Nasty NTFS issue ? [Solved !]

[MerleOne]

Hi,

I am having a nasty issue on my OS drive (C:, XP Pro).  I realized a month ago that even if chkdsk (in read mode) is not finding any serious issue, at boot time, it renders my XP unstable.  The issue seems present for quite some time, because it is present "within" all recent image backups I made with different tools (AIP Free, drive snapshot, R-Drive, etc.). And older backups cannot be restored because some important changes have been made since them I cannot lose.

I have tried the following (among many other experiments) : clone my OS partition to an external drive using a regular cloning tool (HDCLone), perform a chkdsk /f on the destination, then clone back the partition.  At first boot all was fine, then I asked for a chkdsk at boot time, and my OS was "cooked" again.  The drive is surface error-free AFAIK (HDCLone would probably have reported any wrong sector).

Currently, all is working fine, unless a chkdsk is launched at boot time.

Any hint on how to solve this.  I am considering cloning in file mode, if I can manage that, because I suspect the NTFS metadata are somehow damaged.

Any help appreciated !  Thanks.

[eleman]

Try changing the sata port and the sata cable.

This is the easiest and cheapest step of diagnostics for your problem.

[worstje]

Other than 'at boot time, it renders my XP unstable', you don't explain anything about your problem, so how are we supposed to know how to help you? Please supply some extra information.

Does 'unstable' mean 'crashes'? Does it mean 'hangs for ages'? What sort of success rate? How about safe mode? Are all your drivers upgraded? Have you tried a tool, like for example HDtune? Etc.

[Innuendo]

Define 'unstable', please. You might have something as simple as a misbehaving driver or corrupt OS file somewhere.

[hpearce]

does the chkdsk at boot seem to do anything .... usually it write some messages to the screen while running.

Perhaps a windows repair from CD might correct whatever chkdsk changed.

[MerleOne]

Thanks all for your messages.  Here are, in a rather random order, some answers.  I didn't want to give all the fine details because I feared it would have been to long a message to read...

- Sata Port/Cable : it's a portable PC, Dell E6400, so I don't think there is any choice here. Besides, the system works fine before the chkdsk (see below), I guess it's not H/W related.
- Unstable : yes sorry, it means here I get a wealth of various error messages, that I never get otherwise, plus Office 2007 won't launch (Word, Excel) any longer and Windows shuts itself down after a last "serious" error message.  So totally unusable, and unstable...
- The chkdsk at boot *doesn't* display any error message.  I might have more details in the system log (winlogon entry) but since Windows has gone unstable, I cannot access it...  I think I tried also by booting from a WinPE CD, performed the chkdsk with /f /v options, there was a few minor errors, as usual, except one is serious.

The strange thing is that before the chkdsk in invoked, my system is rock solid, never a BSOD or any crash, hang, freeze.

I will try next week a clone in file mode with Casper, my last option today.

[MerleOne]

does the chkdsk at boot seem to do anything .... usually it write some messages to the screen while running.

Perhaps a windows repair from CD might correct whatever chkdsk changed.

Maybe, but it would require a XP Pro install CD, which I don't have (maybe the IT guys at work have one...).  It's my office PC and these IT guys there only propose to reformat it and re-install a fresh system.  This should work but I would lose 2 years of configurations of all the software I have added since I got it.

[MerleOne]

Other than 'at boot time, it renders my XP unstable', you don't explain anything about your problem, so how are we supposed to know how to help you? Please supply some extra information.

Does 'unstable' mean 'crashes'? Does it mean 'hangs for ages'? What sort of success rate? How about safe mode? Are all your drivers upgraded? Have you tried a tool, like for example HDtune? Etc.

I checked surface defects with HDD Regenerator : none found.  Didn't try safe mode, maybe because I considered that after the chkdsk, the system was anyway badly damaged so working in safe mode would not help repairing it (maybe I am wrong here).

[4wd]

This should work but I would lose 2 years of configurations of all the software I have added since I got it.

That shouldn't happen, about the only software I've had affected by a Repair install is Windows itself, (all updates are lost), possibly virtual network drivers will no longer work, (eg. OpenVPN), and AV software will no longer work.  Any time I've done it all my other software has kept working fine unless it specifically relied upon an update later than the install disc.

But I always do a full disk image before attempting the Repair install.

I checked surface defects with HDD Regenerator : none found.  Didn't try safe mode, maybe because I considered that after the chkdsk, the system was anyway badly damaged so working in safe mode would not help repairing it (maybe I am wrong here).

Safe mode will help rule out any driver/program conflict problems.

[Stoic Joker]

Considering the possibility that you could have a sector that is iffy, but not bad enough to send up a flag. Have you tried running chkdsk with the /R  switch?

Sometimes when multiple unrelated applications fail it's because the one thing they do share is a bad spot on the drive.

Just a Thought,

Stoic Joker

[yksyks]

Recently I stumbled upon a couple of discussions about similar strange problems, and they suggested to perform thorough tests on rootkits. Also fixing MBR might help.

An easy step could be reinstalling the MS Office. If it keeps crashing then some rootkit or serious system damage is likely the cause.

[MerleOne]

That shouldn't happen, about the only software I've had affected by a Repair install is Windows itself, (all updates are lost), possibly virtual network drivers will no longer work, (eg. OpenVPN), and AV software will no longer work.  Any time I've done it all my other software has kept working fine unless it specifically relied upon an update later than the install disc.

But I always do a full disk image before attempting the Repair install.

Safe mode will help rule out any driver/program conflict problems.

