Cannot run chkdsk /f in windows xp pro sp2.

[Peter]

My machine was infected with a virus/spyware earlier. I was able to get rid
of the virus/spyware. Now, I have the following problems:

1. Getting svchost.exe application errors the instruction at xxx referenced
memory at xxxxx. The memory could not be read. xxx and xxxxx have different
values for each svchost.exe applicatoin error. I used Process Explorer to
check whether all the running svchost.exe are c:\windows\system32\svchost.exe
and they are. So, I try to run Disk Defragmentation and get the message that
cannot run it because chkdsk /f is scheduled to run.
2. When I try to run chkdsk on c: without any parameter, I will get this
during verifying indexes <stage 2 of 3>...
Deleting index entry......
Index verification completed.

Errors found. CHKDSK cannot continue in read-only mode
3. When I try to chkdsk on c: with /f, I will get the following:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another process. Would
you like to schedule this volume to be checked the next time the system
restarts? (Y/N)

I answer Y but the reboot the system will not run chkdsk at all.
In the HKLM\System\CurrentControlSet\Control\Session Manager, BootExecute
has this:
autocheck autochk /p \??\C:
autocheck autochk *
Am I suppose to see anything in control panel\scheduled tasks? There is no
task scheduled.

4. I want to run sfc /scannow but sfc is asking for XP SP2 CD and I don't
have the SP2 CD since SP2 is downloaded from MS thru this link
http://www.microsoft.com/downloads/...be-3b8e-4f30-8245-9e368d3cdb5a&displaylang=en. How can I run sfc without the CD?


Thanks for any help.

 

[Leonard Grey]

You're either still infected or your attempts to remove the infection,
however valiant, left pieces behind. It ain't easy to rid yourself of
malware these days.

 

[Ron Badour]

I think Leonard may be correct about the infection remaining. On several
highly infected machines (200+ infections), I have had great luck using
Anti-Malware 1.33, which can be downloaded from here:

http://www.download.com/Malwarebyte...l-10804572&subj=dl&tag=button&cdlPid=10997763


--
Regards

Ron Badour
MS MVP
Windows Desktop Experience

 

[Peter]

Hi Ron,

When I try to install it, I get the svchost.exe application error at the end
of the installation. It seems the installation is completed but it won't run
at all.

I think if I can figure how to run chkdsk /f to fix the drive error first.
I may able to run it.

 

[Ron Badour]

You may have to pull the drive out and mount it in another XP machine and
use the system of that PC to clean the drive. I fixed a PC last weekend
that had malware that was smart--they only blocked the .exe files of tools
that I use to clean infections. It blocked AdAware, SpyBot, Malware, AVG,
combofix, another AV program and other cleaning tools. If you want to try
this and need help, post back and I or another poster will give some
directions.

--
Regards

Ron Badour
MS MVP
Windows Desktop Experience

 

[Elmo]

Seems Ron is really onto something here!

I had a virus alert on my Dell laptop, Windows XP SP3 which was
seemingly picked up by Norton antivirus. But computer repeatedly crashes
now. Volume is not flagged as dirty and sfc /scannow comes out OK. But
CHKDSK in read-only mode reports windows file errors. And the following
programs are all being blocked from running: chkdsk /F, MS defrag,
System Restore (whether in normal or safe mode). After reading this post
I downloaded the Malwarebytes program, and it is also blocked from
running! So this would appear to be clever malware which preventing
itself from being removed.

Don't think I will be able to remove the harddisk from my laptop to run
it in another machine. Perhaps I could try to fix this problem by
booting XP from a CD-Rom drive? Any advice gratefully received....

Burn BitDefender, or another program listed, to a CD (using a working
machine) and test the infected machine with it:

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Then run these again:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/superantispywarefreevspro.html

 

[Elmo]

Not sure how I can burn a fully executable version of bitdefender to a
CD. Wouldn't that just be an installation file on a CD, which then
attempts to install bitdefender to the infected machine, where it will
be blocked from running by the malware?

Any of those .exe files will burn a Linux Live OS to a CD. The newly
created CD then runs independent of your HD, updates its virus
definitions, scans for and removes malware.

Download and run one of the exe's rather than trying to figure out how
to burn the image rather than a copy of the iso to the CD. A copy of
the ISO will not run.

 

[Elmo]

Great - all sorted out. Really appreciate the help!

That's great! Thanks for reporting back.

[Previous correspondence]

Burn BitDefender, or another program listed, to a CD (using a working
machine) and test the infected machine with it:

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Then run these again:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/superantispywarefreevspro.html