AUTOCHK and CHKDSK endless loops

[reallywildstuff]

Question: How to fix AUTOCHK and CHKDSK loops when all else fails?

Summary: a new HDD, with a cloned image of malware-infected WinXP that was thoroughly cleaned, continues to show C: Dirty file system bit set. A forced 5-stage CHKDSK /f or CHKDSK /r is not resolving the probelm. System appears to be 100% clean and runs very well except for the "stuck" Dirty bit on C:. Dirty bit can be effectively ignored using CHKNTFS /x c: but Scandisk and Defrag can't be run - probably other problems too. Still trying to solve this issue without wiping it and starting over.

HP Pavilion zd8000 w/ WinXP 2005 Media Center. Would not boot - ran an endless cycle of 3-stage AUTOCHKs and reboots. If AUTOCHK was cancelled, WinXP would sometimes load, but very slowly...HDD was almost certainly failing. Mounted the original 4200rpm HDD on another box and successfully copied some data from it. Recieved warnings from host that disk may have errors. Used Ghost to clone a new 5400rpm HDD.

Installed new HDD in laptop and used MBAM, HitMan, RKill and ComboFix to fix numerous and varied viruses and Trojans (but unsure exactly which Trojans or Viruses, sorry). Possible that one of these viruses caused BSOD 0X0000007b error when trying to boot to Safe Mode; this was resolved during further virus removal and by deleting specific Windows Updates here:

http://answers.microsoft.com/en-us/...xp-after/73cea559-ebbd-4274-96bc-e292b69f2fd1

and here:

http://answers.microsoft.com/en-us/...0000007b/8347d3ea-8351-4709-9580-b692feeacb77

Once infections were gone, and after successful booting to Safe Mode, WinXP continued to report corrupted files ("exception processing message c00001012") along with Event ID 55 ("The file system structure on the disk is corrupt and unusable. Please run the CHKDSK utility on volume C:\") and the same 3-stage AUTOCHK loop on every start.

Performed Repair install using original media. WinXP was SP3, now SP2 after repair. Delaying further updates pending resolution of this issue.

The laptop now runs great - except that the Dirty bit seems to be permanently set for C: - Defrag won't run because it says a CHKDSK /f is scheduled. No more "exception processing message" errors either (suspect that some Windows files were in fact corrupted, possibly by Virus, possibly by previous HDD disc error, but were then repaired by Repair install).

FSUTIL always reports that C: is dirty.

I've set CHKNTFS /x C: and that's preventing AUTOCHK from running on every boot - now it boots and runs seemingly without issue, except that the Dirty bit is still set. I'm not clear whether CHKNTFS /x C: should be prohibiting the AUTOCHK from running on every boot, but that is what its doing regardless...in other words, I don't have to reset CHKNTFS /x C: before every boot, it seems to be "permanently" set. I don't think this is the designed function of the switch...

I've run both CHKDSK /f C: and CHKDSK /r C: under this condition (with CHKNTFS /x set) and both the 5-stage and 3-stage CHKDSK seemed to run successfully each time and respectively - however they also result in an endless loop of CHKDSKs at boot. These are not the same as the "regular" AUTOCHK loop that the system is stuck in with FSUTIL /d set. I interpret this to mean that both the regular AUTOCHK and the manually-invoked CHKDSK are not able to successfully unset the Dirty bit despite not finding any errors.

After resetting FSUTIL /d C: the system still exhibits the same 3-stage AUTOCHK loop on every boot. Event ID 55 continues to be logged when booted under CHKNTFS /d , is not logged when booted under CHKNTFS /x.

Ran chkdsk /r from the Recovery Console. "CHKDSK found and fixed one or more errors on the volume"

ReBoot, no AUTOCHK, C: is still dirty.

Reboot, back into Recovery Console, run chkdsk /r again, once again "CHKDSK found and fixed one or more errors on the volume".

I'm going to reboot and run CHKDSK /r from the RC again (and until I get a "no errors", or at least two passes before I try a regular boot).

 

[DrB0b]

Forgive me for asking but, wouldn't you save alot of time just backing up and reloading?
That being said, have you tested the drive to make sure its physically fine, because if not all this is a moot point.

"Silence is golden, duct tape is silver...

 

[reallywildstuff]

I'm not so sure about the "saving time" part, once you factor in drivers, data, software installs and updates, user settings etc...and that's still something that can be done later regardless.

Currently running brand new HDD that doesn't have any physical errors on it.

After two passes of chkdsk /r in Recovery Console, CHKDSK completed without finding errors - however when I booted to WinXP the drive was still dirty (CHKNTFS DIRTY QUERY C

 

[linney]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager @ BootExecute is the key and value that controls Chdsk running or not.


The data value I have for Bootexecute is autocheck autochk * with that value set Chkdsk does not run at Startup. I think for Chkdsk to run the actual value may have to be autocheck autochk /p \??\C: but you had better confirm that.


You can check what the results of running CHKNTFS /x C: are, and whether that just changes the Registry Value, and whether the Value changes back after a reboot, and whether changing the Registry Value manually is a more permanent fix but it looks a bit doubtful.

CHKNTFS.EXE: What You Can Use It For

http://support.microsoft.com/default.aspx?scid=kb;EN-US;160963#toc

While in the Recovery Console did you try the FixMbr command?



"This issue can occur if the System registry hive or the Software registry hive is damaged, or if both of the following conditions are true:
You use a Hewlett Packard (HP) ScanJet 5100c scanner with the HP driver.
You have not updated the scanner driver to the Windows XP version that is available from Hewlett Packard."

Chkdsk Runs Each Time That You Start Your Computer

http://support.microsoft.com/default.aspx?scid=kb;en-us;316506&FR=1&PA=1&SD=HSCH

 

[reallywildstuff]

FIXMBR and FIXBOOT don't fix the problem. FIXMBR always reports non-standard Partitions (even if you used FIXMBR on the previous boot).

The Registry value is: autocheck autochk /k:c *

Removing the /k:c causes autocheck to run on the dirty C: drive at boot. CHKNTFS /x C: results in /k:c being insterted into the registry value (this appears to be functioning as designed).

CHKDSK /r can be run from RC until >2 "no errors" passes are made - but the drive still shows Dirty.

 

[linney]

Have a look at this tool and see what you think. Apart from this all I can think of is a Format and clean install of Windows.

http://www.terabyteunlimited.com/index.htm

and from their free software.

MBRWork - Freeware utility to perform some common and uncommon MBR and disk functions. Provided As-Is.

It can perform the following:

1 - Backup the first track on a hard drive.

2 - Restore the backup file.

3 - Reset the EMBR area to all zeros.

4 - Reset the MBR area to all zeros.

5 - Install standard MBR Code

6 - Set a partition active (avail on the command line too)

7 - Work with multiple hard drives.

8 - Remove EZ-Drive (You must boot directly to a diskette (by passing ez-drive)
for this option to show)

9 - Edit MBR partition entry values.

A - If no partitions exist in the MBR and no EMBR exists then this option
will allow you to recover lost FAT, HPFS, NTFS, and Extened partitions.

C - Capture up to 64 disk sectors to a file.

R - Restore up to 64 disk sectors from a file. This feature should only
be used by those who completely understand what they are doing!

T - Transfer/Copy sectors from disk to disk. This feature should only
be used by those who completely understand what they are doing!

P - Compare sectors.



The following are notes from the late Alex Nichol MS MVP (Windows Technologies)

"Go to

http://www.terabyteunlimited.com/downloads-free-software.htm

look for MBRWORK in the free tolls and download it, put it on a DOS floppy (one made by formatting in XP and taking the MSDOS Startup disk option will do).

Boot that and run MBRWORK
Use options
1 (to back up the current state, so it could be restored with 2)
3 then 4 to delete the current code and tables
there will then be a possibility of using A
which will scan the disk for 'signatures' of partitions and rebuilt the partition table then
5
to install standard MBR code so the disk could be booted"