As we all know, Windows File Protection protects certain operating system files from corruption, and in the case of corruption, restores the files from a protected storage location. HGowever, where and what is the location of these mysterious files? here is your answer:
http://www.optimumx.com/download/#WFPQuery
Wildcards need to use a full path to be effective. For instance, if you pass the command
wfpquery "c:windowssystem32*.dll"
you would see a report that contained all files that matched that wildcard, and an indication of whether or not they were protected by WFP. The program does not traverse directories, however, so you cannot pass a pathname and have the program check everything that matches that wildcard under that folder.
Aside from simply providing a manifest of all protected files, the program can be used to determine if files known to be harmful—viruses or spyware—have been tagged as protected. Some such programs force themselves to be tagged as protected system files to avoid being removed automatically. To delete such a protected file, the user needs to boot into Safe Mode and delete the file from both the system directory and the Windows File Protection repository (the
%SYSTEMROOT%System32DllCache directory.) The backup file in the cache should be removed first.
http://searchwinsystems.techtarget.c...032894,00.html
