sfc /scannow

  • Thread starter Thread starter Rosie
  • Start date Start date
R

Rosie

When I run System File Checker, I notice that the XPHome CD is being
accessed from time to time. I assume this is to allow it to repair
damaged files. Why doesn't sfc give a list of files that needed repair?
 
There is no such thing as sfc.log with Windows XP, that's why you can't find
it. Windows 98 uses sfclog.txt.

Try System Information...
Start | Run | Type: msinfo32 | OK |
View | System History

Or try the Event Viewer...
Start | Run | Type: eventvwr | OK |
Look under System | Event Source: Windows File Protection

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
Wesley Vogel said:
There is no such thing as sfc.log with Windows XP, that's why you can't find
it. Windows 98 uses sfclog.txt.

Try System Information...
Start | Run | Type: msinfo32 | OK |
View | System History

Or try the Event Viewer...
Start | Run | Type: eventvwr | OK |
Look under System | Event Source: Windows File Protection
Click to expand...
The event viewer mentions my file protection system entries in the log,
but if I go to the MS Help & Support Centre, it says there is no info on
the events listed, i.e. 64016 and 64017.
All I want to do is to find out what files needed to be
repaired/replaced when I run sfc /scannow so that I can look for a
pattern which may point me towards some s/w that is causing problems.
Thanks.
 
sfc is just the wrong tool for what you want. attrib can detect the change in an archive bit, for example. There are a host of tools
available to a user for detecting changes in a system, but sfc isn't one of those.

The latest great tool to come from MS is the new antispy app, which has System Explorer agents for what you want. (It's still in
beta.)

MS Antispy software, and FAQ - Download MS anti-spyware beta : http://g.microsoft.com/mh_mshp/734 and read the FAQ -
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
 
Mark L. Ferguson said:
sfc is just the wrong tool for what you want. attrib can detect the
change in an archive bit, for example. There are a host of tools
available to a user for detecting changes in a system, but sfc isn't
one of those.
Click to expand...
I was assuming/hoping that when sfc copied a file from CD it would tell
me what it had done! I expected it to be an integral part of sfc, or at
least there would have been an 'option' to discover what had changed.
Too simplistic I suppose?
attrib rings a bell from the old DOS days. Presumably this would be a
'before & after' check to find out what files have changed?
The latest great tool to come from MS is the new antispy app, which has
System Explorer agents for what you want. (It's still in
beta.)
Click to expand...
I'm already using this but I don't see how this would help with this
query.
Thanks Mark.
 
Windows File Protection file scan completed successfully. Is about as
detailed as it gets. It doesn't work like it did in Windows 98. ;-(

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
Wesley Vogel said:
Windows File Protection file scan completed successfully. Is about as
detailed as it gets. It doesn't work like it did in Windows 98. ;-(
Click to expand...
I suppose it is something for it to complete successfully, but if it
takes another sfc to get a broken system working again it isn't very
helpful not to be told what broke it!
What would be a good way for me to find out what files are replaced
then?
Thanks Wesley.
 
gillie,

I just looked through some old posts related to this from when I upgraded
from 98 to XP. No way to tell what's been done. Unless you see an Event ID
64002 Windows File Protection in the Event Viewer for File replacement was
attempted on the protected system file.

[[When Windows File Protection restores a file, a log entry is logged in
System Event Viewer.]]
HOW TO Verify That Windows File Protection Is Running
http://support.microsoft.com/default.aspx?scid=kb;en-us;814597

I've been using XP long enough that I've forgotten how SFC really differed
in 98. In XP it's crippled compared to 98.

A couple of quotes that I found from that time. By me ;-) ...

[[I used SFC w/Win98 all the time. I have used SFC with XP and you have no
clue what it is doing. Is there a log? It seems you just insert your XP CD
and the black cloak comes down. No user interaction that I can see, like
w/98 SFC had.

W/98 SFC there was a report on what SFC did. Ignored, restored, deleted,
whatever. I would really like to know if there is log somewhere. I saw
this log question posted a few days ago, but I did not see any replies.

First, I don't need to know all the history, but I think MS took a good
thing (Win98 SFC) and wrecked it. I don't care if they are or are not
related, i.e.98, NT, Win2000 or XP, the result is the same.]]

<shrug>

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
Rosie/Gillie,

What Wes said ... When Windows File Protection restores a file, a log entry
is logged in
System Event Viewer.

For instance, these are my most recent WFP entries in Event Viewer, in
reverse chronological order:

Windows File Protection file scan completed successfully.

