@maxd wrote:
My OEM XP (SP1) version didn't have the dllcache in system32; that's why, I'm presuming, every attempt to run the sfc command always asked for the cd. The dllcache was actually in c:\windows\last known\system32; there was the standard system32 in Windows. I read that the dllcache was normally in c:\windows\system32.
Somehow thru a combination of renaming, copying, and whatever I got Windows to eat my dllcache. I did a registry hack and now have dllcache reg path set to c:\windows\system32; can't remember if this helped cause the loss of the folder or not.
Q1. What's the easiest way to 'manually' restore this folder (with contents) ?
Q2. I will have to re-apply my Windows updates, won't I ?
The DLLCACHE is a Hidden System Folder , mine also shows in it C:\Windows\LastGood\system32 & C:\Windows\system32 to show Hidden System use "My Computer" , Tools > Folder Options , View tab & check "Show hidden file & folders" & untick "Hide protected operating system files". Then use Search Advanced (1st 3 boxes ticked) for dllcache
To replace DLLCACHE files use sfc /purgecache then sfc /scannow
scf /scannow only requires the XP CD to replace files if it doesn't find any corrupted it doesn't need XP CD.
I don't have a \Windows\Lastgood folder, nor \Windows\Last known, only the \Windows\system32\dllCache folder (perhaps because I've never had to repair or reinstall XP?). Also, if you have C:\I386 (which is a copy of the I386 folder on the XP disk), then I think sfc /scannow will look there instead of the disk.
JRosenfeld wrote: I don't have a \Windows\Lastgood folder, nor \Windows\Last known, only the \Windows\system32\dllCache folder (perhaps because I've never had to repair or reinstall XP?). Also, if you have C:\I386 (which is a copy of the I386 folder on the XP disk), then I think sfc /scannow will look there instead of the disk.
I found SFC /scannow used SourcePath shown by HKEY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
Mine was CD Drive D:\ so I changed it to C:\ & SFC /scannow runs OK without using the XP CD. I also found after using the DELL reinstallation XP CD that Folder i386 wasn't on HD C:\i386 so I Copied it from CD to C:\i386.
( I also found after reinstallation from DELL XP CD with SourcePath pointing to CD Drive that SFC /scannow replaced many files from CD & subsequent SFC /scannow replaced the same number of files from CD for every use of SFC /scannow. Perhaps I have a fault as before use of DELL reinstallation XP CD SFC /scannow used to run without replacing files from CD)
Message Edited by gryjhnhpe on 11-06-2003 10:07 AM
It is correct that if the dllcache is empty, sfc will replace missing files from I386 (either on the CD or on C;\, whichever it is pointed to as gryjhnhpe says). However, when a Windows update replaces a dll file with a later version, the later version is also placed in dllcache. So if you delete those and run sfc, it will copy the outdated version, and the effect of the patch is nullified. sfc checks the files in system32 (mainly) and if corrupted, first looks in the cache, that's what the cache is for. This also applies to othher file types, such as system .exe files that have been updated (Explorer.exe is an example).
Example, Shell32.dll version in I386 (XP home SP1 OEM) is 6.0.2800.1106; in DLL cache (and in system32) it is 6.0.2800.1253, the result of one or other Windows Update.
Message Edited by JRosenfeld on 11-06-2003 12:03 AM
PS. You can see which files a particular update replaced by looking at its $NTUninstall foder, which lists the files (and their versions) which it replaced (i.e. the versions the uninstall would put back).
Message Edited by JRosenfeld on 11-06-2003 12:09 AM
Message Edited by JRosenfeld on 11-06-2003 12:13 AM
I had "show Hidden Files and Folders" checked but I failed to uncheck " Hide Protected OS Files". Doing so, and thankyou, not only showed the default dllcache but the Last Good one as well. My default dllcache was empty but I repopulated it with scannow. When I re-ran the sfc /scannow command it still called for the cd proving that my reg hacking leaves something to be desired. I'll post my values/paths tomorrow, Lord willing. In the mean time if anyone can paste a screen shot of the Setup (right) pane it would help. ta
maxd wrote: I had "show Hidden Files and Folders" checked but I failed to uncheck " Hide Protected OS Files". Doing so, and thankyou, not only showed the default dllcache but the Last Good one as well. My default dllcache was empty but I repopulated it with scannow. When I re-ran the sfc /scannow command it still called for the cd proving that my reg hacking leaves something to be desired. I'll post my values/paths tomorrow, Lord willing. In the mean time if anyone can paste a screen shot of the Setup (right) pane it would help. ta
Have you used DELL reinstallation CD & does SFC /scannow use CD to replace all files or only some.? (does the CD Drive start & stop during SFC /scannow , indicating it is only used to replace some files) If SFC /scannow runs without using CD for others who have used DELL reinstallation CD with SourcePath of D:\ , then I have a fault.
