3. Verifying
System Files with the SFC Utility
The System File Scan
(SFC) utility can help you keep viruses at bay by ensuring you have the
correct version of the system files on your system. Viruses often
replace system files with patched versions that contain the virus code.
Hitchhiking on an existing system file makes it less likely that someone
will remove the virus and ensures the virus gets a chance to run, so
virus writers are motivated to use system files whenever they think they
can. This utility uses the following syntax:
SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
[/OFFWINDIR=<offline windows directory>
/OFFBOOTDIR=<offline boot directory>]
NOTE
The syntax of the SFC
utility presented in this article is specific to Vista, Windows Server
2008 Full version, and Server Core. The syntax is completely different
from older versions of SFC that you find in products such as Windows XP.
The older windows products use a command line that looks like this: SFC [/SCANNOW] [/SCANONCE] [/SCANBOOT] [/REVERT]
[/PURGECACHE] [/CACHESIZE=x]. If you need
this and other older versions of the command line for Windows
administrative, get Windows
Administration at the Command Line (Sybex, 2007).
The following list
describes each of the command line arguments.
/SCANNOW
Scans all
of the protected system files immediately and repairs any damage it
finds. The utility normally relies on the content of the \WINDOWS\system32\dllcache folder to make repairs to the system files.
However, it can also use the Server Core DVD, the content of service
pack folders, or even online sources when necessary. In many cases,
you'll want to verify the files using the /VERIFYONLY command line switch before you do a repair using this
command line switch.
/VERIFYONLY
Verifies all
of the protected system files immediately and works much the same as the
/SCANNOW option. However, this option
doesn't perform any repairs. Even so, it provides you with a report of
system file reliability. To use this option, type SFC /VERIFYONLY and press Enter. You'll see the utility work in
stages as shown in Figure 1.
/SCANFILE=
File
Scans the specified
file and repairs any damage. You must provide the full path to the
file.
/VERIFYFILE=
File
Verifies the
specified file, but doesn't repair any damage. You must provide the full
path to the file.
/OFFBOOTDIR=
Directory
Performs
offline repair of the specified boot directory.
/OFFWINDIR=
Directory
Performs
offline repair of the specified Windows directory.
