[kwielechow1987]

I have Comodo System Utilities installed on my system. I noticed a first time occurrence of a window (Comodo displayed on the header) stating a download was occurring. I did nothing to instigate this (it came out of nowhere, but looked very suspicious). It was late and I turned off my notebook. The next morning, I re-booted my notebook. I have Kaspersky Internet Security 2012 installed. I tried to run a Quick Scan. The quick scan was running for about 10 minutes (usually finishes within 5 minutes), then all of a sudden, Kaspersky was disabled, and the following errors were displayed: protection disabled, subscription problem, database is corrupt. About 10 minutes later, Kaspersky was re-enabled (on it's own - I did nothing). I then tried to download the Panda Active Scan software to check my system (downloaded executable 'PandaCloudCleaner.exe'). Download was fine but when I doubled clicked on it to begin the self extraction and install, I received the following error message:

An error occurred while trying to create file in the destination directory. The disk structure is corrupted and unreadable.

I tried downloading Malwarebytes free, and received the same above error when clicking on the self-extracting install executable (mbam-setup-1.65.0.1400.exe).

I did not see any specific malware related error messages, just the above described behaviors. I know my system is somehow corrupted by some kind of malware.

My PC is a Dell Inspiron XPS notebook purchased in December, 2008 (fastest processor at the time plug 4 GB memory). I am running the Windows Vista operating system (it is up to date with all security patches). I am using Kaspersky 2012 Internet Security as my malware protection (which was updated in the morning before all my problems occurred).

Please help. I wish I could give you more, but I described all the symptoms that occurred. I turned off my notebook because I want to prevent further damage.

Thank you very much for your help,

Ken Wielechowski

[Advertisements]

The disk structure is corrupted and unreadable.

Sounds like your hard drive is failing. Try running chkdsk

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Start, Run, eventvwr.msc, OK to bring up the Event Viewer. Right click on System and Clear All Events, No (we don't want to save the old log), OK. Repeat for Application.

Reboot.

The disk check will run and will probably take an hour or more to finish.


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Double-click VEW.exe
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron

[RKinner]

The disk structure is corrupted and unreadable.

Sounds like your hard drive is failing. Try running chkdsk

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Start, Run, eventvwr.msc, OK to bring up the Event Viewer. Right click on System and Clear All Events, No (we don't want to save the old log), OK. Repeat for Application.

Reboot.

The disk check will run and will probably take an hour or more to finish.


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Double-click VEW.exe
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron

[kwielechow1987]

Hi Ron,

Thank you for your reply. Before I had a chance to do anything (upon restarting my computer), Windows detected problems with the disk and ran CHKDSK automatically. It fixed a number of issues. Before I cleared the event logs, I saw many error entries in the system log as follows:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.
I then followed your instructions. Upon my first re-boot, CHKDSK stated there were no problems and didn't run. I then selected CHKDSK to run again. Upon the second reboot, CHKDSK did run (ran for about 2 hours). I have attached the two logs from running the VEW application. From my observation, it appears my disk is OK now (hopefully).

Just to give you some history I did the following before I ran into my problems. I used Perfect Disk 12 to defragment my disk. Afterwards, I ran CHKDSK at reboot (with only first option checked - it ran for about 10 minutes) and didn't detect any errors. Maybe running Perfect corrupted my disk?

After running the defrag on Saturdsy, more than half my disk space was in use. Now after running CHKDSK, doing a properties on my C: drive states 98.3 GB Used and 187 GB Free.

Thank you for all your help.

Ken

Attached Files

•  System_VEW.txt   4.21KB   158 downloads
•  Application_VEW.txt   1.22KB   62 downloads

[RKinner]

Could have been the defrag software. I don't see the need for 3rd party defrag software. Windows does a good job by itself. I've also seen hard drives get messed up by bad RAM so it wouldn't hurt to run the builtin Memory test: http://www.howtogeek...iagnostic-tool/


The errors in your system log about BCM42RLY should go away if you update your Wireless software. See:
http://forum.securit...wlan-1505vista/

I have no idea what this error means. Have never seen it before and can't find any useful answers.

Log: 'System' Date/Time: 26/09/2012 4:30:55 AM
Type: Error Category: 0
Event: 1002 Source: Microsoft-Windows-ResourcePublication
Element Provider\Microsoft.Base.Publication/Publication/Computer failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.

The "Event: 10" errors in your application log have a FixIt:

http://support.micro...b;en-US;2545227

[kwielechow1987]

Hi Ron,

Thanks for your reply. I ran the Windows Memory diagnostic and the results stated 'Your computer has a memory problem'. I found another free Memory checker (checks all available free memory) and let it run all night. It didn't detect any errors. I don't know about the reliability of this memory checker. I guess I can trust the results of the Windows Memory Diagnostic tool. I'll have to have the notebook checked out or buy a new notebook.

Thank you again so much for your help. You and the other 'Geeks To Go' team do a fantastic job and it's nice to know that there is some really great help out there.

Ken

[RKinner]

I don't know which memory test you used besides the built-in one. This is one of the better ones:

http://www.memtest.org/

See

http://howto.cnet.co...ram-in-windows/

for instructions

I'll have to have the notebook checked out or buy a new notebook.

It's a fairly simple operation on most notebooks to change out the memory. Much cheaper than buying a new one or having it serviced. Usually you just need a small Phillips screw driver like you get in a set of jeweler's screwdrivers at the Dollar store for $1. Then you turn off the notebook and remove the battery. Remove two screws from a panel on the bottom. Once the panel is off you can see the two slots where the RAM lives. They have little levers on each end which need to be opened then the RAM will pop out. Do not touch the RAM by the contacts. Note how the old RAM was oriented. Insert the new RAM the same way and then push it down until the levers pop up. What make and model number is it? I can look it up for you and tell you what you need to order and can probably find you some exact instructions.

[kwielechow1987]

Hi Ron,

Thanks for the information. I will run the memory test this weekend. I have a Dell XPS M1530 notebook with Intel Core 2 Duo CPU T8100 @ 2.10GHz with 4 GB RAM. I am running the Vista Home Premium OS. I purchased the notebook in December, 2008.

Thanks again for all your help.

Ken



.

[RKinner]

Instructions here:

http://support.dell....s.htm#wp1116017

and even a movie here:

I assume you have two 2 GB sticks of RAM. Module Size: 2GB

These should be DDR2 PC2-6400

Further specs below but you really just need to look for DDR2 PC2-6400.

Memory module connector
two user-accessible SODIMM connectors
Memory module capacities
1 GB, 2 GB, and 4 GB
Memory type
667 MHz SODIMM DDR2
Minimum memory
1 GB
Maximum memory
4 GB

Amazon has them for $28
http://www.amazon.co...sxp_grid_pt_1_1
This one might be a tad faster than those that came with your PC. but should still work. If you just get one, put it in the first slot.

or you can buy a pair of them for $51.17
http://www.amazon.co...&seller=&sr=1-1



It says it can only take 4 GB so resist the urge to buy two 4 GB sticks. And it will be happier with 2 x 2 GB rather than 1 X 4 GB.

It should boot and run the mem test with only one stick in the DIMM 1 position so you can test each stick individually and just replace the one that's bad.

[kwielechow1987]

Hi Ron,

Thanks again for all the information and finding the actual memory my notebook uses. I ran the memory test at boot up and the tool identified bad memory. I am going to use the info you sent me and order replacement memory (2 x 2GB).

Thanks,

Ken