Because many of those sources are on your hard disk, malware authors attempt to replace or damage them all to prevent the repair process from working. If it fails to have the expected information, it will be skipped.

In all cases, the repair process also checks that the copy it’s restoring is correct. In addition, many systems include a copy of Windows on a restore or recovery partition, and, when all else fails, the original Windows installation media might be used. When system file protection needs to restore a file, it usually tries the original first.

Cached copies of the file, kept as a performance enhancement that loads the file more quickly when needed.

Previous versions of the file saved by Windows Update, so you can uninstall specific updates if needed.

If you’ve ever searched for a system file on Windows, it’s not uncommon to find several copies: So, what happens when a problem is found? Repairing altered files System file protection notices when this happens.

Set-up programs often replace system components with their own, sometimes breaking things.

System file protection detects when this happens and repairs the damage. Malicious software can inject itself into the system by modifying Window’s own files.

Malware is the primary reason system file protection exists.

Unfortunately, “wrong” can be the result of many different things: If they don’t, something is wrong, and Windows will likely report the error. When files are “officially” updated, this information is also updated to reflect the new official files.Įvery so often, Windows checks all those files to make sure they still match, meaning the time stamp, size, and hash value all match what is expected. The premise behind system file protection is that Windows keeps information for critical files - possibly including, but not limited to, the date/time stamp of the file, its size, and its cryptographic hash. Run SFC by entering “SFC /scannow” in an admin Command Prompt or PowerShell.

If an unexpected version is found, SFC attempts to restore it from copies or original installation media. SFC scans your system files and confirms they have not been compromised or replaced with unofficial versions.

System file checker tool windows 10