Probelm with Safe Mode and chkdsk

[Fox Hunter]

I recently discovered that chkdsk /f will not run when booting or cannot enter Safe Mode. What is the common link between these two problems? I was able to run a boot log but don't know what it is telling me. Using Windows XP Home SP1 which has been installed for several years and running good until this discovery. Any suggestions short of a reinstall?

Fox Hunter

 

[Carey Frisch [MVP]]

CHKNTFS.EXE: What You Can Use It For
http://support.microsoft.com/?kbid=160963

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/?­id=827315

Download Ad-aware SE and scan your PC for the presence of sp­yware:
http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

Symantec Security Check
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym&plfid=23&pkj=YVXRORVWHFHMFNZMBBX

Microsoft Windows AntiSpyware
http://www.microsoft.com/downloads/...a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

-------------------------------------------------------------------------------------------

:

I recently discovered that chkdsk /f will not run when booting or cannot enter Safe Mode. What is the common link between these two
problems? I was able to run a boot log but don't know what it is telling me. Using Windows XP Home SP1 which has been installed for
several years and running good until this discovery. Any suggestions short of a reinstall?

Fox Hunter

 

[Rich Barry]

Try doing a System Restore. Start>All Programs>Accessories>System
Tools>System Restore. Go back as far as you can. Also, have you checked for
Malware? If not, you can use these free sites
http://www.lavasoftusa.com/software/adaware/





http://www.safer-networking.org/en/index.html





http://housecall.trendmicro.com/



http://www.webroot.com/



http://www.microsoft.com/downloads/...A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en







http://www.kephyr.com/spywarescanner/index.html?source=appvisit










I recently discovered that chkdsk /f will not run when booting or cannot
enter Safe Mode. What is the common link between these two problems? I was
able to run a boot log but don't know what it is telling me. Using Windows
XP Home SP1 which has been installed for several years and running good
until this discovery. Any suggestions short of a reinstall?

Fox Hunter

 

[Fox Hunter]

Carey:
Tried CHKNTFS and drives were indicated to not have the dirty bit set. Ran CHKDSK /R and it said "cannot open for direct access". Is it safe to use CHKDSK /R /X to force opening the volume? I have the Ad-ware, Spybot, Norton Antivirus, and MS AntiSpyware programs and run periodically.

 

[Fox Hunter]

Rich:
I deleted System Restore files about a week ago before I discovered this problem. Isn't that the way it usually happens? Have always ran adware and malware software frequently

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

Hi *Fox Hunter* :

Carey:
Tried CHKNTFS and drives were indicated to not have the dirty bit set. Ran CHKDSK /R and it said "cannot open for direct access".
Is it safe to use CHKDSK /R /X to force opening the volume? I have the Ad-ware, Spybot, Norton Antivirus, and MS AntiSpyware programs
and run periodically.

May be some system files are located on bad cluster and prevent you to
access to the safe mode...or a driver installed by some programs ( e.g.
INCD /NERO)...

1- Check in the logs to find the errors and warnings related to this
problem

Start | Run | eventvwr.msc

The most important informations are the source and the event ID.
You can have some hints about thoses errors there:
http://www.eventid.net/

2- Check for errors related to drivers:

Start | Run | devmgmt.msc

a)
Errors codes generated by the device management:
http://support.microsoft.com/Default.aspx?kbid=310123

b)
to find recent drivers:

www.driverfiles.net[Eng.]
or
[Fr.]
www.eu.microsoft.com/france/telechargements/drivers/default.asp
www.touslesdrivers.com
www.clubic.com/pilotes.html

3- The chkdsk can't be executed to fix the errors when the volume is used
by the system : the correct syntax is :

chkdsk /F /R /V X: where X = the volume letter. E,g. C:, D: etc.
You must reboot to start chkdsk...

4- Did you install or uninstall some hardware, driver, application since
the time you have thios problem?

5- Did a restore point can fix the problem ?

Non more idea ...


--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Fox Hunter]

Claude:
Have not found any errors in device management. Cannot recall any hardware that has recently been installed other that the usual hot swapping of USB devices. The only errors in the event viewer are:

Event Source: Perflib
Event Category: None
Event ID: 1015
Date: 6/4/2005
Time: 3:56:38 PM
User: N/A
Computer: P4DESKTOP
Description:
The timeout waiting for the performance data collection function "PerfProc" in the "C:\WINDOWS\system32\perfproc.dll" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1015
Date: 6/4/2005
Time: 3:50:08 PM
User: N/A
Computer: P4DESKTOP
Description:
The timeout waiting for the performance data collection function "PerfProc" in the "C:\WINDOWS\system32\perfproc.dll" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 2002
Date: 6/4/2005
Time: 3:49:45 PM
User: N/A
Computer: P4DESKTOP
Description:
The open procedure for service "WmiApRpl" in DLL "C:\WINDOWS\System32\wbem\wmiaprpl.dll" has taken longer than the established wait time to complete. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

Hi *Fox Hunter* :

Carey:
Tried CHKNTFS and drives were indicated to not have the dirty bit set. Ran
CHKDSK /R and it said "cannot open for direct access".
Is it safe to use CHKDSK /R /X to force opening the volume? I have the
Ad-ware, Spybot, Norton Antivirus, and MS AntiSpyware programs and run
periodically.

May be some system files are located on bad cluster and prevent you to
access to the safe mode...or a driver installed by some programs ( e.g.
INCD /NERO)...

1- Check in the logs to find the errors and warnings related to this
problem

Start | Run | eventvwr.msc

The most important informations are the source and the event ID.
You can have some hints about thoses errors there:
http://www.eventid.net/

2- Check for errors related to drivers:

Start | Run | devmgmt.msc

a)
Errors codes generated by the device management:
http://support.microsoft.com/Default.aspx?kbid=310123

b)
to find recent drivers:

www.driverfiles.net[Eng.]
or
[Fr.]
www.eu.microsoft.com/france/telechargements/drivers/default.asp
www.touslesdrivers.com
www.clubic.com/pilotes.html

3- The chkdsk can't be executed to fix the errors when the volume is used
by the system : the correct syntax is :

chkdsk /F /R /V X: where X = the volume letter. E,g. C:, D: etc.
You must reboot to start chkdsk...

4- Did you install or uninstall some hardware, driver, application since
the time you have thios problem?

5- Did a restore point can fix the problem ?

Non more idea ...


--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[da_test]

Claude:
Have not found any errors in device management. Cannot recall any hardware that has recently been installed other that the usual hot swapping of USB devices. The only errors in the event viewer are:

Event Source: Perflib
Event Category: None
Event ID: 1015
Date: 6/4/2005
Time: 3:56:38 PM
User: N/A
Computer: P4DESKTOP
Description:
The timeout waiting for the performance data collection function "PerfProc" in the "C:\WINDOWS\system32\perfproc.dll" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

<snip>
I don't think these events are related.
Have you tried running chkdsk /r from the recovery console?

If you have a proper XP, the rc is available after booting from
the CD.

 

[Fox Hunter]

No, I haven't tried the recovery console. Not comfortable booting from the CD but may give it a try if I can find some guidance.

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

Hi *Fox Hunter* :

Claude:
Have not found any errors in device management. Cannot recall any hardware that has recently been installed other that the usual hot swapping of USB devices. The only errors in the event viewer are:

Event Source: Perflib
Event Category: None
Event ID: 1015
Description:
The timeout waiting for the performance data collection function "PerfProc" in the "C:\WINDOWS\system32\perfproc.dll" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 1015
Description:
The timeout waiting for the performance data collection function "PerfProc" in the "C:\WINDOWS\system32\perfproc.dll" Library to finish has expired. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

Event Type: Error
Event Source: Perflib
Event Category: None
Event ID: 2002
Description:
The open procedure for service "WmiApRpl" in DLL "C:\WINDOWS\System32\wbem\wmiaprpl.dll" has taken longer than the established wait time to complete. There may be a problem with this extensible counter or the service it is collecting data from or the system may have been very busy when this call was attempted.

Those Event are not related to your problem...(apparently...)
Except for the one related to WMI : Windows Management Instrumentation...
a suspect...
These counters can be disabled with exctrlst.exe
(Extensible Counter Listing Tool) of the W 2000 Ressource Kit...

1- check that registry key :
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager
Key : BootExecute
Type : Reg_Multi_Sz
Value: autochk autochk*

This key must be present to allow chkdsk at boot time
when it is needed...

2- Register the DLL related to chkdsk
Start | Run | regsvr32.exe Untfs.dll
Start | Run | regsvr32.exe Ufat.dll

And try again with chkdsk ...
For the purpose of this test you can run chkdsk in read only mode:
Start | Run | chkdsk /V

You have to know that this read only mode report some false positive so
don't be alarmed with these messages : nothings can goes wrong with this
command.

3- You can also try a restore to a previous date

4- You can also check the Windows Protected Files with System File Checker

*but* be aware that this command *void* all restore points : they are still
there but unusable !!! So use this if *any* restore points solve your
problem.

Like this :

Start | Run | sfc /scannow
normally Windows XP ask you to insert the W xp CD
to fix the problems.

after this command :
1- reboot
2- go to Control Panel | System | and stop the System Restore to erase all
Rest. Points (now unusable) and restart the system restore (create au new
restore point)

5- You can also *repair* Windows XP with the Wxp CD...

1- check the bios parameters to set le CD Reader as primary boot and HD as
secondary boot device

2- Insert the W xp CD and start the PC

3- Begin the installation of Windows XP:
Do Not choose repair option at this moment.
This is the access to the recovery console...

Finally the intsllation program will find Windows XP already installed on
the HD : there you choose the repair option...

No more or better idea for the moment.

Check also the answer of the other people and make a plan to
check each possible solution from the most simple to the most
"sophisticated"

Give us some news.


--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Fox Hunter]

Claude:
Found the Bootexecute value in the registry and it had been modified by SysMechanic5. Restored the value to default and, of course, uninstalled the buggy SysMech.

Still cannot run chkdsk /f but this must be because the dirty bits are not set. Chkdsk /v ran ok but did not reset the bits even though it reported errors.

Cannot do a restore as I only have about a weeks worth of restore points.

Been wondering, how does SFC and/or repair work if I have SP1 and the programs use the CD to check files?

I tremendiously appreciate your help.

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

Bonjour *Fox Hunter* :

Claude:
Found the Bootexecute value in the registry and it had been modified by SysMechanic5.
Restored the value to default and, of course, uninstalled the buggy SysMech.

Fantastic Fox Hunter ! You are a good "Sherlock Holmes" !!!

Still cannot run chkdsk /f but this must be because the dirty bits are not set. Chkdsk /v ran ok but did not reset the bits even though it reported errors.

You can reset the dirty bit with the fsutil command that way :

Start | Run | cmd <press enter> and in the cmd windows :

fsutil dirty query X: where X: = the letter of your HD

This commands give you the status of the dirty bit.

Start | Run | cmd <press enter> and in the cmd windows :

fsutil dirty set X: where X: = the letter of your HD

This command set the dirty bit.

Cannot do a restore as I only have about a weeks worth of restore points.

OK. So it's not an option.

Been wondering, how does SFC and/or repair work if I have SP1 and the programs use the CD to check files?

Sfc with the /scannow switch compare the protected Windows files with the
copy in an hidden folder C:\WINDOWS\system32\dllcache and the copies on
the Windows XP CD. If there is a difference between the original and the
copy actualy in use (for instance in C:\Windows\system32) the sfc command
replaced the suspect or corrupted file with a safe copy .

You can have more information about the Windows File Protection there:

Description of the Windows File Protection Feature
http://support.microsoft.com/default.aspx?scid=kb;en-us;222193

I tremendiously appreciate your help.

I hope this information help you.



--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Fox Hunter]

Claude:
You are too kind! I don't considered myself on the low end of the novice scale but I often get into areas less frequented.

I used the msconfig menu to select the /safeboot option and it worked after running chkdsk which had previously been scheduled on the next start. The /safeboot option must be removed while you are in safe mode or it will continue the safeboot on each start.

I disabled all the performance counters but had to disable only perfproc since additional errors appeared. The only error now is ID 2002 "wmiaprpl.dll" and is the last event after the start. I wonder if lack of sufficient time is really the problem.

What is the downside of running SFC in XP? Can it replace an updated file with an older one and cause problems? I remember running it for Win 98 to get the log and not to make changes.

Your patient guidance and valuable information (utilities) have been comforting.

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

HI *Fox Hunter* :

Claude:
You are too kind! I don't considered myself on the low end of the novice scale but I often get into areas less frequented.

I used the msconfig menu to select the /safeboot option and it worked after running chkdsk which had previously been scheduled on the next start.
The /safeboot option must be removed while you are in safe mode or it will continue the safeboot on each start.

Good ! It's a way to boot in safemode. Remember to uncheck this option
when you leave the safe mode to reboot in "normal" mode.

One remark about this option : if you can't boot in safe mode by using the
F8 key after the power On Self Test this option can stuck you in an
unbootable Windows : impossible in safe mode and in normal one
(because this option was checked!)

I disabled all the performance counters but had to disable only perfproc since additional errors appeared.
The only error now is ID 2002 "wmiaprpl.dll" and is the last event after the start. I wonder if lack of sufficient time is really the problem.

This is a strange error ( almost every errors in W xp are "strange" ;-) )

This message is related to WMI (Windows Management Instrumentation) and
wbem (an other mysterious feature of Windows ;-) )

Some informations about this message at EventID:
http://www.eventid.net/display.asp?eventid=2002&eventno=84&source=Perflib&phase=1

I guess it's not a major problem or a permanent one.
You can ignore it.

What is the downside of running SFC in XP? Can it replace an updated file with an older one and cause problems?

SFC replace the protected file with the copy of that file from the W xp CD...

Is there a problem of replacing the protected file with an old version ? No.

But:

If you upgrade to the sp2 , for example, sfc ask you to enter the
path of the new installation version...
Normally this is not a problem ... if you know that "path" ...

The best solution when you upgrade to an other Service Pack is
to create a new Wxp CD which include the sp2. This procedure is called
"Slip streaming" Detail at The Elder Geek : a very good site for W xp ).
http://www.theeldergeek.com/slipstreamed_xpsp2_cd.htm

The downside effect as I stated in a previous post is the void of all
restore points... You must stop the system restore in the applet "System"
in control panel (to erase the voided points of restore) and start it again
to create a new one.

This is important because the "voiding" of restore points by sfc is done
with absolutly no warnings ...

The problems comes when you try to restore one of these points...

I hope my explanation is readable (my native language is french not english
and sometimes my sentences may look as strange as a Windows error message
:-D )

I remember running it for Win 98 to get the log and not to make changes.

Well, I don't trust Windows as much as you Sir :-D

Your patient guidance and valuable information (utilities) have been comforting.

You'll be an expert very soon.
A good site for reliable informations and guide is The Elder Geek.
http://www.theeldergeek.com/index.htm

You can also check for good information at Kelly's Korner :
a site of Kelly Therriot[MVP]:
http://www.kellys-korner-xp.com/xp_abc.htm

And Doug Knox[MVP]:
http://www.dougknox.com/

You can check the articles of those sites from time to time and discover
new features or new way to fix the problems in W xp...

Have a great day !


--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

HI *Fox Hunter* :

About good site to know :

http://www.sysinternals.com/

A must !



--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Fox Hunter]

Claude, your English is excellent. I would not have guessed it was not your native language.

