Repairing Windows System Files If you have a Windows system file that was accidentally deleted or corrupted, you don't have to start from scratch, usually it can be extracted from your Windows CD. If you are a Windows 95 user If you can boot Windows and have WinZip, you can simply put your Windows 95 CD in the drive, go to the directory D:\Win95 (assuming your CD-ROM drive letter is D: ), and double click on the cab files to display the contents. Scroll to find the file you need, highlight it, and go to the Actions menu and choose Extract. Keep trying the cab files until you find your file. Get WinZip 7.0 at http://www.winzip.com Alternatively you can boot to DOS and use the utility extract.exe (or do it from the DOS prompt if Windows is running, though you won't be able to overwrite a file that is in use). Reboot, press F8 during startup when it says "Starting Windows 95". This will give you the boot menu, with options. Choose "Command Prompt Only" from the list of options. Note that you will need to be able to access your CD-ROM from DOS for this, it requires using MSCDEX.exe in Autoexec.bat and a real mode CD-ROM driver in the config.sys file. Go to http://www.pcnineoneone.com/howto/cdboot1.html to learn how to load CD-ROM drivers in DOS At the C:\ prompt, insert the Windows 95 CD and type D: Be sure to substitute the appropriate drive letter if your CD ROM drive is not D:. Now type CD WIN95 to change to the directory on the CD containing the .cab files. If by chance you know the .cab file that the desired file resides in, use the following syntax: EXTRACT D:\WIN95\WIN95_10.CAB UNIDRV.DLL /L C:\WINDOWS\SYSTEM This would extract the file unidrv.dll from the win95_10.cab into the Windows/System directory. The /L switch is used to specify the location, without it the default is the current directory, which in this case would be on the CD and would result in an error. If you don't know which .cab file contains the file that you need, use the following command syntax> It searches all the .cab files (starting with the one you specify) and extract the file when found: EXTRACT /A D:\WIN95\WIN95_02.CAB MSVCRT.DLL /L C:\WINDOWS\SYSTEM The /A switch tells extract to search all the cab files in sequence, starting with the one you specified. If you just want to find which .cab file the file you need lives in, use the following command: EXTRACT /A /D D:\WIN95\WIN95_02.CAB MSVCRT.DLL The /D switch prevents the file from being extracted. Note for DOS People: I'm including a redundant path in the command in case someone happens to type it from the wrong directory; the command will still work with extract.exe in c:\windows\command If you are a Windows 98 user If you are running Windows 98, the task of extracting a file is almost too easy! The System File Checker utility is one of the most powerful and useful utilities that comes with Windows 98. The easiest way to get to it is to click the Start button and go to Run, type SFC in the field and hit Enter. When System File Checker opens, the first thing you should do is click the settings button and check the two boxes labeled Check for Changed Files and Check for Deleted Files. There are two ways to use System File Checker. If you select Scan for altered files, it will scan all of your system files (in a comprehensive preset directory search order, you can see where it looks if you go to settings and click the Search Criteria tab). If it finds a file that is corrupted, changed or deleted you will be prompted for action. The first action is to "update verification information". Choose this option if you know a file has been updated, e.g. you have upgraded software or applied a patch, and to accept the file the way it is. The next option is to Restore the file from the Windows 98 CD. Choose this option if the file in question is corrupted, deleted or changed to an older version - check the date, version number and size. When you restore a file, by default, SFC saves a backup of the file you are replacing. The last option is to Ignore, which will do nothing and you can make a decision on it later. Each time you run the scan, you will be prompted again until you have made a decision to either update the verification information or to restore it. This option will give you the chance to get back to it later after doing some research. The other way to use SFC is to Extract One File from the Installation Disk. This is absolutely a breeze. Just type the exact name of the missing or damaged file in the field, and it will find it on the Windows 98 CD and put it where it is supposed to go. It will prompt you to reboot if it is a file that is in use. End of story, the original file is restored after you reboot. Note: There is one fatal flaw to this that I must make you aware of. When you extract a file with System File Checker, it will look for the very first occurrence of it in the cabinet files. If this happens to be a file that is also in one of the pre-copy cabinet files System File Checker will "restore" the wrong file! For example, lets say you were getting error messages referring to user.exe and you decided you were going to use SFC to restore user.exe from the Windows 98 CD. System File Checker would pull it out of mini.cab and your next reboot will be your last, until you figure out what happened and restore the file from the proper location. If this happens to you, you will have