Windows File Protection scan found that the system file
c:\windows\system32\ntvdmd.dll has a bad signature. This file was restored
to the original version to maintain system stability. The file version of
the system file is 5.1.2600.0.

Windows File Protection scan found that the system file
c:\windows\system32\ntvdmd.dll has a bad signature. This file was restored
to the original version to maintain system stability. The file version of
the system file is 5.1.2600.1560.

Windows File Protection file scan was started.

If you have nothing between the Start and End entries, then SFC replaced
nothing.
 
Wesley Vogel said:
gillie,

I just looked through some old posts related to this from when I upgraded
from 98 to XP. No way to tell what's been done. Unless you see an Event ID
64002 Windows File Protection in the Event Viewer for File replacement was
attempted on the protected system file.
Click to expand...
Hi Wes. I got 3 Event ID entries which just said that a scan had started
and when I followed the links, MS told me they had no information on
them! Now that's really helpful!
[[When Windows File Protection restores a file, a log entry is logged in
System Event Viewer.]]
HOW TO Verify That Windows File Protection Is Running
http://support.microsoft.com/default.aspx?scid=kb;en-us;814597
Click to expand...

I checked that and yes, calc.exe was replaced so WFP is working on my
system.
I've been using XP long enough that I've forgotten how SFC really differed
in 98. In XP it's crippled compared to 98.
Click to expand...

I wonder why?
A couple of quotes that I found from that time. By me ;-) ...

[[I used SFC w/Win98 all the time. I have used SFC with XP and you have no
clue what it is doing. Is there a log? It seems you just insert your XP CD
and the black cloak comes down. No user interaction that I can see, like
w/98 SFC had.
Click to expand...

They don't want us to know, do they!
W/98 SFC there was a report on what SFC did. Ignored, restored, deleted,
whatever. I would really like to know if there is log somewhere. I saw
this log question posted a few days ago, but I did not see any replies.
Click to expand...

That may have been me, I would really like to know what files are
getting 'zapped'. They may be different every time I run WFP, but I just
don't know.
First, I don't need to know all the history, but I think MS took a good
thing (Win98 SFC) and wrecked it. I don't care if they are or are not
related, i.e.98, NT, Win2000 or XP, the result is the same.]]

<shrug>
Click to expand...
Right. At least someone agrees with me that it has been wrecked, I was
beginning to think I was the only one!
Thanks Wes for the confirmation etc.
 
Kangaroo said:
Rosie/Gillie,

What Wes said ... When Windows File Protection restores a file, a log
entry is logged in
System Event Viewer.

For instance, these are my most recent WFP entries in Event Viewer, in
reverse chronological order:

Windows File Protection file scan completed successfully.

Windows File Protection scan found that the system file
c:\windows\system32\ntvdmd.dll has a bad signature. This file was
restored to the original version to maintain system stability. The
file version of the system file is 5.1.2600.0.

Windows File Protection scan found that the system file
c:\windows\system32\ntvdmd.dll has a bad signature. This file was
restored to the original version to maintain system stability. The
file version of the system file is 5.1.2600.1560.

Windows File Protection file scan was started.

If you have nothing between the Start and End entries, then SFC
replaced nothing.
Click to expand...
snip

Now that is interesting. It does say what it's done. I may have made an
assumption here. When I ran sfc /scannow the last couple of times, I
could see the CD being accessed now and again and I was assuming that
files were being replaced. It seems they weren't. The event logs showed
64016 & 64017 which say (to the effect) 'scan has started, scan has
finished'. You've have cleared up the mystery for me!
While I was typing up this reply, Explorer.exe took an 'unknown fault'
and I had to reboot. The event log showed no sign of this being logged,
so unless I'm not reading the log properly its not helping!
Anyway, many thanks for that Kangaroo. ;)
 
You're very welcome.

snip

Now that is interesting. It does say what it's done. I may have made
an assumption here. When I ran sfc /scannow the last couple of times,
I could see the CD being accessed now and again and I was assuming
that files were being replaced. It seems they weren't. The event logs
showed 64016 & 64017 which say (to the effect) 'scan has started,
scan has finished'. You've have cleared up the mystery for me!
While I was typing up this reply, Explorer.exe took an 'unknown fault'
and I had to reboot. The event log showed no sign of this being
logged, so unless I'm not reading the log properly its not helping!
Anyway, many thanks for that Kangaroo. ;)
Click to expand...
 
Back
Top