Norton removed-NO chkdsk on restart

[paulyoungstrom]

I finally removed and replaced Norton Internet Security, whereupon Windows 7 began reporting disk volume errors. Chkdsk reports errors, but is unable to fix them. Run from an administrator command prompt, chkdsk /f offers to fix the errors upon the next restart. However, when the PC is restarted chkdsk does not run. I have replaced autochk.exe with a known good copy, but the problem remains.
Would greatly appreciate your insight/experience with this problem, and possible fixes. The computer seems to be running well (better since removing Norton). Is this a real problem, or can it be ignored?

 

[Layback Bear]

Did you remove Norton with the Norton removal tool?
Do you or have you used Advance System Care or tools like it?

You can try this to check Windows system files.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[ignatzatsonic]

Did you confirm chkdsk did not run by looking in Event Viewer, specifically as a "wininit" entry? That's how it would appear if it ran on a reboot.

 

[paulyoungstrom]

Thank you for your replies!
I had to restore my system with a backup from 2 days ago (saved after replacing Norton with Eset).
I removed Norton with the (Norton) uninstall program (Start - All programs - Norton), using the option to remove settings and everything else. I believe it was a valid uninstall as it entailed questions from Norton as to why I was dissatisfied with their product. It ran smoothly.
I have used PC Tools disk repair, but I believe it just runs chkdsk as the same problem occurs. I haven't used Advanced System Care - do you recommend it?
Chkdsk does not run on restart as there is no sign of it in Event Viewer.
I have attached today's SFC details: it looks like there are 7 files it cannot repair, and 2 it cannot verify, but I frankly do not understand most of what it reports. Perhaps you could shed light on this?
Thanks for the link - I will try to work my way through the options.

 

[paulyoungstrom]

By the way, my Windows 7 DVD is an upgrade version. It refuses to perform a Repair install.

 

[Layback Bear]

DO NOT USE ADVANCED SYSTEM CARE.
I ask the question for one reason. If you use ASC you will probable need a Clean Install.
I'm not qualified to analyze sfc logs but do have a question.
Did you do sfc /scannow exactly like this tutorial instructions.? If not I recommend doing so.

By Brink:
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

If SFC could not fix something, then run the command again to see if it may be able to the next time. Sometimes it may take running the sfc /scannow command 3 or more times to completely fix everything that it's able to.

Is this the tool you used to remove Nortons?

https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us

 

[NortonSupport]

I finally removed and replaced Norton Internet Security, whereupon Windows 7 began reporting disk volume errors. Chkdsk reports errors, but is unable to fix them. Run from an administrator command prompt, chkdsk /f offers to fix the errors upon the next restart. However, when the PC is restarted chkdsk does not run. I have replaced autochk.exe with a known good copy, but the problem remains.
Would greatly appreciate your insight/experience with this problem, and possible fixes. The computer seems to be running well (better since removing Norton). Is this a real problem, or can it be ignored?

Sorry for the trouble. That's odd! Can you please elaborate it? What do you mean by "Chkdsk removed at restart?" Did you receive any message from the Norton product?

Thanks!

Vineeth
Norton Support

 

[Layback Bear]

Thank you Vineeth for coming to help.
It's nice to see a major vendor coming to help.
Welcome to the Forum!

 

[paulyoungstrom]

Thanks so much for your consideration!
I have run sfc /scannow twice from an elevated command prompt in Windows 7 as per the tutorial; results were the same. I have not yet run it at boot, but will do so.
The tool I used to uninstall Norton Internet Security was the uninstall tool that loaded with the product. I did not download anything from the Norton website to accomplish the uninstall. The uninstall tool seemed to work smoothly, said that everything was removed (including settings, etc), and I can find no trace of it. However, I will go to their website and try their removal tool, and let you know what happens.
I have received no messages from Norton, and let me clarify the chkdsk/restart problem. When I run chkdsk /f it says there are problems that it offers to fix at the next startup. I agree (Y) to have it run at the next start, then restart my computer. When the computer restarts, there is no sign of chkdsk; I don't see any evidence that it runs, and if I run it again I complete the circle. The action center continues to tell me that I have disk volume errors.
I'm open to suggestion as this is way beyond my computer literacy; I'm beginning to think of it as "Norton's Revenge."

 

[paulyoungstrom]

I downloaded and ran the Norton Removal Tool; it appeared to "run" and remove things, but I can't be sure what it actually did.
Windows still says I have disk volume errors.
Running chkdsk /f from an elevated command prompt again finds problems and offers to fix on reboot, but then does not appear on restart.
Running chkdsk within PC Tools also finds problems, says the disk will be repaired on reboot; the following message appears on restart: "Cannot find chkdsk logs, c:\ Repair disk operation completed." This appears only briefly, and gives no indication that anything was fixed. In fact, the problem persists.
I ran sfc /scannow at boot, and have attached the sfc details. To my untrained eye, I don't see any difference. That's 3 times I've run sfc /scannow, with no resolution.
Suggestions?