I found Windows File Protection SFC /scannow uses winlogon.exe I have version 5.1.2600.29 , 419 KB on CD Home & with SP1 installed the dllcache shows version 5.1.2600.1106 , 505 KB. Curios: ? If the dllcache is emptied with SFC /purgecache & then SFC /scannow run is replaces files from XP CD so it must have list somewhere of files to replace. (perhaps in winlogon.exe) (SourcePath CD-Drive ie: D:\)
Message Edited by gryjhnhpe on 11-06-2003 05:52 PM
XP SP1 home was installed as OEM on my PC, and that is also my CD version. It shows winlogon.exe version 5.1.2600.1106, 505KB, date created and modified both 29/08/2002. It is still the version in \sytem32, no post SP1 updates have updated it (I have all critical and security updates installed), it is not in my DLLCache (as I said earlier, updated file versions are placed in the DLLCache), so I guess that is the current version.
I have the same version you have and on my system it is located in C:\Windows\system32 and C:\Windows\system32\dllcache. I received my system without SP1 and installed SP1 when it became available, which explains the presence of the file in two locations on my computer. The version of winlogon.exe that is on my non-SP1 CD is 5.1.2600.0 with a date of 8/17/2001 and a size of 420KB.
The 5.1.2600.29 version of the file was contained in the hotfix described
here which I have not installed on my computer. Even if I had, it should have been replaced by the later version.
I believe this is a variation. My OEM SP1 cd came with 1106/505 in both system32 and the dllcache; the created/modified dates (all 4)at both locations are the same, March 31,2003. As I said it's an Ebay special. I still am in a bit of a quandry. Have to do some research on sfc/wfp vis a vis the registry. Hope you keep this thread checked for another day or 2. Thanks
If anyone is still there I could use some help. To bring you up-to-date, I tried to set the dllcache to Win 2000 default; didn't show any different in Winlogon. I disabled sfc and tried to run it from dos prompt. It ran (/scannow) and still asked for the cd. btw My dllcache size is 583 Mb after a purge and sfc; I guess it picks up the updates from the registry ??
I have no capability to run sfcdllcachedir, do I ?
Is there a reg hack to make Windows look to the dllcache instead of the cd-rom when sfc is run. I've messed with registry enough on my own. Any ideas ?Thanks
ps. standalone, home sp1 cd, classic logon with un/pw
@maxd wrote:
I have no capability to run sfcdllcachedir, do I ?
Is there a reg hack to make Windows look to the dllcache instead of the cd-rom when sfc is run.
You can only change SFC to use C:\i386 Folder if on HD instead of CD-ROM Drive as it always checks the DLLCACHE & I previously Reply with;
---------------------------------
I found SFC /scannow used SourcePath shown by HKEY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
My HKEY was CD Drive D:\ so I changed it to C:\ & SFC /scannow runs OK without using the XP CD. I also found after using the DELL reinstallation XP CD that Folder i386 wasn't on HD C:\i386 so I Copied it from CD to C:\i386.
( I also found after reinstallation from DELL XP CD with SourcePath pointing to CD Drive that SFC /scannow replaced many files from CD & subsequent SFC /scannow replaced the same number of files from CD for every use of SFC /scannow. Perhaps I have a fault as before use of DELL reinstallation XP CD SFC /scannow used to run without replacing files from CD) ----------------------
If you have also used DELL reinstallation CD perhaps the SFC /scannow is a Microsoft fault as mine now requests CD for every use of SFC /scannow with SourcePath pointing to CD Drive. If you change SourcePath to C:\ it doesn't give any indications of replacing files otherwise shown by start of CD Drive.
