Hi,

I apologize in advance for posting here but I'm at my wits end. I posted in malware and didn't get a response for three days. Probably I'm too impatient, but this seemed the more likely forum after investigating for these three days.

Below I've pasted pretty much what I originally posted except for things which I wasn't sure of. I also added some detail.

I've browsed the site and can't find anything that relates to me. I've tried a couple of things that seemed to be close to the same problem but not really. Needless to say, I'm at a standstill.

I'm now on my laptop with my desktop which is the culprit, next to me.

Here's some detail. After installing a clean Windows 7 to a brand new 500GB disk in the desktop I setup and worked for awhile on Windows 7 disk. Then, when I switched back to boot to the Raid XP Pro disk, it performed an automatic chkdsk. Uh Oh.

So, when I boot, it boots fine and everything seems to load, but if I look at the event log, I can't find what the properties of the error are. For instance the error for the IE or Firefox not working is event 1500. Also in msconfig I can't get to system info (msinfo32.exe).

Some executables run and others don't?

More info that I forgot... My CD can read but not be written to. Network is also down as part of this problem. So you can see that I can't post results from the bad pc to here. I bought a flash drive and that allowed me to capture otl.txt only (out of all the files that I should be able to capture and get back to you.

Here are partial results of the clean malware guide:
1. TFC ran OK. Cleaned about 112.
2. Can't create system restore point w/sysrestorepoint (box just sits there "creating restore point" or in safe mode with normal restore point. When I try to run the downloaded sysrestorepoint it states that it can't create an active x component.
3. ERUNT ran ok.
4. MBAM setup ran ok. MBAM doesn't run. Gives runtime error 372 (can't load vbalGrid from Vbalgrid6.ocx. May be outdated.
5. Root Repeal ran but can't get the files onto the flash drive and back to this laptop.
6. OTL --- Only created otl.txt and not the other file. I was able to paste the otl.txt file here and that's pasted below:


Thanks and waiting at this end.

rich
--------- thumbsup.gif

If it has been 3 days then what you need to do is post in the Waiting Room with a link to your malware topic with the date of the original post. Be patient as they are very busy in that forum.

Thanks for the info. That's what I'll do.

Sorry, I just realized it's only been two days. I'll wait and once again I apologize.

Rich
-------

No problem glad to be of help.

I'm back. I put my original post in the waiting room after three days and was told by Hahdah that it isn't a malware problem. He instructed me to post a reply to this topic that I also had posted and mention that I am cleaned of malware and viruses and it is an OS problem. I'm running XP pro.

So it's now been 4 days. Hope I can get started troubleshooting with someone's guidance soon.

Thanks in advance,

Rich
----------

Then let's try some scans and possible fix's.

How To Run Chkdsk /r from Recovery Console:


How to run checkdisk from recovery console (Windows xp). (Courtesy dsenette)

1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.
   Note:Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted to do so.
2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
   Note:If you have a dual-boot or multiple-boot computer, select the installation that you want to access from the Recovery Console.
3. When you are prompted to do so, type the Administrator password. If the administrator password is blank, just press ENTER.
4. At the Recovery Console command prompt, type the following then press Enter:
   

   chkdsk /r

5. Allow this to run UNDISTURBED until completed (45 min or so)
6. Report any errors

After this is done the proceed to the following.

If you have more than one RAM module installed, try starting computer with one RAM stick at a time.

NOTE Keep in mind, the manual check listed above is always superior to the software check, listed below. DO NOT proceed with memtest, if you can go with option A

B. If you have only one RAM stick installed...
...run memtest...

1. Download - Pre-Compiled Bootable ISO (.zip)
2. Unzip downloaded memtest86+-2.11.iso.zip file.
3. Inside, you'll find memtest86+-2.11.iso file.
4. Download, and install ImgBurn: http://www.imgburn.com/
5. Insert blank CD into your CD drive.
6. Open ImgBurn, and click on Write image file to disc
7. Click on Browse for a file... icon:



8. Locate memtest86+-2.11.iso file, and click Open button.
9. Click on ImgBurn green arrow to start burning bootable memtest86 CD:



10. Once the CD is created, boot from it, and memtest will automatically start to run.

The running program will look something like this depending on the size and number of ram modules installed:




It's recommended to run 5-6 passes. Each pass contains very same 8 tests.

