SFC System File Checker - any secret switch to get of log of which files fixed ?

[QuienEs]

The CD drive disappeared from My Computer sometime in the last 2 weeks
and SFC saved the day [ XP PRO].

Being of a curious nature I wonder if there is any way to force a log
file, if this happens again I'd love to know what system file had
to be replaced.

TIA, QE in NJ

 

[Wesley Vogel]

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[QuienEs]

On Mon, 31 Jul 2006 10:52:46 -0600, "Wesley Vogel"

|If SFC.EXE did anything it will be in the Event Viewer.
|
|Open the Event Viewer...
|Start | Run | Type: eventvwr | Click OK |
|Click System | Look at any Windows File Protection
|entries
=======================
Many thanks, Wesley. This seems reasonable but I could'nt find any
events althought I think I should have.

When I first ran SFC /SCANNOW I got a series of requests for the SP2
CD, which I skipped. Then I ran it again with the CD present
[mounted in an Alcohol120% virtual drive to avoid the Catch-22 that I
couldn't access it from the real CD drive until the problem with that
drive was fixed] and my problem was solved, my real CD drive was back.

The 1st try requests for a CD, and the success with the virtual CD
suggests that a bunch of system files were fixed.

I know when I ran the SFC recovery yesterday afternoon and sorted by
date/time and read every entry in that time period.

Are you sure that XP's event logger is running when SFC shuts down XP
and boots into the recovery process ?

I didn't see any "Windows File Protection" entries under the event
viewer's "SOURCE" column, nor under any other columns in the
"Sytem" display.

Cheers, QE

 

[Wesley Vogel]

I know when I ran the SFC recovery yesterday afternoon and sorted by

date/time and read every entry in that time period.

What command is that?

There is no switch for SFC.EXE called recovery that I know of.

These are the only switches:

/SCANNOW Scans all protected system files immediately.
/SCANONCE Scans all protected system files once at the next boot.
/SCANBOOT Scans all protected system files at every boot.
/REVERT Return scan to default setting.
/PURGECACHE Purges the file cache.
/CACHESIZE=x Sets the file cache size.

Also see...
Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/?kbid=310747

Are you sure that XP's event logger is running when SFC shuts down XP
and boots into the recovery process ?

What recovery process?

Do you mean the Recovery Console?

And if so, why are you running sfc from the Recovery Console?

And, no, I do not believe that the Event Log service runs while the Recovery
Console is running.

The purpose of the Recovery Console...
[[To recover your operating system when your computer does not start
correctly or does not start at all, you may want to install and use the
Windows Recovery Console. However, Microsoft recommends this method of
system recovery for advanced users only.]]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

If SFC.EXE did anything it will be in the Event Viewer.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click System | Look at any Windows File Protection
entries

=======================
Many thanks, Wesley. This seems reasonable but I could'nt find any
events althought I think I should have.

When I first ran SFC /SCANNOW I got a series of requests for the SP2
CD, which I skipped. Then I ran it again with the CD present
[mounted in an Alcohol120% virtual drive to avoid the Catch-22 that I
couldn't access it from the real CD drive until the problem with that
drive was fixed] and my problem was solved, my real CD drive was back.

The 1st try requests for a CD, and the success with the virtual CD
suggests that a bunch of system files were fixed.

I know when I ran the SFC recovery yesterday afternoon and sorted by
date/time and read every entry in that time period.

Are you sure that XP's event logger is running when SFC shuts down XP
and boots into the recovery process ?

I didn't see any "Windows File Protection" entries under the event
viewer's "SOURCE" column, nor under any other columns in the
"Sytem" display.

Cheers, QE

 

[QuienEs]

Hello again -

Sorry that I confused you, just substitute the word "replace" wherever
I previously said "recover".

I know about the SFC switches, what I am is a retired PC professional
looking for a way to see something like the SFC /SCANNOW "log" if
that's actually possible.

May I repeat one of my previous questions, edited for clarity:

Are you sure that XP's event logger is running when SFC shuts down XP
and reboots into the file replacement process ?