Message Edited by gryjhnhpe on 11-09-2003 10:12 AM
Message Edited by gryjhnhpe on 11-09-2003 10:16 AM
I do not understand what you mean by setting dll cache to Win 2000 default.
All the files in my dllcache are updated versions of the ones in I386, so I think the dllcache is essentially a backup store of updated versions of system files that were replaced by the various installed Windows updates. There may be a few relating to other updates, such as those in \Common Files\Microsoft Shared, I haven't gone through the list in detail.
My dllcache has 249 files, 76MB, all placed there, as far as I can tell, by Windows updates. I can't remember looking when I first got the PC, but it was either empty or with only a few files in it then.
(for 2000, but the same in XP), sfc first looks in %systemroot%\system32\dllcache, then if it cannot find the file it needs, I think it looks to see if you have the I386 folder, if not it asks for your CD.
The same article gives the following information in cases where the dllcache has been deleted, and gives the possible command lines (I've edited their text slightly):
If the %systemroot%\system32\dllcache becomes corrupted or is deleted, sfc.exe will scan protected files and repopulate the Dllcache run either sfc /scannow,sfc /scanonce, or sfc /scanboot.
Maybe it is because you deleted the cache that it got repopulated with so many files.
System File Checker Tool Syntax:
Parameter: /Cachesize=n - Sets the file cache size. /Cancel - Cancels all pending scans of protected system files. /Enable - Enables WFP to default status. Users will be prompted to restore any files that are overwritten. /Purgecache - Purges the file cache and scans all protected system files. /Quiet - Scans and replaces all incorrect file versions without prompting the user. /Scanonce - Scans all protected system files once. /Scannow - Immediately scans all protected system files. /Scanboot - Scans all protected system files every time you start your computer.
You can control how much space is consumed using the command-line sfc /cachesize=xx
The only references to the dllcache folder (search for \Dllcache) in the Registry that I found on my system were in keys relating to updates, as one of several locations where the updated versions of files were placed.
Personally, I don't think purging the dllcache is a good idea, since you lose the backups to all the updated versions of files in there, and if the ones used by the system (e.g. those in \system32) get corrupted, sfc /scannow will have to get outdated versions from I386, nullifying any updates.
Perhaps if you ran the hot fix installation checker
you could find out if sfc /scannow did have to replace some file with an earlier version from your CD (the checker seems to work by checking file versions in the system folders against those installed by the fixes, and if it finds the wrong (earlier) version it suggests to reinstall the update).
gryjhnhpe
2 Intern
•
2K Posts
0
November 5th, 2003 19:00
The DLLCACHE is a Hidden System Folder , mine also shows in it C:\Windows\LastGood\system32 &
C:\Windows\system32
to show Hidden System use "My Computer" , Tools > Folder Options , View tab & check "Show hidden file & folders" & untick "Hide protected operating system files".
Then use Search Advanced (1st 3 boxes ticked) for dllcache
To replace DLLCACHE files use
sfc /purgecache
then sfc /scannow
scf /scannow only requires the XP CD to replace files if it doesn't find any corrupted it doesn't need XP CD.
JRosenfeld
2 Intern
•
4.4K Posts
0
November 5th, 2003 20:00
gryjhnhpe
2 Intern
•
2K Posts
0
November 5th, 2003 20:00
I found SFC /scannow used SourcePath shown by HKEY
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
Mine was CD Drive D:\ so I changed it to C:\ & SFC /scannow runs OK without using the XP CD.
I also found after using the DELL reinstallation XP CD that Folder i386 wasn't on HD C:\i386 so I Copied it from CD to C:\i386.
( I also found after reinstallation from DELL XP CD with SourcePath pointing to CD Drive that SFC /scannow replaced many files from CD & subsequent SFC /scannow replaced the same number of files from CD for every use of SFC /scannow.
Perhaps I have a fault as before use of DELL reinstallation XP CD SFC /scannow used to run without replacing files from CD)
Message Edited by gryjhnhpe on 11-06-2003 10:07 AM
Hydralisk00222
2 Intern
•
2.4K Posts
0
November 5th, 2003 20:00
Files inside dllcache are not needed, FYI.
