Windows File Protection Error & sfc.exe

After installing some applications I am receiving a Windows File Protection Error.
I checked the event viewer and it list
The protected system file c:\windows\system32\dsound.dll could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.
Is there a log or switch with SFC.exe I can check to see which application overwrote this file? Sfc.exe probably will fix the problem but I still do not know which application is overwriting the file (dsound.dll) for future installs.
Thanks
TonyTech7Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
riotzConnect With a Mentor Commented:
check your eventlog it should be listed under the system tab
0
 
MrArubaCommented:
dsound.dll is a part of dirextX. Did any of the applications you installed upgrade  your existing directX ?
0
 
TonyTech7Author Commented:
Yes , I am not sure if that is the only file. Is there a way to have sfc.exe scan all the system files and tell me which ones were overwritten. When I run sfc.exe it replaces the file(s) but doesn’t list the changes that have been made. I am building an image so I need to know which files are being replaced I can’t run the repair utility on every workstation.
The other option is to set the registry to ignore the error but I don’t think that’s a good idea.
Thanks

0
[Webinar] Kill tickets & tabs using PowerShell

Are you tired of cycling through the same browser tabs everyday to close the same repetitive tickets? In this webinar JumpCloud will show how you can leverage RESTful APIs to build your own PowerShell modules to kill tickets & tabs using the PowerShell command Invoke-RestMethod.

 
riotzCommented:
Is there a way to have sfc.exe scan all the system files and tell me which ones were overwritten.

try "sfc.exe /SCANNOW"
0
 
TonyTech7Author Commented:
sfc.exe /SCANNOW
 will repair the missing files but is there a log ? it doen't display which files it replacled .
0
 
TonyTech7Author Commented:
Yes, see above
The protected system file c:\windows\system32\dsound.dll could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.
Was from the event viewer
How can I find out WHICH application overwrote the file ?

0
 
riotzCommented:
hmm well you cant find that out anymore..

to track that down you would need to hook the CreateFile function in windows or some app that does that..
and starts monitoring overwrites of files

but i mean you must know what kinda software you installed lately
0
All Courses

From novice to tech pro — start learning today.