Apparently this was a common problem.

For the benefit of other users who may read this post I should point out that Windows sfc scannow file replacement can sometimes cause other issues. In my case it completely removed Accessories & Administration Tools from the Start / All Programs list. This had to be re-instated using Microsoft's own fix, so they were obviously aware of issues with the SP2 update. Also the Pin to Start Menu option had disappeared from the context menu and had to restored.

[crisoco8722]

Quote from message #28

---------------------------------------------------------------------------

Quiet Mode

I now have 15 programs configured so that when any one of them loads it will put Norton into Quiet Mode (not Silent Mode). The programs have been selected so that Norton will always remain in Quiet Mode. I have also turned off Idle Time Optimizer and set all the remaining time out / delays to the maximum possible. In this way Norton will not run Idle Time Quick Scans or background tasks so that I am then able to configure Norton to run Quick Scans at times when the computer is not in use, knowing that I will not be crippled by the resources that Quick Scans consumes. Useful popup messages will also continue to be displayed.

---------------------------------------------------------------------------

I have noticed an unusual problem that has been occuring with Quiet Mode that Symantec should be aware of.

When Norton 2012 first loads at start up Quiet Mode does not initially activate (I haven't tested it otherwise) from any of the loaded programs unless the Norton Protection Center UI Stub window is loaded. Perhaps this an intended feature but it is not how I would like it to work. To overcome this I have now added uistub.exe to the Windows startup so that Quiet Mode will immediately be activated when any of the loaded programs are opened.