So, you will be fine without them.
JRosenfeld
2 Intern
•
4.4K Posts
0
November 5th, 2003 21:00
Hydralisk00222,
It is correct that if the dllcache is empty, sfc will replace missing files from I386 (either on the CD or on C;\, whichever it is pointed to as gryjhnhpe says). However, when a Windows update replaces a dll file with a later version, the later version is also placed in dllcache. So if you delete those and run sfc, it will copy the outdated version, and the effect of the patch is nullified. sfc checks the files in system32 (mainly) and if corrupted, first looks in the cache, that's what the cache is for. This also applies to othher file types, such as system .exe files that have been updated (Explorer.exe is an example).
Example, Shell32.dll version in I386 (XP home SP1 OEM) is 6.0.2800.1106; in DLL cache (and in system32) it is 6.0.2800.1253, the result of one or other Windows Update.
Message Edited by JRosenfeld on 11-06-2003 12:03 AM
PS. You can see which files a particular update replaced by looking at its $NTUninstall foder, which lists the files (and their versions) which it replaced (i.e. the versions the uninstall would put back).
Message Edited by JRosenfeld on 11-06-2003 12:09 AM
Message Edited by JRosenfeld on 11-06-2003 12:13 AM
maxd
2 Intern
•
2.4K Posts
0
November 6th, 2003 00:00
Denny Denham
2 Intern
•
18.8K Posts
0
November 6th, 2003 01:00
My HKLM\Software\Microsoft\Windows\CurrentVersion\Setup is
here.
The system files are in C:\I386 on my hard disk.
Message Edited by Denny Denham on 11-05-2003 07:53 PM
Message Edited by Denny Denham on 11-05-2003 07:57 PM
gryjhnhpe
2 Intern
•
2K Posts
0
November 6th, 2003 03:00
Have you used DELL reinstallation CD & does SFC /scannow use CD to replace all files or only some.?
(does the CD Drive start & stop during SFC /scannow , indicating it is only used to replace some files)
If SFC /scannow runs without using CD for others who have used DELL reinstallation CD with SourcePath of D:\ , then I have a fault.
I found Windows File Protection SFC /scannow uses winlogon.exe
I have version 5.1.2600.29 , 419 KB on CD Home & with SP1 installed the dllcache shows version 5.1.2600.1106
, 505 KB.
Curios: ?
If the dllcache is emptied with SFC /purgecache & then SFC /scannow run is replaces files from XP CD so it must have list somewhere of files to replace. (perhaps in winlogon.exe) (SourcePath CD-Drive ie: D:\)
Message Edited by gryjhnhpe on 11-06-2003 05:52 PM
JRosenfeld
2 Intern
•
4.4K Posts
0
November 6th, 2003 14:00
gryjhnhpe,
XP SP1 home was installed as OEM on my PC, and that is also my CD version. It shows winlogon.exe version 5.1.2600.1106, 505KB, date created and modified both 29/08/2002. It is still the version in \sytem32, no post SP1 updates have updated it (I have all critical and security updates installed), it is not in my DLLCache (as I said earlier, updated file versions are placed in the DLLCache), so I guess that is the current version.
What is the date of version 5.1.2600.29, and how did you get it? Unfortunately, the MS file version database at http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp only deals with .dll files so I can't look it up there.
Denny Denham
2 Intern
•
18.8K Posts
0
November 6th, 2003 15:00
I have the same version you have and on my system it is located in C:\Windows\system32 and C:\Windows\system32\dllcache. I received my system without SP1 and installed SP1 when it became available, which explains the presence of the file in two locations on my computer. The version of winlogon.exe that is on my non-SP1 CD is 5.1.2600.0 with a date of 8/17/2001 and a size of 420KB.
The 5.1.2600.29 version of the file was contained in the hotfix described here which I have not installed on my computer. Even if I had, it should have been replaced by the later version.
JRosenfeld
2 Intern
•
4.4K Posts
0
November 6th, 2003 16:00
Denny,
Thanks for clearing up that point. I didn't install that hotfix either.
maxd
2 Intern
•
2.4K Posts
0
November 6th, 2003 20:00
maxd
2 Intern
•
2.4K Posts
0
November 8th, 2003 20:00
I have no capability to run sfcdllcachedir, do I ?
