Disabling windows file protection

Hi,

I was trying to replace a system file( classpnp.sys) in
windows/system32/drivers directory. But I am not able to , It gets replaced
with the system file every time I replace it. I tried disabling windows
file protection by setting SFCDisable in the registry to ffffff9d ( Referred
the link http://www.winguides.com/registry/display.php/790/ ).
But even then I am not able to replace the file. The system has the Win2K3 OS.
What can be the problem?

Thanks in Advance.
Sareena.

Maxim
Wed Feb 09 06:25:29 CST 2005

Instead, put your driver under another name and add ImagePath to
ClassnPnP's service key.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Sareena" <Sareena@discussions.microsoft.com> wrote in message
news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
> Hi,
>
> I was trying to replace a system file( classpnp.sys) in
> windows/system32/drivers directory. But I am not able to , It gets replaced
> with the system file every time I replace it. I tried disabling windows
> file protection by setting SFCDisable in the registry to ffffff9d ( Referred
> the link http://www.winguides.com/registry/display.php/790/ ).
> But even then I am not able to replace the file. The system has the Win2K3
OS.
> What can be the problem?
>
> Thanks in Advance.
> Sareena.

Steve
Sun Apr 03 00:33:01 CST 2005

Could you please name ClassnPnP's service key? I cannot find one :(

--

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:el2hqJqDFHA.1292@TK2MSFTNGP10.phx.gbl...
> Instead, put your driver under another name and add ImagePath to
> ClassnPnP's service key.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
> "Sareena" <Sareena@discussions.microsoft.com> wrote in message
> news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
>> Hi,
>>
>> I was trying to replace a system file( classpnp.sys) in
>> windows/system32/drivers directory. But I am not able to , It gets
>> replaced
>> with the system file every time I replace it. I tried disabling windows
>> file protection by setting SFCDisable in the registry to ffffff9d (
>> Referred
>> the link http://www.winguides.com/registry/display.php/790/ ).
>> But even then I am not able to replace the file. The system has the
>> Win2K3
> OS.
>> What can be the problem?
>>
>> Thanks in Advance.
>> Sareena.
>
>

Maxim
Sun Apr 03 00:52:36 CST 2005

SYSTEM\CurrentControlSet\Services\ClassPnP

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Steve Watkins" <anonymous@discussions.microsoft.com> wrote in message
news:%23%23eQ%23bBOFHA.3668@TK2MSFTNGP14.phx.gbl...
> Could you please name ClassnPnP's service key? I cannot find one :(
>
> --
>
> "Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
> news:el2hqJqDFHA.1292@TK2MSFTNGP10.phx.gbl...
> > Instead, put your driver under another name and add ImagePath to
> > ClassnPnP's service key.
> >
> > --
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > maxim@storagecraft.com
> > http://www.storagecraft.com
> >
> > "Sareena" <Sareena@discussions.microsoft.com> wrote in message
> > news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
> >> Hi,
> >>
> >> I was trying to replace a system file( classpnp.sys) in
> >> windows/system32/drivers directory. But I am not able to , It gets
> >> replaced
> >> with the system file every time I replace it. I tried disabling windows
> >> file protection by setting SFCDisable in the registry to ffffff9d (
> >> Referred
> >> the link http://www.winguides.com/registry/display.php/790/ ).
> >> But even then I am not able to replace the file. The system has the
> >> Win2K3
> > OS.
> >> What can be the problem?
> >>
> >> Thanks in Advance.
> >> Sareena.
> >
> >
>
>

Steve
Sun Apr 03 03:36:41 CDT 2005

Sorry, there's no such a key on my Win2003 and WinXP. Should I create one?

--

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:u3OSBnBOFHA.2252@TK2MSFTNGP15.phx.gbl...
> SYSTEM\CurrentControlSet\Services\ClassPnP
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
> "Steve Watkins" <anonymous@discussions.microsoft.com> wrote in message
> news:%23%23eQ%23bBOFHA.3668@TK2MSFTNGP14.phx.gbl...
>> Could you please name ClassnPnP's service key? I cannot find one :(
>>
>> --
>>
>> "Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
>> news:el2hqJqDFHA.1292@TK2MSFTNGP10.phx.gbl...
>> > Instead, put your driver under another name and add ImagePath to
>> > ClassnPnP's service key.
>> >
>> > --
>> > Maxim Shatskih, Windows DDK MVP
>> > StorageCraft Corporation
>> > maxim@storagecraft.com
>> > http://www.storagecraft.com
>> >
>> > "Sareena" <Sareena@discussions.microsoft.com> wrote in message
>> > news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
>> >> Hi,
>> >>
>> >> I was trying to replace a system file( classpnp.sys) in
>> >> windows/system32/drivers directory. But I am not able to , It gets
>> >> replaced
>> >> with the system file every time I replace it. I tried disabling
>> >> windows
>> >> file protection by setting SFCDisable in the registry to ffffff9d (
>> >> Referred
>> >> the link http://www.winguides.com/registry/display.php/790/ ).
>> >> But even then I am not able to replace the file. The system has the
>> >> Win2K3
>> > OS.
>> >> What can be the problem?
>> >>
>> >> Thanks in Advance.
>> >> Sareena.
>> >
>> >
>>
>>
>
>

