Questions

Help please with XP machine possible corruption.

Tags:
+
0 Votes
Locked

Help please with XP machine possible corruption.

gcondick
Firstly, some system facts:

Gigabyte 8Ik1100 R2 m/board
Windows XP SP3, SP3 installed for 3 weeks
Was re-formatted and re-installed about 1 year ago.
120GB SATA1 HDD, single partition
1.5GB RAM
HDD nearly full, maybe 10GB free.
AVG free and Zonealarm free.
ADSL modem netcomm nb1300
IDE DVD, parallel scanner and printer.

Last night my teenage daughter reported that "the toolbar was not working" while she was on MSN and Limewire. She shut it down and I tried to boot. The error reported was along the lines of "windows failed to start... a hardware or software change may have caused this..." and giving options for safe mode, normal boot, last known good config etc. I tried these several times then gave up.

The hard disk controller check seemed OK in the BIOS check, and it started the XP scrolling screen, the bar scrolled across for a few times then reverted to the error screen again. I could hear and see the HDD doing some activity in this time.

I decided to try the Bart PE boot cd. This booted correctly, but when I tried to run the A43 file management utility, it went into an endless lopp trying to access the hard drive, with the activity LED coming on on each loop but nothing else.

This morning I booted again with Bart PE and began a chkdsk which is still running at home and I will check tonight. In the index checking stages it found some "file record segment 15232 is unreadable" with 4 errors. Then it began deleting some index entries.

So my question is what general or specific things to do next with the objective of resurrecting the system or at least recovering the data ready for a complete re-install?
  • +
    0 Votes
    OldER Mycroft

    General rule of thumb suggests leaving 10% - 15% of total capacity as free space. You have already gone below the 10% limit.

    Bart PE is useful but may well be running out of HDD space for its own Temp files, which it will require as it does its own checking procedures.

    I would rather find out why the toolbar stopped working before running system-wide scans. Unfortunately it would appear you cannot do this at the moment.

    It would help greatly if you could tell us exactly what the error message says.

    In terms of data recovery you would be best to remove this HDD and run it in Slave mode in another computer.

    +
    0 Votes
    jkforms

    First thing you need to do is back up...

    It appears as if the hard drive may be failing due to unreadable segments that useable is a sing of hard drive failure. Time is an issue the longer you let the hard drive run without a backup the more you risk losing data.
    If you have another computer, I would remove the hard drive and connect it to the desktop assuming that is what you have and copy the important data to a good hard drive. If you have a laptop and don?t have a desktop in that case I would go to a local computer store pick up an IDE or SATA to USB and then move files over that way.
    Now that you have a backup, watch is always to have one just in case?. Look in to Mozy when you are back up and running.

    Now I would download Seagate or western digital tools who ever made your hard drive and run there diagnostics tools to see what shape the hard drive is in.
    1. Assuming that it is okay there could be a damaged operating system backup and reinstall if that is the case
    2. If the diagnostics fails the test than replace hard drive and reinstall?


    If you need any more help feel free to hit me with a note?
    Also how old is this computer
    Normal hard drives last between 3 to 5 years. Depending on the use.

    Thank You Jon K. King

    +
    0 Votes
    Jacky Howe

    Follow jkforms advice if possible if not try this. Do you have access to another PC that would be able to hold that amount of information.
    I believe that 17% is a safer mark to go by.
    Boot with Bart and open a command prompt. Work your way through all user profiles to delete temp files. You will need to free up at least 7-8GB for the drive to function. You are familiar with the Drive so if you know that you have a DVD or two that have recently been burnt but not deleted remove them.
    At the command prompt type in.....remembering to press Enter at the end of each line.
    c:
    cd C:\Docume~1\username\Locals~1\Tempor~1
    del *.* /s /q
    rmdir . /s /q

    cd windows\TEMP
    del *.* /s /q

    When you have enough free space. At the command prompt type in chkdsk /r allow it to unmount the volume and let it run through. When it is finished see if you can access the PC.

    From another PC download and install these programs and copy the the installed folders along with stng380.exe to a USB Stick or burn them to CD.

    Restart the PC in Safe Mode and turn off System Restore. Insert the USB Stick or CD and run Sophos.bat when it is completed run stng380.exe. Reboot in Safe Mode again and run Spybot.

    Download Spybot - Search & Destroy 1.5.2 and install it. Update it. http://www.safer-networking.org/en/download/index.html

    Download Stinger http://vil.nai.com/vil/stinger/stinger.htm

    Download Sophos and the latest IDE Files. Install it and extract the IDE files to the C:\SAV32CLI folder.
    http://www.sophos.com/support/knowledgebase/article/13251.html

    Copy and paste the below two lines into Notepad and save the file to the USB Stick as sophos.bat, it will scan and remove.