I can imagine that it might not be running which would explain the
lack of entries in the System part of the Event Viewer.

Thanks for the link to the uSoft site - that furthered my education.

BTW, there is another, but different, suggested approach to getting
the log info, here:

http://groups.google.com/group/micr...54966?lnk=st&q=&rnum=1&hl=en#b38e205717c54966

But, no joy there either this time around - it takes a little dinking
around to get to the area of interest, the poster's info isn't exact,
I'll hack thru it again and post cookbook instructions if anyone asks.

Cheers, QE
==============================

On Mon, 31 Jul 2006 15:24:02 -0600, "Wesley Vogel"

|> I know when I ran the SFC recovery yesterday afternoon and sorted
by
|> date/time and read every entry in that time period.
|
|What command is that?
|
|There is no switch for SFC.EXE called recovery that I know of.
|
|These are the only switches:
|
|/SCANNOW Scans all protected system files immediately.
|/SCANONCE Scans all protected system files once at the next
boot.
|/SCANBOOT Scans all protected system files at every boot.
|/REVERT Return scan to default setting.
|/PURGECACHE Purges the file cache.
|/CACHESIZE=x Sets the file cache size.
|
|Also see...
|Description of Windows XP and Windows Server 2003 System File Checker
|(Sfc.exe)
|http://support.microsoft.com/?kbid=310747
|
|> Are you sure that XP's event logger is running when SFC shuts down
XP
|> and boots into the recovery process ?
|
|What recovery process?
|
|Do you mean the Recovery Console?
|
|And if so, why are you running sfc from the Recovery Console?
|
|And, no, I do not believe that the Event Log service runs while the
Recovery
|Console is running.
|
|The purpose of the Recovery Console...
|[[To recover your operating system when your computer does not start
|correctly or does not start at all, you may want to install and use
the
|Windows Recovery Console. However, Microsoft recommends this method
of
|system recovery for advanced users only.]]

 

[Wesley Vogel]

QE,

I have never had sfc.exe shutdown and restart Windows.

I do not understand how or why that is happening for you.

I must be missing something.

Try this experiment. We'll see if Windows File Protection is working and if
there is an entry in the Event Viewer.

Start | Run | Type: system32 | Click OK |
Size the window so that you can see the Desktop.
Scroll clear down to the bottom.
Drag zipfldr.dll to the Desktop.
Wait a minute or less.
Notice a new zipfldr.dll appear at the bottom of the System32 folder?
If not, hit F5 to refresh.
Close System32.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click on System in the left hand pane.
Double click on the Windows File Protection entry in the right hand pane.

It should look something like this...

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 01-Aug-06
Time: 11:34:36 AM
User: N/A
Computer: MYPENTIUM450
Description:
File replacement was attempted on the protected system file
c:\windows\system32\zipfldr.dll. This file was restored to the original
version to maintain system stability. The file version of the system file is
6.0.2800.1584.
-----

<quote>
Windows File Protection also writes an event to the Event log that notes the
file-replacement attempt.

Note When Windows File Protection restores a file, a log entry is logged in
System Event Viewer that is similar to the following:

File replacement was attempted on the protected system file
C:\Windows\System32\Calc.exe. This file was restored to the original version
to maintain system stability. The file version of the system file is
5.2.3752.0
<quote>
http://support.microsoft.com/default.aspx?scid=kb;en-us;814597

These may be of some interest.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/?kbid=310747

HOW TO Verify That Windows File Protection Is Running
http://support.microsoft.com/default.aspx?scid=kb;en-us;814597

Description of the Windows File Protection Feature
http://support.microsoft.com/default.aspx?scid=kb;en-us;222193

Registry Settings for Windows File Protection
http://support.microsoft.com/default.aspx?scid=kb;en-us;222473

You may be prompted to insert a Windows XP Professional CD when you run the
System File Checker tool in Windows XP Home Edition
http://support.microsoft.com/kb/897128

System File Checker (sfc)
http://www.microsoft.com/resources/...p/all/proddocs/en-us/system_file_checker.mspx

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello again -

Sorry that I confused you, just substitute the word "replace" wherever
I previously said "recover".