Is there a reg hack to make Windows look to the dllcache instead of the cd-rom when sfc is run. I've messed with registry enough on my own. Any ideas ?Thanks
ps. standalone, home sp1 cd, classic logon with un/pw
gryjhnhpe
2 Intern
•
2K Posts
0
November 8th, 2003 21:00
---------------------------------
I found SFC /scannow used SourcePath shown by HKEY
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
My HKEY was CD Drive D:\ so I changed it to C:\ & SFC /scannow runs OK without using the XP CD.
I also found after using the DELL reinstallation XP CD that Folder i386 wasn't on HD C:\i386 so I Copied it from CD to C:\i386.
( I also found after reinstallation from DELL XP CD with SourcePath pointing to CD Drive that SFC /scannow replaced many files from CD & subsequent SFC /scannow replaced the same number of files from CD for every use of SFC /scannow.
Perhaps I have a fault as before use of DELL reinstallation XP CD SFC /scannow used to run without replacing files from CD)
----------------------
If you have also used DELL reinstallation CD perhaps the SFC /scannow is a Microsoft fault as mine now requests CD for every use of SFC /scannow with SourcePath pointing to CD Drive.
If you change SourcePath to C:\ it doesn't give any indications of replacing files otherwise shown by start of CD Drive.
Message Edited by gryjhnhpe on 11-09-2003 10:12 AM
Message Edited by gryjhnhpe on 11-09-2003 10:16 AM
JRosenfeld
2 Intern
•
4.4K Posts
0
November 8th, 2003 22:00
I do not understand what you mean by setting dll cache to Win 2000 default.
All the files in my dllcache are updated versions of the ones in I386, so I think the dllcache is essentially a backup store of updated versions of system files that were replaced by the various installed Windows updates. There may be a few relating to other updates, such as those in \Common Files\Microsoft Shared, I haven't gone through the list in detail.
My dllcache has 249 files, 76MB, all placed there, as far as I can tell, by Windows updates. I can't remember looking when I first got the PC, but it was either empty or with only a few files in it then.
According to
http://is-it-true.org/nt/nt2000/registry/rtips8.shtml
(for 2000, but the same in XP), sfc first looks in %systemroot%\system32\dllcache, then if it cannot find the file it needs, I think it looks to see if you have the I386 folder, if not it asks for your CD.
The same article gives the following information in cases where the dllcache has been deleted, and gives the possible command lines (I've edited their text slightly):
If the %systemroot%\system32\dllcache becomes corrupted or is deleted, sfc.exe will scan protected files and repopulate the Dllcache run either sfc /scannow,sfc /scanonce, or sfc /scanboot.
Maybe it is because you deleted the cache that it got repopulated with so many files.
System File Checker Tool Syntax:
Parameter:
/Cachesize=n - Sets the file cache size.
/Cancel - Cancels all pending scans of protected system files.
/Enable - Enables WFP to default status. Users will be prompted to restore
any files that are overwritten.
/Purgecache - Purges the file cache and scans all protected system files.
/Quiet - Scans and replaces all incorrect file versions without prompting the user.
/Scanonce - Scans all protected system files once.
/Scannow - Immediately scans all protected system files.
/Scanboot - Scans all protected system files every time you start your computer.
You can control how much space is consumed using the command-line
sfc /cachesize=xx
The only references to the dllcache folder (search for \Dllcache) in the Registry that I found on my system were in keys relating to updates, as one of several locations where the updated versions of files were placed.
Personally, I don't think purging the dllcache is a good idea, since you lose the backups to all the updated versions of files in there, and if the ones used by the system (e.g. those in \system32) get corrupted, sfc /scannow will have to get outdated versions from I386, nullifying any updates.
Perhaps if you ran the hot fix installation checker
http://support.microsoft.com/default.aspx?scid=kb;en-us;282784
you could find out if sfc /scannow did have to replace some file with an earlier version from your CD (the checker seems to work by checking file versions in the system folders against those installed by the fixes, and if it finds the wrong (earlier) version it suggests to reinstall the update).