Slow computer and I/O Error Status

I have a computer that I built a few years back with top of the line components (at that time) and have developed some problems recently.  I went to the safer-networking forums and worked through all of their malware tools (with help from a volunteer) and have eliminated the possibility of a virus or malware infection and they recommended that I see if you all could help to pinpoint a software or hardware error.

 

This all began about a year ago after a windows update when my boot sequence got messed up.  I was getting GRUB loader errors on bootup that would go to a black screen and just sit there.  I finally figured out how to correct that in the BIOS, but am now experiencing odd crashes and slowness that I cant figure out.  I am not sure where to begin. 

 

I did run CCleaner and other programs that I fear could have messed things up a bit. Anyway, I read the post about new users and going to Pit Stop to scan the system to get information and have done that.  A link to my results is below:

 

http://pcpitstop.com/betapit/sec.asp?conid=25684731

 

Also, to give you some perspective on the work that I did with the safer networking crew, here is a link to that thread:

 

http://forums.spybot.info/showthread.php?71103-Slow-computer

 

I would very much appreciate any help you can give!

 

Tom

Forgot to mention the application error I received.  Attached is a photo of the error message.

Great job reading the introductory info for new users and following directions! 

 

Welcome to WhatTheTech.

 

I reviewed your PCPitStop scan and don't see anything to be concerned about.

 

You should probably thoroughly test your hard drives and system memory.  I see you have ImgBurn on your computer so I'm sure you are already familiar with burning a CD from an .ISO file.  I'd like you test your system memory by downloading MemTest86+ and burning a bootable CD.  Here's the download link for the .zip file that you can decompress and then burn the .ISO: http://www.memtest.org/download/5.01/memtest86+-5.01.iso.zip

 

Once you make the CD from the .ISO you will need to boot your computer from it.  The way of doing this varies from motherboard to motherboard but you can usually adjust your boot order in the BIOS settings to include the CD/DVD drive first, or you can press a certain function key during the initial startup of your system to choose a different boot device.  Once you boot the memory test you should let it run for several hours looking for any errors.  Even if the memory is not bad there can be bad connections that intermittently cause problems.  So, as an added measure, while the test is running you can remove the cover of your computer and gently tap the RAM modules with the plastic, handle side of a screwdriver.  Any crashes or errors indicate something going on with the memory.  If you experience trouble while tapping on the modules you can remove and reinsert them (with the power off, obviously) then re-test again.  You'll want to get through several hours of testing without any problems.

 

Next, you should check the health of your hard drive.  While in Windows you can click Start and type CMD and then right-click "Command Prompt" and choose "Run As Administrator."  Once you are at the command prompt, you can type CHKDSK C: /F and press ENTER.  You'll be prompted to schedule the scan after the next reboot and you can answer yes, and reboot your computer.  Let the scan finish, it will take a long time.  Look for any messages about bad clusters - this may indicate a failing hard drive.

 

After you have confirmed these items you can be fairly confident there aren't any hardware problems causing your trouble.  While you are inside your case just make sure everything is clean and fans are working properly.  I personally like to wiggle cables and expansion cards, and gently tap other components of the system while these tests are running to make sure there aren't bad connections or other strange behaviors.  Sometimes things just get bad connections over time and they just need to be cleaned up a bit and reseated.

I booted from the memtest CD last night and the program began testing.  It was still running this morning when I got up and did not see that there were any errors reported.  I don't think it created a log of any sorts.  I also just ran the chkdsk function, rebooted and it started and when I came back about 10 minutes later it must have completed because I was at the windows login again.  There were no messages from the scan though, so I am not sure what the results were.

 

I will check for loose cables and components next.  Also, I ran CCleaner and am worried that it deleted something in the registry that it should not have.  Is there a way to check for that and repair if need be?

I'm sorry.  In my rush I gave you the wrong command for CHKDSK.

 

Please use the command: CHKDSK C: /R

 

/F only fixes the file system.  /R will check the physical surface of the drive.

I have run this twice, but when I come back to check on it a couple hours later, it is at the windows login. After login, I don't see any report from the test. Shouldn't there be some results displayed?

Until appleoddity gets back to you here are the steps to both run chkdsk with the r switch and view the resulting log file:

You must run the command prompt as an administrator or in an "elevated mode".
at the Start menu, in the search bar type "cmd"
Right-click the cmd icon, select "run as administrator"
user account control (UAC)  may prompt you to accept that action, so do so
type in "chkdsk /r" (note the space twixt chkdsk and /
NOTE For these commands do not use the quotation marks


To view results log:

• Open the Start Menu, and type eventvwr.msc in the search box and press enter.
• If prompted by UAC, then click on Yes (Windows 7) or Continue (Vista).
• In the left pane of Event Viewer, double click on Windows Logs to expand it, then right click on Application and click on Find.
• Copy and paste Chkdsk into the line, and click on Find Next.
• You will now see the system log for the scan results of Check Disk (chkdsk).
• In the right had menu select copy, open notepad and paste the chkdsk results into notepad, save the file on your desktop
• Post it in your next reply. ( if you need assistance in interpreting it.)

 

Regards

paws


 

　

Found it.  Here are the logs:

 

From the first scan using /F instead of /R

 

　

Checking file system on C:

The type of the file system is NTFS.

　

A disk check has been scheduled.

Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)…

Cleaning up instance tags for file 0x28214.

263424 file records processed. File verification completed.

1093 large file records processed. 0 bad file records processed. 2 EA records processed. 76 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)…

330636 index entries processed. Index verification completed.

0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)…

263424 file SDs/SIDs processed. Cleaning up 292 unused index entries from index $SII of file 0x9.

Cleaning up 292 unused index entries from index $SDH of file 0x9.

Cleaning up 292 unused security descriptors.

Security descriptor verification completed.

33607 data files processed. CHKDSK is verifying Usn Journal…

34995592 USN bytes processed. Usn Journal verification completed.

Windows has made corrections to the file system.

976657407 KB total disk space.

267907876 KB in 198040 files.

116064 KB in 33608 indexes.

0 KB in bad sectors.

395923 KB in use by the system.

65536 KB occupied by the log file.

708237544 KB available on disk.

4096 bytes in each allocation unit.

244164351 total allocation units on disk.

177059386 allocation units available on disk.

Internal Info:

00 05 04 00 eb 88 03 00 2b 9a 06 00 00 00 00 00 ……..+…….

1e 02 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ….L………..

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….

Windows has finished checking your disk.

Please wait while your computer restarts.

 

Using the /R chkdsk:

 

Checking file system on C:

The type of the file system is NTFS.

A disk check has been scheduled.

Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)…

263424 file records processed. File verification completed.

1091 large file records processed. 0 bad file records processed. 2 EA records processed. 76 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)…

330654 index entries processed. Index verification completed.

0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)…

263424 file SDs/SIDs processed. Cleaning up 8 unused index entries from index $SII of file 0x9.

Cleaning up 8 unused index entries from index $SDH of file 0x9.

Cleaning up 8 unused security descriptors.

Security descriptor verification completed.

33616 data files processed. CHKDSK is verifying Usn Journal…

35843800 USN bytes processed. Usn Journal verification completed.

CHKDSK is verifying file data (stage 4 of 5)…

Read failure with status 0xc00000b5 at offset 0xa764b0000 for 0x10000 bytes.

Read failure with status 0xc00000b5 at offset 0xa764bf000 for 0x1000 bytes.

Windows replaced bad clusters in file 1995

of name \PROGRA~3\CARBON~1\CARBON~2\.working\{7E3F9~1.

Read failure with status 0xc00000b5 at offset 0x304373c000 for 0x10000 bytes.

Read failure with status 0xc00000b5 at offset 0x304373c000 for 0x1000 bytes.

Windows replaced bad clusters in file 181558

of name \Windows\System32\config\SOFTWARE.

263408 files processed. File data verification completed.

CHKDSK is verifying free space (stage 5 of 5)…

177063270 free clusters processed. Free space verification is complete.

Adding 2 bad clusters to the Bad Clusters File.

CHKDSK discovered free space marked as allocated in the

master file table (MFT) bitmap.

Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.

976657407 KB total disk space.

267891416 KB in 197963 files.

116080 KB in 33617 indexes.

8 KB in bad sectors.

396823 KB in use by the system.

65536 KB occupied by the log file.

708253080 KB available on disk.

4096 bytes in each allocation unit.

244164351 total allocation units on disk.

177063270 allocation units available on disk.

Internal Info:

00 05 04 00 a7 88 03 00 82 99 06 00 00 00 00 00 …………….

1e 02 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ….L………..

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….

Windows has finished checking your disk.

Please wait while your computer restarts.

 

　

Ran the /R a second time because I didn't see results from the first one…

 

Checking file system on C:

The type of the file system is NTFS.

A disk check has been scheduled.

Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)…

263424 file records processed. File verification completed.

1057 large file records processed. 0 bad file records processed. 2 EA records processed. 76 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)…

330658 index entries processed. Index verification completed.

0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)…

263424 file SDs/SIDs processed. Cleaning up 5 unused index entries from index $SII of file 0x9.

Cleaning up 5 unused index entries from index $SDH of file 0x9.

Cleaning up 5 unused security descriptors.

Security descriptor verification completed.

33618 data files processed. CHKDSK is verifying Usn Journal…

37128224 USN bytes processed. Usn Journal verification completed.

CHKDSK is verifying file data (stage 4 of 5)…

263408 files processed. File data verification completed.

CHKDSK is verifying free space (stage 5 of 5)…

177046382 free clusters processed. Free space verification is complete.

Windows has checked the file system and found no problems.

976657407 KB total disk space.

267957748 KB in 198052 files.

116084 KB in 33619 indexes.

8 KB in bad sectors.

398039 KB in use by the system.

65536 KB occupied by the log file.

708185528 KB available on disk.

4096 bytes in each allocation unit.

244164351 total allocation units on disk.

177046382 allocation units available on disk.

Internal Info:

00 05 04 00 02 89 03 00 38 9a 06 00 00 00 00 00 ……..8…….

1e 02 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ….L………..

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 …………….

Windows has finished checking your disk.

Please wait while your computer restarts.

I will say that this seems to have sped my system up a bit.  We'll see how it performs, but it looks like the scans did correct some things on the disk.  I have several other drives that I use for storage of pictures and videos.  Should I run on them as well?

One other error I am getting is shown below:

 

I get this error when ever I right click on a drive folder under my computer.  It doesn't happen on any other folders; just on the root drive letters.

 

Thank you Paws!!!

 

Well the logs definitely look promising, but I have good news and I have bad news.  Probably more bad news than good.

 

Here is the important part of those logs:

 

Read failure with status 0xc00000b5 at offset 0xa764b0000 for 0x10000 bytes.

Read failure with status 0xc00000b5 at offset 0xa764bf000 for 0x1000 bytes.

Windows replaced bad clusters in file 1995

of name \PROGRA~3\CARBON~1\CARBON~2\.working\{7E3F9~1.

Read failure with status 0xc00000b5 at offset 0x304373c000 for 0x10000 bytes.

Read failure with status 0xc00000b5 at offset 0x304373c000 for 0x1000 bytes.

Windows replaced bad clusters in file 181558

of name \Windows\System32\config\SOFTWARE.

 

The above indicates that Windows found at least 2 physical defects on your primary hard drive and "locked" them out from further use.  The second scan you ran indicated no further defects.  This is good.  A limited amount of physical damage like this is not likely to indicate any significant issue with the hard drive.  However, you should run the CHKDSK /R command and look for the above messages in the future.  I would suggest in another week or so and then maybe after a month.  If still no further defects, then check it again quarterly or so.  Keep an eye on it, because it can indicate the hard drive is starting to fail.  That's the good news.

