Delayed Write probs etc. in XP Pro - sp3

Hi Folks,

I am extremely pleased with the help I got at the Malware forum, thank you very much LDTate

He suggested I ask here for some additional help with the following issues…

A link to one of my posts in the original thread in the Malware forum:
http://forums.whatthetech.com/I_think_I_m_…st&p=558452

Could you please help with:

1 - A way of forcing XP Pro - sp3 to stop using write caching on one of my external hard disks (a Maxtor 80 Gb IEEE 1394 - "Firewire" drive) (I keep getting occasional Windows error messages: "Delayed write failed… the I:\$Mft file could not be saved…" or something along those lines… I have set "Control Panel - System - Hardware - Device Manager - Policies" to "Optimize for quick removal" on both of my external IEEE 1394 drives, which supposedly disables write caching… NOT!!!

It doesn't happen that often but when it does the contents of the drive "disappears" to "explorer" and "my computer" and often crashes these services or any software trying to acces files on it. Once it led to a severe loss of data. I bought "Active File Recovery" which brought most of the lost 75 Gb of data back.
Lately, I have been trying to scan all my drives with Kaspersky AV 2009 (downloaded a trial version which has helped weed out some well hidden old infected files). EVERY TIME I try using it on the Maxtor drive this error causes the drive to stop working normally and the scan to need a longwinded abort… So far the drive has come back as normal after a re-boot when this happens.
When doing this Kaspersky scan I disable any other active AV services from my current (recently added) VIPRE AV software and any other anti virus/spyware utilities. The only thing actively running would be the COMODO Firewall.


2 - Some help in finding and installing the "Windows Recovery Console" since "ComboFix" was unable to properly download and install it when it was doing it's thing during my "disinfection".

3 - Any idea why the "Business Contact Manager" add-on to Outlook 2003 was broken by the various removal proceedures? I believe it happened during one of the ComboFix runs but I can't be certain. The end result was that Outlook came up with a couple of error messages during and after start up and it also became very sluggish particularly during starting up.
The errors were relating to "not able to connect to database engine…" and "unable to access data…" or something along those lines.

Today I decided to give up fighting this problem after having found the original Office 2003 Pro CDs including the Business Contact Manager CD… I tried to use the "Help - Detect & Repair" inside Outlook as well as the change options within the "Add/Remove" app. with no luck. In the end I just Removed the Business Contact Manager… Outlook is now a whole lot faster and working properly again I still would love to know what happened…?

Do you think I need to go through every piece of software I have installed on the PC (quite a lot…) to see that it all runs properly before I decide to delete my latest backup and replace it with my current CLEANED state of affairs…?

Any other advice?

Many thanks in advance for your help

Cheers,

Flinky

hey flinky, I can help with the first part I believe.

1 - A way of forcing XP Pro - sp3 to stop using write caching on one of my external hard disks (a Maxtor 80 Gb IEEE 1394 - "Firewire" drive) (I keep getting occasional Windows error messages: "Delayed write failed… the I:\$Mft file could not be saved…" or something along those lines… I have set "Control Panel - System - Hardware - Device Manager - Policies" to "Optimize for quick removal" on both of my external IEEE 1394 drives, which supposedly disables write caching… NOT!!!

well that is the way, however, for 'removeable drives' and media, that is also the default setting. I Note also that you say "one of my external hard disks" If you do have more than one, and it's behavior is normal, then you pretty-much eliminate the PC or OS as the source of the problem. Unfortunately MS error messages CAN be misleading. The file referenced is the backup Master File Table ($MFT). Changes made to it and the MFT do not take place when a file is altered, but after.

It is possible that one of the sectors that the $MFT occupies, may in fact be bad. Have you tried running CHKDSK on it ? goto Start—accessories—-command prompt and type:

CD /
CHKDSK I: /X /R

[ Note that I used I: because in your example it was using I:, if that drive letter changes, you need to use the Letter assigned at that time.]

It also could be a heat problem, if you notice that it is hot when it happens. A very short power interruption can also cause that.

Tallon41

Hi Tallon41, Thanks for your suggestions I had run Chkdsk with the /F option and nothing came up so I figured it was ok. I did find some various discussions regarding the problems with turning off caching properly so I figured this was what was happening to me as well, particularly with the error messages mentioning delayed write etc. However, since the problems have only occured when as far as I can tell… only read operations should be going on, NOT write… I'm even more confused about it. The deep scan from Kaspersky has been the culprit when this has happened. When the drive disappeared a while back I also got these messages. I believe this was happening as part of me trying to safely turn off the two external drives ending up freezing the system with a hard re-boot needed… After re-booting the drive was gone until I got my hands on "Active FileRecovery". Now, when I come to think of it, I had to abort the scan of my larger 320 Gb Lacie firewire drive a couple of times as well (but no error messages from Windows just a semi frozen Kaspersky for a very long time - I decided to wait, just in case). In any case, what you suggested, running chkdsk with /X /R resulted in a stoppage at 10% of the File verification (stage 4) tried it a couple of times with the same result… So I guess there must indeed be some bad sectors there or something along those lines but the drive works fine apart from this issue (when trying to scan it… or now run an indepth chkdsk…). I had thought that after the serious data loss I experienced recently (with the drive in question "disappearing"), following what I believe may have been a malware induced slow down etc. of the PC. when I had recovered most of the data and done an NTFS re-format (using the slower option), that any bad sectors would have been marked as unusable… and avoided when I then copied all the recovered data back. So now what, chkdsk can't fix or even diagnose the problem… any other ideas on a utility that could do the trick and mark the sectors as unavailable. I don't mind if I have to copy all the data off the drive again and do a low level format or whatever. Any ideas would be welcome… I would also still like to find out about how to get my hands on and install the "Windows Recovery Console" if anyone else could give me a hand with this please. Cheers, Flinky

Hi Flinky. I'm going back to your first question,
1 - A way of forcing XP Pro - sp3 to stop using write caching on one of my external hard disks. See here:

http://certcities.com/editorial/columns/st…ditorialsID=228

Looks like it can be done on a per disk basis.

Also, on the lacie site: http://www.lacie.com/support/ if you enter the SN of the drive, you may be able to download a diagnostic that you can run to test the drive to see if it has any detectable problems.

Hi Ztruker As I mentioned in my first post the write caching was disabled that way (as your link mentions) all along. (Link for my Lacie drive): For some reason my serial number comes up as not found but looking at the drive type I found an update that I will check out later - thanks for that Cheers, Flinky

Did you actually check the drive to see if Write Caching was disabled or not? The article I pointed you to says this:

To disable write caching, follow this procedure:

* Start Windows Explorer
* Right-click your Local Disk and select Properties
* Click on the Hardware tab
* Select your hard drive and click on Properties
* Click the Policies tab
* Uncheck the box "Enable write caching on the disk"

Hello again Ztruker, Yes, of course… otherwise I wouldn't have mentioned it in the first place but thanks As mentioned in my post regarding the chckdsk failure… I'm now trying to find some utility that will help bypass (or rather mark as bad…) the bad sectors that seem to be causing the occasional problems. I have since also got rid of the Kaspersky AV trial which was causing this problem every time it was run on this drive so I don't expect to encounter it again in a hurry… I would however like to try to make sure the drive is working as well as possible for normal (occasional use). Any ideas on that? Best regards, Flinky

Hi Flinky. Check out the drive manufacturers web site. Almost all of them have a utility you can download and use to test/repair one of their drives. It's normally available as a .iso file so you download it, creaate a CD from it then boot the CD to run the test.