Normally, WFP protects certain files that are key to the operating system. The protection is to prevent deletion of system files, unauthorized updating, and file damage that may be caused by viruses. When an application attempts to replace a protected file, WFP either restores the original file from the cache directory and writes a warning to the Event Log and/or prompts the user to insert the OS CD for file recovery.
To troubleshoot, I'd start by checking the Event Logs immediately after such an event occurs, so you can get some idea of what application is attempting to overwrite or replace a key system file. And scanning for a virus might be a very good idea.