Solved Chkdsk results

[ICIT2LOL]

Have just read Brink's brilliant tutorial on finding stuff in event viewer and went looking for my last chkdsk.

Following the instructions I came up with an entry called Wininit it had the chkdsk results etc but as a matter of curiosity why the difference in the location name? as I have seen it before and have not really known what it is.

However I am going to spend a bit more time inhere as my local forum one has to crowbar such info out and one doesn't always get the answer back that one expects - or likes!! (I'm a newbie)

While I am here a member of the other forum told me that he was concerned my machine was constantly rebooting (gleaned from a Kaspersky report) although I cannot see those reboots in those reports myself as such.

I am a bit concerned as I leave all three on from say 7am - 11pm on days off and 7am-1.30pm on workdays.

Can I get this info from the event viewer as I certainly do not reboot in any such way except if a Windows update requests it.

 

[Neutron16]

I am not sure what do you mean by "difference in the location name". WINdows INITialization process (Windows Start-up application) starts, performs disc check with a child process and reports results.

Regarding reboots you can check this article
How To Know the Last ShutDown Time Of Your Windows PC
If you filter by described Event ID 6006, it will give you shutdowns and restarts all together.

Or you can check reboots with Everest by Lavalys.

 

[ICIT2LOL]

Ok

Sorry Neutron I meant or should have said when I "find" > chkdsk > it comes up with the wininit log and shows the chkdsk log.

then

> details gives me the report.

Ok I might try that Everest app - cheers!

 

[ICIT2LOL]

Ok Brink

Sorry forgot we can upload here!

 

[Neutron16]

ICit2lol, from the first post I understood what you have done, and what you have found. But your question is still not clear.

Are you surprised with the fact that you were looking for "X" and it is showing you "Y"?

As I explained earlier, Wininit is a Windows Start-up application, which starts Windows, if something is required during start up, like disc checking, it does that via child processes (starts other applications).

But if you start CHKDSK from Windows yourself, that is a totally different story. It will be reported under its own name - in Event Viewer source would be Chkdsk (NOT wininit), because in this case it would NOT be considered a child process, because the process was initiated by user, rather then by another program.

 

[ICIT2LOL]

ICit2lol, from the first post I understood what you have done, and what you have found. But your question is still not clear.

Are you surprised with the fact that you were looking for "X" and it is showing you "Y"?

As I explained earlier, Wininit is a Windows Start-up application, which starts Windows, if something is required during start up, like disc checking, it does that via child processes (starts other applications).

But if you start CHKDSK from Windows yourself, that is a totally different story. It will be reported under its own name - in Event Viewer source would be Chkdsk (NOT wininit), because in this case it would NOT be considered a child process, because the process was initiated by user, rather then by another program.

Ok Neutron now I am still following the tutrial steps exactly and getting the same results.

I have initiated chkdsk on several occasions but the tutorial procedure for checking results comes up with the same result - the screen I posted (on all three machines).

I start chkdsk by > Computer > right click > Properites > click Tools > click Check now > tick both boxes > click Start > message > do i want to schdeule the check forthe next time I start the computer > Schedule check disk check > go back out of the Computer windows (and usually I do this at night after work) > reboot.

The black screen with the chkdsk info in white text will start saying that unless one hits any button in a set time frame (a count down is shown in seconds) > leave it and the chkdsk starts up and I go to bed.

Am I doing it wrong and / or missing something out because I know I have done at least four chkdsk's over the last two months and there is the only one reference by "Find" to Wininit??

I will set them all for tonight when I get home from work and then check again in the morning but I am not going to hold my breath.

Sorry mate to cause you this angst as I said I am not really that computer literate and just followed the instructions for doing a chkdsk from Googling for an answer.

 

[Neutron16]

Those checks could be missing if log was cleared.

I initiated chkdsk the way you described and I have found it in the Event Viewer under Windows Logs/ Application
by Event ID number 26212.

 

[ICIT2LOL]

Hmmmm

Neutron don't know why mine is different because I purposely set a chkdsk last night and this is what I get from "Find" in Windows Applications on checking this morning.

So I am lost for what is going on

 

[Neutron16]

It is there mate. Just search the number only, do not add "event" word.

 

[ICIT2LOL]

Hmmmm again

Yeah neutron thats the first thing I did - same result so I added the word "event" for the second try.

Just don't know what the heck is going on?

 

[Neutron16]

That is interesting.
If you want, you can save events, upload somewhere and PM me the link.
Windows Logs\Application - right click -Save All events as.

 

[ICIT2LOL]

Ok

Ok mate I have saved to my docs I'll send that as a file if it doesn't come out let me know and I'll have to find some other way.

Now it's taken ages to upload and it's only 4.5Kbs long so heres hoping.

 

[ICIT2LOL]

Try something else

Neutron have tried several things and cannot get it down to a size that will upload.

As a matter of curiousity I built this machine about 5 weeks ago yet the event log goes back to Jan 2010??

So I'm off to find a way of copying it in order to send.

 

[ICIT2LOL]

No go

Hey Neutron have tried all sorts of ways of saving this log but am getting nowhere, any ideas??

 

[Neutron16]

Select the very first event and holding SHIFT press PAGE DOWN key untill two days worth of data is selected then Right click - Save selected event.

Jan 2010 might be something to do with installation process before you selected the current date on the computer or something like that. I have entries from 2009, but my system is way newer than that.

 

[ICIT2LOL]

Ok

Ok Neutron I did that but was starting from the bottom and it was going to take forever so I treid from two days ago and tried saving ti asa word doc and it came back too much info for upload.

So I'll try the last ?4 days perhaps as just the saved log *.evxt.

Here goes and if I don't get back soon it's because it's getting close to workhouse time

 

[ICIT2LOL]

Cripes

Neutron is this ok??

 

[Neutron16]

So far, I spotted only these two:
Information 6/05/2011 2:26:36 a.m. Wininit 1001 None
Information 4/05/2011 1:26:47 a.m. Wininit 1001 None

And you witnessed more chkdsk checks?

 

[ICIT2LOL]

Neutron

Now mate this is the strangest thing this happens on all of my machines - even the one I am cleaning up for a friend.

I did one last night for a look see - same result and there should be quite a few stretching back to last year as I have done chkdsk's on a fairly regular basis a while ago when I was experiencing slow downs etc, but "Find" only comes up with these two - well will be three now.

The slow downs I don't know what caused them as scanning with my ISS. MBAM, HiJack This, Kaspersky TDSS killer, GMER, DrWeb all came up clear.

So why this Wininit is coming up as the result I don't know as in the past it has referred to - chkdsk. AS a matter of interest on trawling through screeds of entries the chkdsk changed to wininit early Dec 2010.

Sory I meant to say that I only wnet back a couple of days or so.

 

[Neutron16]

chkdsk could not just change into wininit. Wininit with event id 1001 is a chkdsk, it is just run at the startup before windows starts, chkdsk with event id 26212 is chkdsk run in Windows by a user.

I am sorry, I am not able to tell more without access to those events and their descriptions.
But I am sure that the answer is simple and straight-forward, we just need to find it.