to use extract.exe from DOS and extract the file from Windows 98_42.cab to c:\windows\system with the following command: EXTRACT D:\WIN98\WIN98_42.CAB USER.EXE /L C:\WINDOWS\SYSTEM That was an example, but remember that if you don't know which cab file to look in, you can use extract.exe in the following manner to search all of the cabinet files: EXTRACT /A /D D:\WIN98\WIN98_22.CAB FILENAME.xxx | more If Microsoft file versions are ever in question, the best place to pin down the exact version number you are supposed to have based on the Microsoft software you have installed is The Microsoft DLL Help Database at http://support.microsoft.com/servicedesks/fileversion/dllinfo.asp Note that you cannot download the files from this site, but you can search by product and filename to see the version number, and then cross check it with other products you have installed. Here is an example of how to use this. If we were looking for the version number of shlwapi.dll that ships with Windows 98 Second Edition, it would tell us 5.0.2614.3500. Clicking the more information link would show us the file size and date and a slightly more verbose description. But wait! There's more. What if you've installed Internet Explorer 5.5? Simply select Internet Explorer from the Product drop list, and choose version 5.5 from the version drop list. Now search for the filename and you'll see that the required version is 5.50.4134.600 and you know not to extract it from the Windows 98 CD or copy it from another PC that doesn't have the correct version. If you are running Windows Millennium Edition System Files aren't as much of a problem in Windows Millennium because of a new feature called System File Protection, which monitors attempts to modify protected system files. If a protected file gets overwritten, deleted or renamed, SFP will replace it with the original correct version. This means that software installations cannot install their own custom or older versions of dlls, except for use in their own directories. This is permitted, but frowned upon because if two incompatible versions of the same dll are in memory it can still cause instability. Vendors are encouraged to make their products compatible with current versions. Here's how WinME System File Protection works. You launch a software installation, that replaces some system files with incorrect versions. WinME first stores a copy of the original files and then lets the installer replace them, so that it doesn't cause the installation to fail. It then checks a database of catalogue files to determine whether or not the replacement of files were valid updates. If valid, SFP allows the files to be replaced. Otherwise, after the installation completes, WinME silently copies back the original files, without any indication to the user and then deletes the copy of the originals it made during the installation. There are approximately 800 protected system files under the WinME System File Protection scheme. These files can be replaced only in the following manner. This is straight from the horse's mouth (Microsoft): 1 - A new release of Windows Millennium Edition 2 - Windows Update and other authorized Microsoft hot-fixes 3 - An authorized redistribution pack that Microsoft supplies to application vendors to include with their product. Unfortunately, the System File Protection scheme has no mechanism to detect or prevent files from being corrupted. In the (relatively) rare event that occurs, you will have to extract a new copy from the WinME source files. While Windows Millennium Edition doesn't have a utility that's anything like the Windows 98 System File Checker, you can extract single files using a function found within the Microsoft Configuration Utility. Go to Start / Run, type msconfig and press Enter. On the General tab, you'll see a button called Extract File. If you click that button, you can enter the name of the file you wish to extract, or browse for it. Click Start and you'll be prompted to enter (or browse for) the Restore From (e.g. \WINME on the Windows Millennium Edition CD or perhaps the directory on your hard drive you copied the source files to, or c:\windows\options\install where they were automatically copied if you had enough disk space during setup) and Save File In directories. Unfortunately there is still a problem with this. If you try to replace a file that's protected or in use, you will just get an error that the file is protected and cannot be overwritten. I suppose that would be useful for files that the system recognizes as no longer present but quite frankly it otherwise stinks. Where does that leave us? There is little recourse but to boot with a Windows Millennium Startup Disk (EBD) and use the DOS Extract command. Using extract.exe in Windows Millennium Edition You could use the Extract command in a DOS prompt Window to find the file or extract it to a temporary directory, but you're not going to be able to replace files that are in use or protected. For example, if I wanted to find msvcrt.dll in the Windows ME cabinet files I could use the following procedure: Change to the \WINME directory on the CD-ROM or to the directory on the hard disk where the source files have been copied. Extract.exe is in that directory as well as the cabinet files. Substitute the correct drive letter for your CD-ROM drive - I will use E: for this example. E: CD \WINME EXTRACT /A /D WIN_10.CAB MSVCRT.DLL | MORE The usage of the extract command hasn't changed. The /A switch causes extract.exe to search all the cabinet files in sequences, starting with the file specified. The /D switch causes extract.exe to only display the file when found. The | more (pipe symbol to direct the output to more.com) allows you to press any key to display the next screen. It will fly by too quickly otherwise. You could also extract the file to a temporary directory for comparison purposes, then later boot with a DOS bootdisk and perform the old switcheroo (rename the old and copy the new). EXTRACT /A /L C:\TEMPDIR WIN_10.CAB MSVCRT.DLL The /L switch is used to specify the location to extract the file to. To actually replace a file you believe to be corrupted, that is in use or protected, you must boot with the Windows ME Startup Disk (EBD) and use the extract command to replace it. Put the diskette in the drive and restart your computer. If you need to use the CD-ROM, choose the With CD-ROM Support boot option. If you have the source files on the hard disk, choose Without CD-ROM Support. You will be at the A:\> prompt. Change to the appropriate directory containing the WinME source files and use the following command to replace (in this example) msvcrt.dll E: CD \WINME EXTRACT /A /L C:\WINDOWS\SYSTEM WIN_10.CAB MSVCRT.DLL When the file is found, you will be prompted. Say Y to overwriting it. Eject the floppy disk and press Ctrl-Alt-Del to restart Windows Millennium normally. Windows Millennium also has a System Restore option that you can access through the msconfig utility or under Start / Programs / Accessories / System Tools / System Restore. You can create a "Save Point" immediately before installing software, or you can restore one of the automatically created "System Check Points". How it works is, as changes are made to your hard disks, they are tracked and patterns are written to the _Restore folders and stored in compressed cabinet files. When you restore a Save Point or System Check Point, it will restore your system to the same configuration it was in before. I must warn you about this, however. While it will certainly restore your registry and other configuration files to the state they were in before you panicked and restored a Save Point, it will also remove any new program files (for example, files with the extension .dll, .exe, .com, .drv and .sys) that are not stored in your My Documents folder. This means, any new programs (perhaps programs that don't even write to the registry) or any driver files you've extracted to directories will be removed from the file allocation tables, effectively deleting them. Fortunately, the WinME System Restore has an undo feature that can be invoked from within the System Restore applet or from the WinME startup disk. You can use this to undo the last System Restore and the deleted files will be recovered. If You are Running Windows 2000 Windows 2000, like Windows Millennium, has a protection scheme for system files, though it uses a different mechanism and is called Windows File Protection. WFP protects system files by running in the background and detecting attempts to replace protected system files. Windows File Protection is triggered after it receives a directory change notification for a file in a directory that's protected. Once this notice is received, WFP determines which file was changed and if the file is protected, WFP looks up the file's signature in a catalogue file to determine if the new file is the correct Microsoft version. If it is not correct, WFP replaces the file with the correct version from the dllcache directory (\winnt\system32\dllcache). If the file is not found in the dllcache or if the version in the dllcache doesn't match what it's supposed to be according to the catalogue, the user is prompted to insert distribution media (eg. the Windows 2000 CD). If WFP has been triggered, you will find an entry in the System Log in the Event Viewer program. Protected files can be replaced only in the following manner: 1 - Installing a Windows 2000 Service Pack 2 - Windows Update or Microsoft hot-fixes or redistribution packs 3 - Operating System Upgrades (using winnt32.exe) 4 - Windows 2000 Device Installer Again, as with Windows ME, this will not detect or prevent files from becoming corrupted. Fortunately, there are a few options in Windows 2000 for replacing files and even a few steps you can take to prevent the unlikely event of a software installation screwing up your system. System State Backup The Windows 2000 Backup Utility provides a means to backup the system registry and the system dlls all in one shot, by creating a System State backup. This will require approximately 200-300 Mb of disk space somewhere on your drives, for the backup.bkf file. To perform this procedure, you need to log on with an account that's in the Local Administrators group. First, clear your users' Temporary Internet Files (I would log on as each user and clear them properly, through Internet Options but you can delete the Temporary Internet Files Folders and they'll get rebuilt next time the user logs on) and the files in any users' temp folders (\documents and settings\username\local settings\temp) within the Documents and Settings folder to reduce the clutter. The reason will be apparent in a minute. Go to Start / Programs / Accessories / System Tools