 

[Layback Bear]

I'm not smart enough to read and understand sfc logs.
First things first. Because you might be having problems you should back up anything you want to save just in case.
Use this program to find out what hard drive you have. Then we can hunt down another hard drive test.

By Brink:
http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

By Kari:
http://www.sevenforums.com/tutorials/311593-speccy-publish-snapshot-your-system-specs.html

This will also allow you to fill in your system specs as requested.

 

[paulyoungstrom]

ST9160821AS ATA Device
Fixed hard disk media
2 partitions
149.05 GB
NTFS

By the way, I ran SpinRite (for 17 hours!) and it found no problems with the disk surface.

 

[Layback Bear]

To make sure we are on the same page. Look at this tutorial by Brink.
Then go to the bottom of that page. Their will be a list of options. See if any of them helps your needs.
Please let us know if any of them will meet your needs.

http://www.sevenforums.com/tutorials/433-disk-check.html

I will find somebody to look at the sfc logs.

 

[NoelDP]

From your SFC log...

2014-03-18 07:12:20, Info                  CSI    000001ff [SR] Repairing 10 (0x0000000a) components
2014-03-18 07:12:20, Info                  CSI    00000200 [SR] Beginning Verify and Repair transaction
2014-03-18 07:12:20, Info                  CSI    00000202 [SR] Cannot repair member file [l:24{12}]"smserial.sys" of mdmmotsm.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-03-18 07:12:20, Info                  CSI    00000204 [SR] Cannot repair member file [l:22{11}]"autochk.exe" of Microsoft-Windows-Autochk, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-03-18 07:12:20, Info                  CSI    00000206 [SR] Cannot repair member file [l:22{11}]"msdtctm.dll" of Microsoft-Windows-COM-DTC-Runtime-TM, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-03-18 07:12:20, Info                  CSI    00000209 [SR] Cannot verify component files for Microsoft-Windows-DirectWrite-FontCache.Resources, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"hu-HU", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 07:12:20, Info                  CSI    0000020b [SR] Cannot repair member file [l:32{16}]"WebEnroll-DL.man" of Microsoft-Windows-Migration-DownlevelManifests, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-03-18 07:12:25, Info                  CSI    0000020c [SR] Cannot repair member file [l:24{12}]"timedate.cpl" of Microsoft-Windows-timedate, Version = 6.1.7601.17753, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2014-03-18 07:12:25, Info                  CSI    0000020f [SR] Cannot verify component files for Microsoft.VC80.MFC, Version = 8.0.50727.762, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:1fc8b3b9a1e18e3b}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 07:12:25, Info                  CSI    00000212 [SR] Cannot verify component files for Microsoft.VC80.MFCLOC, Version = 8.0.50727.762, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:1fc8b3b9a1e18e3b}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 07:12:25, Info                  CSI    00000214 [SR] Cannot repair member file [l:34{17}]"I386\CNBP_295.DLL" of prnca00e.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-03-18 07:12:25, Info                  CSI    00000216 [SR] Cannot repair member file [l:24{12}]"prnlx00v.inf" of prnlx00v.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch

I'll post a fix in a few minutes, I hope.

 

[Layback Bear]

Thank you Noel for coming to help.

paulyoungstrom please follow Noel's instructions.

 

[NoelDP]

I've uploaded a file - pysaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\pysaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\pysaa
or
DIR E:\pysaa



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\pysaa<drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

Then...

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply.

 

[NoelDP]

The reason that Chkdsk wouldn't run is that the autochk.exe file used to run it was missing!

<rant mode>
It's a shame that a 'Senior Norton Content Specialist' (whatever that is) can't actually say anything other than (effectively) 'WTH?'

While this particular problem may well have nothing to do with Norton, there are far too many instances of problems demonstrably fixed by a complete removal of Norton for it to be considered benign in all cases.
It does seem to have improved over recent years - particularly in the cleanliness of the uninstallers - but it still has a long way to go, and I consider it still to be almost as bad as the malware it attempts to prevent, and tending also to train the user in Pavlovian responses which actually endanger the security of the system.
In short, I would recommend against its installation on any machine, and think seriously about removing it from any machine on which I work.
</rant mode>

 

[paulyoungstrom]

Thank you Noel!
I could not reach the advanced boot menu - "Windows failed to start, recent hardware or software changes might be the cause." Then advised to use the installation disc to restart (I only have an upgrade disc), and reported that boot selection failed because a required device is inaccessible. ? At any rate, I used my windows system repair disc to access a command prompt - hope that will suffice. After I ran pysaa and rebooted, chkdsk (I think) appeared and deleted many corrupt attributes. The subsequent sfc /scannow log is attached. The checksur log is also attached.
Since doing the above, chkdsk run within PC Tools no longer finds any problems, and the Action Center is also no longer reporting any disk volume errors or other problems. However, when I run chkdsk /f from an elevated command prompt, it again schedules to run on reboot, but subsequently does not show up.