Maxim
Sun Apr 03 07:01:36 CDT 2005

Then looks like you're in trouble. This means that ClassPnP.sys is loaded
as a kernel mode DLL by import resolution in Disk.sys, and its name is taken
from the import table in Disk.sys.
Looks like you will either need to replace both Disk and ClassPnP, or
really try to disable SFC. There were some hacks to do this, but I'm not sure
they are working on modern Windows.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Steve Watkins" <anonymous@discussions.microsoft.com> wrote in message
news:eWfDFhCOFHA.3960@TK2MSFTNGP12.phx.gbl...
> Sorry, there's no such a key on my Win2003 and WinXP. Should I create one?
>
> --
>
> "Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
> news:u3OSBnBOFHA.2252@TK2MSFTNGP15.phx.gbl...
> > SYSTEM\CurrentControlSet\Services\ClassPnP
> >
> > --
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > maxim@storagecraft.com
> > http://www.storagecraft.com
> >
> > "Steve Watkins" <anonymous@discussions.microsoft.com> wrote in message
> > news:%23%23eQ%23bBOFHA.3668@TK2MSFTNGP14.phx.gbl...
> >> Could you please name ClassnPnP's service key? I cannot find one :(
> >>
> >> --
> >>
> >> "Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
> >> news:el2hqJqDFHA.1292@TK2MSFTNGP10.phx.gbl...
> >> > Instead, put your driver under another name and add ImagePath to
> >> > ClassnPnP's service key.
> >> >
> >> > --
> >> > Maxim Shatskih, Windows DDK MVP
> >> > StorageCraft Corporation
> >> > maxim@storagecraft.com
> >> > http://www.storagecraft.com
> >> >
> >> > "Sareena" <Sareena@discussions.microsoft.com> wrote in message
> >> > news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
> >> >> Hi,
> >> >>
> >> >> I was trying to replace a system file( classpnp.sys) in
> >> >> windows/system32/drivers directory. But I am not able to , It gets
> >> >> replaced
> >> >> with the system file every time I replace it. I tried disabling
> >> >> windows
> >> >> file protection by setting SFCDisable in the registry to ffffff9d (
> >> >> Referred
> >> >> the link http://www.winguides.com/registry/display.php/790/ ).
> >> >> But even then I am not able to replace the file. The system has the
> >> >> Win2K3
> >> > OS.
> >> >> What can be the problem?
> >> >>
> >> >> Thanks in Advance.
> >> >> Sareena.
> >> >
> >> >
> >>
> >>
> >
> >
>
>

Alexander
Sun Apr 03 10:12:39 CDT 2005

Boot to safe mode and replace the file. Then reboot to normal mode.

"Sareena" <Sareena@discussions.microsoft.com> wrote in message
news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
> Hi,
>
> I was trying to replace a system file( classpnp.sys) in
> windows/system32/drivers directory. But I am not able to , It gets
> replaced
> with the system file every time I replace it. I tried disabling windows
> file protection by setting SFCDisable in the registry to ffffff9d (
> Referred
> the link http://www.winguides.com/registry/display.php/790/ ).
> But even then I am not able to replace the file. The system has the Win2K3
> OS.
> What can be the problem?
>
> Thanks in Advance.
> Sareena.

fuzzyduck
Wed Jun 01 12:29:18 CDT 2005

While this works for development, if you touch or look sideways at the file,
windows file protection will replace it with the original version. Has
anyone come up with a method to replace those files covered by WFP in an
install script for an application and have the changes stick? Expecting an
end user to boot to safe mode and manually install a driver is not a good
solution.

"Alexander Grigoriev" wrote:

> Boot to safe mode and replace the file. Then reboot to normal mode.
>
> "Sareena" <Sareena@discussions.microsoft.com> wrote in message
> news:8DD0AD54-8CA6-4216-BBFC-580705533D67@microsoft.com...
> > Hi,
> >
> > I was trying to replace a system file( classpnp.sys) in
> > windows/system32/drivers directory. But I am not able to , It gets
> > replaced
> > with the system file every time I replace it. I tried disabling windows
> > file protection by setting SFCDisable in the registry to ffffff9d (
> > Referred
> > the link http://www.winguides.com/registry/display.php/790/ ).
> > But even then I am not able to replace the file. The system has the Win2K3
> > OS.
> > What can be the problem?
> >
> > Thanks in Advance.
> > Sareena.
>
>
>

Don
Wed Jun 01 12:35:27 CDT 2005

Expecting a user to put up with you replacing system files is even a bigger
joke. The reason for windows file protection is to help you have a stable
system, any attempt to circumvent this without the user being involved is a
virus or malware.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply



"fuzzy_duck" <fuzzyduck@discussions.microsoft.com> wrote in message
news:28EC2B50-10F2-44B5-A611-CB0160E12369@microsoft.com...
> While this works for development, if you touch or look sideways at the
> file,
> windows file protection will replace it with the original version. Has
> anyone come up with a method to replace those files covered by WFP in an
> install script for an application and have the changes stick? Expecting
> an
> end user to boot to safe mode and manually install a driver is not a good
> solution.
>

fuzzyduck
Fri Jun 03 10:49:22 CDT 2005

Agreed, this is dangerous and a bad idea, except when this method is being
recommended to me by the MS apps engineers as a solution. Even then its
still a bad idea and I have rejected it as a feasible option.

"Don Burn" wrote:

> Expecting a user to put up with you replacing system files is even a bigger
> joke. The reason for windows file protection is to help you have a stable
> system, any attempt to circumvent this without the user being involved is a
> virus or malware.
>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
>
>
> "fuzzy_duck" <fuzzyduck@discussions.microsoft.com> wrote in message
> news:28EC2B50-10F2-44B5-A611-CB0160E12369@microsoft.com...
> > While this works for development, if you touch or look sideways at the
> > file,
> > windows file protection will replace it with the original version. Has
> > anyone come up with a method to replace those files covered by WFP in an
> > install script for an application and have the changes stick? Expecting
> > an
> > end user to boot to safe mode and manually install a driver is not a good
> > solution.
> >
>
>
>