1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Does this corruption look potentially fatal?

Discussion in 'Hardware' started by Joseph King, Dec 17, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. Joseph King

    Joseph King Thread Starter

    Joined:
    Jun 30, 2001
    Messages:
    305
    I'm running XP SP3 on a machine used by my assistant. While it was sitting idly we noticed a prominent error message had appeared in the middle of the desktop:

    Windows - Delayed Write Fault
    Windows was unable to save all the data for the file C:\Documents and Settings\All Users\Application Data\Norton\0000000=82\0000011A\00000581\DTLMS1.dat. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

    When I clicked OK, a bubble popped up over the warning triangle in the systray saying the identical thing but with DTLMS2.

    And at the same time, clicking OK on the main error caused the window to disappear only to reveal an identical error message underneath that window but with a different path and filename, and so on, until I quit counting and gave up.

    I then tried to open Word and SnagIt to no avail. And when I tried to open Notepad, and got an error saying:

    C:\Windows\System32\Notepad.exe
    Not enough quota is available to process this command.

    At that point, I turned off the machine with the power button and restarted it. On restart, it went into CHKDSK, and I watched it do a lot of repairs.

    Here's the Winlogon file:

    =======================================================

    Checking file system on C:
    The type of the file system is NTFS.


    One of your disks needs to be checked for consistency. You
    may cancel the disk check, but it is strongly recommended
    that you continue.
    Windows will now check the disk.
    The attribute of type 0x80 and instance tag 0x0 in file 0x198
    has allocated length of 0xcb3000 instead of 0xcaf000.
    Deleted corrupt attribute list entry
    with type code 128 in file 408.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x13c0000000038fa. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 14586.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x1320000000042be. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 17086.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x81000000005060. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 20576.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xcb000000005141. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 20801.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x17300000000b7d3. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 47059.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xcab00000000b98f. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 47503.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xb600000000b9da. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 47578.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xf000000000c448. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 50248.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x171000000012ded. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 77293.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xd420000000130eb. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 78059.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x230000000013184. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 78212.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xa700000001320e. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 78350.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xcbb000000013223. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 78371.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x600000000132de. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 78558.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x1e0000000133ad. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 78765.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x130000000144b0. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 83120.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x34000000014ba7. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 84903.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0xc80000000155d6. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 87510.
    Unable to locate attribute with instance tag 0x0 and segment
    reference 0x2000000016a00. The expected attribute type is 0x80.
    Deleting corrupt attribute record (128, "")
    from file record segment 92672.
    The file reference 0x55000000000561 of index entry ncwperfm.db-journal of index $I30
    with parent 0x1a3 is not the same as 0x54000000000561.
    Deleting index entry ncwperfm.db-journal in index $I30 of file 419.
    The file reference 0x55000000000561 of index entry NCWPER~1.DB- of index $I30
    with parent 0x1a3 is not the same as 0x54000000000561.
    Deleting index entry NCWPER~1.DB- in index $I30 of file 419.
    The file reference 0x4f000000000561 of index entry SYMEFA.DB of index $I30
    with parent 0x3dd0 is not the same as 0x54000000000561.
    Deleting index entry SYMEFA.DB in index $I30 of file 15824.
    Cleaning up minor inconsistencies on the drive.
    CHKDSK is recovering lost files.
    Recovering orphaned file SYMEFA~1.DB- (790) into directory file 15824.
    Recovering orphaned file SYMEFA.DB-journal (790) into directory file 15824.
    Recovering orphaned file NCWPER~1.DB- (1377) into directory file 419.
    Recovering orphaned file ncwperfm.db-journal (1377) into directory file 419.
    Cleaning up 1714 unused index entries from index $SII of file 0x9.
    Cleaning up 1714 unused index entries from index $SDH of file 0x9.
    Cleaning up 1714 unused security descriptors.
    Inserting data attribute into file 408.
    CHKDSK is verifying Usn Journal...
    The remaining of an USN page at offset 0x6f8ea590 in file 0x37
    should be filled with zeros.
    The remaining of an USN page at offset 0x6f8eb108 in file 0x37
    should be filled with zeros.
    The remaining of an USN page at offset 0x6f8ec420 in file 0x37
    should be filled with zeros.
    The remaining of an USN page at offset 0x6f8ed210 in file 0x37
    should be filled with zeros.
    The remaining of an USN page at offset 0x6f8ee478 in file 0x37
    should be filled with zeros.
    The remaining of an USN page at offset 0x6f8ef058 in file 0x37
    should be filled with zeros.
    Repairing Usn Journal file record segment.
    Usn Journal verification completed.
    The upcase file content is incorrect.
    Correcting errors in the uppercase file.
    Correcting errors in the master file table's (MFT) BITMAP attribute.
    Correcting errors in the Volume Bitmap.
    Windows has made corrections to the file system.