Please clarify this remark as I don't understand you meaning. "One remark about this option : if you can't boot in safe mode by using the F8 key after the power On Self Test this option can stuck you in an unbootable Windows : impossible in safe mode and in normal one (because this option was checked!)"

Yes, I know about slipstreaming. I have an installation CD that includes SP1 in case I have to reinstall.

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

Bonjour *Fox Hunter* :

Claude, your English is excellent. I would not have guessed it was not your native language.

Please clarify this remark as I don't understand you meaning. "One remark about this option : if you can't boot in safe mode by using the F8 key after the power On Self Test this option can stuck you in an unbootable Windows : impossible in safe mode and in normal one (because this option was checked!)"

Yes, I know about slipstreaming. I have an installation CD that includes SP1 in case I have to reinstall.

Simple : when you have no problem to boot Windows XP in safe mode
with the key F8 after the Power On Self Test it's fine to used the msconfig
option /BOOT.INI -> /SAFEMODE to access the safe mode.

But if you can't access the safe mode with the F8 key AND you try to access
the safe mode with the msconfig option you can not access the safe mode
AND the normal mode (since the option safe mode was checked)...

If such things happen you are in a big trouble...

This option is usefull for users with some usb keyboard unaccessible during
the boot process. If those users have a such usb keyboard and a trouble
with the safe mode you can figure out the headache...

You can use this msconfig if you are sure that W xp is trouble free
with the safe mode otherwise avoid this option.

I prefer used a "normal" keyboard and F8 ... and avoid headache


--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Fox Hunter]

Wow! Makes sense after your explaination. The reason I tried it was the inability to boot into safe mode was one of the original problems. After keying F8 and selecting Safe Mode, the screen will have Safe Mode in blue at the bottom. After the enter key the drivers start scrolling and then stops because it is hung. The last driver at the bottom of the screen is agp440.sys, if it is significant. I have to power down to restart the system. I just tried it and it still hangs instead of going into Safe Mode.

Not getting any errors in the event viewer now.

 

[Claude =?iso-8859-1?Q?LaFreni=E8re?=]

Bonjour *Fox Hunter* :

Wow! Makes sense after your explaination.
The reason I tried it was the inability to boot into safe mode was one of the original problems.
After keying F8 and selecting Safe Mode, the screen will have Safe Mode in blue at the bottom.
After the enter key the drivers start scrolling and then stops because it is hung.
The last driver at the bottom of the screen is agp440.sys, if it is significant. I have to power down to restart the system.
I just tried it and it still hangs instead of going into Safe Mode.

Not getting any errors in the event viewer now.

Well, the problem was with one of the driver loaded at startup.
(Some drivers are loaded at startup some others when you start a
program...)

1- To check which drivers are loaded at startup :
check the /BOOTLOG option in msconfig.
The log file is there :
C:\WINDOWS\ntbtlog.txt

2- You can also check wich drivers are loaded , how and when with this
tool:
ServiWin:
http://www.nirsoft.net/utils/serviwin.html

Do not change anythings unless you are absolutly sure ...
The suspected *third party* driver can be disabled for troubleshooting ...
*Be very carefull with this*.

Check with W xp tools before ! Use this if you have no choice.
The best usage of this tool is : *look only* ...

3- The Device manager can give you some informations about
drivers problems:

Start | Run | devmgmt.msc
Devices error codes
http://support.microsoft.com/Default.aspx?kbid=310123

4- Msinfo32 :
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"
Check for peripherals with problems...


5- Resources to find the updated driver:

to find the most recent drivers:
Microsoft:
http://www.windowsmarketplace.com/results.aspx?bcatId=392
http://www.microsoft.com/downloads/search.aspx?displaylang=en&categoryid=3
http://www.microsoft.com/technet/itsolutions/drivers/default.mspx
or
www.driverfiles.net




--
Claude LaFrenière [MVP]

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)
http://climenole.serendipia.net

 

[Marco Schmidt]

Try "Last known good configuration" in the menu you get after pressing
F8 on startup. It worked on my Windows 2000 Pro.