This will show the progress of the test. It can take a while. Be patient, or leave it running overnight.



The following image is the test results area:



The most important item here is the “errors” line. If you see ANY errors, even one, most likely, you have bad RAM.

I can't run chkdsk /r from the recovery console booting from CD. I only have the recovery disk that was shipped with the system (Gateway). When I boot from that and hit "R" it gives me the options of either a full restore , wiping out data or restore while backing up data. Definitely not what I want.

Can I boot in safe mode and run chkdsk /r from there or go to recovery console from the command prompt if I just boot to it? Or what about msconfig. I think there's a way so that chkdsk will start auto the next time you restart but can you add the /r switch?

Thanks,

Rich
-----------

If you can boot into normal or safe mode you can do the following...


Go to

Start and then to Run
Type in Chkdsk /r Note the space between k and /
Click Enter ...It will probably ask if you want to do this on the next reboot...click Y

If the window doesn't shutdown on its own then reboot the system manually. On reboot the system will start the chkdsk operation
This one will take longer then chkdsk /f

Note... there are 5 stages...
It may appear to hang at a certain percent for a hour or more or even back up and go over the same area...this is normal...
DO NOT SHUT YOUR COMPUTER DOWN WHILE CHKDSK IS RUNNING OR YOU CAN HAVE SEVERE PROBLEMS
This can take several hours to complete.
When completed it will boot the system back into windows.

Let me know if this fixes the problem

Here are the errors I encountered running chkdsk /r per your instructions:

Stage 1 thru 3 ok.
Stage 4 (file data verification)
Windows replaced bad clusters in file 17631 of name \system~1\resto~1\rp803\A0079650.ini
" " " " " " 202583 \system~1\resto~1\ ------------.con
"""""""" """"""""""""""""""""""""""""" """"""""""""""" ._regis~4.
Two more bad cluster replacements in .msi files in same \system~1\resto~1 directory.
I have the file names if needed.

Stage 5--- I don't know about stage 5 because it finished and then rebooted. I saw that for a second while booting after changing the msconfig safe mode back to normal that it said disk was clean. I still have the same problems so now I want to make sure of the next step...

I have 4GB memory. Do you want me to find the base memory (if that's the correct term) and boot from that board. Then put each board in that slot and boot and see if the problem exists with each ram board? One last question - With one board in the system does it have to be in a certain slot or will the system find it anyway?

Thanks again so much - At least now I was able to run chkdsk successfully and have confidence in the disk.

Rich
--------

Redo the chkdsk /r instructions until it does not find any more problems.

Here's the latest... I ran the chkdsk /r again and it ran with no errors Stages 1 thru 5.

0 bad sectors. I've still got the same problems. Please refer to my last post and let me know if that's what you'd like me to do next.

Thanks,

Rich

OK now move on to the memtest86 instructions and let em know what that shows.

Here's the latest... I swapped out my 4 ram's running each one separately and using different memory slots. Same thing. Also, from your instructions above, I didn't run memtest since it states that if you have more than one ram then swap them out one at a time. No need for memtest since all 4 ram modules installed singly in different slots exhibit same problem. Just making sure I'm following instructions!

I noticed that there are a lot of services not running like the network services and a bunch more. If I try to look at the services in Computer management, the right window is partly blue. Seems like it tries to load andn then stops. Doesn't hang system.

Sorry but I gotta tell you one more thing just in case. When booting there's also a message that states RPC server isn't available.

Thanks much once again,

Rich
------

This post has been edited by horizonatdawn: Nov 1 2009, 07:33 AM

Run hard drive diagnostics: http://www.tacktech.com/display.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.

NOTE. If your hard drive is made by Toshiba, unfortunately, you're out of luck, because Toshiba doesn't provide any diagnostic tool.

Thanks to Broni for the instructions