System File Checker Problem

[BobK]

NoelDP

Attached file contains DropBox link.

 

[NoelDP]

You have some major file system problems - from your CBS log...

 Line 52742: 2014-04-20 14:32:29, Error                 CSI    0000010d (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #2226859# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile(h = 5d8 ("\Device\HarddiskVolume3\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp6.jpg"), evt = 0, apcr = NULL, apcc = NULL, iosb = @0x87d210, data = {l:0 b:}, byteoffset = 393216 (0x0000000000060000), key = (null))
 Line 52744: 2014-04-20 14:32:29, Error                 CSI    [EMAIL="0000010e@2014/4/20:18:32:29.377"]0000010e@2014/4/20:18:32:29.377[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2155): Error c0000185 [Error,Facility=(system),Code=389 (0x0185)] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile expression: (null)
 Line 52746: 2014-04-20 14:32:32, Error                 CSI    0000010f (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #2226858# from Windows::Rtl::SystemImplementation::CFile_IRtlFileTearoff::ReadFile(Flags = 3, Buffer = {l:0 ml:65536 b:}, Offset = 393216 (0x0000000000060000), Disposition = 0)[gle=0xd0000185]

This appears to have terminated the SFC scan.


I suspect that this is a problem with the drive -


Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.

You will be told that the drive is locked, and the CHKDSK will run at he next boot - hit the Y key, and then reboot.
The chkdsk will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot)

Once completed,
Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

 

[BobK]

Chkdsk

Apparently CHKDSK must run at different levels. I do run this monthly and always get the message that "No problems were found on the device or disk. I is ready to use." I have attached a more detail summary of the last disk check.

I saw that if I run CHKDSK C: /F /R it will attempt to fix any bad sectors. Do you think that is advisable?

 

[NoelDP]

The CHKDSK C: /R that I suggested will do exactly the same as the /F /R - the /F is redundant as it does a subset of the /R tests.

/F simply tells CHKDSK to fix problems found (without the /F CHKDSK just reports 'some of' the problems found, without attempting to fix them).
/R fixes found problems (exactly as /F), then scans the whole drive for access problems and attempts to read 'sticky' sectors, and copy data into good ones, if necessary - it then flags any bad sectors so that Windows ignores them in future.

 

[BobK]

CHKDSK C: /R Completed Finally

Sorry for the delay; I have just returned and have finally completed the CHKDSK C: /R run. The results: "Windows Replaced Bad Clusters" in three files; all in the Windows directory. They were GB-wp6.jpg, HPFIGLHN.dll, and system.windows.Forms.d77 files. The system rebooted cleanly when finished.

Then it got hard! I navigated "Event Viewer" => "Windows Logs Events" => "Application Events." The menu bar "file" tab contains no "save" option. On the right side under "Actions" there were choices to "Open Saved Log", "Save All Events As ...", and "Find." None of the choices found any files.

Finally I searched the entire C directory and found 21 *.evtx files in the c:\Windows\System32\winevt\Logs directory, all generated at the right date-time. Most of the files are from 1MB to 5MB. There are three 20MB files. They are Security.evtx, System.evtx, and Application.evtx.

 

[NoelDP]

OK - just copy the Application.evtx file to your desktop, compress it, and attach it to a reply.

It does sound as if your system's hard drive is failing - I would start backing up now, and preparing to replace the drive.