up vote 1 down vote favorite
share [g+] share [fb]

Several users in my office all reported on the same day that they were getting "Windows File Protection" messages. It wasn't after windows updates or other software/drivers were pushed.

I generally assume driver updates and windows updates will cause this, and it is no cause for concern. This time, however, I'm curious what caused it.

Can anyone shed some light on this? How can I find which files were modified?

link|improve this question
100% accept rate
Whoa, there's another person on this site named J McKinnon? I was just scanning recent questions, and just happened to notice the name next to this question and thought "hey, I didn't ask that!" and then realized it was indeed not me... ;-) – Jessica McKinnon Aug 31 '09 at 16:18
Indeed - I noticed there being another McKinnon as well. I am surprised it didn't pick up my full name from Stack Overflow... – Joshua McKinnon Sep 1 '09 at 2:34
feedback

1 Answer

up vote 1 down vote accepted

The System File Checker tool gives an administrator the ability to scan all the protected files to verify their versions. Use "sfc" command-line tool

UPD: in comments

link|improve this answer
This is good to know, but it still won't give me any information on which file(s) were modified. There may not be a better answer though, so if one doesn't come in then in a week I will accept... – Joshua McKinnon Sep 1 '09 at 2:38
My answer "sfc /SCANNOW" just tries to repair these files using an original CD. I found no tools to list changed files, sorry. The idea is to compare files in "%WinDir%\System32\Dllcache" with their digital signatures in "%Systemroot%\system32\catRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}". – o_O Tync Sep 1 '09 at 11:00
accepted - it's worth pushing your above commentinto the answer, I think it's helpful. I also found microsoft.com/whdc/archive/wfp.mspx was a nice summary – Joshua McKinnon Sep 8 '09 at 14:06
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.