Removing WFP from Current Installation of XP

[Punkrulz]

Hey guys,

CPUGenius has been trying to help me out, and one of the things is trying to remove WFP from my current installation of Windows... On winguides, he found this:

# Make a backup the SFC_OS.DLL in the C:\WINDOWS\SYSTEM32 directory.
# Make an additional copy of SFC_OS.DLL called SFC_OS1.DLL and open it in a hex editor.
# Windows XP (no Service Pack)
At offset 0000E2B8 (0E2B8h) you should find the values "8B" and "C6".
Windows XP (Service Pack 1)
At offset 0000E3BB (0E3BBh) you should find the values "8B" and "C6".
# Do not continue if you are unable to find these values.
# Change the values "8B C6" to read "90 90" and save the changes.
# Run these commands to update the system files:

copy c:\windows\system32\sfc_os1.dll c:\windows\system32\sfc_os.dll /y
copy c:\windows\system32\sfc_os1.dll c:\windows\system32\dllcache\sfc_os.dll /y

# If you are prompted to insert the Windows CD, click Cancel.
# Restart Windows for the change to take effect.

I was following the directions, including getting some sort of hex editor... I've been trying to search for that specific offset, and I can't find it. Does anyone have any other ideas?

 

[PseudoKiller]

WFP = Windows File Protection ??

removing this would not be a good idea IMO

 

[Punkrulz]

Mine is coming up for an unknown reason, but the only thing I have to worry about is viruses trying to overwrite something, which is rare for me...