I know about the SFC switches, what I am is a retired PC professional
looking for a way to see something like the SFC /SCANNOW "log" if
that's actually possible.

May I repeat one of my previous questions, edited for clarity:

Are you sure that XP's event logger is running when SFC shuts down XP
and reboots into the file replacement process ?

I can imagine that it might not be running which would explain the
lack of entries in the System part of the Event Viewer.

Thanks for the link to the uSoft site - that furthered my education.

BTW, there is another, but different, suggested approach to getting
the log info, here:

http://groups.google.com/group/micr...54966?lnk=st&q=&rnum=1&hl=en#b38e205717c54966

But, no joy there either this time around - it takes a little dinking
around to get to the area of interest, the poster's info isn't exact,
I'll hack thru it again and post cookbook instructions if anyone asks.

Cheers, QE
==============================

I know when I ran the SFC recovery yesterday afternoon and sorted by
date/time and read every entry in that time period.

What command is that?

There is no switch for SFC.EXE called recovery that I know of.

These are the only switches:

/SCANNOW Scans all protected system files immediately.
/SCANONCE Scans all protected system files once at the next boot.
/SCANBOOT Scans all protected system files at every boot.
/REVERT Return scan to default setting.
/PURGECACHE Purges the file cache.
/CACHESIZE=x Sets the file cache size.

Also see...
Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/?kbid=310747

Are you sure that XP's event logger is running when SFC shuts down XP
and boots into the recovery process ?

What recovery process?

Do you mean the Recovery Console?

And if so, why are you running sfc from the Recovery Console?

And, no, I do not believe that the Event Log service runs while the
Recovery Console is running.

The purpose of the Recovery Console...
[[To recover your operating system when your computer does not start
correctly or does not start at all, you may want to install and use the
Windows Recovery Console. However, Microsoft recommends this method of
system recovery for advanced users only.]]

 

[QuienEs]

Hello Wesley,

What could be worse than someone asking you to elucidate on something
that never happened ?

My extreme apologies. Shortly after I posted my last msg I did a
Usenet "cancel" on it but Murphy's Law took effect and you saw it
anyway, and of course Google has it archived.

In the interests of furthering my apology and for scientific accuracy
I want to now state that SFC does not reboot to make its repairs, it
was something else that was rebooting during my attempts to fix my
problems, probably System Restore.

With regards to System Restore, it was an eye-opener to me to learn
that if you do an XP SystemRestore it deletes any EXE files not there
when the restore point was made, e.g. recently downloaded exe files
[and many others - see following links] anywhere on C: except in My
Documents.

http://www.microsoft.com/technet/prodtechnol/winxppro/plan/faqsrwxp.mspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sr/sr/monitored_file_extensions.asp

Also, thanks for the links below some of which are new to me and I
have started to read them.

Again many thanks for all your help.

QE
========================================




On Tue, 1 Aug 2006 12:48:00 -0600, "Wesley Vogel"

