3 computers now where chkdsk was automatically started

[CountryBumkin]

Over the past two weeks I have been seeing some weird behavior on my home computers.

First my primary computer started to act up (slow boots, freezing, and auto-start of windows recovery services, etc., some issues found running dism and chkdsk that wouldn't fix). It seemed the hard drive was going bad, so I bought a SSD. I installed a clean version of Win7 Pro x64. Reloaded everything over the weekend. Everything seemed to be working well. Last night I ran the windows backup (backed up image of C: to drive D:. The program said it finished but this morning there is a warning (the taskbar "notification flag") that said the process failed and I should run "chkdsk /r". So I am running it now on drive D: and it seems to be taking for ever. It's now on step 4 of 5 (it is at 10% on file 76 of 13,xxx). It's taking a few minutes just to go from file 50 to 76. Hopefully it will be finished when I get home tonight.

Then my second (media server) computer went into an automatic "chkdsk" mode the other day. It scanned the hard drive (made a fix I think) and all seems okay.

This morning my third computer (wife's) was acting up. First it was very slow starting/browsing internet, then the computer froze (ctrl+alt+del won't work). When I restarted it up, the automatic Chkdsk scan started. Its at about 22% now.

Coincidence?
I an running Microsoft Security Essentials and Malwarebytes Premium. Nothing was reported by either.

 

[MilesAhead]

Are the 3 machines networked together? I think I would do a clean install of the first one where you changed the HD to SSD. Do not restore the backup image. Disconnect it from everything. See if it stays clean for a day or two. If so then likely you have an infection that's a bit more sophisticated than usual.

Edit: The other thing is, are your machines battery backed up? If not it is conceivable that a very quick power glitch is what is causing errors on the file systems.

 

[CountryBumkin]

Hi Milesahead,
I did a clean install on the first computer (I did Not restore a backup image).
All the computers are networked together.
All computers are on their own APC battery backups.
I'll watch everything for a couple of days - hopefully this is just coincidence and not a virus of some sort.
As I mentioned, all computers have anti-virus and malware protection.

Thanks for responding.

 

[MilesAhead]

OK. Please post what you find out from the disk scans. If there were lots of disk errors fixed etc..

 

[CountryBumkin]

I now have another computer that is acting up. I went to start my HTPC last night and got a message that boot manager (or such) can't be found "insert disk and hit any key" message. I put in the Windows 7 installation disk but it wanted a Recovery (or maybe it was Repair) disk, which I didn't have. I went to another computer to make one, however when I came back and restarted the HTPC it booted up normally. I am going to run chdsk and sfc fist chance I get.

It may be just coincidental but I seem to be having a lot of computer problems lately.

My wife's computer and my office computer are now rebuilt (clean Windows install) and working fine. The HTPC computer has no data to backup (it just streams video from server to TV) so it would not be a problem to reinstall Win if I have too.

But want is going on with these machines? I am now running Malwarebytes premium (was not before) and MS Security Essentials (which I have always had installed) on all my computers.

 

[MilesAhead]

If it is attacking the boot mechanism you probably have a root kit that is spreading across the network.

I would read through everything in the tutorials section that comes up under rootkit. Here is one:
http://www.sevenforums.com/tutorials/338877-kaspersky-tdsskiller-detect-repair-tdss-rookits.html

Also I would try some different scanners. Especially those that detect rootkits. You can download trial versions of most av scanners from the major download sites like Softpedia.com and Snapfiles.com.

Best Free Rootkit Scanner and Remover | Gizmo's Freeware

 

[CountryBumkin]

Thanks again. I'll head over to Kaspersky now and get this TDSSkiller program. I see that Malwarebytes has a (beta) Anti-RootKit available now at their website. I'll get that too.

 

[MilesAhead]

Thanks again. I'll head over to Kaspersky now and get this TDSSkiller program.

You are welcome. Please post back what you find.

 

[GokAy]

MBAM has an option to scan for rootkits that you need to check (default is unchecked). Try that one too.

 

[CountryBumkin]

Thanks.
I installed Malwarebytes premium on the two computers where I just re-installed Windows (so it possible any rootkits are gone with the clean install). I ran the scan yesterday, but not the rootkit scan (thanks for pointing out that scan is not on by default).

I think the Malwarebytes license allows me to install it on up to 3 computer (I'll recheck that) as I have five computers in the house. But I could run the Trial version on the other two if needed.

 

[GokAy]

It depends. Mine is an older Pro license which was changed to Premium so I can only install on 1 PC. Catch is it's lifetime subscription.

If yours has a yearly subscription, then you can install premium on 3 machines.

 

[MilesAhead]

Another thing you can do, especially if there are other users on other machines less "techie" than yourself, is set them up with the free ToolWiz TimeFreeze

I use it to try out installs. It uses Shadow Services to redirect all writes that would go to the system partition, to a cache file. When you reboot all changes are discarded. You can download to a different drive or put a folder in the exception list so that downloads aren't thrown out. It works pretty well. I have a Laptop and the latest version has very little performance hit. A nice freeware to have.

 

[GokAy]

Oh, nice I have Acronis 2010 TI Home and it does have similar functionality but never used it to be honest I am reluctant to test some stuff. Maybe I can use TimeFreeze for those.

 

[MilesAhead]

Oh, nice I have Acronis 2010 TI Home and it does have similar functionality but never used it to be honest I am reluctant to test some stuff. Maybe I can use TimeFreeze for those.

Probably closest to it in function is Returnil. But TimeFreeze is free and more recently updated afaik.

 

[CountryBumkin]

I ran the Malwarebytes Anti-Maleware and Anti-Rootkit beta programs on both computers (that had clean Windows install) and nothing was detected, however I don't think it is scanning my "D:" drive which is where I store saved programs and my backups. I did not see the D:/ come up during the scan and there is no place in the program to select a specific drive.

Should I be scanning D:?

 

[MilesAhead]

On MBAM if you have Explorer Integration enabled, you can right click a drive, folder, or file, in Explorer and scan it. I recommend opening MBAM first and updating the database, then closing it, before doing the right click scan. At least on my freeware version it will do a Threat Scan rather than what I right clicked on, if I don't perform that ritual. I don't know why.