[tuffstuff]

checkhd.txt logThe type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
CHKDSK is verifying indexes (stage 2 of 3)...
CHKDSK is recovering lost files.
CHKDSK is verifying security descriptors (stage 3 of 3)...
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows found problems with the file system.
Run CHKDSK with the /F (fix) option to correct these.

239368499 KB total disk space.
30707696 KB in 98496 files.
66948 KB in 10687 indexes.
0 KB in bad sectors.
266491 KB in use by the system.
65536 KB occupied by the log file.
208327364 KB available on disk.

4096 bytes in each allocation unit.
59842124 total allocation units on disk.
52081841 allocation units available on disk.

[Advertisements]

Hi tuffstuff,

You have some problems with the hard drive. Let's do some system maintenance. We are gonna run a program that will check the critical system files and then run one to repair the errors on the hard drive.


Step-1.

A.
Show Hidden Files and Folders

• Click Start, click Computer.
• On the next window, at the top of the window, click Tools then click Folder Options.
• On the Folder Options window click the View tab.
• Under the Files and Folders section:
• Make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
  
  
  
• Also make sure that Hide protected system operating files(recommended) is un-checked.
  
  
  
• Also make sure the Hide extensions for known file types box is un-checked.
  
  
  
  

B.
Run SFC

Close all open applications/windows etc.

• Click on Start , then click Run...
• Type in SFC /Scannow <--- Make sure to leave a space between SFC and the forward slash.
• Click on OK
• System File Checker will now scan all protected files to verify their versions.

Note: This will take some time. Also you may be prompted to place your XP installation CD-ROM in the CD-Drive. If you are, just click retry (may have to several times) and see if it can finish.
If that doesn't work, STOP here and let me know.

C.
Hard-Drive Maintenance/Repair:

Note: for the CHKDSK portion you may refer to a tutorial by Dakeyras, found here and follow the instructions for Graphical Mode if you so wish.
NOTE: If you decide to use the Graphical Mode, close the Command window after Defrag has finished by typing Exit at the blinking cursor and pressing the Enter key.

• Click Start , then click Run... then type in CMD and click on OK.
• At the Command Prompt C:\ > type the following:
• CD C:\ and press the Enter key.
• Now type in DEFRAG C: -F
• A Analysis report will be displayed and then Windows will start the Deragmentation run automatically.
• This may take some time, when completed the Command Prompt C:\ > will appear.
  At this point, please note any files were replace and any files that it was not able to replace.
  
  NOTE: If you chose to use the Graphical Mode, this would be where you close the Command window. If you want to continue in the Command window, complete the remaining steps.
  
  VERY IMPORTANT: Chkdsk may take a long time, depending on the severity of the problems on the disk . I have seen it take hours and hours to complete so be prepared to let it run until all 3 stages have been completed.
  
• Now type in CHKDSK C: /R and press the Enter key.
• When prompted with:
  

  CHKDSK cannot run because the volume is in use by another process
  Would you like to schedule this volume to be checked next time the system
  restarts (Y/N)

• Hit the Y key then at the Command Prompt C:\ >
• Type in EXIT and and press the Enter key.
• Now Reboot(Restart) your computer.

Note: Upon Reboot(Restart) the CHKDSK(check-disk) will start and carry out the repairs required.

You should see a screen like this just after the Post(power on self test) screen:



Note: Do not touch either the keyboard or Mouse, otherwise the Check-Disk will be canceled and you computer will continue to boot-up as normal.

After chkdsk has run, please note any problems that it found and repaired and let me know.


Step-2.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Let me know what, if anything, SFC found and replaced or did not replace.
2. Let me know the chkdsk results.

[godawgs]

Hi tuffstuff,

You have some problems with the hard drive. Let's do some system maintenance. We are gonna run a program that will check the critical system files and then run one to repair the errors on the hard drive.


Step-1.

A.
Show Hidden Files and Folders

• Click Start, click Computer.
• On the next window, at the top of the window, click Tools then click Folder Options.
• On the Folder Options window click the View tab.
• Under the Files and Folders section:
• Make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
  
  
  
• Also make sure that Hide protected system operating files(recommended) is un-checked.
  
  
  
• Also make sure the Hide extensions for known file types box is un-checked.
  
  
  
  

B.
Run SFC

Close all open applications/windows etc.

• Click on Start , then click Run...
• Type in SFC /Scannow <--- Make sure to leave a space between SFC and the forward slash.
• Click on OK
• System File Checker will now scan all protected files to verify their versions.

Note: This will take some time. Also you may be prompted to place your XP installation CD-ROM in the CD-Drive. If you are, just click retry (may have to several times) and see if it can finish.
If that doesn't work, STOP here and let me know.

C.
Hard-Drive Maintenance/Repair:

Note: for the CHKDSK portion you may refer to a tutorial by Dakeyras, found here and follow the instructions for Graphical Mode if you so wish.
NOTE: If you decide to use the Graphical Mode, close the Command window after Defrag has finished by typing Exit at the blinking cursor and pressing the Enter key.

• Click Start , then click Run... then type in CMD and click on OK.
• At the Command Prompt C:\ > type the following:
• CD C:\ and press the Enter key.
• Now type in DEFRAG C: -F
• A Analysis report will be displayed and then Windows will start the Deragmentation run automatically.
• This may take some time, when completed the Command Prompt C:\ > will appear.
  At this point, please note any files were replace and any files that it was not able to replace.
  
  NOTE: If you chose to use the Graphical Mode, this would be where you close the Command window. If you want to continue in the Command window, complete the remaining steps.
  
  VERY IMPORTANT: Chkdsk may take a long time, depending on the severity of the problems on the disk . I have seen it take hours and hours to complete so be prepared to let it run until all 3 stages have been completed.
  
• Now type in CHKDSK C: /R and press the Enter key.
• When prompted with:
  

  CHKDSK cannot run because the volume is in use by another process
  Would you like to schedule this volume to be checked next time the system
  restarts (Y/N)

• Hit the Y key then at the Command Prompt C:\ >
• Type in EXIT and and press the Enter key.
• Now Reboot(Restart) your computer.

Note: Upon Reboot(Restart) the CHKDSK(check-disk) will start and carry out the repairs required.

You should see a screen like this just after the Post(power on self test) screen:



Note: Do not touch either the keyboard or Mouse, otherwise the Check-Disk will be canceled and you computer will continue to boot-up as normal.

After chkdsk has run, please note any problems that it found and repaired and let me know.


Step-2.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Let me know what, if anything, SFC found and replaced or did not replace.
2. Let me know the chkdsk results.

[tuffstuff]

The SFC only showed Analysis Report 228GB 198GB(86% free) 7% fragmented 14% file fragmentation

Defrag Report 228GB Total 198GB (86% Free) 1% fragmented 3% file fragmentation

Did I do it correctly?

The CHKDSK said volume is clean.

Also I can non longer rename a file when I downloaded a picture as it says it will destroy it.

Also in the estscanner log I posted what was the one infected file
C:\Documents and Settings\Owner\My Documents\Downloads\microsoft security essentials setup.exe probably a variant of Win32/Soft32Downloader.C application

Edited by tuffstuff, 14 May 2013 - 05:59 PM.

[godawgs]

The SFC only showed Analysis Report 228GB 198GB(86% free) 7% fragmented 14% file fragmentation

Defrag Report 228GB Total 198GB (86% Free) 1% fragmented 3% file fragmentation

Did I do it correctly?

Doesn't look like it. Looks like the first line above was the analysis report before the defrag operation and the second line is the % of file fragmentation after the defrag operation.
The sfc /scannow operation would have listed any files that it repaired, or it would have said that it found damaged files but was unable to repair them. We will try to find them another way.

Also in the estscanner log I posted what was the one infected file
C:\Documents and Settings\Owner\My Documents\Downloads\microsoft security essentials setup.exe probably a variant of Win32/Soft32Downloader.C application

That was a false positive as that file is the Microsoft Security Essentials antivirus setup file.
You can go ahead and delete it thought.

Also I can non longer rename a file when I downloaded a picture as it says it will destroy it.

Please tell me exactly how you are trying to rename the file and exactly what the error message is.

Please let me know if you are still having the internet issue.

[tuffstuff]

Should I do the scan now again? I typed exactly what you had listed.

It is still not staying on long and I have to restart.

I right click on the picture name and click rename, then I rename it and when I hit enter, it says,
If you change a file name extension, the file may become unusable. Are you sure you want to change it.
My did it on a picture she had just downloaded and to see what would happen she said yes and it deleted it. I just did it on an old file and it said the same thing, but I said no. Sorry my sister said destroy to me.

[godawgs]

If you change a file name extension, the file may become unusable. Are you sure you want to change it.

When you click on the file and click Rename are you leaving the same file extension eg; .txt or .jpg?
If you just type in a new file name and do not have the extension, the file you are renaming will be deleted.

[tuffstuff]

yes just renaming the picture. I didn't think I ever added, anything else. Okay so me being a stupid novice. Nothing to worry about then. Thanks.

[godawgs]

Let's try SFC again, but we'll do it a little differently.

Run SFC

Close all open applications/windows etc.

• Copy the text in the Quote box below (except the word Quote). To do that: Highlight the text and right click and click Copy
  

  sfc /scannow

• Click on Start , then click Run...
• Right click in the Run box and click Paste. This will place the text inside the Run box.
• Click the OK button.
• System File Checker will now scan all protected files to verify their versions.

Note: This will take some time. Also you may be prompted to place your XP installation CD-ROM in the CD-Drive. If you are, just click retry (may have to several times) and see if it can finish.
If that doesn't work, STOP here and let me know.

[tuffstuff]

I did the scannow by copying and pasting it in the run window. It scanned and then closed without showing anything. The window didn't stay up. In the beginning it said, please wait while windows verifies that all protected window files are intact and in their original versions.

[godawgs]

Let's see if the Event Viewer logged any files that Windows couldn't repair/replace.


Step-1.

• Click Start then click Run
• In the Open box type compmgmt.msc and click the OK button. The Computer Management window will open.
• In the tree on the left click the + beside Event Viewer
• Click System. Look in the right pane, fairly high in the list, below the Source heading there should be at least 1 entry of Windows File Protection and the value in the Event ID column should be 64017.
  
  Possible values in the right part of the windows in the Event column could be:
• 64016: System File Checker has started.
• 64021: System File Checker hasn't been able to successfully restore a certain file.
• 64017: System File Checker has finished.

All 60421 entries are interesting.
If you see any Windows File Protection entries with an Event ID of 60421:

• You can open the entry by double clicking on it. An Event log window will open.
• Click the Details tab and click the Copy button. This will copy the contents to the clipboard. Then click the Close button.
• Open a Notepad file
• Right click inside the open file and click Paste. This will paste the contents of the Event log into the notepad file.
  If there is another 60421 event in the log, double click it, click the Details tab and click the Copy button, then the Close button and then open the notepad file and add it to the end of the file. Do this for all 64021 events in the Event log. Once all 60421 events have been added to the notepad file:
• Click File at the top of the Notepad window.
• Click Save. A Save as window will open.
• Click the Desktop icon in the left column.
• In the File name: box type eventlog.
• Make sure it is saved as a Text Document (.txt) and click the Save button. This will put a file named eventlog.txt on the desktop.
• Copy it's contents and paste them into your next reply.

Step-1.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. If there were any 60421 entries in the Event Viewer, post the contents of the text file you created. If there weren't any 60421 Event entries just tell me.

[tuffstuff]

there were no entries for 64021, there were 2 for 64017 and 2 for 64016.

what about SP3 uninstalled yet still showing in my properties of the computer? That has always caused me connection problems. Although I was having the problems before installing that.

Edited by tuffstuff, 16 May 2013 - 01:15 PM.

[godawgs]

Hello,

The first thing we were doing was making sure the system is clean. The next thing was trying to repair the hard drive errors that the check of the hard disk found. Then we ran SFC to see if there were any corrupt system files. The Event Viewer didn't show any so that's good.
Now I want to run a scan that will look for any system services that aren't running or service registry keys that may be missing.
I don't want to speculate on the SP3 issue until I know if any of these things aren't working or are missing. But I want to ask a question. When you open the Control Panel and click on Add/Remove Programs is the box at the top of the window titled Show Updates checked? If it isn't, click the box and the Add/Remove Programs will re-populate and include the Windows Updates and that is where XP SP3 should show up...probably at the very bottom of the list. If it is there DO NOT uninstall it.

Run Farbar Service Scanner

Please download Farbar Service Scanner to the desktop.

• Doubleclick the FSS.exe file to run it.
  
  
  
• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. Answer my question above.
2. The FSS.txt log

[tuffstuff]

show updates is checked.

here is fss.txt

Farbar Service Scanner Version: 14-04-2013
Ran by Owner (administrator) on 17-05-2013 at 08:23:51
Running from "C:\Documents and Settings\Owner\Desktop"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Avgtdix(10) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
0x0B00000004000000010000000200000003000000080000005A000000090000000A000000050000000600000007000000
IpSec Tag value is correct.

**** End of log ****

[godawgs]

The services are good. Let's manually reset the TCP/IP and Winsock and see if that will help with the internet issue.


Step-1.

Releaese/Renew TCP/IP connection XP

• Click Start > Run. A Run box will open up.
• Type cmd.exe and click Open. A black command window will open up.
• At the blinking cursor type the following commands, pressing the Enter key after each command typed:
  • ipconfig /release
  Back at the blinking cursor tpye the following command, and press the Enter key.
  • ipconfig /renew
  Back at the blinking cursor type Exit and press the Enter key. This will close the command window.
• Reboot the computer

Step-2.

Reset TCP/IP Stack and Winsock for Windows XP

• Open a command prompt. To do that:
  • Click Start and then click Run.
  • Copy and paste (or type) the following command in the Open box and then press ENTER:
    cmd
  A black Command window will open.
• At the blinking cursor, copy and paste (or type) the following command and then press ENTER:
  netsh int ip reset c:\resetlog.txt
• Back at the blinking cursor, copy and paste (or type the following command and then press Enter
  netsh WINSOCK reset catalog
• Back at the blinking cursor type Exit and press the Enter key to close the Command window.
• Reboot the computer.

Now see if the internet connection stays on or keeps kicking you off.

[tuffstuff]

I will let you know after work tomorrow how it does. I will have my sister use it all day. Thank you.