|QE,
|
|I have never had sfc.exe shutdown and restart Windows.
|
|I do not understand how or why that is happening for you.
|
|I must be missing something.
|
|Try this experiment. We'll see if Windows File Protection is working
and if
|there is an entry in the Event Viewer.
|
|Start | Run | Type: system32 | Click OK |
|Size the window so that you can see the Desktop.
|Scroll clear down to the bottom.
|Drag zipfldr.dll to the Desktop.
|Wait a minute or less.
|Notice a new zipfldr.dll appear at the bottom of the System32 folder?
|If not, hit F5 to refresh.
|Close System32.
|
|Open the Event Viewer...
|Start | Run | Type: eventvwr | Click OK |
|Click on System in the left hand pane.
|Double click on the Windows File Protection entry in the right hand
pane.
|
|It should look something like this...
|
|Event Type: Information
|Event Source: Windows File Protection
|Event Category: None
|Event ID: 64002
|Date: 01-Aug-06
|Time: 11:34:36 AM
|User: N/A
|Computer: MYPENTIUM450
|Description:
|File replacement was attempted on the protected system file
|c:\windows\system32\zipfldr.dll. This file was restored to the
original
|version to maintain system stability. The file version of the system
file is
|6.0.2800.1584.
|-----
|
| <quote>
|Windows File Protection also writes an event to the Event log that
notes the
|file-replacement attempt.
|
|Note When Windows File Protection restores a file, a log entry is
logged in
|System Event Viewer that is similar to the following:
|
|File replacement was attempted on the protected system file
|C:\Windows\System32\Calc.exe. This file was restored to the original
version
|to maintain system stability. The file version of the system file is
|5.2.3752.0
| <quote>
|http://support.microsoft.com/default.aspx?scid=kb;en-us;814597
|
|These may be of some interest.
|
|scannow sfc (sfc.exe)
|http://www.updatexp.com/scannow-sfc.html
|
|Description of Windows XP and Windows Server 2003 System File Checker
|(Sfc.exe)
|http://support.microsoft.com/?kbid=310747
|
|HOW TO Verify That Windows File Protection Is Running
|http://support.microsoft.com/default.aspx?scid=kb;en-us;814597
|
|Description of the Windows File Protection Feature
|http://support.microsoft.com/default.aspx?scid=kb;en-us;222193
|
|Registry Settings for Windows File Protection
|http://support.microsoft.com/default.aspx?scid=kb;en-us;222473
|
|You may be prompted to insert a Windows XP Professional CD when you
run the
|System File Checker tool in Windows XP Home Edition
|http://support.microsoft.com/kb/897128
|
|System File Checker (sfc)
|http://www.microsoft.com/resources/...p/all/proddocs/en-us/system_file_checker.mspx

 

[Wesley Vogel]

QE,

Once a message is sent, that's it. You can delete it so that you can't see
it, but the rest of the world can. ;-)

Here's some more System Restore links that I happened to have handy. BTW, I
do not use System Restore.

System Restore What's Restored and What's Not
http://bertk.mvps.org/html/tips.html#WhatsRestored

System Restore
http://bertk.mvps.org/html/tips.html

System Restore for Windows XP
http://www.kellys-korner-xp.com/xp_restore.htm

How to turn on and turn off System Restore in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310405

How antivirus software and System Restore work together
http://support.microsoft.com/default.aspx?scid=kb;en-us;831829

How System Restore Functions When You Delete Hard Links
http://support.microsoft.com/default.aspx?scid=kb;en-us;286164

How the System Restore Tool Handles Hard-Disk Space Usage
http://support.microsoft.com/default.aspx?scid=kb;en-us;300044

How the System Restore Utility Uses Drive Letters
http://support.microsoft.com/default.aspx?scid=kb;en-us;287505

How to Disable the System Restore Configuration User Interface
http://support.microsoft.com/default.aspx?scid=kb;en-us;283073

How to start the System Restore tool at a command prompt in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;304449

How to troubleshoot the System Restore tool in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;302796

HOW TO Use the System Restore Utility with Windows Management
Instrumentation in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;295299

Improper Shutdown May Affect System Restore
http://support.microsoft.com/default.aspx?scid=kb;en-us;283096

Information on System Restore and Password Restoration
http://support.microsoft.com/default.aspx?scid=kb;en-us;295050

Non-Administrator User Is Unable to Start System Restore Utility
http://support.microsoft.com/default.aspx?scid=kb;en-us;283252

System Restore Displays Duplicate Drives With Offline Status
http://support.microsoft.com/default.aspx?scid=kb;en-us;306217

System Restore Does Not Restore .bkf Files
http://support.microsoft.com/default.aspx?scid=kb;en-us;281616

System Restore Does Not Restore Compression
http://support.microsoft.com/default.aspx?scid=kb;en-us;286103

System Restore Does Not Restore Printer Drivers to Original State
http://support.microsoft.com/default.aspx?scid=kb;en-us;293889

System Restore Does Not Restore Your Wallpaper or Background
http://support.microsoft.com/default.aspx?scid=kb;en-us;281842

System Restore restore points are missing or deleted
http://support.microsoft.com/default.aspx?scid=kb;en-us;301224

