Welcome Guest.   Make a donation to an author on the site August 22, 2014, 12:44:33 PM  *

Please login or register.
Or did you miss your validation email?


Login with username and password (forgot your password?)
Why not become a lifetime supporting member of the site with a one-time donation of any amount? Your donation entitles you to a ton of additional benefits, including access to exclusive discounts and downloads, the ability to enter monthly free software drawings, and a single non-expiring license key for all of our programs.


You must sign up here before you can post and access some areas of the site. Registration is totally free and confidential.
 
Your Support Funds this Site: View the Supporter Yearbook.
   
   Forum Home   Thread Marks Chat! Downloads Search Login Register  
Pages: [1] 2 Next   Go Down
  Reply  |  New Topic  |  Print  
Author Topic: Nasty NTFS issue ? [Solved !]  (Read 4891 times)
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« on: January 13, 2012, 10:04:26 AM »

Hi,

I am having a nasty issue on my OS drive (C:, XP Pro).  I realized a month ago that even if chkdsk (in read mode) is not finding any serious issue, at boot time, it renders my XP unstable.  The issue seems present for quite some time, because it is present "within" all recent image backups I made with different tools (AIP Free, drive snapshot, R-Drive, etc.). And older backups cannot be restored because some important changes have been made since them I cannot lose.

I have tried the following (among many other experiments) : clone my OS partition to an external drive using a regular cloning tool (HDCLone), perform a chkdsk /f on the destination, then clone back the partition.  At first boot all was fine, then I asked for a chkdsk at boot time, and my OS was "cooked" again.  The drive is surface error-free AFAIK (HDCLone would probably have reported any wrong sector).

Currently, all is working fine, unless a chkdsk is launched at boot time.

Any hint on how to solve this.  I am considering cloning in file mode, if I can manage that, because I suspect the NTFS metadata are somehow damaged.

Any help appreciated !  Thanks.

« Last Edit: January 17, 2012, 06:57:45 AM by MerleOne » Logged

.merle1.
eleman
Supporting Member
**
Posts: 267

see users location on a map View Profile Give some DonationCredits to this forum member
« Reply #1 on: January 13, 2012, 10:06:42 AM »

Try changing the sata port and the sata cable.

This is the easiest and cheapest step of diagnostics for your problem.
Logged
worstje
Honorary Member
**
Posts: 555



The Gent with the White Hat

View Profile Give some DonationCredits to this forum member
« Reply #2 on: January 13, 2012, 10:08:28 AM »

Other than 'at boot time, it renders my XP unstable', you don't explain anything about your problem, so how are we supposed to know how to help you? Please supply some extra information. smiley

Does 'unstable' mean 'crashes'? Does it mean 'hangs for ages'? What sort of success rate? How about safe mode? Are all your drivers upgraded? Have you tried a tool, like for example HDtune? Etc.
Logged
Innuendo
Charter Member
***
Posts: 1,913

View Profile Give some DonationCredits to this forum member
« Reply #3 on: January 13, 2012, 03:56:13 PM »

Define 'unstable', please. You might have something as simple as a misbehaving driver or corrupt OS file somewhere.
Logged
hpearce
Charter Member
***
Posts: 132

see users location on a map View Profile Give some DonationCredits to this forum member
« Reply #4 on: January 13, 2012, 04:56:32 PM »

does the chkdsk at boot seem to do anything .... usually it write some messages to the screen while running.

Perhaps a windows repair from CD might correct whatever chkdsk changed.
Logged

Windows 7 SP1 (TM) Home Premium 64-bit .. Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26 GHz / 2.27 GHz .. 4GB RAM .. NVIDIA GeForce 9800M GTS .. Gateway P-7805u FX
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #5 on: January 13, 2012, 05:21:15 PM »

Thanks all for your messages.  Here are, in a rather random order, some answers.  I didn't want to give all the fine details because I feared it would have been to long a message to read...

