| Event Id | 64001 |
| Source | Windows File Protection |
| Description | File replacement was attempted on the protected system file c:\winnt\system32\file_name. This file was restored to the original version to maintain system stability. The file version of the system file is x.x:x.x. |
| Event Information | Cause: The Windows File Protection (WFP) feature prevents the replacement of certain monitored system files. It uses the file signatures and catalog files generated by code signing to verify if protected system files are the correct Microsoft versions. Windows 2000 will try to locate the original file from the installation source. If the file required for replacement is found in the sources, WFP automatically overwrites the file and the following event is placed in the System event log: Resolution: If the file is not located in any of the source folders and the original installation source (network share or local CD-ROM) is not available, the user is prompted to insert the Windows 2000 installation CD-ROM. To replace a Windows 2000 system file: 1.Boot Windows 2000 into Safe mode. 2.Rename the file you want to replace in all the following sub directories (ensure that Windows Explorer is set to show hidden files and folders): %systemroot%\system32\(all subdirectories) %systemroot%\system32\dllcache (dllcache is a hidden folder) Copy the updated file into the locations where the files originally existed above. Reboot into normal mode. Note: Windows 2000 will try to locate the original file from the installation source, so make sure there is no CD inserted or network connection to the Windows 2000 distribution files. |
| Reference Links | "Event ID 64001 of Source Windows File Protection
Microsoft Support-1 Microsoft Support-2" |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.