System Restore Settings Are Not Preserved During Reinstallation or Upgrade
http://support.microsoft.com/default.aspx?scid=kb;en-us;299906

System Restore Tool Displays a Blank Calendar in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;313853

The Registry Keys and Values for the System Restore Utility
http://support.microsoft.com/default.aspx?scid=kb;en-us;295659

The System Restore Utility May Be Suspended on a System Drive Even Though
There Is Enough Disk Space
http://support.microsoft.com/default.aspx?scid=kb;en-us;299904

The System Restore Utility Restarts with an Unsaved Open Document
http://support.microsoft.com/default.aspx?scid=kb;en-us;287507

Windows System Restore Utility Quits and All Restore Points Are Deleted
http://support.microsoft.com/default.aspx?scid=kb;en-us;812119

Windows XP System Restore Feature Restores Old Lotus Notes Password Files
http://support.microsoft.com/default.aspx?scid=kb;en-us;816543


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Hello Wesley,

What could be worse than someone asking you to elucidate on something
that never happened ?

My extreme apologies. Shortly after I posted my last msg I did a
Usenet "cancel" on it but Murphy's Law took effect and you saw it
anyway, and of course Google has it archived.

In the interests of furthering my apology and for scientific accuracy
I want to now state that SFC does not reboot to make its repairs, it
was something else that was rebooting during my attempts to fix my
problems, probably System Restore.

With regards to System Restore, it was an eye-opener to me to learn
that if you do an XP SystemRestore it deletes any EXE files not there
when the restore point was made, e.g. recently downloaded exe files
[and many others - see following links] anywhere on C: except in My
Documents.

http://www.microsoft.com/technet/prodtechnol/winxppro/plan/faqsrwxp.mspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sr/sr/monitored_file_extensions.asp

Also, thanks for the links below some of which are new to me and I
have started to read them.

Again many thanks for all your help.

QE
========================================

QE,

I have never had sfc.exe shutdown and restart Windows.

I do not understand how or why that is happening for you.

I must be missing something.

Try this experiment. We'll see if Windows File Protection is working
and if there is an entry in the Event Viewer.

Start | Run | Type: system32 | Click OK |
Size the window so that you can see the Desktop.
Scroll clear down to the bottom.
Drag zipfldr.dll to the Desktop.
Wait a minute or less.
Notice a new zipfldr.dll appear at the bottom of the System32 folder?
If not, hit F5 to refresh.
Close System32.

Open the Event Viewer...
Start | Run | Type: eventvwr | Click OK |
Click on System in the left hand pane.
Double click on the Windows File Protection entry in the right hand pane.

It should look something like this...

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 01-Aug-06
Time: 11:34:36 AM
User: N/A
Computer: MYPENTIUM450
Description:
File replacement was attempted on the protected system file
c:\windows\system32\zipfldr.dll. This file was restored to the original
version to maintain system stability. The file version of the system
file is
6.0.2800.1584.
-----

<quote>
Windows File Protection also writes an event to the Event log that notes
the file-replacement attempt.

Note When Windows File Protection restores a file, a log entry is logged
in System Event Viewer that is similar to the following:

File replacement was attempted on the protected system file
C:\Windows\System32\Calc.exe. This file was restored to the original
version to maintain system stability. The file version of the system
file is
5.2.3752.0
<quote>
http://support.microsoft.com/default.aspx?scid=kb;en-us;814597

These may be of some interest.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/?kbid=310747

HOW TO Verify That Windows File Protection Is Running
http://support.microsoft.com/default.aspx?scid=kb;en-us;814597

Description of the Windows File Protection Feature
http://support.microsoft.com/default.aspx?scid=kb;en-us;222193

Registry Settings for Windows File Protection
http://support.microsoft.com/default.aspx?scid=kb;en-us;222473

You may be prompted to insert a Windows XP Professional CD when you run
the System File Checker tool in Windows XP Home Edition
http://support.microsoft.com/kb/897128

System File Checker (sfc)

http://www.microsoft.com/resources/...p/all/proddocs/en-us/system_file_checker.mspx