    ===============================
    CD SAV32CLI
    SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT
    ===============================

    When all steps are finished Restart the PC and re-enable System Restore.

    Let us know how you get on.

    Tip: When all this is over and you are planning your Rebuild try Partitioning your Drive. 20GB Primary should be enough for OS and installs. Either split the rest of the Drive or leave it single. Make a folder on the Partition and redirect MY Documents to it and also save anything of value here. The next time that you have a problem like this you can just delete and recreate the Primary and reinstall.

    +
    0 Votes
    gcondick

    Well CHKDSK seems to have got me back to where I was. Windows boots apparently normally. I have uninstalled some games etc. so I now have about 16GB free. There was actually only 5GB free when I first booted. I am currently backing up and using the machine. (the machine I am typing this from). I have downloaded a diagnostic from WD and will soon run this. Will also run spybot and ad-aware, virus scan etc and de-frag. Thanks again to those with helpfull comments, which is all who replied, especially True Blue.

    +
    0 Votes
    Jacky Howe

    even if in only in a small way.

    +
    0 Votes
    mjd420nova

    My problem sounds the same as what you've experienced. I found a corrupted master boot record and also a partition table that got scrambled. I had available another hard drive I was going to install in another unit but installed it in this unit as the first drive, moving the suspect one to secondary instead and did a clean install of XP. I was then able to recover all the precious data from the drive and found a root kit to be the problem. A repair of the OS could get you past any problems but with so little space it might balk and fail.

    +
    0 Votes
    Jacky Howe

    see the word Limewire and it is installed on a corrupt PC. You never know what to expect.

    +
    0 Votes
    IC-IT

    the /R option if errors are still reported or if it won't boot; download either UBCD or MHDD32.
    Run the program MHDD32, once loaded press F4. use the arrow keys to scroll through the options, set the loopback to yes (Spacebar), set the Repair to yes. press F4 again to start the scan. Let it run through at least three times (overnight is good).
    This basically checks your drive, pulls off recoverable data, and will oftentimes even clear bad SMART reports.
    Consider backing up all your data (after the successful procedure) and be prepared to purchase a new drive (or monitor closely for re-occuring bad sectors).

    +
    0 Votes
    gcondick

    Thanks to you and other responders. I am digesting all suggestions and am greatful for the considered effort of all. My wife has rung me and says CHKDSK has finished, and it has now booted to the windows login screen so I told her to leave it until I can get to it shortly. BTW the HDD is 4 years old and I think a WD. I have a USB HDD ready for backups and will probably bring the HDD in to work tomorrow to finish the backup process hopefully. The I intend to follow some of your suggestions.

    +
    0 Votes
    jkforms

    Please be cautious when backing up your hard drive there could be infections that your may not know about you don?t want them to spread through the network or to other computer through other media. Talk to your administrator about this...

  • +
    0 Votes
    OldER Mycroft

    General rule of thumb suggests leaving 10% - 15% of total capacity as free space. You have already gone below the 10% limit.

    Bart PE is useful but may well be running out of HDD space for its own Temp files, which it will require as it does its own checking procedures.

    I would rather find out why the toolbar stopped working before running system-wide scans. Unfortunately it would appear you cannot do this at the moment.

    It would help greatly if you could tell us exactly what the error message says.

    In terms of data recovery you would be best to remove this HDD and run it in Slave mode in another computer.

    +
    0 Votes
    jkforms

    First thing you need to do is back up...

    It appears as if the hard drive may be failing due to unreadable segments that useable is a sing of hard drive failure. Time is an issue the longer you let the hard drive run without a backup the more you risk losing data.
    If you have another computer, I would remove the hard drive and connect it to the desktop assuming that is what you have and copy the important data to a good hard drive. If you have a laptop and don?t have a desktop in that case I would go to a local computer store pick up an IDE or SATA to USB and then move files over that way.
    Now that you have a backup, watch is always to have one just in case?. Look in to Mozy when you are back up and running.

    Now I would download Seagate or western digital tools who ever made your hard drive and run there diagnostics tools to see what shape the hard drive is in.
    1. Assuming that it is okay there could be a damaged operating system backup and reinstall if that is the case
    2. If the diagnostics fails the test than replace hard drive and reinstall?


    If you need any more help feel free to hit me with a note?
    Also how old is this computer
    Normal hard drives last between 3 to 5 years. Depending on the use.

    Thank You Jon K. King

    +
    0 Votes
    Jacky Howe

    Follow jkforms advice if possible if not try this. Do you have access to another PC that would be able to hold that amount of information.
    I believe that 17% is a safer mark to go by.
    Boot with Bart and open a command prompt. Work your way through all user profiles to delete temp files. You will need to free up at least 7-8GB for the drive to function. You are familiar with the Drive so if you know that you have a DVD or two that have recently been burnt but not deleted remove them.
    At the command prompt type in.....remembering to press Enter at the end of each line.
    c:
    cd C:\Docume~1\username\Locals~1\Tempor~1
    del *.* /s /q
    rmdir . /s /q

    cd windows\TEMP
    del *.* /s /q

    When you have enough free space. At the command prompt type in chkdsk /r allow it to unmount the volume and let it run through. When it is finished see if you can access the PC.

    From another PC download and install these programs and copy the the installed folders along with stng380.exe to a USB Stick or burn them to CD.

    Restart the PC in Safe Mode and turn off System Restore. Insert the USB Stick or CD and run Sophos.bat when it is completed run stng380.exe. Reboot in Safe Mode again and run Spybot.

    Download Spybot - Search & Destroy 1.5.2 and install it. Update it. http://www.safer-networking.org/en/download/index.html

    Download Stinger http://vil.nai.com/vil/stinger/stinger.htm

    Download Sophos and the latest IDE Files. Install it and extract the IDE files to the C:\SAV32CLI folder.
    http://www.sophos.com/support/knowledgebase/article/13251.html

    Copy and paste the below two lines into Notepad and save the file to the USB Stick as sophos.bat, it will scan and remove.

    ===============================
    CD SAV32CLI
    SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT
    ===============================

    When all steps are finished Restart the PC and re-enable System Restore.

    Let us know how you get on.

    Tip: When all this is over and you are planning your Rebuild try Partitioning your Drive. 20GB Primary should be enough for OS and installs. Either split the rest of the Drive or leave it single. Make a folder on the Partition and redirect MY Documents to it and also save anything of value here. The next time that you have a problem like this you can just delete and recreate the Primary and reinstall.

    +
    0 Votes
    gcondick

    Well CHKDSK seems to have got me back to where I was. Windows boots apparently normally. I have uninstalled some games etc. so I now have about 16GB free. There was actually only 5GB free when I first booted. I am currently backing up and using the machine. (the machine I am typing this from). I have downloaded a diagnostic from WD and will soon run this. Will also run spybot and ad-aware, virus scan etc and de-frag. Thanks again to those with helpfull comments, which is all who replied, especially True Blue.

    +
    0 Votes
    Jacky Howe

    even if in only in a small way.

    +
    0 Votes
    mjd420nova

    My problem sounds the same as what you've experienced. I found a corrupted master boot record and also a partition table that got scrambled. I had available another hard drive I was going to install in another unit but installed it in this unit as the first drive, moving the suspect one to secondary instead and did a clean install of XP. I was then able to recover all the precious data from the drive and found a root kit to be the problem. A repair of the OS could get you past any problems but with so little space it might balk and fail.

    +
    0 Votes
    Jacky Howe

    see the word Limewire and it is installed on a corrupt PC. You never know what to expect.

    +
    0 Votes
    IC-IT

    the /R option if errors are still reported or if it won't boot; download either UBCD or MHDD32.
    Run the program MHDD32, once loaded press F4. use the arrow keys to scroll through the options, set the loopback to yes (Spacebar), set the Repair to yes. press F4 again to start the scan. Let it run through at least three times (overnight is good).
    This basically checks your drive, pulls off recoverable data, and will oftentimes even clear bad SMART reports.
    Consider backing up all your data (after the successful procedure) and be prepared to purchase a new drive (or monitor closely for re-occuring bad sectors).

    +
    0 Votes
    gcondick

    Thanks to you and other responders. I am digesting all suggestions and am greatful for the considered effort of all. My wife has rung me and says CHKDSK has finished, and it has now booted to the windows login screen so I told her to leave it until I can get to it shortly. BTW the HDD is 4 years old and I think a WD. I have a USB HDD ready for backups and will probably bring the HDD in to work tomorrow to finish the backup process hopefully. The I intend to follow some of your suggestions.

    +
    0 Votes
    jkforms

    Please be cautious when backing up your hard drive there could be infections that your may not know about you don?t want them to spread through the network or to other computer through other media. Talk to your administrator about this...