How to Use Windows System File Checker After Malware Damage

Malware can alter, replace, or corrupt Windows components while attempting to disable security tools, change browser settings, or maintain access to a computer. System File Checker (SFC) can replace damaged protected files with correct versions, helping restore normal Windows operation after an infection has been contained.

SFC is a repair utility, not a malware scanner. It will not remove a trojan, decrypt ransomware-locked documents, or undo every registry change. A thorough cleanup should come first, using Microsoft Defender or a reputable security product and, when necessary, a trusted malware removal guide for the specific threat.

This process is relevant to Australian users running Windows on home computers, gaming PCs, and laptops purchased through retailers such as JB Hi-Fi or Officeworks. Before repairing a device used for online banking in Sydney, Melbourne, Brisbane, or elsewhere, disconnect it from suspicious network activity and protect important files stored locally or through an NBN-connected home network.

Why Malware Can Damage Windows Files

Windows relies on protected files and services for sign-in, networking, updates, printing, and security. A malicious programme may modify these components to launch at startup, weaken Microsoft Defender, block updates, or prevent diagnostic tools from running. Sudden crashes, missing Windows features, and repeated error messages can follow.

Adware and browser hijackers may cause less obvious damage. They can alter proxy settings, browser policies, scheduled tasks, and security-related files. If unwanted advertising or redirects remain after a scan, consult specialist information about adware threats before assuming that SFC alone has solved the problem.

Prepare Windows Before Scanning

SFC needs administrator access and may require Windows installation files or the component store to be healthy. Save open work, connect the computer to reliable power, and create a backup of documents, photographs, password exports, and business files. Do not back up executable files or unknown scripts from an infected system without checking them first.

Use these preparation steps:

• Update Microsoft Defender and run an offline or full scan.
• Disconnect suspicious USB drives and unnecessary peripherals.
• Record important error messages and recently installed applications.
• Keep the Windows account password available for elevation prompts.

If ransomware may have encrypted files, avoid repeatedly opening affected documents or running random “repair” utilities. Preserve copies of encrypted data and investigate recovery options separately. SFC repairs Windows components; it does not decrypt personal files.

Run System File Checker From An Elevated Console

Open the Start menu, type Command Prompt, right-click it, and select Run as administrator. Windows Terminal or PowerShell can also be opened with administrator privileges. In the elevated window, enter:

sfc /scannow

Press Enter and allow the verification to reach 100 percent. The scan can take several minutes, particularly on older hard drives or systems with extensive corruption. Do not shut down the computer while it is processing. If a laptop is being repaired at an airport, library, or café, use a stable power source and avoid an unreliable public Wi-Fi connection.

SFC may report that it found no integrity violations, repaired corrupted files, or found files it could not repair. A successful message means protected system files were restored, not that the computer is free from malware. Restart Windows, then check whether the original symptoms remain.

Utility	Main purpose	Suitable use
SFC	Replaces corrupted protected Windows files	Missing components, crashes, damaged system files
DISM	Repairs the Windows component store used by SFC	SFC cannot repair some files
Microsoft Defender	Detects and removes malicious software	Active malware or suspicious behaviour
System Restore	Reverts system settings and files to an earlier point	Recent software or configuration damage

Repair The Component Store With DISM

When SFC cannot repair all files, open an administrator Command Prompt and run:

DISM /Online /Cleanup-Image /RestoreHealth

DISM may download clean components through Windows Update, so a trusted internet connection is usually needed. Allow the operation to finish, then run sfc /scannow again. This order matters because SFC may depend on files stored in the Windows component store.

If DISM fails, note the error code rather than repeatedly launching the command. A damaged update cache, insufficient disk space, interrupted servicing operation, or continuing malware can cause failure. On a work computer, preserve the result for the organisation’s IT team, particularly where Australian Privacy Act obligations or a Notifiable Data Breaches assessment may apply.

Read The Scan Result And CBS Log

SFC records detailed information in the Component-Based Servicing log, usually found at:

C:\Windows\Logs\CBS\CBS.log

The file can be large. To extract SFC-related entries to the desktop, run this command in an administrator console:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\sfc-details.txt"

Review the resulting text file for repeated paths, file names, and repair failures. Do not delete CBS.log merely because it is large; it can help identify recurring corruption. If the same files fail after DISM and a restart, consider Windows Update repair, an in-place repair installation, or professional technical support.

Know When A Clean Installation Is Safer

SFC is most useful after malware has been removed and the operating system remains fundamentally trustworthy. If security software is disabled, unknown administrator accounts appear, browser traffic is redirected, or the machine reconnects to a malicious server, prioritise containment and credential changes from a separate clean device.

Further action may be necessary when:

• Ransomware has encrypted personal or shared business files.
• Malware returns after every restart or scan.
• Windows cannot boot normally or enter Safe Mode.
• DISM and SFC both fail on critical components.

A compromised computer used for Australian tax, banking, health, or workplace accounts deserves extra caution. Change passwords only after the device is clean, enable multifactor authentication, and contact the relevant bank or organisation if suspicious transactions or data exposure are possible. The Australian Cyber Security Centre also provides current public guidance for reporting and responding to cyber incidents.

Reduce The Risk Of Repeat Corruption

After repairs, install pending Windows and browser updates, remove untrusted applications, and review startup entries and scheduled tasks. Use a standard user account for everyday activity where practical. Regular backups should include an offline or versioned copy, so malware cannot silently encrypt every available backup.

Good maintenance habits include:

• Keep Microsoft Defender real-time protection enabled.
• Download software from official publishers and verified app stores.
• Treat unexpected NBN, parcel, tax, and banking messages as possible scams.
• Test backups by restoring a small sample of files.

Australian households often manage banking, government services, and work accounts from the same home laptop. Separating work and personal profiles, using a password manager, and avoiding pirated software reduces the chance that a repaired Windows file becomes the first sign of another compromise. SFC is a useful recovery step, but lasting protection depends on removing the infection and correcting the behaviour that allowed it in.