 

The bad news is, at least one of those defects was in layman's terms, the worst possible place it could be.  Smack dab in the middle of your registry!  This means that your registry is now corrupt in some way, but where and how is impossible to know.  However, it will likely cause you problems.  The other problem was found within your carbonite software and that concerns me because if that isn't working properly then you may also not have a good backup.  So, you'll want to login to Carbonite and go through your data and make sure it looks current and that it is backing up properly.  I would go ahead and make a second backup of any important data on your primary hard drive and place it on one of your other hard drives.

 

So, now we are left with some fairly insignificant physical defects in the hard drive but in an area that causes significant trouble in probably the most important file on your computer.  What do we do?  Well, honestly, if it was me I'd backup data, wipe the hard drive, and reload the operating system so that I know everything is going to work OK.  That's pretty extreme and takes some pretty good skill to do properly.  You could also just see how the computer works and live with any minor problems or possibly try reinstalling any software that doesn't work properly.  Finally, you might also try doing a system restore back to a time when the registry was not effected by these physical defects.  But, in order for this to be successful, you would have to have a clear idea of when the problems started and have recovery points prior to that date.  The problem is compounded if you have installed software since that date.  Because of the nature of system restore, if you decide to roll back the system to a date far in the past, you'll want to go into control panel -> programs and features and sort your program listing by "Date Installed."  Find any programs installed after the date you intend to restore to, and uninstall them first.  Perform the restore, then reinstall the software you removed.  Obviously, this last option is the best if you haven't really made any significant changes to your computer for a long time and you have a clear idea of how far back you need to go.

 

System restore will restore the registry to a working non-corrupted version if a quality version exists at some date in the past.

 

In regards to scanning the other hard drives, yes, it is not a bad idea at all to do that.  It is not a bad idea to do this periodically anyways.  Except on solid state hard drives.   You would simply change the drive letter (C:) to whatever drive letter your other drive(s) use when typing the command.

Okay, lots to think about, but I am happy to finally understand what has been causing me problems for so long.  My only system restore point is from July 2013 so it may be from before the issue began, but I am not sure.  The main thing that I am concerned with are my family videos and pictures.  I have them backed up to Carbonite and to the external drives and I save them on Bluray so there are multiple redundancies.  It might be time for a fresh start any way.

 

Thank you so much for your help with this!!

 

Tom

Ok.  I want to add a couple more things for you I didn't think of in my last post.

 

It appears, but I may be wrong, that your C: drive is a Seagate Barracuda 1TB?  http://www.newegg.com/Product/Product.aspx?Item=N82E16822148840

 

If I am correct, please download and use SeaTools to run a full set of tests on your hard drive: http://www.seagate.com/support/downloads/seatools/

 

The problem with CHKDSK is that its very limited as to its bad sector analysis and handling.  To insure the problem is truly resolved and the drive is healthy I feel you need to run a more advanced tool like above.  It too will probably find a couple of bad sectors and lock them out, or it may indicate your drive is failing. You'll want to do this regardless of your next steps, especially if you intend to wipe and reload the OS. On a side note, in my experience Seagate makes horrible hard drives and you have a hard drive that is probably 10x more likely to fail than any other hard drive on the market.  And I'm seriously not exaggerating. So, be careful with that drive and keep your data backed up.  What used to be one of the best manufacturers in the industry is now the worst by many multiples. http://www.extremetech.com/extreme/175089-who-makes-the-most-reliable-hard-drives

 

In regards to your system restore points, it seems a bit out of the ordinary to have one recovery point that far in the past.  Windows periodically makes "checkpoints" and so you should have nearly daily restore points to choose from.  Are you sure we are talking about the same thing?  The system restore I am talking about is found by clicking Start then typing System Restore and pressing ENTER.  If you truly have some kind of backup or recovery from 2013 then this very well may solve your issue. But, that's a long ways back and you're going to lose any changes since then.  

 

I forgot to ask if you actually had a full system backup you could fall back on?  Carbonite has some system imaging capabilities, but that is the higher end version.  If you have the higher priced version of Carbonite, or If you have an actual "image" of the hard drive prior to this problem you could restore to that after confirming the hard drive is OK.