    488375295 KB total disk space.
    48774920 KB in 86358 files.
    32348 KB in 7185 indexes.
    0 KB in bad sectors.
    213307 KB in use by the system.
    65536 KB occupied by the log file.
    439354720 KB available on disk.

    4096 bytes in each allocation unit.
    122093823 total allocation units on disk.
    109838680 allocation units available on disk.

    Internal Info:
    e0 77 01 00 73 6d 01 00 d8 06 02 00 00 00 00 00 .w..sm..........
    e8 00 00 00 02 00 00 00 35 0d 00 00 00 00 00 00 ........5.......
    9e 29 26 08 00 00 00 00 0a ff 19 23 00 00 00 00 .)&........#....
    ee 67 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 .g..............
    00 00 00 00 00 00 00 00 f2 eb 12 4b 00 00 00 00 ...........K....
    80 d7 5e b2 00 00 00 00 80 38 07 00 56 51 01 00 ..^......8..VQ..
    00 00 00 00 00 20 fc a0 0b 00 00 00 11 1c 00 00 ..... ..........

    Windows has finished checking your disk.
    Please wait while your computer restarts.


    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    =======================================================

    On booting after that, it seems pretty stable. A couple processes did fail until I rebooted again, and now it seems to all be okay, though I haven't had a chance to test a lot as yet.

    Based on that Winlogon file, can you please tell me whether you think this machine might be okay as is? Or if you'd try to find a recent restore point to restore to? Or if you'd throw in the hat before it gets any more involved and just reinstall the OS and apps?

    And, besides my asking if the current install looks like it might still be in good shape, what do you guess caused this? Hardware? I'm going to run a memory test at the least.

    Thanks!
     
  2. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    You should back up anything at all that you might want to save. The hard drive may be failing.

    After backing up, run chkdsk /r at boot time and look for bytes in bad clusters in the final report. Or run the manufacturer's test. But only after backing up since the test itself could end up causing the drive to fail completely.

    (Moving to Hardware.)
     
  3. Joseph King

    Joseph King Thread Starter

    Joined:
    Jun 30, 2001
    Messages:
    305
    Thanks. It's got a RAID 5 setup. And it may be under HP warranty still, to get replacement drives. Problem is with these dc7800 machines I've had issues with "maybe it's the hard disk controller, maybe it's the drive" to where I've just replaced machines rather than keep chasing it down. I have extra identical machines here to clone if needed. I'll start imaging the machine regularly. Maybe I'll run a memtest too.

    Meanwhile, would you feel okay continuing to run the current install based on the above resutls if it seems to be running okay so far?

    Thanks!
     
  4. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    I would expect drive corruption to increase until failure.
     
  5. Joseph King

    Joseph King Thread Starter

    Joined:
    Jun 30, 2001
    Messages:
    305
    I'm now performing frequent image backups of the machine.

    Please tell me:

    1. How much do you think this could have been a "fluke" and it might run fine another year or more with no issues? Since my experience is it could be hard drive or hard disk controller (I’ve had similar issue with these same machines, that pointed to hard disk but weren’t resolve by replacing the drives), I’ll replace the whole machine (rather than just the drives) using an image backup. I have one brand new in-the-box machine that I was saving in case my main machine goes down. Would you do that now, or wait to see if it ever happens again, on the chance it was just a fluke? I realize this is a guess.

    2. It seems to be running fine right now, so I’m optimistic the OS and apps survived this last crash and the resultant CHKDSK repair without issue. I’m not going to reinstall the OS and apps unless I see issues come up. I’m going to just address this from the hardware side unless I see an issue with the software. But would you do a System Restore from a previous Restore Point (it’s XP) at this time, or would you leave it be and hope for the best if no issues are showing up?

    Thanks so much!
     
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1031608

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice