Having just worked for about two weeks getting some malware removed from my system, I am left with a problem that caused very slow exection of any type of file open actions. Clicking on "My Computer", each time it is executed, causes the "flashlight" to search and apparently build the file information for all the permanently mounted drives. Similar delays occurr when doing a file open or save from Word, Notepad, Notepad++, and assume others as well. The actions do perform and other that the time everything appears to work okay. In performing the research and cleanup for the DNS problem, it was tried to perform a check disk upon restart. This will not work for the "C" drive. The machine has two drives and it works fine for the "D" drive. This operation has been tried several time in normal mode, as well as being tried–set and restarted–in "Safe" mode. Same result in normal mode, informed that it cannot obtain exclusive control, next message is that Windows has finished checking drive and continues into normal operations. When tried under "Safe" mode, the disk check screen of pale blue never appeared.
The error messages from the disk tool were not all the same. I will try and include some screen captures.
It is normal for chkdsk to not be able to get exclusive access to the C: drive. The C: drive is your system drive and is always in use.
You must run the chkdsk c: /f command and answer [Y]es when prompted about scheduling a scan during the next restart. At that point, restart the computer and the chkdsk should perform its scan and boot into windows normally.
Hi Appleoddity:
I have done that and even after doing this "chkdsk" cannot gain access to the drive. It appears to have randon errors, found running "chkdsk" in read-only mode. Tried setting in Safe Mode and restarting into Safe Mode. No luck!!!
Appreciate other suggestions.
Regards,
jmc46
I guess I am confused to exactly what is happening here.
When you run chkdsk /f you will be told that chkdsk can't get exclusive access and be prompted to schedule a scan during the next restart. When you answer Yes, and reboot you should see the chkdsk scan running. Do you see this or not? I've never seen a message about exclusive access during the boot time scan, and technically can't figure out how that could be happening, so I'm expecting there is some lack of communication between us rather than what it seems like you are saying.
Thanks
You could also try booting the Recovery Console and running chkdsk from there.
You are going to have to get into BIOS Setup on your computer to set the CD/DVD drive as the first bootable device, so you can then boot your XP CD.
How you do this varies with each manufacturer. Normally you press F1, F2, F10 or Del when you see the manufacturers logo. Often there is a clue somewhere on the screen when you boot normally telling you what key to press. Some computers (most newer ones) have a key you can press (often F12) to bring up the Boot Menu from where you can select the CD/DVD drive to boot from.
If you don't have an XP CD, download and create a bootable CD from the .iso file XP Recovery Console
You don't burn the iso file itself to CD., you create a CD from the iso file using your CD burning software. There is a good freeware burner called ImgBurn which will
do this.
Boot the CD and at the first opportunity, enter R to start the Recovery Console.
Next, choose which XP installation you want to login to. Normally this will be 1.
Lastly you will be asked for the Administrator password. Just press the Enter key as the Administrator does not have a password (unless you gave it one, then you would enter it).
From the command prompt, enter: chkdsk c: /r
Allow it to complete undisturbed. It can take an hour or more depending on the size of the hard drive.
Remove the CD, type exit and the computer will reboot. Hopefully that will have fixed the problem (corrupted file system).
Hello:
Well no I do not think there is a communication gap. What I am telling you is that I am stumpted as you are as to why "chkdsk" does not execute.
I just ran the following three cases:
1) entered the following text or clicks; Start, Run, cmd, changed directory to root on C, entered chkdsk /f and rebooted. Upon reboot went directly to Windows without stopping for "chkdsk". Probably my fault as I did not "exit" out the cmd screen.
2) entered the following; Start, Run, cmd, changed to root, chkdsk /f /r /x, exit out of cmd, rebooted. Upon restart paused at PBR notice, also paused at operating system selection–Recovery or XP, then entered pale blue screen of disk check. Was informed that was checking file system on C, it is an NTFS system, Cannot open for direct access, Windows finished checking disk, and then closed out and continued into Windows within 15 - 20 seconds. Never received any Stage or Phase checking messages.
