Verifying System Files with the SFC Utility

[Guest]

Is there any specific order to follow when using SFC command line arguments?
I ran into some problems a while back when I used this command to check if I
had the correct version of system files on my system after I removed a piece
of malware. I used the following commands in the order below and this
resulted in a boot-time of 30 minutes.

SFC /PURGECACHE, to remove the files in the \Windows\System32\dllcache folder

SFC /SCANBOOT, to increase boot-time and improve system security

SFC /REVERT, to set SFC back to default.

I may have used the /SCANNOW argument instead of the /SCANBOOT argument, and
it caused SFC to run everytime the system would reboot. The SFC /REVERT
argument did nothing to resolve the slow boot-time and I eventually wiped out
the partition just to be safe.
Anyways, I was just currious to know if there is anything to be aware of
when using the SFC Utility becides the performance loss?
Thank you

 

[Wesley Vogel]

I removed a piece of malware. I used the following commands in the order

below and this resulted in a boot-time of 30 minutes.

sfc /Scanboot caused that. sfc /Revert should have fixed it.

sfc /scannow is the only command that you really need to use.

/Scannow: Scans all protected system files immediately and replaces
incorrect versions with correct Microsoft versions. This command may require
access to the Windows installation source files.

/Purgecache: Purges the file cache and scans all protected system files
immediately. This command may require access to the Windows installation
source files.

/Scanboot: Scans all protected system files every time you start your
computer. This command may require access to the Windows installation source
files every time you start your computer. The SfcScan DWORD value is set to
1 in the following registry key when you run this command:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

/Revert: Returns scan to the default setting (do not scan protected files
when you start the computer).The default cache size is not reset when you
run this command. This command is equivalent to the /Enable switch in
Windows 2000.

See...
Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/kb/310747

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

I do not plan on using the SFC command line arguments anytime in the near
future but I will take what you have said about the SFC /SCANBOOT argument
into consideration if there ever is the need to verify system files.
I kind of thought the problem was caused by the /SCANBOOT because SFC would
run each time the system rebooted but the book I reference for command line
administration did not specify any precautions to consider before running the
utility.
Thanks for the feedback.