Thanks, I can always try that with a good image backup dine before.

[MerleOne]

Considering the possibility that you could have a sector that is iffy, but not bad enough to send up a flag. Have you tried running chkdsk with the /R  switch?

Sometimes when multiple unrelated applications fail it's because the one thing they do share is a bad spot on the drive.

Just a Thought,

Stoic Joker

Yes, it is something to consider.  But HDD Regen found no bad sector.  Slow sectors were not monitored because I was using it within Windows.  I can always try to boot from the recovery media, there I will see if there are some "half-bad" sectors.  Thanks for the suggestion.

[MerleOne]

Recently I stumbled upon a couple of discussions about similar strange problems, and they suggested to perform thorough tests on rootkits. Also fixing MBR might help.

An easy step could be reinstalling the MS Office. If it keeps crashing then some rootkit or serious system damage is likely the cause.

Thanks.  Any tool recommended for checking rootkits (this PC already runs McAfee Corporate V8, with some strict policies) ?  I already tried Hitman Pro (before chkdsk, while the system was ok).

[Shades]

Get MHDD, burn it to CD/DVD and boot from it. After boot, select the correct hard disk, hit F4 a few times to start a very thorough check on the state of the selected disc.

It is not a nice tool to look at (DOS look) and the information shown might even be too daunting, but it is very powerful. Depending on the size it can take its time, but you will have a very clear picture on the state of the HD (amount of good sectors, amount of slow sectors, amount of too slow sectors and (types of) error(s)).

The software offers options to fix slow sectors and remap bad ones (but not both at the same time). And these options will destroy all content that is on the disk, so make a backup of the complete system first, if you are inclined to use these options.

[MerleOne]

@Shades : thanks ! 

Still, what troubles me is why this defect would be revealed by a chkdsk@boottime. 

[Shades]

Recently (after a power failure) I got a hard disk acting up. Not always, but after a random write action it would notify me that the SATA controller was acting up and preventing me from writing anything anymore while the complete system would grind to a halt (extremely slow).

So I use MHDD on the hard disk (2TB) I suspected to be the troublemaker and it found one error. After deducing that this error was located in one partition, I do not write to that particular partition anymore and the HD did not act up anymore.

As that partition contains data which I cannot move (with the current HD prices), I did the next best thing...splitting up that particular partition, so the part with the error is not accessible. Happy sailing ever since.

With the story above I just want to say that error messages and error causes are not always as closely related as you might expect. Re-attaching SATA cables (on both ends!) is the first thing I do when experiencing errors which could be (remotely) related to hard disk I/O. You would not believe how much computer problems are related to less than optimal connections.

[MerleOne]

Thanks !  And BTW, try using HDD Regen demo version on this HDD.  If you know the approximate location, it will speed up the process.  AFAIK, the demo version allows the repair of one bad sector, then exits.  If there is just one it should be ok.  Beware that repair here means content destroyed, but no longer bothering the HDD controller.

[4wd]

Still, what troubles me is why this defect would be revealed by a chkdsk@boottime.  

Because at boot time there are files that aren't locked by the operating system and are therefore accessible for testing.  That's why it's always better to do an offline test and the main reason I always have some form of PE to boot from.

[cmpm]

You could try these tools.
Let them run overnight, they take a while.
The rootkit detector will find stuff that is supposed be there though.
You should be able to spot the trouble, if any.

http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit/download.aspx

http://www.sophos.com/en-us/products/free-tools/conficker-removal-tool/download.aspx

http://www.sophos.com/en-us/products/free-tools/aurora-malware-removal-tool/download.aspx

Twice I was able to fix 2 different problems with the rootkit detector.
Once there was some .contentIE5 that was messing up my browsing.
Removed all the .contentIE5 stuff.

Never a boot problem with chkdsk as you describe,
but Sophos is very thorough imo.

A reboot is required after removal of problems.

[MerleOne]

Still, what troubles me is why this defect would be revealed by a chkdsk@boottime.  

Because at boot time there are files that aren't locked by the operating system and are therefore accessible for testing.  That's why it's always better to do an offline test and the main reason I always have some form of PE to boot from.

OK !  Thanks.  And also for the Rootkit detectors.

[yksyks]

Regarding Sophos: They require to enter my phone number to download. This was enough for me to stop entering any more details. However, I've already entered my mail, and name on a previous page form, but that was not enough for them. I don't know why they need my phone number. Collecting data, perhaps? What else?

So, if you're sensitive about your private details, don't even start filling up the form.

[cmpm]

I don't know why they want so much info,
but all I get is their newsletters, which I could unsubscribe to.

Never any phone calls.
You could put an old disconnected number in I suppose.

Anyway, the info thing didn't bother me.
It may stop some from getting these tools.

There is supposed to be an updated rootkit detector coming out in February.

http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx

[4wd]

There's also the bootable MSSS, Microsoft Standalone System Sweeper, in both x86 and x64 flavours.

Thank you for contacting Microsoft Support. You have been directed here to download and install the beta version of Microsoft Standalone System Sweeper Beta, a recovery tool that can help you start an infected PC and perform an offline scan to help identify and remove rootkits and other advanced malware. In addition, Microsoft Standalone System Sweeper Beta can be used if you cannot install or start an antivirus solution on your PC, or if the installed solution can’t detect or remove malware on your PC.

It will output to Flash, CD/DVD or ISO.

You could put an old disconnected number in I suppose.

Fake Name Generator

[MerleOne]

Great, thanks !