Here is a simple "experiment" you can perform using the rundll32.exe file that may help you understand what sfc /scannow does and what it does not do:
Rename or just delete your c:\windows\system32\rundll32.exe file so it is "missing".
rename rundll32.exe ----> rundll32.xxx
If you have booted normally, almost before you can blink, the "missing" rundll32.exe file will be quickly and silently replaced with the copy from the dllcache folder. That is Windows File Protection in action and you will see something like this in the Event
Viewer System log:
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Description:
File replacement was attempted on the protected system file c:\windows\system32\rundll32.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.
Next, boot your system in Safe Mode or the Recovery Console so Windows File Protection is not running.
Again, rename or just delete your c:\windows\system32\rundll32.exe file so it is "missing".
Now your rundll32.exe file is really missing. If Windows File Protection was running, the "missing" file would be quickly and silently replaced (try renaming or deleting it in normal mode and it will be replaced).
That is a critical XP system file, right? It is on the list of 3498 file that Windows File Protection and the System File Checker knows about but now it is missing.
Now, with your system32/rundll32.exe file missing, boot in Normal mode and try to use something like control panel to open something like the Power Options and you will see this familiar message:
Control Panel
Windows cannot find 'C:\WINDOWS\system32\rundll32.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.
Now you have recreated a common problem with the missing file and seen the error with our own eyes. A Microsoft Support Engineer will usually suggest running sfc /scannow for this kind of problem, but it will not work or help and you can prove it to yourself.
With your still system booted normally, next, run sfc /scannow to completion.
Take a look and you will see that the system32\rundll32.exe file is still missing, right?
How can that be if sfc /scannow is supposed to replaces missing or corrupt system files?
Did running sfc /scannow replace the missing file? No it did not.
Now you know what sfc /scannow does not do. It does not replace missing or corrupt files from the system32 folders - you just proved it.
Why do you keep suggesting it? It is just another wild goose chase.
Now go to c:\windows\system32\dllcache and delete or rename the rundll32.exe file from there - and it will stay gone and not be replaced since Windows File Protection does not look after the contents of the dllcache folder.
Run sfc /scannow to completion again.
This time, the missing rundll32.exe file in the dllcache folder will be replaced since that is the folder sfc /scannow cares about but the file will still not be replaced in the system32 folder since that is not what sfc /scannow does.
Now you know what sfc /scannow doesn't do and what it does do.
Be sure to put your "missing" rundll32.exe file back by either renaming it or replacing it from the backup copy in the dllcache folder.