You receive a "Windows File Protection: Files that are required for windows to run properly have been replaced by unknown versions" error in Windows Server 2003, Windows XP, or Windows 2000 (904677)


The information in this article applies to:

  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Media Center Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Internet Explorer 6.0

Beta Information

This article discusses a Beta release of a Microsoft product. The information in this article is provided as-is and is subject to change without notice.

No formal product support is available from Microsoft for this Beta product. For information about how to obtain support for a Beta release, see the documentation that is included with the Beta product files, or check the Web location where you downloaded the release.

SYMPTOMS

You may experience one or more of the following symptoms on computers that are running Microsoft Windows Server 2003, Microsoft Windows XP, or Microsoft Windows 2000:
  • When you start Windows, you receive the following error message:

    Windows File Protection: Files that are required for windows to run properly have been replaced by unknown versions; Windows needs to restore these files to function properly.
  • An error message that is similar to the following is logged in the System event log:Source: Windows File Protection
    Event ID: 64033
    Description: Windows File Protection could not be initialized. The specific error code is 0xc000000f.
  • You cannot correctly run Windows Update because trusted root certificates are missing from the certificate store.

CAUSE

This behavior may occur because of an infection by VX2 malicious program variants.

RESOLUTION

Microsoft Windows AntiSpyware (Beta) can detect and remove many variants of the VX2 malicious program.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

892279 How to obtain Microsoft Windows AntiSpyware (Beta)

How to resolve the problem on a computer that is running Microsoft Internet Explorer 6

  1. Run Windows AntiSpyware (Beta) to remove the VX2 program variants that are detected.
  2. Register the Initpki.dll file. To do this, click Start, click Run, type regsvr32 initpki.dll, and then click OK.

How to resolve the problem on a computer that is not running Internet Explorer 6

  1. Register the Initpki.dll file. To do this, click Start, click Run, type regsvr32 initpki.dll, and then click OK.
  2. Download and install Internet Explorer 6. For more information, visit the following Microsoft Web site:

    http://www.microsoft.com/windows/ie/default.mspx

    Note If a restart is required after you install the program, you should re-register the Initpki.dll file after you restart the computer.
  3. Download and install Windows AntiSpyware (Beta).
  4. Run Windows AntiSpyware (Beta) to remove the VX2 program variants that are detected.
Note Windows AntiSpyware (Beta) is a beta product from Microsoft. There is currently no telephone support for beta products. To obtain support for Windows AntiSpyware (Beta), follow these steps:
  1. Visit the following Microsoft Web site:

    http://www.microsoft.com/communities/newsgroups/default.mspx

  2. Click Security, and then click Security Virus.

    You can ask any questions about Windows AntiSpyware (Beta) in this newsgroup. For more information about the access to or the use of Microsoft newsgroups, visit the following Web site, point to User Guide, and then click Getting Started:

    http://www.microsoft.com/communities/newsgroups/default.mspx

MORE INFORMATION

The VX2 malicious program has many different variants that could change the techniques that are used for removal. Not all variants of the VX2 program will be fully addressed by the techniques that are described in this article.

For more information about spyware and malicious program removal applications, visit the following Microsoft Web site:

http://www.microsoft.com/athome/security/protect/windowsxpsp2/antispy.mspx

Modification Type:MajorLast Reviewed:8/31/2006
Keywords:kbtshoot kbprb KB904677 kbAudEndUser
©2004 Microsoft Corporation. All rights reserved.