- Sata Port/Cable : it's a portable PC, Dell E6400, so I don't think there is any choice here. Besides, the system works fine before the chkdsk (see below), I guess it's not H/W related.
- Unstable : yes sorry, it means here I get a wealth of various error messages, that I never get otherwise, plus Office 2007 won't launch (Word, Excel) any longer and Windows shuts itself down after a last "serious" error message.  So totally unusable, and unstable...
- The chkdsk at boot *doesn't* display any error message.  I might have more details in the system log (winlogon entry) but since Windows has gone unstable, I cannot access it...  I think I tried also by booting from a WinPE CD, performed the chkdsk with /f /v options, there was a few minor errors, as usual, except one is serious.

The strange thing is that before the chkdsk in invoked, my system is rock solid, never a BSOD or any crash, hang, freeze.

I will try next week a clone in file mode with Casper, my last option today.
Logged

.merle1.
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #6 on: January 13, 2012, 05:25:12 PM »

does the chkdsk at boot seem to do anything .... usually it write some messages to the screen while running.

Perhaps a windows repair from CD might correct whatever chkdsk changed.

Maybe, but it would require a XP Pro install CD, which I don't have (maybe the IT guys at work have one...).  It's my office PC and these IT guys there only propose to reformat it and re-install a fresh system.  This should work but I would lose 2 years of configurations of all the software I have added since I got it.
Logged

.merle1.
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #7 on: January 13, 2012, 05:29:56 PM »

Other than 'at boot time, it renders my XP unstable', you don't explain anything about your problem, so how are we supposed to know how to help you? Please supply some extra information. smiley

Does 'unstable' mean 'crashes'? Does it mean 'hangs for ages'? What sort of success rate? How about safe mode? Are all your drivers upgraded? Have you tried a tool, like for example HDtune? Etc.

I checked surface defects with HDD Regenerator : none found.  Didn't try safe mode, maybe because I considered that after the chkdsk, the system was anyway badly damaged so working in safe mode would not help repairing it (maybe I am wrong here).
Logged

.merle1.
4wd
Supporting Member
**
Posts: 3,287



see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #8 on: January 13, 2012, 06:27:13 PM »

This should work but I would lose 2 years of configurations of all the software I have added since I got it.

That shouldn't happen, about the only software I've had affected by a Repair install is Windows itself, (all updates are lost), possibly virtual network drivers will no longer work, (eg. OpenVPN), and AV software will no longer work.  Any time I've done it all my other software has kept working fine unless it specifically relied upon an update later than the install disc.

But I always do a full disk image before attempting the Repair install.

Quote
I checked surface defects with HDD Regenerator : none found.  Didn't try safe mode, maybe because I considered that after the chkdsk, the system was anyway badly damaged so working in safe mode would not help repairing it (maybe I am wrong here).

Safe mode will help rule out any driver/program conflict problems.
Logged

Four wheel drive: Helping you get stuck faster, harder, further from help...........and it's no different on this forum Evil
Stoic Joker
Honorary Member
**
Posts: 5,194



View Profile WWW Give some DonationCredits to this forum member
« Reply #9 on: January 13, 2012, 06:35:08 PM »

Considering the possibility that you could have a sector that is iffy, but not bad enough to send up a flag. Have you tried running chkdsk with the /R  switch?

Sometimes when multiple unrelated applications fail it's because the one thing they do share is a bad spot on the drive.

Just a Thought,

Stoic Joker
Logged
yksyks
Supporting Member
**
Posts: 461


see users location on a map View Profile Give some DonationCredits to this forum member
« Reply #10 on: January 14, 2012, 12:56:17 AM »

Recently I stumbled upon a couple of discussions about similar strange problems, and they suggested to perform thorough tests on rootkits. Also fixing MBR might help.

An easy step could be reinstalling the MS Office. If it keeps crashing then some rootkit or serious system damage is likely the cause.
Logged
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #11 on: January 14, 2012, 05:33:35 AM »


That shouldn't happen, about the only software I've had affected by a Repair install is Windows itself, (all updates are lost), possibly virtual network drivers will no longer work, (eg. OpenVPN), and AV software will no longer work.  Any time I've done it all my other software has kept working fine unless it specifically relied upon an update later than the install disc.