and choose Microsoft Backup. You'll see a bit of a wizard initially, ignore it for now. Click the Backup tab, and place a checkmark in the System State checkbox. Also place a checkmark beside the Documents and Settings folder (this way you get the users' registry files and even their documents folder as an added bonus). Choose a location for the backup, any hard disk (I don't like tape drives or spanning removable media but it's up to you) or any directory. Proceed with the backup, it'll take approximately 3-5 minutes. When it's done, you'll have the registry backed up in \winnt\repair\regback and a file backup.bkf, containing important system files and the Documents and Settings folder, wherever you chose to put it. If you can boot Windows 2000 in normal or safe mode, you can restore this System State backup to return your system to that exact state. It will prompt you to restart after restoring the backup. System File Checker Yes, Windows 2000 has a System File Checker. I'll warn you right now though, it's not the user friendly SFC program that came with Windows 98. This is a command line utility that advanced administrators can use to scan all protected files, and if necessary, repopulate the dllcache if files within it have become corrupted. Type SFC /? in a command prompt window to see the switches and syntax. SFC.exe scans all protected system files and replaces incorrect versions with correct Microsoft versions. The following shows the syntax: SFC [/SCANNOW] [/SCANONCE] [/SCANBOOT] [/CANCEL] [/QUIET] [/PURGECACHE] [/CACHESIZE=x] /SCANNOW Scans all protected system files immediately. /SCANONCE Scans all protected system files once at boot. /SCANBOOT Scans all protected system files at every boot. /CANCEL Cancels all pending scans of protected system files. /ENABLE - Enables Windows File Protection for normal operation. (it is by default enabled) /QUIET Replaces all incorrect file versions without prompting the user. /PURGECACHE Purges the file cache and scans all protected system files immediately. /CACHESIZE=x Sets the file cache size (in megabytes). By default, SFC will prompt for action unless you use the /quiet switch (I don't recommend that). The /SCANNOW option in addition to what it says above, copies all protected system files from the Windows 2000 CD to the dllcache (~200 Mb), so make sure you have plenty of disk space. Do not play with this tool. It is designed to run automatically, after software installations. Only invoke it manually when there is a reason to. See the following article for more information on Windows File Protection and SFC: http://support.microsoft.com/support/kb/articles/Q222/1/93.ASP This still isn't perfect though - what if you do need to manually extract a file and replace it? Well, fortunately there is the Recovery Console and Expand.exe for manually extracting and replacing files from the original source files. The Windows 2000 Recovery Console The Recovery Console is a special command line boot mode that allows limited access to your Windows 2000 System. You can get to the Recovery Console by booting with the Windows 2000 Setup floppy disks or the Windows 2000 CD-ROM and choosing R for repair, then pressing C to start the Recovery Console. Alternatively, and what I would recommend, you can install the Recovery Console to your computer so you can access it from the NTLDR boot menu just like an operating system choice. To install the Recovery Console, use the following command from Start / Run. Do this ahead of time, so it will be ready if you have a problem. X:\I386\WINNT32.EXE /CMDCONS Where X: is your CD-ROM drive letter, or the drive where the i386 directory is saved. Once the Recovery Console is installed, you can choose it from the boot menu. See the following articles for much more information. Please do read them carefully before proceeding with any of this. If you are expecting to be able to copy files anywhere you like, think again. In order to enable the Recovery Console to allow access to all drives and folders, you will have to effect a policy change, in Local Security Policy (or Domain Security Policy if the machine is a domain controller server) from the Administrative Tools menu, and then use the SET command at the console. The second article in the list below covers the details of that. By default though you will have access to the \winnt and \winnt\system32 directories and the CD-ROM drive which is what you'll want for extracting system files. Yes, the Recovery Console has CD-ROM drive support. http://support.microsoft.com/support/kb/articles/Q229/7/16.ASP http://support.microsoft.com/support/kb/articles/Q240/8/31.ASP http://support.microsoft.com/support/kb/articles/Q216/4/17.ASP http://support.microsoft.com/support/kb/articles/Q235/3/64.ASP Expand.exe When you boot to the Recovery Console, type HELP to see a list of all available commands. Type HELP EXPAND to see command specific help. The syntax of the expand command is: EXPAND [SOURCE FILE] [DESTINATION] Very simple. Note that the Windows 2000 (and Windows NT) source files are individual compressed files, with the last letter of the file extension replaced with an underscore _ You can use this to replace a system file, in this example, mfc42.dll EXPAND X:\I386\MFC42.DL_ C:\WINNT\SYSTEM32 Where X: is your CD-ROM drive and C: is the drive where your Win2K installation resides. http://www.PCNineOneOne.com