| Event Id | 64020 |
| Source | Windows File Protection |
| Description | Windows File Protection scan found that the system file <Location>has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is <No>. |
| Event Information | According to Microsoft: CAUSE: This behavior can occur if the certificate for Verisign time stamping has been removed from the computer. This certificate is listed as: "Issued To: No Liability Accepted, (c)97 Versign, Inc.". RESOLUTION: To resolve this behavior, the certificate needs to be restored to the original location. You need to export the certificate from a Windows 2000-based computer: 1. Locate a Windows 2000-based computer. 2. Click Start, and then click Run. 3. In the Open box, type: MMC. 4. When Microsoft Management Console (MMC) is displayed, click Console, and then click Add/Remove Snap-in. 5. On the Add/Remove window, click Add. 6. When the list of available snap-ins are displayed, click Certificates, and then click Add. 7. Click Computer Account. 8. Click Next. 9. Click Local Computer, and then click Finish. 10. Click Close, and then click OK to close out the Add/Remove Snap-in window. 11. Under Console Root, double-click Certificates (Local Computer). 12. Double-click Trusted Root Certificate Authorities, and then double-click Certificates. 13. In the right pane, the installed certificates are displayed. Scroll down the list until you locate the No Liability Accepted certificate. 14. Right-click this certificate, click All Tasks, and then click Export. 15. On the Export Wizard, click Next, click DER encoded Library X.509, and then click Next. 16. In the File name box, enter a file name to save the file (for example, C:\Cert). A .cer extension is added to the file name. 17. Transfer this file to the computer that is receiving the error message. When the file is transferred to the computer that is receiving the error message, use the following steps to import the file: 1. Click Start, and then click Run. 2. In the Open box, type: MMC. 3. When the MMC starts, click Console, and then click Add/Remove Snap-in. 4. On the Add/Remove Window, click Add. 5. When th |
| Reference Links | Description of the Windows File Protection Feature http://support.microsoft.com/default.aspx?scid=kb;en-us;310747" target="_blank">Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe) |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.