3) Starting in Windows, selected dirve C, Properties, Tools, check, and then checked the two boxes within that selection, enter. Was notified in this case as well as prior cases, that could perform at this time but would at next reboot. Rebooted again, and received the same results as in case number 2.
Also you should note that whenever select "My Computer", the flashlight comes up to search for the physically attached drives C and D. The other devices I have A, E, and F have nothing loaded. There are not thumb dirves of other sticks currently connected to the computer.
I am very confused and have found next to nothing matching my symptions in any of the forums. Any and all help will be appreciated.
Thanks,
jmc46
Folks:
Appreciate the input so far. However, I am stumpted! I read the feedback yesterday, and tried to follow the instructions to run "chkdsk" either from the CD or within the MS Recovery section of the operating system. Terrible news so far neither has been possible!
First, I tried to enter the MS Recovery system by selection "R" on restart and then the MS Recovery console. I tried twice and obtain the Blue Screen of Death(BSD) both times. On the Stop screen was shown the following: 0x0000007B (0xF78D2524 0xC00000034 0x00000000 0x00000000). This version of the Recovery console was installed when ComboFix was used to assist in the repair of the DNS issue just recently removed. Next, I tried to create a new backup boot disk via the All Programs, Accessories, System Tools, Backup. In this attempt received message informing me that "The files for the recovery diskette could not be created. The operation was aborted." Tried this several times, same outcome. Next, read options of creating via MS site as I have all the original disks in some secure location–THAT I CANNOT LOCATE! This option seemed quite involve and creating about 6 disks or so. I then removed the original install of the Recovery per instructions from the MS site. I than reran ComboFix and it claimed to reinstall this operating system. I tried to enter MS Recovery again and failed with same BSD and codes. Also, retried the backup diskette creation and failed with same message. I did examine the folder and the 2 files that were supposed to be created sir* etc. were not created.
Please advise as to what steps to undertake next. This is quite frustrating.
Regards,
jmc47
Follow the directions I provided, then boot the CD you create and run chkdsk from there as I described. Doing it that way gives you some isolation from the hard drive and has abetter chance of succeeding.
The problem with your 0x7B blue screen is most likely a SATA driver issue. You will be unable to access the drive via recovery console without loading the necessary SATA drivers. I'm not sure how this effects the recovery console installed by combofix. I've never really used that option as I always have a CD available to boot from. But, the 0x7B error is a typical missing SATA driver do to AHCI or RAID mode in your BIOS. Normally, when booting the XP CD you press F6 to load SATA drivers. I'm not sure how to do it with the rc.iso, or the installed recovery console.
I'm concerned about the underlying root cause of what is preventing a chkdsk even when it is scheduled during reboot. I have never seen this problem before. I suspect you have some low level disk driver interfering with the chkdsk. I'm going to read your malware removal thread for some direction and do some more research.
Good Evening All:
Thanks for all the advice so far. I truly appreciate the advice, direction, and education that you folks are providing as you direct me through these issues. I was working on my own after encountering all the problems trying to get "chkdsk" to execute. This led me down the direction of looking into other disk commands to ascertain what was going on with the disk system. This led to attempting to perform; Start, Run, cmd, okay, diskmgmt.exe, and hopefully obtain some info as to health of the disk system. However, this was not to be! This led to the logical disk manager to claim that it was unable to connect the remote computer because dmremote.exe is not in the Windows Firewall exception list. This seemed very strange to me, but as I had not clean up this in a long time, I reset the Windows Firewall back to default settings. This track of thinking was enabled with my reading of various articles that I was reading in the MS site forum / knowledge database areas. I felt that resetting the Firewall would be a minor incovenience, if it enable the operation to execute or anything to get better.
Surprise! This permitted the "chkdsk" to execute from the file option, tools with checking both boxes. This operation executed for about 2 hours. It went through all 5 stages. It found NO errors! This made me feel very good, the physical disk was good. Why and what association these actions had to each other, leave me quite confused! In many respectsfrom my point of thinking, this should not have fixed the problem(s).
I actually ran MS system defrag after the firsst success and then ran "chkdsk" a second time, again with NO errors.
Now, I need guidance from you folks as I still have problems. Although, these all came at the same time, I now can perform the 'chkdsk". The remaining problem(s) as I can determine is that for still for every file system operation, open, change directory, click on "My Computer", the file system search operation is performed. The flahlight is shinning for the "My Computer" execution, and for all other file action the response time is minutes. This is each and every operation. Second, the execution of the diskmgmt.exe attempts to bring up the disk console, but eventually this is stopped with the error message mentioned previously. My question is whether I need to let this thread close and then open a new one with a more descriptive subject line? Please advise as to the correct way to continue with obtaining assistance and proper use of the site. The saving of files and content seems to be fine as far as I can determine. This problem happens with Word, Notepad, and Notepad++ for sure.
Also, there maybe a malware component floating around this machine somewhere, as MS Security Essentials identified something, and I click to clean before thinking to capture the name of the offending file. Should this occur again, I will note it down first.
Awaiting your advise and instructions.
Regards,
jmc46
I'm glad to hear you were able to resolve one issue. As to how firewall settings effected a chkdsk during boot, I have no idea. I suspect that might not be the real cause of what is going on here, and it may just be a coincidence.
I tried to read your malware thread, but none of the posts would display on my computer. I will try again soon. There was something wrong with the site, or a compatibility issue at the time for me. I still think there may be a clue in that forum to look for.
Hi All:
Not a happy camper!!!
Just spent the last 10-20 minutes trying to assemble information as the outstanding issue with my computer and while trying to re-create the problems and just lost all the documentation. I don't know what happened or what key was "struck" that reset this screen to blank.
The current status is there are at least 3 remaining problems. The problems are:
1) The file system does not respond to normal activities. Opening 'My Computer" or any other file operation causes the 'Search' operation (Flashlight) to scan each time taking about 30 - 45 seconds. Prior to the DNS problem, this was instantaneous. Also, opening a file action from within an application takes the same amount of time. Neither of these extremely slow performance were present before.
2) Next, the component or the services section appear to be missing or not installed correctly. I had examples of trying to get Logical disk manager to execute and the error messages comes back stating this cannot occur as there is a "remote computer" connection not in the Windows Firewall exception list. There are many other examples that can be generated.
3) Next going from one windows page to another page via a xyz.php causes a web page fault. The claim was something was either not working or creating a malicious page. The most recent example include WebEx for participating in an online training session from TDAmeriTrade.
What can be do either to assist in repairing this system or if more diagnostics are needed what needs to run. More specific details can be generated again if needed.
I have run "sfc.exe /scannow" No messages as to files being restored, nor was any disk or CD's requested. No messages at all, ran for a while.
Please respond.
Regards,
jmc46
Hi Jmc. Would you please provide the results of a PCPitStop test.
Here's how:
How to run PCPitStop's Overdrive tests:
Please click here to go to the PCPitStop Overdrive sign-up page: Signup at PCPitStop (You need to use Internet Explorer with this test so that an ActiveX control can be installed.)
Click "Create a free account"
Enter in your relevant information on the sign-up page. You must sign-up in order to have your results recorded so that we can take a look at them here.
After signing up you'll see the "Registration Complete" page, and you can click "Test Your System Now" to return to the test page.
Login with your newly created e-mail address and password on the left hand side.
Follow the directions to "Scan this system now." An activeX control will need to be installed. It is safe, and you should allow it to be installed.
Once the tests have been run, you will see an "Almost there" page requesting further information about your computer and your experience with PCPitStop, just scroll down to the bottom and click "GO."
A test results page will display, and I need the link to that page.
Look in the address bar of your browser. It will look like 'http://www.pcpitstop.com/betapit/…' Please copy and paste that here to the forum.
Note: PCPitStop may recommend that you use certain utilities to fix problems on your computer. At WhatTheTech, the help we provide is free. We do not endorse or recommend the use of any products PCPitStop may suggest. Instead, we prefer to help you with each issue manually without using possible pay to use programs.
Just managed to finish running the Overdrive program. Initial problems were encountered with DEP stopping the execution, and also that Security on IE8 was set to Custom. I do not recall doing that setting, nor why I would want to. I moved it back to Medium High and then got to PitStop.
Thanks
