chkdsk appears to have deleted stuff and disabled system restore

windowsuser111 · 01 Aug 2011

dunno if this is the right place to post this

i ran chkdsk last night and today when i logged in around half of my desktop shortcuts were gone; they were there before chkdsk ran.
i tried to do system restore, but it failed because the restore point was damaged or deleted (couldn't extract a file from c:\windows\amd64\smbserver or something like that)

here's the chkdsk log

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
Cleaning up instance tags for file 0x169bc.
502272 file records processed. File verification completed.
1071 large file records processed. 0 bad file records processed. 0 EA records processed. 108 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
587884 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
502272 file SDs/SIDs processed. Cleaning up 1378 unused index entries from index $SII of file 0x9.
Cleaning up 1378 unused index entries from index $SDH of file 0x9.
Cleaning up 1378 unused security descriptors.
Security descriptor verification completed.
42807 data files processed. CHKDSK is verifying Usn Journal...
35182440 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
502256 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
182548981 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

966359039 KB total disk space.
235295752 KB in 437897 files.
233304 KB in 42808 indexes.
0 KB in bad sectors.
634059 KB in use by the system.
65536 KB occupied by the log file.
730195924 KB available on disk.

4096 bytes in each allocation unit.
241589759 total allocation units on disk.
182548981 allocation units available on disk.

Internal Info:
00 aa 07 00 c7 55 07 00 f1 a9 0d 00 00 00 00 00 .....U..........
2b 0d 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 +...l...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

thanks

mjm6783 · 01 Aug 2011

Hmm, the only thing I see in the log is a pretty common cleanup of index and security entries.

Interwebs says this:

This problem occurs because if Chkdsk is run against an NTFS volume, Chkdsk.exe may report that security descriptors are in the database that are no longer referenced by any file or folder and that it is removing them. However, Chkdsk.exe just reclaims the unused security descriptors as a housekeeping activity, and it does not actually fix any kind of problem.

Not sure if that would have any impact on your shortcuts or restore points though. In fact I would guess that it wouldn't Maybe there is another issue here, have you made any other changes to the operating system, or an unsuccessful restore at any point?

windowsuser111 · 01 Aug 2011

i don't believe so
havent restored in a while though so i wouldn't know when that part happened

just ran sfc/scannow and it didn't find anything wrong

karlsnooks · 01 Aug 2011

Simple.

Your hard disk has problems.

Run chkdsk /r again!

this time use following to view the results.

VIEW CHKDSK (CHECK DISK) LOG

Check Disk (chkdsk) - Read Event Viewer Log

The log giving the results from running Check Disk can be viewed using the Event Viewer.

· WIN key | type EVENTVWR.MSC | ENTER key
WIN is the key with the Microsoft flag on top.
· Wait for the Summary of Administrative Events section in the middle pane to be populated.
· In the left-pane, click on Windows Logs | Application
· Right-click on Application | select Filter current log
· in the <All Event IDs> box, enter 1001 | OK button
· center pane, Sources column, click on Wininit
you could have made that selection also in the filter dialog
· The chkdsk log is in the General tab
· To save: click in the scrollable area of the General tab |
Ctrl + A (to select All) | Ctrl + C (to copy the selection)
· paste your selection into NotePad, WordPad, Word or the editor of your choice.

windowsuser111 · 02 Aug 2011

ran it again, here's the log

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
502272 file records processed. File verification completed.
1071 large file records processed. 0 bad file records processed. 0 EA records processed. 108 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
587978 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
502272 file SDs/SIDs processed. Cleaning up 157 unused index entries from index $SII of file 0x9.
Cleaning up 157 unused index entries from index $SDH of file 0x9.
Cleaning up 157 unused security descriptors.
Security descriptor verification completed.
42854 data files processed. CHKDSK is verifying Usn Journal...
36350520 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
502256 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
182678570 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

966359039 KB total disk space.
234774700 KB in 440240 files.
234496 KB in 42855 indexes.
0 KB in bad sectors.
635563 KB in use by the system.
65536 KB occupied by the log file.
730714280 KB available on disk.

4096 bytes in each allocation unit.
241589759 total allocation units on disk.
182678570 allocation units available on disk.

Internal Info:
00 aa 07 00 1d 5f 07 00 e6 bb 0d 00 00 00 00 00 ....._..........
2b 0d 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 +...l...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

karlsnooks · 02 Aug 2011

OK.

Let's take a different tack.

Is this a networked computer?

Does this computer belong to a workgroup of computers?

Run CLEANMGR.EXE (that's the win 7 disk cleanup pgm).

Download, install and run the free CCleaner (link in my sig)

After than, then carry out following:
LIST OF STARTUP AND INSTALLED PROGRAMS USING CCLEANER

STARTUP PROGRAMS
CCleaner | Tools icon | Startup button | click on Save to text file button (bottom right side)

Using the PAPER CLIP icon in the top panel of a Message Reply window, attach the startup.txt file generated by CCleaner.

INSTALLED PROGRAMS
CCleaner | Tools icon | Uninstall button | click on Save to text file button (bottom right side)

Using the PAPER CLIP icon in the top panel of a Message Reply window, attach the install.txt file generated by CCleaner.

windowsuser111 · 03 Aug 2011

sorry for the late reply

which files should i delete in disk cleanup?

karlsnooks · 03 Aug 2011

which files should i delete in disk cleanup?

All.

karlsnooks · 03 Aug 2011

WindowUser,

| MSCONFIG |STARTUP tab |

uncheck ALL except for:
MSC "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

Reboot your computer immediately thereafter.

You haven't deleted anything this way. You have simply told Win 7 not to run the programs at startup.

I will be looking at the install.txt file next.

I can already tell you one very strong recommendation I will make:

REMOVE ALL anti-virus type of software EXCEPT for Microsoft Secrutiy Essentials.

This is not the Windows 3 and Win xp days.

MORE is NOT better.

Rest assured that you will have a much better system without any av except for Microsoft Security Essentials.

When you notice behaviour that you think may be virus relate, then urse the Microsoft Standalone System Sweeper.

karlsnooks · 03 Aug 2011

WindowUser,

You have so much installed on there that you don't need that it staggers my imagination.

For all of the off-of-the-wall stuff you have, go to the mfg's website and see if they have a win 7 64BIT version. If not, then delete. If yes, then update to the win 7 64 bit version if you haven't already.

Your firefox is far, far out-of-date. Either update or remove.