Disable ME File Protection

Note: Removing the File Protection is not a recommended action.

 

Warning!!!: Using the Windows Registry Editor incorrectly can cause serious problems requiring the re-installation of your operating system and possible loss of data. I do not and will not support problems that arise from you editing your own registry. Use the Registry Editor and my directions at your own risk. Be sure that you create a backup of your registry and be very sure that you know how to restore it. If you are not sure how to do both of these things then STOP here!! and read the directions.

 

  Read this WHOLE page FIRST.

Microsoft added a new feature to Windows called Windows File Protection (WFP), part of System File Checker (SFC). The WFP role is to protect the OS by blocking "misbehaved" applications and inexperienced users from replacing vital system files with older or incompatible versions. On the downside, WFP also blocks valid system files replacements, which in normal conditions do not threaten OS integrity.

  STAY SAFE!!:   BACKUP YOUR ORIGINAL FILES NOW!

To disable WFP in Windows 2000/XP, just follow these steps:
First you need to manually "patch" (hex-edit) BOTH SFC.DLL (Win2000 with SP2) or SFC_OS.DLL (WinXP) files from the %\systemroot%\System32 folder (default is C:\Windows\System32 for WinXP or C:\Winnt\System32 for Win2000) and from %\systemroot%\System32\Dllcache to effectively disable WFP. Windows 2000 Service Pack 2 (SP2) can be downloaded from Microsoft: http://www.microsoft.com/windows2000/downloads/servicepacks/sp2/ Here we go: Load SFC.DLL (or SFC_OS.DLL) into your favorite hex editor. HexEdit (freeware) will do the job: http://www-physics.mps.ohio-state.edu/~prewett/hexedit/
SFC.DLL from Win2000 SP2: go to physical offset 00006211 (6211h) and change the 8BC6 bytes to read 9090.
SFC_OS.DLL from WinXP: go to physical offset 0000E2B8 (0E2B8h) and change the 8BC6 bytes to read 9090.


  WARNING!!:  If the actual bytes found in your DLL file DO NOT MATCH these values EXACTLY then DO NOT make ANY changes!


Save your work and exit the hex editor.
Reboot when done.
Modify the "SFCDisable" Registry ValuC: this step is MANDATORY for BOTH Windows XP and Windows 2000, WITH OR WITHOUT SP2 installed:

A.) Manual FIX:
To disable WFP, start Regedit or Regedt32 and go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Add/modify the "SFCDisable" DWORD [REG_DWORD] Binary entry to read FFFFFF9D.
Reboot when done.
To (re)enable WFP modify "SFCDisable" to read 0."

B.) Automatic FIX:
Get SetSfc for Win2000 [7 KB, freeware]:
http://www.collakesoftware.com/files/setsfc.zip
to apply the Registry hack detailed above without using the Registry Editor.

About this site