But I always do a full disk image before attempting the Repair install.

Safe mode will help rule out any driver/program conflict problems.

Thanks, I can always try that with a good image backup dine before.
Logged

.merle1.
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #12 on: January 14, 2012, 05:37:27 AM »

Considering the possibility that you could have a sector that is iffy, but not bad enough to send up a flag. Have you tried running chkdsk with the /R  switch?

Sometimes when multiple unrelated applications fail it's because the one thing they do share is a bad spot on the drive.

Just a Thought,

Stoic Joker

Yes, it is something to consider.  But HDD Regen found no bad sector.  Slow sectors were not monitored because I was using it within Windows.  I can always try to boot from the recovery media, there I will see if there are some "half-bad" sectors.  Thanks for the suggestion.
Logged

.merle1.
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #13 on: January 14, 2012, 05:48:01 AM »

Recently I stumbled upon a couple of discussions about similar strange problems, and they suggested to perform thorough tests on rootkits. Also fixing MBR might help.

An easy step could be reinstalling the MS Office. If it keeps crashing then some rootkit or serious system damage is likely the cause.

Thanks.  Any tool recommended for checking rootkits (this PC already runs McAfee Corporate V8, with some strict policies) ?  I already tried Hitman Pro (before chkdsk, while the system was ok).
Logged

.merle1.
Shades
Member
**
Posts: 1,631


see users location on a map View Profile Give some DonationCredits to this forum member
« Reply #14 on: January 14, 2012, 05:53:55 AM »

Get MHDD, burn it to CD/DVD and boot from it. After boot, select the correct hard disk, hit F4 a few times to start a very thorough check on the state of the selected disc.

It is not a nice tool to look at (DOS look) and the information shown might even be too daunting, but it is very powerful. Depending on the size it can take its time, but you will have a very clear picture on the state of the HD (amount of good sectors, amount of slow sectors, amount of too slow sectors and (types of) error(s)).

The software offers options to fix slow sectors and remap bad ones (but not both at the same time). And these options will destroy all content that is on the disk, so make a backup of the complete system first, if you are inclined to use these options.

Logged
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #15 on: January 14, 2012, 06:13:41 AM »

@Shades : thanks ! 

Still, what troubles me is why this defect would be revealed by a chkdsk@boottime. 
Logged

.merle1.
Shades
Member
**
Posts: 1,631


see users location on a map View Profile Give some DonationCredits to this forum member
« Reply #16 on: January 14, 2012, 11:25:26 AM »

Recently (after a power failure) I got a hard disk acting up. Not always, but after a random write action it would notify me that the SATA controller was acting up and preventing me from writing anything anymore while the complete system would grind to a halt (extremely slow).

So I use MHDD on the hard disk (2TB) I suspected to be the troublemaker and it found one error. After deducing that this error was located in one partition, I do not write to that particular partition anymore and the HD did not act up anymore.

As that partition contains data which I cannot move (with the current HD prices), I did the next best thing...splitting up that particular partition, so the part with the error is not accessible. Happy sailing ever since.

With the story above I just want to say that error messages and error causes are not always as closely related as you might expect. Re-attaching SATA cables (on both ends!) is the first thing I do when experiencing errors which could be (remotely) related to hard disk I/O. You would not believe how much computer problems are related to less than optimal connections.
Logged
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #17 on: January 14, 2012, 12:41:28 PM »

Thanks !  And BTW, try using HDD Regen demo version on this HDD.  If you know the approximate location, it will speed up the process.  AFAIK, the demo version allows the repair of one bad sector, then exits.  If there is just one it should be ok.  Beware that repair here means content destroyed, but no longer bothering the HDD controller.
Logged

.merle1.
4wd
Supporting Member
**
Posts: 3,287



see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #18 on: January 14, 2012, 09:18:42 PM »

Still, what troubles me is why this defect would be revealed by a chkdsk@boottime.  

Because at boot time there are files that aren't locked by the operating system and are therefore accessible for testing.  That's why it's always better to do an offline test and the main reason I always have some form of PE to boot from.
« Last Edit: January 14, 2012, 09:31:52 PM by 4wd » Logged

Four wheel drive: Helping you get stuck faster, harder, further from help...........and it's no different on this forum Evil
cmpm
Charter Member
***
Posts: 2,025

View Profile Give some DonationCredits to this forum member
« Reply #19 on: January 14, 2012, 09:53:25 PM »

You could try these tools.
Let them run overnight, they take a while.
The rootkit detector will find stuff that is supposed be there though.
You should be able to spot the trouble, if any.

http://www.sophos.com/en-...nti-rootkit/download.aspx

http://www.sophos.com/en-...emoval-tool/download.aspx

http://www.sophos.com/en-...emoval-tool/download.aspx

Twice I was able to fix 2 different problems with the rootkit detector.
Once there was some .contentIE5 that was messing up my browsing.
Removed all the .contentIE5 stuff.

Never a boot problem with chkdsk as you describe,
but Sophos is very thorough imo.

A reboot is required after removal of problems.
Logged
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #20 on: January 15, 2012, 05:02:19 AM »

Still, what troubles me is why this defect would be revealed by a chkdsk@boottime.  

Because at boot time there are files that aren't locked by the operating system and are therefore accessible for testing.  That's why it's always better to do an offline test and the main reason I always have some form of PE to boot from.

OK !  Thanks.  And also for the Rootkit detectors.
Logged

.merle1.
yksyks
Supporting Member
**
Posts: 461


see users location on a map View Profile Give some DonationCredits to this forum member
« Reply #21 on: January 15, 2012, 06:42:19 AM »

Regarding Sophos: They require to enter my phone number to download. This was enough for me to stop entering any more details. However, I've already entered my mail, and name on a previous page form, but that was not enough for them. I don't know why they need my phone number. Collecting data, perhaps? What else?

So, if you're sensitive about your private details, don't even start filling up the form.
Logged
cmpm
Charter Member
***
Posts: 2,025

View Profile Give some DonationCredits to this forum member
« Reply #22 on: January 15, 2012, 08:36:11 AM »

I don't know why they want so much info,
but all I get is their newsletters, which I could unsubscribe to.

Never any phone calls.
You could put an old disconnected number in I suppose.

Anyway, the info thing didn't bother me.
It may stop some from getting these tools.

There is supposed to be an updated rootkit detector coming out in February.

http://www.sophos.com/en-.../sophos-anti-rootkit.aspx
Logged
4wd
Supporting Member
**
Posts: 3,287



see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #23 on: January 15, 2012, 10:26:29 PM »

There's also the bootable MSSS, Microsoft Standalone System Sweeper, in both x86 and x64 flavours.

Quote
Thank you for contacting Microsoft Support. You have been directed here to download and install the beta version of Microsoft Standalone System Sweeper Beta, a recovery tool that can help you start an infected PC and perform an offline scan to help identify and remove rootkits and other advanced malware. In addition, Microsoft Standalone System Sweeper Beta can be used if you cannot install or start an antivirus solution on your PC, or if the installed solution can’t detect or remove malware on your PC.

It will output to Flash, CD/DVD or ISO.

You could put an old disconnected number in I suppose.

Fake Name Generator
« Last Edit: January 15, 2012, 10:34:23 PM by 4wd » Logged

Four wheel drive: Helping you get stuck faster, harder, further from help...........and it's no different on this forum Evil
MerleOne
Supporting Member
**
Posts: 885


4D thinking

see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #24 on: January 16, 2012, 12:56:03 AM »

Great, thanks !
Logged

.merle1.
Pages: [1] 2 Next   Go Up
  Reply  |  New Topic  |  Print  
 
Jump to:  
   Forum Home   Thread Marks Chat! Downloads Search Login Register  

DonationCoder.com | About Us
DonationCoder.com Forum | Powered by SMF
[ Page time: 0.041s | Server load: 0 ]