I tend to agree with georgib, but I'm dealing with a friend and her machine, so I don't have the option of 'quitting' McAfee. I gave it up some time ago on my own computers. My friend called me last evening in a state of panic because she had just rebooted after a McAfee update and had a screen message telling her that "Files that are required for Windows to run properly have been replaced by unrecognised versions"...I did some googling, and we ended up restoring her machine to a point before the McAfee update. Windows restore reported that many files with McAfee in the name had been renamed and put in a temp folder (or whatever it is that restore does with those files). The machine seemed to work fine after the restoration except McAfee's Real Time Protection was turned OFF and wouldn't stay ON when turned on. Tried updating McAfee again with exact same results - WFP warning came up after restart. I agree with Moderator that this is an item for Tech Support, but I found that you can't get to them without running MVT, and (IMHO) it is absolutely senseless to run MVT in this situation. Aside from that, the update should have been adequately tested before release, and the problem - which is the same problem that happened last year - should have been identified and fixed.
If I have any influence, I will be installing different malware protection on my friend's machine later today.
That sounds like your friend's machine was infected or they were using a rather lethal registry cleaner perhaps but unlikely. No security software on Earth offers a 100% protection guarantee, so although it's unfortunate it happens, changing brands wont necessarily cure anything.
I'm not sure I understand why you would say that in view of the number of people who have reported the same problem in this and related threads with no hint of any infection, the fact that the problem has been around off and on at least since early 2011, the implication that it is caused by buggy McAfee updates that never got a published explanation or fix, and your own statement that it is a matter for Tech Support.
And, no, my friend does not use/has not used registry cleaners.
And, of course I will do a thorough malware scan before I've finished with the machine just in case McAfee missed something.
It was just a thought as I've seen that before with infections.
Well, you can add me to the list of folks with the WFP errors again. I'm in the exact situation as I was in last year at this time. I'm running a Malwarebytes scan and a WFP message popped up telling me that files had been replaced with earlier versions. I took a peek at my event log and discovered that as of Oct. 28 WFP errors were recorded on shut down stating that WPF was terminating and that files could not be verified. The event numbers for both are 64008. The files involved are Windows.system32\kbdus.dll and ***resources\themes\luna.
This is EXACTLY what happened to me a year ago. I got the errors when running a Malwarebytes scan and events were recorded on shut down with the same two files and every once in a while others were involved.
My computer seems to be running fine. Last year this went on for months until it magically got fixed. I was then ok until I got some horrible virus and had to take the computer all the way back to factory settings and start fresh. I was following and posting on the thread (quite lengthy before it got taken care of) last year and here I am again.
I'm running Windows MCE, Service Pack 3. Everything is up to date (Windows, McAfee, Malwarebytes and soon SuperAntiSpyware). Scans are coming up clean. But something is going on again and since I've run across this thread I'm wondering if it's McAfee again like it was last fall.
I know you are a volunteer and appreciate what you do for us. I'm hoping that my information will shed some light on the current WFP errors and we'll see if more people are running into this. Maybe it can be fixed sooner this time if the techs go back and see what they had to do last year to fix it. And after round two, maybe they'll be more careful before they put out the updates!
I think it would be best to contact Technical Support about this as I'm not too sure where McAfee comes into play with such errors. However I would say that most errors I see in my Event Viewer I totally ignore, unless there is an actual problem with my PC. In my experience it's impossible to have an Event Viewer totally devoid of errors. Perhaps you should also post this on a Windows Platform forum.
Add me too the list. My XP SP3 Media Centre machine updated McAfee on the 9th, at 13:30 and the WFP warnings started later that afternoon, at 16:28. Now, it is possible that I was already logged in, but chose Shutdown from the log in page, but I do not believe there were any applications running at that point. I'm happy to make the log file available to assist understanding the problem, but I would rather not spend countless hours on end, as I seemingly have to with occasional hiccoughs from McAfee from time to time.
This has all the hallmarks of the problems we went through a year ago and it was months before a solution appeared, although lets just say that the problem coincided with a McAfee update, and disappeared coincident with a later McAfee update. It took me an age to figure out then. I then found the thread and realised I was not alone. (On that occasion, I was able to supress the WFP by disabling AOL in the Start Programs list, but that required me to say Yes to a non-standard start every time).
For those less familiar with finding their way to the event logs, try Start: Control Panel: Administrative Tools: Computer Management: System Tools: Event Viewer: System, allows the events to be seen in more detail. For me, the most recent entry, timed at 10:49 Event ID 64005 reports that ehtray.exe was not restored. File version of bad file is 5.1.2715.2765. Looking on the internet, I can find others have encountered the warning, but Microsoft have not replied with info as to whether that version is legitimate.
The other WFP "Warnings" dated from 9-11-2012 concerning protected system files that could not be verified as valid because Windows File Protection is terminating. Event ID 64008, affecting:
There is mention in the Event Viewer that "SFC" can possibly be used to resolve these problems, but I've no idea whether that is an appropriate action for this situation. Once i know that, then I can learn how to do that.
I should add that my PC came with the software pre-installed, so I cannot load the Windows XP Professional CD as directed, so there is no option beyond cancelling the box, but what risk is there in carrying on after doing that? Are others able to actually resolve the problem if they do have the disks to hand, I wonder?
Hoping you can help.
Message was edited by: hud_engineer on 12/11/12 06:05:52 CSTMessage was edited by: hud_engineer on 12/11/12 06:10:10 CST
It's indicating that this is a Windows problem and as I suggested in my previous post this is really better asked on a Windows forums.
SFC or System File Check is easy enough to do but you may need to have on hand your installation CD/DVD media which includes SP3.
How to do an SFC /SCANNOW in XP
How to slipstream SP3 into an earlier XP installation disc using nlite:
(Do not attempt to slipstream XP SP3 using a Vista machine - future system activation may fail as a result).
.Message was edited by: Ex_Brit on 12/11/12 7:19:51 EST AM
Peter, my issue appears to be a conflict between McAfee and Malwarebytes. As a test, I began a Malwarebytes scan tonight with McAfee running in the background like I always do. I got the WFP error with a different file this time but it was one of the ones that popped up the last time I had this problem. I then stopped the scan, disabled background scanning in McAfee and ran Malwarebytes again. No WFP errors showed up with McAfee background scanning disabled. As I said in my original post, this is the exact same thing that happened last year.
Anyway, I cancelled the WFP box and didn't mess around with files. I don't have a SP3 disk and can't streamline one onto my OEM disk even if I was brave enough to try it.
I'm not worried about the WFP event log errors on shutdown but the WFP errors when running scans was bugging me. Now I'll just disable McAfee real time scan when running Malwarebytes and stay off the internet until the scan is done.
I still think it has something to do with a recent McAfee update. I guess it could be caused by a Malwarebyte update as well but I'm suspicious because this happened for months last year after a McAfee update and then disappeared eventually with another update months later. If I remember correctly I had to disable McAfee real time scan at that time too when I ran Malwarebytes.
Either way, I know what I have to do to work around it and as long as my system is running ok I'll just let things be.Message was edited by: Greens on 11/12/12 10:43:43 PM GMT-05:00
When I Google Windows File Protection Errors in XP I get thousands of hits, so it would appear to be a fairly common annoyance. Unless these are annoying popups or strange behaviour I would ignore Event Viewer, I know I do.
If you want to be really sure use Hijackthis and post a log as instructed in the last link in my signature below. Note the log doesn't go here, but on specialist forums.
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: