Windows File Protection WFP detectin bad files seconds after install

[GeneL]

Hello all,

Can someone explain this to me?

Here is the process:
I install XP PRO
I run "sfc /scannow" and it detects files that have changed (lots more than jsut one file) SECONDS after installing.
OK, I give it the CD and let it do it's thing.
I reboot
when it comes up I do "sfc /scannow" again... Same thing! It finds files that "have been changed"

How can this be? Is it possible to make WFP happy?

Also, SFC comes up sometimes on a non admin. account. does anyone know why this is happening and/or how to stop it?

Many thanks,
--G

 

[Sharon F]

I run "sfc /scannow" and it detects files that have changed (lots more
than jsut one file) SECONDS after installing.

Are you connected to the internet while installing (an always on
connection: dsl or cable, for example)? If yes, maybe the check for updates
during setup is bringing in some newer files? And that particular update
process does not update the SFC file list?

 

[GeneL]

Thanks for your input, but this machine is off the network. Mostly because I didn't want it getting attacked the moment it came up.

I really don't think that SFC (or WFP) does what is advertised. I would really rather have WFP turned on then have it turned off.

--G

 

[Sharon F]

Thanks for your input, but this machine is off the network. Mostly
because I didn't want it getting attacked the moment it came up.

I really don't think that SFC (or WFP) does what is advertised. I would
really rather have WFP turned on then have it turned off.

--G

Gene, I haven't seen this problem and have had nothing but success with SFC
and WFP. I'm not sure what's going on in your case since the system was
completely isolated and the only input was SFC.

What happens if you hold off on running SFC? Wait until the system has
restarted at least a few times? Sometimes finishing touches take place in
the first few restarts - past the last one that setup does before it
launches Windows for the first time.

 

[GeneL]

The system has come up completely, and finished the welcome wizard and reboot before any manually running of SFC. I should specify that SFC is being run manually, and I believe that for whatever
reason WFP is not prompting for a scan.

The reason for this test is my non test machines are currently comming up with the SFC scan (not manually induced) and I want to make sure these have gone away so I can turn WFP back on.

--Gene

 

[Sharon F]

The reason for this test is my non test machines are currently comming up
with the SFC scan (not manually induced) and I want to make sure these
have gone away so I can turn WFP back on.

Gene, I always leave WFP on. When updates are installed that alter a
monitored file's info, this theoretically will update the version info that
WFP and SFC will use. I have seen situations where updates do not
communicate new version info correctly but not since XP was first released
and even then these were rare.

WFP would be the vehicle that would handle automatic notices about an
inconsistency between a working file and the cached copy (windows\dllcache
folder).

 

[GeneL]

If these is the case, how can I have failures on a sfc /scannow seconds after an install. I would note, that sfc does not come up with anything on it's own, but only after prompted. It realy mkes me
believe that SFC and/or WFP is faulty.

--Gene