windows was unable to complete the disk check

[Ken Aitken]

I'm running XP Home Edition (SP3 as of today but that's not the problem) on a
Toshiba Satellite P30 with an NTFS file system and it keeps stopping - mouse
still moves and alt tab works but nothing else. Been trying all the usual
maintenance to see if that helps: Windows Update, Virus Scan, Disk Clean Up,
etc. However, I can't get Check Disk or Defrag to run. When I try to run
Check Disk from the disk properties/tools tab I get the error "windows was
unable to complete the disk check". I've tried chkdsk from command prompt
but it says it can't run becasue of other processes (although I've no other
apps open) and schedules for next restart. When it tries to run at restart
it says the disk is RAW and can't be checked. I've also tried it from safe
move to no avail.

Similarly, Defrag won't run - well it starts but when I hit Analyse it says
it can't!

Is my disk on it's way out?

Appreciate any help.

Rgs

Ken

Appreciate any suggestions for fixing

 

[Ken Aitken]

Thanks, John.

I've got the full Norton Protection Centre so I'm not sure Symantec on-line
will add much. I suspect my problem, if it's not the disk, may be with
network driver or IE so going on line my be challenging anyway. (I'm doing
this from another PC, BTW.)

Currently running CHKDSK from recovery console, and it's doing something, so
I'll see what that turns up. If that doesn't sort the problem I'll have a
look at the third party option.

Rgs

Ken

 

[Ken Aitken]

So, CHKDSK run from recovery console and claimed to have fixed some problems
but it still won't run from Windows (or command prompt) and neither will
Defrag.

And the Laptop still hangs (when I started IE)...

Any suggestions?

 

[1PW]

If you recently had a fake antivirus program such as AV2009 (they go by
many names), they can cause the raw disk, no chkdsk, no defrag issues.
Once the infected files are removed, the problem goes away. I had to
reformat many of these infected machines before I figured it out.

I have found this to be caused by a UAC Rootkit which may require you
to boot to a Live CD such as UBCD to resolve, but you will have to know
your way around the registry as well as searching it out in c:/programs
files, c:/windows, c:/windows/system32, c:/windows/system32/drivers
among others locations such as the user profile application data
folders. Note that Live CDs that automatically load the remote registry
do not always help since I believe that the some PE environments are so
robust, that the infection may be active in that it will be hidden. UBCD
is great for this, although it may not pickup many Sata drivers.

The easiest way would probably be to download Combofix from
http://download.bleepingcomputer.com/sUBs/ComboFix.exe and/or SDFix from
http://www.myantispyware.com/2007/11/09/sdfix-free-trojan-remover-tool/.

Combofix is my first method of choice since it can be run in both Safe
and Normal Mode, while SDFix can only be run in Safe mode.

Hope this helps, I don't frequent this forum, but I know many techs
that meet their match with this one and I wanted to help.

I wonder if GMER would have mitigated this rootkit?

<http://www.gmer.net/#files>