Check Disk (chkdsk) killed my computer!

[FeMaster]

Well, it seems that I've run into a MAJOR problem, thanks to Check Disk
basically deleting my user profile... The damn thing deleted my NTUSER.DAT
file! WTF?? Why would it even be allowed to do that?

What a mess! I've performed the suggested operations furnished by MS
knowledgebase, however with it, I've only ever-so-slightly got my system
running (i.e. created a new user profile, and copied the contents of the old
user profile to the new profile.) Ultimately, I'm going to have to start
from scratch as this are still massively screwed up, all my software thinks
that it was just installed, none of my settings (Windows or otherwise) are
valid anymore... YEAH!

Below is the Event Viewer log for the Check Disk that was performed (without
my permission!) Maybe someone can make heads or tales as to why exactly it
went through and deleted all the crap that is did.

----------------------------------

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 12/13/2006
Time: 8:06:57 AM
User: N/A
Computer: BIG-GUY
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is MAIN.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
Deleting orphan file record segment 3228.
Deleting orphan file record segment 3229.
Deleting orphan file record segment 3230.
Deleting orphan file record segment 3231.
Deleting orphan file record segment 41473.
The object id index entry in file 0x19 points to file 0xc9c
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
The object id index entry in file 0x19 points to file 0xc9f
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
The object id index entry in file 0x19 points to file 0xc9e
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
Index entry system.LOG of index $I30 in file 0x20 points to unused file
0xc9f.
Deleting index entry system.LOG in index $I30 of file 32.
Index entry userdiff of index $I30 in file 0x20 points to unused file 0xc9e.
Deleting index entry userdiff in index $I30 of file 32.
Index entry NTUSER.DAT of index $I30 in file 0xc9b points to unused file
0xc9c.
Deleting index entry NTUSER.DAT in index $I30 of file 3227.
Index entry Templates of index $I30 in file 0xc9b points to unused file
0xc9d.
Deleting index entry Templates in index $I30 of file 3227.
Index entry TEMPLA~1 of index $I30 in file 0xc9b points to unused file
0xc9d.
Deleting index entry TEMPLA~1 in index $I30 of file 3227.
Cleaning up minor inconsistencies on the drive.
CHKDSK is recovering lost files.
Cleaning up 7 unused index entries from index $SII of file 0x9.
Cleaning up 7 unused index entries from index $SDH of file 0x9.
Cleaning up 7 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

11542670 KB total disk space.
8616624 KB in 57630 files.
36096 KB in 3687 indexes.
0 KB in bad sectors.
122982 KB in use by the system.
43184 KB occupied by the log file.
2766968 KB available on disk.

4096 bytes in each allocation unit.
2885667 total allocation units on disk.
691742 allocation units available on disk.

Internal Info:
c6 0d 01 00 8e ef 00 00 75 42 01 00 00 00 00 00 ........uB......
a3 d1 00 00 00 00 00 00 74 04 00 00 00 00 00 00 ........t.......
fc 18 e3 02 00 00 00 00 fc a1 ad 5e 00 00 00 00 ...........^....
62 f2 27 06 00 00 00 00 00 00 00 00 00 00 00 00 b.'.............
00 00 00 00 00 00 00 00 4c ee 3a 71 00 00 00 00 ........L.:q....
99 9e 36 00 00 00 00 00 08 38 07 00 1e e1 00 00 ..6......8......
00 00 00 00 00 c0 ea 0d 02 00 00 00 67 0e 00 00 ............g...

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Gary]

Well maybe you should look into a way to start backing up your system so you
won't have this kind of problem in the future when your hard drive fails
completely.

 

[DatabaseBen]

well, it probably fixed the
errors you were having. so why
the disappointment?

you probably could have used
microsoft's profile hive cleaner.
but save this for next time.

right now, simply do a "repair installation"
instead of a new install with your win cd.....

 

[Patrick Keenan]

Well, it seems that I've run into a MAJOR problem, thanks to Check Disk
basically deleting my user profile... The damn thing deleted my
NTUSER.DAT file! WTF?? Why would it even be allowed to do that?

Your drive was damaged. Possibly still is. When the damage was detected,
you didn't cancel the disk check. Unfortuntely, the corruption was in user
data spaces.

Consider backing up the contents of the drive and then wiping it, testing it
thoroughly, and reinstalling. Pay close attention for potential corruption
as you re-install, as there may be hardware reasons not limited to the drive
for this failure. Be prepared to swap in another drive in case your
original drive is failing. Drives are cheap these days, probably cheaper
than your time.

You might reconsider simply rebuilding a new profile on a file system that
has had serious damage like that.

HTH
-pk

 

[NewScience]

FWIW, I would do a CHKDKS /r periodically so this doesn't happen again?
When was the last time you did some system maintenance on your own?

 

[Pop`]

Actually, if you read the chkdsk data, I think you'll understand. It would
appear that the damage was done prior to your running chkdsk; in fact, it
was very likely that damage is what caused the machine to want to run
chkdsk.
Notice the ntuser.dat it deleted was useless anyway, since it didn't
point to anywhere useful. Etc..
In other words, I think you'd have probably had much worse problems had
you cancelled the chkdsk operation. As in you may have not even been able
to recover anything at all.

IT's probably a good time to put that disk thru the mfg's diagnostics apps
to see if it's starting to give up on something. Assuming you can get that
far; it appears you're online, so I assume you did.
I'd also suggest getting a good backup process going since it's possible
you may be looking at a catastrophic failure at any moment, unless you
already have such a process in place and are using it faithfully. And then
of course, a thorough scanning for viruses, spyware and general malware.
Remember to update all those apps before you apply them; things are changing
very quickly "out there" right now and there are many updates, sometimes
more than one in a day. And of course it goes without saying the same
applies to windows istelf. Adaware and Spybot seem to be the two best
malware apps in my cast at least; ymmv of course.

Best of luck,

Pop`

 

[Rock]

well, it probably fixed the
errors you were having. so why
the disappointment?

you probably could have used
microsoft's profile hive cleaner.
but save this for next time.

right now, simply do a "repair installation"
instead of a new install with your win cd.....

What does the User Profile Hive cleanup service have to do with corruption
on the hard drive?


<snip>

 

[FeMaster]

According to numerous pieces of software, and the drives own SMART log, it
has absolutely NO issues. Thanks for the helpful reply anyway...

 

[FeMaster]

Boy, it amazes me at the number of shitty attitudes in replies to my plea
for a little help and/or advice...

------------
Well maybe you should look into a way to start backing up your system so you
won't have this kind of problem in the future when your hard drive fails
completely.
------------
If the drive were the problem, I'd have taken action a LONG time ago. Drive
is CLEAN, no errors according to numerous drive scanners, Manufacturers own
HD diagnostic software, and the drives SMART log.

------------
------------
FWIW, I would do a CHKDKS /r periodically so this doesn't happen again?
When was the last time you did some system maintenance on your own?
------------
CHKDSK had been performed only a week prior, with no problems detected at
all. It is also performed approximately once a month to try to prevent such
issues. Last time I did system maintenance? It is done on a VERY regular
basis, thank you. Don't automatically figure that you are dealing with
someone of a lower intelligence than yourself.

 

[FeMaster]

Actually, if you read the chkdsk data, I think you'll understand. It
would appear that the damage was done prior to your running chkdsk; in
fact, it was very likely that damage is what caused the machine to want to
run chkdsk.
Notice the ntuser.dat it deleted was useless anyway, since it didn't
point to anywhere useful. Etc..
In other words, I think you'd have probably had much worse problems had
you cancelled the chkdsk operation. As in you may have not even been able
to recover anything at all.

That's what I don't understand. What cause the problem in the first place?
According to everything I've run and tried, the drive is in tip-top shape.
Not even a single "error" listed in the drives SMART log.

IT's probably a good time to put that disk thru the mfg's diagnostics apps
to see if it's starting to give up on something. Assuming you can get
that far; it appears you're online, so I assume you did.

Everything works fine, except that all my user information and settings are
screwed. I've had a few problems with installing some software that I've
tried to use to see if I could recover the file. I've got it up and running
under another user account which I've transferred most of my info into...
Still a major mess though...

a thorough scanning for viruses, spyware and general malware. Remember to
update all those apps before you apply them; things are changing very
quickly "out there" right now and there are many updates, sometimes more
than one in a day. And of course it goes without saying the same applies
to windows istelf. Adaware and Spybot seem to be the two best malware
apps in my cast at least; ymmv of course.

Clean as a whistle. Has been since the day I freshly installed Windows
about a year and a half to two years ago...

Thanks for the reply. Yours was one of the more useful at least.

 

[Pop`]

news:[email protected]...

I guess if you're up and running OK, it's no big deal, so in that case just
file the below away for "someday":

That's what I don't understand. What cause the problem in the first
place? According to everything I've run and tried, the drive is in
tip-top shape. Not even a single "error" listed in the drives SMART
log.

Pretty annoying, I know. Possibilities are limitless, including badly
written applications, corruption from who knows where, to as yet
undiscovered viruses and malwares. My guess is you'll never find out unless
it's something an antivirus or antispy program picks up in the future.
It IS possible for disk corruption to go on for very long periods of time
before it "hits" anything that matters, so ... it could be a problem that's
been there for a long time but just never happened to mess anything up; as
in, perhaps it was "corrupting" areas of the disk that were as yet unused.

I know you're pretty skittish of chkdsk, but ... you might want to run it
again. It's not all that unusual to have to run chkdsk more than once to
get everything straightened out. When there are a lot of errors,
occasionally some errors can't be found until others are gotten out of the
way. Once after clearing out a GAIN infestation (humongous spyware and
adware), I had to run it three times before it quit finding errors.
Of course, the old saw about backing up now applies here, regardless of
what you do next.

Everything works fine, except that all my user information and
settings are screwed. I've had a few problems with installing some
software that I've tried to use to see if I could recover the file. I've
got it up and running under another user account which I've
transferred most of my info into... Still a major mess though...

If there are still screwed up tables on the disk, chkdsk might still be able

Clean as a whistle. Has been since the day I freshly installed
Windows about a year and a half to two years ago...

You'll forgive me if I take that with a grain of salt because you havent'
mentioned which applications you ran. Reputable AV does a good job but it
can take several malware apps before you get the one that will detect what
the others haven't. No single malware app will handle the situation at this
time.

Thanks for the reply. Yours was one of the more useful at least.

Things happen, unfortunately. Have you tried a Repair install of XP? It
won't wipe out any data but you will have to reupdate windows afterwards.
As always, backup first, just in case.

HTH
Pop`

 

[FeMaster]

I know you're pretty skittish of chkdsk, but ... you might want to run it
again. It's not all that unusual to have to run chkdsk more than once to
get everything straightened out. When there are a lot of errors,
occasionally some errors can't be found until others are gotten out of the
way.

If there are still screwed up tables on the disk, chkdsk might still be
able to find/repair them by running it again. After a full backup<g>.

I'll give it another go or 6. Hopefully things will straighten out, but I'm
doubting it. Currently I'm having "permissions" issues with the new
account. I can't do simple things like assign what program opens a certain
file extension. It only applies to a select few extensions however. New
user account is an administrator account...? Oh well.

You'll forgive me if I take that with a grain of salt because you havent'
mentioned which applications you ran. Reputable AV does a good job but it
can take several malware apps before you get the one that will detect what
the others haven't. No single malware app will handle the situation at
this time.

Yeah, I could have mentioned a few... Kaspersky Internet Security
(Antivirus, etc.) Ad-Aware SE Pro, Spybot, and HiJack This!

Have you tried a Repair install of XP? It won't wipe out any data but you
will have to reupdate windows afterwards. As always, backup first, just in
case.

Not yet... That is on the list for the next few days however.

Thanks again!

 

[Enkidu]

Boy, it amazes me at the number of shitty attitudes in replies to my plea
for a little help and/or advice...

chkdisk is a *file system* level utility. The file system is written to
the disk at format time.

There may be no *physical* errors on the disk when chkdisk runs. If the
files system is screwed the underlying disk may be perfect. When chkdisk
checks a file system it *may* come across bad blocks, in which case it
will work around them by copying the data to another block, if possible.

The system detected file system corruption and that is why the chkdisk ran.

Cheers,

Cliff