 

[NoelDP]

Here's the errors from your latest CheckSUR scan..

Summary:
Seconds executed: 1973
 Found 33 errors
 Fixed 21 errors
  CSI Manifest and S256H Do Not Match Total count: 2
  Fixed: CSI Manifest and S256H Do Not Match.  Total count: 2
  CSI Manifest Failed Catalog Check Total count: 21
  Fixed: CSI Manifest Failed Catalog Check.  Total count: 12
  CSI Payload File Missing Total count: 3
  CBS MUM Corrupt Total count: 7
  Fixed: CBS MUM Corrupt.  Total count: 7
  Fixed: CBS Paired File.  Total count: 7
Unavailable repair files:
 winsxs\manifests\x86_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_hu-hu_adf0832d51ff788e.manifest
 winsxs\manifests\x86_microsoft-windows-i..ownlevel-deployment_31bf3856ad364e35_6.2.9200.16521_none_456c86a936532e55.manifest
 winsxs\manifests\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_8a14c0566bec5b24.manifest
 winsxs\manifests\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_none_8dd7dea5d5a7a18a.manifest
 winsxs\manifests\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed.manifest
 winsxs\manifests\x86_microsoft-windows-i..orer-oob-deployment_31bf3856ad364e35_10.2.9200.16521_none_761b9dc784d6f848.manifest
 winsxs\manifests\x86_microsoft-windows-i..oyment-languagepack_31bf3856ad364e35_10.2.9200.16521_en-us_9871da7f8680534a.manifest
 winsxs\manifests\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_none_43efccf17831d131.manifest
 winsxs\manifests\x86_microsoft-windows-i..optional-deployment_31bf3856ad364e35_10.2.9200.16521_none_cf3cf63ec89764b6.manifest

The earlier one fixed a lot of problems.

SFC also shows new problems...

2014-03-18 21:12:44, Info                  CSI    00000215 [SR] Repairing 12 (0x0000000c) components
2014-03-18 21:12:44, Info                  CSI    00000216 [SR] Beginning Verify and Repair transaction
2014-03-18 21:12:44, Info                  CSI    00000219 [SR] Cannot verify component files for 830839a048f1ec01e8725930813f36e2, Version = 6.1.7601.17632, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    0000021c [SR] Cannot verify component files for b59c32f608fe3a3f8409c4303f51d707, Version = 6.1.7601.17952, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:b77a5c561934e089}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    0000021e [SR] Cannot repair member file [l:22{11}]"msdtctm.dll" of Microsoft-Windows-COM-DTC-Runtime-TM, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-03-18 21:12:44, Info                  CSI    00000221 [SR] Cannot verify component files for Microsoft-Windows-DirectWrite-FontCache.Resources, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"hu-HU", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    00000224 [SR] Cannot verify component files for Microsoft-Windows-ImageBasedSetup-IE-Base-Downlevel-Deployment, Version = 6.2.9200.16521, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    00000227 [SR] Cannot verify component files for Microsoft-Windows-InternetExplorer-Optional-Deployment-LanguagePack, Version = 10.2.9200.16521, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    0000022a [SR] Cannot verify component files for Microsoft-Windows-InternetExplorer-OOB-Deployment, Version = 10.2.9200.16521, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    0000022d [SR] Cannot verify component files for Microsoft-Windows-PeerToPeerBase.Resources, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    00000230 [SR] Cannot verify component files for Microsoft-Windows-Printing-StandardPortMonitor-TCPMibDLL, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    00000233 [SR] Cannot verify component files for Microsoft-Windows-Security-Licensing-SLC, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    00000236 [SR] Cannot verify component files for Microsoft.VC80.MFC, Version = 8.0.50727.762, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:1fc8b3b9a1e18e3b}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)
2014-03-18 21:12:44, Info                  CSI    00000239 [SR] Cannot verify component files for Microsoft.VC80.MFCLOC, Version = 8.0.50727.762, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:1fc8b3b9a1e18e3b}, Type = [l:10{5}]"win32", TypeName neutral, PublicKey neutral, manifest is damaged (TRUE)

This concerns me - problems should not keep appearing. It may be that your hard drive is failing.
Please check Event Viewer - Windows Logs > Applications - look for the results of the CHKDSK scan (filter on Source: Wininit), copy and paste the results to your reply

 

[paulyoungstrom]

I reran pysaa, as that seems to be the only way to subsequently run a scheduled boot chkdsk (if only once). That log is attached.

By the way, Windows Update has started nagging me to install 2 updates (kb2604121 and kb2737019). I've tried to install them 3 times, and each time has failed. This is unusual; could it have something to do with this problem?