XP protects critical system files by making a backup to a cache. If a critical file is accidently deleted, modified or corrupted, it is replace automaticly from this cache.
It can come to pass that the "backup" in the cache and the file version being actively used are out of synch, or that both are corrupted (say, by a virus).
In order to restore the protections afforded by the Windows Protetected File System, the sfc utility (System File Checker) allows you to empty the cache, and restore identical copies of critical files to your active directories and to the backup. The /purgecache option is only used after you have changed the cache size.
You should rarely need to do this. I quite honestly have never had the need.
The purging/synchronization processes are done by several of the possible command line options of sfc:
The /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions. This command also repopulates the DLLCache folder with the most recent versions of protected files. This requires access to the Windows installation source files and also the installed Service Pack files. You are usually prompted for the location of these files during the scan operation.
The /scanonce command scans all protected system files once. This command requires access to the Windows installation source files.
The /scanboot command scans all protected system files every time that you start your computer. This command requires access to the Windows installation source files.
The /cancel command cancels all pending scans of protected system files.
The /enable command enables WFP for normal operation.
The /purgecache command purges the file cache and scans all of the protected system files immediately. This command requires access to the Windows installation source files. This command is required after you run the /cachesize=x command.
The /cachesize=x command sets the file cache size in megabytes (MB). This command requires a reboot followed by a /purgecache command to adjust the size of the on-disk cache.
This command sets the SfcQuota DWORD value to x in the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The /quiet command replaces all incorrect file versions without prompting the user.
For XP and Windows 20003 systems only:
The /revert command returns scan to the default setting (do not scan protected files when you start the computer).The default cache size is not reset when you run this command. This command is equivalent to the /Enable switch in Windows 2000.
Remarks
. You must be logged on as a member of the Administrators group to run sfc.
. If sfc discovers that a protected file has been overwritten, it retrieves the correct version of the file from the %systemroot%\system32\dllcache folder, and then replaces the incorrect file.
. If the %systemroot%\system32\dllcache folder becomes corrupt or unusable, use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents of the Dllcache directory.
You would increase the size of the cache if you were concerned its default size was not large enough to protect critical system files. For example, a Service Pack installation or Hotfixes over time may require an increase in the size of the cache. I personally have yet to have to do so.
