Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Regarding SFC or running .....

by Gakada Nov 19, 2003 11:31AM PST

system restore, or add/remove windows components.

Windows XP Pro SP1a, with most (if not all) critical updates/patches.

The question are, when I run SFC and it replaced/restore certain files.. (or running system restore, or add/remove windows components for this matter) ... does this affect the update/patches that I installed?

Do I have to reinstall the update/patches?

Sometimes ago, I try SFC, then I'm going to Windows updates, it didn't find any critical updates, THEN, I try 'pedestalsoftware', and it found many critical updates, which I know I already installed before using SFC.

Any information about this?

Thank You

Discussion is locked

10 Posts
- Collapse + Expand Details
- Collapse -
Re:Regarding SFC or running .....
by David Chan Nov 19, 2003 12:14PM PST

We know for a fact that System Restore will remove any SP or Hotfixes/updates as well as S/W and drivers.

So all these have to be reapplied.

But SFC is only supposed to affect system files and not supposed to touch anything else.

I have run SFC several times and my WU is set to auto-download all Security Updates but it did not reinstall any after SFC. Even if I manually go to WU and scan for updates.

But I will retest this and report back later if it result is different.

I have just applied the latest Updates Yesterday so I will try SFC again and see what happens.

It's an interesting point worth looking into.

- Collapse -
Follow up...
by David Chan Nov 19, 2003 1:11PM PST

OK.
I first went tp Pedestal S/W to run a Webscan.
It caught two new updates for Office XP which I applied.

I rescan with Pedestal and this time passed with no updates required.

I've then went to WU and D/L and installed 5# Recommended Updates since all Critical Updates are current.

I rebooted and rescan with Pedestal Webscan. Again passed.

I now perform SFC and completes it successfully.

Finally I re-scan with Pedestal Webscan.
It passed with no updates required.

This proves that SFC does not affect any WU as I suspected since it only scans system files.

- Collapse -
What is Pedestal Webscan?
by Ray Harinec Nov 20, 2003 2:02PM PST

.

- Collapse -
Re:What is Pedestal Webscan?
by Keith Marcotte Nov 20, 2003 2:32PM PST
- Collapse -
Re:Follow up...
by Gakada Nov 25, 2003 4:34PM PST

I need a little more information on this matter.

As we all know, older windows (9x), keeping a window update log file ..(wu...) inside windows system directory. I supposed Windows XP do the same.

So, if I do SFC, and it found a bad file, then it will replace with the good one from a CD or backup directory or from any other source.

The question then, if the bad file is newer than the original.. or came with an update, does this mean that the Update file get undone or incomplete, while the update search function only scan the 'log' file?

So, in other word, we get a false updated file search result?

If this really happened, no wonder many people get an error, while they think they already installed the patch or update and get protected.

Thank you

- Collapse -
Re:Re:Follow up...
by David Chan Nov 25, 2003 8:20PM PST

Looking deeper into the subject...
We know for a fact that System Restore will remove any Window Updates and programs or drivers installed after the restore date.
So if you do a restore you have to reinstall the updates.
The restore will replace the Windows Update Lof file with the earlier version

This log file Windows Update Log is in the WINDOWS folder. It has the complete history of all updates you've applied or uninstalled and if there are any errors during the updates.

I suspect Pedestal Webscan and even Belarc Advisor audit simply pull all the info on your PC's WU from this log file and list them in their report.

Now the more interesting question is if SFC will also undo the updates?
I've run SFC several times on several PCs without having to reapply WU after SFC.
But logic dictates that if a WU replaces a DLL or other system files and SFC then reverts these back to original state it could certainly affect the WU and that update may have to be reinstalled.
The question if in such a scenario when SFC replace aDLL (changed by WU) with an original DLL will the WU Log file be changed?
I suspect this won't change thus a resan at WU site may not show the need to reapply the affected update.

- Collapse -
NT - I don't think so because of WFP.
by Cursorcowboy Nov 25, 2003 8:48PM PST

.

- Collapse -
PART I.
by Cursorcowboy Nov 19, 2003 9:35PM PST

1. The article [Q310747] discusses and describes the Beta release of System File Checker (Sfc.exe), a command-line tool that examines protected system files and restores the correct versions by using backups stored in the Dllcache folder or files copied from the operating system CD. Protected files include those with .sys, .dll, .exe, .ttf, .fon and .ocx file name extensions. Due to disk space considerations, storing all protected files in the Dllcache folder might not be practical especially on computers with limited storage space. Therefore, the system may require and prompt for the operating system CD. In addition, SFC can be used to repopulate the %Systemroot%\System32\Dllcache folder if the contents become damaged or unusable.

2. Windows File Protection prevents the replacement of protected system files installed by the Setup program such as .sys, .dll, .ocx, .ttf, .fon, and .exe files and runs in the background. If WFP detects an attempt by other programs to replace or move a protected system file it checks the file's digital signature to determine if the new file is the correct Microsoft version and if not, it either replaces the file from the backup stored in the Dllcache folder or from the Windows CD. If it cannot locate the appropriate file, it prompts the user to provide the appropriate location. By default, WFP is always enabled and allows Windows digitally signed files to replace existing files and information is written to the Event.log, noting file replacement attempt.

- Collapse -
PART II.
by Cursorcowboy Nov 19, 2003 9:35PM PST

3. The article [Q222193] explains that Windows File Protection (WFP) prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system. WFP protects critical system files that are installed as part of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and some True Type fonts). WFP uses the file signatures and catalog files that are generated by code signing to verify if protected system files are the correct Microsoft versions. Replacement of protected system files is supported only through the mechanisms following, and controlled by the registry setting:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Windows Service Pack installation using Update.exe
Hotfixes installed using Hotfix.exe or Update.exe
Operating system upgrades using Winnt32.exe
Windows Update

- Collapse -
[NT] Thank you all for the explanation.
by Gakada Nov 26, 2003 12:07AM PST

.

Back to Windows Legacy OS forum

CNET Forums

Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Brand Forums
Roadshow Autos
Off Topic

Other Forums

Forum Info