[cRAYonhere]

Sir,
I had come to this forum seeking help on a malware issue. But Mailprog ( Group: Malware Removal) helped me determine that my problem was related to system rather than malware. Here is the link to the post of our malware detection procedure Malware HackTool
The problems I am facing in the system is that my computer suddenly after a day the malware detection procedure followed by mailprog was completed it showed a blue screen during I was browsing the net using "Comodo Dargon" a Chromium based browser and the computer shut down and it didn't start. I again seeked help from Mail prog but he asked me to seek help in this section of the forum. Now sometimes my computer just switches off and won't start up again. It would show that black BIOS boot up screen then ask for a normal start up or a Startup Repair(Recommended) in both the options the computer won't be able to load the O.S and with Switch off shortly. I will have to try to switch on the computer 10-15 times then it will start normally and even function normally. And even when I put my computer into hibernation( I extensively use it instead of shutdown due to the nature of my work ) when I resume the system it would say "improper shutdown" and it needs to send error report to Microsoft. And all my work will be lost. Its been Happening since last 3 weeks or so. I have no idea what to do. My copy of Windows is Genuine as verified by Mailprog. And My system is ensured against any hardware related malfunction. I handle my Computer very carefully though the system heats up at times and there is a auto shutdown set off at critical temperature that shuts it down automatically.

System Details:

Microsoft Windows 7 Home Premium 64-bit SP 1
Intel Core i3 CPU M 350 @ 2.27Ghz
4.0GB RAM, ATI Mobility Radeon HD 5470

Thank you.

[Advertisements]

If bluescreen comes up, you should check your memory. You can use Hiren's Bootcd to test it.

[Forece]

If bluescreen comes up, you should check your memory. You can use Hiren's Bootcd to test it.

[DonnaB]

Hi cRAYonhere,

Sorry for the delay.

It might be best to eliminate the possibility that the HD is in good condition. I can help you with that.

Please do the following:

• Click on Start then click on My Computer
• Right click on the C: drive, scroll down and click on Properties
• Click on the Tools tab
• Click on the Check Now... button
• In the dialog box that opens, place a checkmark in the 2 boxes and click on Start
• The next dialog box will now show the following
  
  • Chkdsk cannot run because the volume is in use by another
    process. Would you like to schedule this volume to be
    checked the next time the system restarts? <Y/N>
  • Type Y and reboot the computer.
• Checkdisk will start once the computer reboots. It can take up to an hour or more to complete as it goes through the stages. Allow it to run uninterrupted till complete.

To find the log that is produced, please do the following:

• Reboot the computer.
• Click on Start then Control Panel
• In Control Panel click on Administrative Tools
• Click on Event Viewer
• Once the Event Viewer opens, in the middle pane, near the bottom under Log Summary, click on Application.
• Locate the Winlogon entry under the Source column that corresponds with the time that Checkdisk was ran.
• Double click on it and a window will open.
• Click on Details tab then click on Copy in the lower left of that window to save the data to clipboard and post in your next reply.

For a 2nd opinion, you could also download Seagate SeaTools which is a free program that is used to test all computer hard drives. Just click on the download tab at the top of the page and under Downloads > Utilities > SeaTools for Windows, select your OS.

Donna

[cRAYonhere]

Sorry For The Late Reply, I was preoccupied with My examinations. I have run Dell's Diagnostics Software which Showed no issues with it's memory tests. But I will run your prescribed tests within a day. And Report to you positively by tomorrow.
Thank you

[cRAYonhere]

****The next dialog box will now show the following
Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? <Y/N>
Type Y and reboot the computer.****

Instead of this my Dialog box is showing
*** Windows can't check the disk while it's in use
Do you want to check for hard disk errors the next time you
start your computer ?
<Schedule disk check/Cancel>****
I selected Schedule disk Check then the dialog box disappeared and nothing happened.

[mysoul]

****The next dialog box will now show the following
Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? <Y/N>
Type Y and reboot the computer.****

Instead of this my Dialog box is showing
*** Windows can't check the disk while it's in use
Do you want to check for hard disk errors the next time you
start your computer ?
<Schedule disk check/Cancel>****
I selected Schedule disk Check then the dialog box disappeared and nothing happened.

You're then supposed to shut down the pc,

and turn it back on.

chkdsk will then start automatically.

Alow it to finish which will take some time.Do NOT interrupt the process.

Edited by mysoul, 29 October 2012 - 03:38 AM.

[cRAYonhere]

Log of Scan using first method "Checkdisk" :

Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 29-Oct-12 7:07:18 PM
Event ID: 6000
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Dell-PC
Description:
The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
<EventID Qualifiers="32768">6000</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-10-29T13:37:18.000000000Z" />
<EventRecordID>59292</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Dell-PC</Computer>
<Security />
</System>
<EventData>
<Data>SessionEnv</Data>
<Binary>D9060000</Binary>
</EventData>
</Event>
Thank you

[DonnaB]

Darn! That's the wrong log. My mistake. I'm sorry.

Please go to Start > Control Panel > Administrative Tools > Event Viewer and click on the little arrow to the left of Windows Logs. Next click on Applications. Scrol down till you see the Wininit entry under Source for the same date and time as the log above. Double click on the Wininit entry and then click on Copy button in the lower left to copy to clipboard then paste to your next reply.

The log we need includes the following info:

230715391 KB total disk space.
48432096 KB in 166306 files.
87648 KB in 34913 indexes.
0 KB in bad sectors.
475291 KB in use by the system.
65536 KB occupied by the log file.
181720356 KB available on disk.

4096 bytes in each allocation unit.
57678847 total allocation units on disk.
45430089 allocation units available on disk.

[cRAYonhere]

No issues.

The new Wininit log:

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 29-Oct-12 8:51:43 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Dell-PC
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
Read failure with status 0xc00000b5 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49132 is unreadable.
Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49133 is unreadable.
Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49134 is unreadable.
Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49135 is unreadable.
296960 file records processed.

File verification completed.
1625 large file records processed.

Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x400 bytes.
4 bad file records processed.

0 EA records processed.

90 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
Index entry old1uninstall.iss of index $I30 in file 0xb7f7 points to unused file 0xbfec.
Deleting index entry old1uninstall.iss in index $I30 of file 47095.
Index entry OLD1UN~1.ISS of index $I30 in file 0xb7f7 points to unused file 0xbfec.
Deleting index entry OLD1UN~1.ISS in index $I30 of file 47095.
367850 index entries processed.

Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
3 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
296960 file SDs/SIDs processed.

Cleaning up 1584 unused index entries from index $SII of file 0x9.
Cleaning up 1584 unused index entries from index $SDH of file 0x9.
Cleaning up 1584 unused security descriptors.
Security descriptor verification completed.
35446 data files processed.

CHKDSK is verifying Usn Journal...
37134864 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0xb4fd71000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0xb4fd7d000 for 0x1000 bytes.
Windows replaced bad clusters in file 77876
of name \Users\Dell\Desktop\STUDYM~1\Chemistry\Resonance\How to draw resonance structures (1).flv.
296944 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
5814985 free clusters processed.

Free space verification is complete.
Adding 2 bad clusters to the Bad Clusters File.
Correcting errors in the master file table's (MFT) DATA attribute.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

102296575 KB total disk space.
78494928 KB in 259109 files.
137472 KB in 35447 indexes.
8 KB in bad sectors.
404223 KB in use by the system.
65536 KB occupied by the log file.
23259944 KB available on disk.

4096 bytes in each allocation unit.
25574143 total allocation units on disk.
5814986 allocation units available on disk.

Internal Info:
00 88 04 00 a7 7e 04 00 d2 dd 06 00 00 00 00 00 .....~..........
90 06 00 00 5a 00 00 00 00 00 00 00 00 00 00 00 ....Z...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-10-29T15:21:43.000000000Z" />
<EventRecordID>59306</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Dell-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
Read failure with status 0xc00000b5 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49132 is unreadable.
Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49133 is unreadable.
Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49134 is unreadable.
Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x1000 bytes.
File record segment 49135 is unreadable.
296960 file records processed.

File verification completed.
1625 large file records processed.

Read failure with status 0xc0000185 at offset 0xc2ffb000 for 0x400 bytes.
4 bad file records processed.

0 EA records processed.

90 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
Index entry old1uninstall.iss of index $I30 in file 0xb7f7 points to unused file 0xbfec.
Deleting index entry old1uninstall.iss in index $I30 of file 47095.
Index entry OLD1UN~1.ISS of index $I30 in file 0xb7f7 points to unused file 0xbfec.
Deleting index entry OLD1UN~1.ISS in index $I30 of file 47095.
367850 index entries processed.

Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
3 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
296960 file SDs/SIDs processed.

Cleaning up 1584 unused index entries from index $SII of file 0x9.
Cleaning up 1584 unused index entries from index $SDH of file 0x9.
Cleaning up 1584 unused security descriptors.
Security descriptor verification completed.
35446 data files processed.

CHKDSK is verifying Usn Journal...
37134864 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0xb4fd71000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0xb4fd7d000 for 0x1000 bytes.
Windows replaced bad clusters in file 77876
of name \Users\Dell\Desktop\STUDYM~1\Chemistry\Resonance\How to draw resonance structures (1).flv.
296944 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
5814985 free clusters processed.

Free space verification is complete.
Adding 2 bad clusters to the Bad Clusters File.
Correcting errors in the master file table's (MFT) DATA attribute.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

102296575 KB total disk space.
78494928 KB in 259109 files.
137472 KB in 35447 indexes.
8 KB in bad sectors.
404223 KB in use by the system.
65536 KB occupied by the log file.
23259944 KB available on disk.

4096 bytes in each allocation unit.
25574143 total allocation units on disk.
5814986 allocation units available on disk.

Internal Info:
00 88 04 00 a7 7e 04 00 d2 dd 06 00 00 00 00 00 .....~..........
90 06 00 00 5a 00 00 00 00 00 00 00 00 00 00 00 ....Z...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

Thank you.

[DonnaB]

Hi cRAYonhere,

Perfect! Unfortunately, I'm afraid I have a bit of bad news for you. The 8 KB's of bad sectors on your HD could cause the issues you are experiencing. I have outlined those in red below:


102296575 KB total disk space.
78494928 KB in 259109 files.
137472 KB in 35447 indexes.
8 KB in bad sectors.
404223 KB in use by the system.
65536 KB occupied by the log file.
23259944 KB available on disk.

At this time, I would make sure you have all your personal data backed up. The HD will need to be replaced.

@Mysoul,

Thank you for your help.

[mysoul]

You're welcome Donna.

[cRAYonhere]

What could be the possible reasons for this 8Kb's of Bad Sector Issue ?

[cRAYonhere]

Please Reply.
Thank you

[mysoul]

Please Reply.
Thank you

Gosh there are a number of causes,Bad sectors may be a result of regular everyday use for a long period of time(so old age).The problem of damaged sectors can also be found on brand new hdd'sby the way,as,simply the result of poor quality.Physical shock not being handled gently,knocks and dropping it,may well damage the platter, which in turn may create bad sectors. Also excessive heat and poor ventilation can be the cause..

Don't fret too much,get yourself a new one(if warranty expired) and hopefully the new one will last you longer.