Revision #17

You are currently reviewing an older revision of this page.
Go to current version

The sfc tool can be used to check the integrity of all protected system files and registry keys. If any of the files have been modified or corrupted, it can replace them with the correct version of the file. Malicious software often attempts to modify system files. If it succeeds, the malware may have extensive control over the system. The sfc utility can be very useful in repairing system files that have been corrupted by malware (or by other means).

Note 1: You can view the results of a scan in the cbs.log file, which is located in the %windir%\Logs\CBS folder.

Note 2: The sfc command must be run from an elevated Command Prompt. For more information regarding how to start Command Prompt in elevated mode, click here.

There are several switches that can be used with the sfc command, as shown in the following table:

Note 3: The syntax of the SFC utility presented in this wiki article is specific to Windows 7, Vista, Windows Server 2008/2008 R2. The syntax is sometimes different from older versions of SFC that you find in products such as Windows XP and Windows Server 2003.

 Command Description
 /scannow
The /scannow switch initiates a full check of all the system resources. It checks the integrity of the resources and repairs problems when possible. This check does take some time.

Note 1: This switch also available in Windows XP and Windows Server 2003.

Note 2: In some situations, especially in Windows XP and Windows Server 2003, you may also need access to your original Windows installation CD or DVD.

Note 3: Restart your computer if sfc /scannow did actually repair any files. sfc may or may not prompt you to restart but even if it doesn't, you should restart anyway.
 /verifyonly This is similar to the /scannow switch but doesn’t attempt to repair anything. It ONLY scans the files and reports any issues.



If running sfc with /verifyonly switch finds problems, it reports as the following statement:

Windows Resource Protection found integrity violations. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log.
 /scanfile
 You can scan specific files and check for integrity problems on these specific files. Just as the /scannow switch repairs any detected problems, the /scanfile switch repairs the file if problems are identified. You must specify the full path to the file. Look at the following example:



Note: You cannot include spaces before or after the = sign in this command.
 /verifyfile
 The /verifyfile switch checks specific files for integrity problems and reports the results. It does not attempt a repair. You must specify the full path to the file.



Note:
You cannot include spaces before or after the = sign in this command.
/offbootdir
/offwindir
You can also scan an offline instance of Windows. In other words, if you have a dual-boot system, you can boot into one system and scan the other system. The /offbootdir switch specifies the offline drive and the /offwindir switch specifies the offline Windows folder.

These switches are used in conjunction with other switches, such as the /scannow switch.

Note 4: For more information regarding to sfc tool, click here.

Revert to this revision