BleepingComputer.com: Ran CHKDSK found 4 KB in bad sectors.

I was sent here from the "Virus, Trojan, Spyware, and Malware Removal Logs Forum" by B-boy/StyLe/ . He helped me remove Internet Security 2011 malware from my computer. My computer is now malware free. That thread can be found here http://www.bleepingcomputer.com/forums/topic371390.html . I am running vista (32 bit).

Anyway during the above process after doing an OTL custom scan (see page 5 in above link) he noticed errors that indicate problems with the file system structure of my HDD (A 140GB TOSHIBA MK1637GSX ATA).

Error - 1/15/2011 2:04:16 PM | Computer Name = Owner-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/15/2011 2:04:19 PM | Computer Name = Owner-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/15/2011 2:04:23 PM | Computer Name = Owner-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.


He then asked me to do a CHKDSK scan (chkdsk c: /f /r ), which found 4kb in bad sectors (full results of CHKDSK scan are at the end of this post.) What should I do?

He was concerened about this but not comfortable in this area (HDD) so asked me to post here.

He did say:
"If the errors are logical, but not physical I am sure that HDD regenerator will repair them all.
My boss laptop had 2 KB in bad sectors and HDD regenerator fixed about 900 errors for 8 hours and now all is ok. HDD Regenerator is very powerful and easy to use, but the application is shareware. MHDD 4.6 or HDAT2 4.53 can be useful too and they are all freeware but I am not feeling comfortable in this area, so please proceed to our Internal Hardware."

Full CHKDSK log:

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 1/16/2011 12:22:32 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Owner-PC
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
238400 file records processed.

2619 large file records processed.

0 bad file records processed.

0 EA records processed.

92 reparse records processed.

302298 index entries processed.

0 unindexed files processed.

238400 security descriptors processed.

Cleaning up 3552 unused index entries from index $SII of file 0x9.
Cleaning up 3552 unused index entries from index $SDH of file 0x9.
Cleaning up 3552 unused security descriptors.
31950 data files processed.

CHKDSK is verifying Usn Journal...
34625088 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc000009c at offset 0x3ae64000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x3ae70000 for 0x1000 bytes.
Windows replaced bad clusters in file 50054
of name \Windows\System32\winevt\Logs\MI82A6~1.EVT.
238384 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
12473338 free clusters processed.

Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

147790847 KB total disk space.
97441560 KB in 156913 files.
100028 KB in 31951 indexes.
4 KB in bad sectors.
355899 KB in use by the system.
65536 KB occupied by the log file.
49893356 KB available on disk.

4096 bytes in each allocation unit.
36947711 total allocation units on disk.
12473339 allocation units available on disk.

Internal Info:
40 a3 03 00 cc e1 02 00 8f 0b 05 00 00 00 00 00 @...............
4d 07 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 M...\...........
42 00 00 00 12 75 24 77 b8 87 24 00 b8 7f 24 00 B....u$w..$...$.

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-01-16T00:22:32.000Z" />
<EventRecordID>225084</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Owner-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
238400 file records processed.

2619 large file records processed.

0 bad file records processed.

0 EA records processed.

92 reparse records processed.

302298 index entries processed.

0 unindexed files processed.

238400 security descriptors processed.

Cleaning up 3552 unused index entries from index $SII of file 0x9.
Cleaning up 3552 unused index entries from index $SDH of file 0x9.
Cleaning up 3552 unused security descriptors.
31950 data files processed.

CHKDSK is verifying Usn Journal...
34625088 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc000009c at offset 0x3ae64000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x3ae70000 for 0x1000 bytes.
Windows replaced bad clusters in file 50054
of name \Windows\System32\winevt\Logs\MI82A6~1.EVT.
238384 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
12473338 free clusters processed.

Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

147790847 KB total disk space.
97441560 KB in 156913 files.
100028 KB in 31951 indexes.
4 KB in bad sectors.
355899 KB in use by the system.
65536 KB occupied by the log file.
49893356 KB available on disk.

4096 bytes in each allocation unit.
36947711 total allocation units on disk.
12473339 allocation units available on disk.

Internal Info:
40 a3 03 00 cc e1 02 00 8f 0b 05 00 00 00 00 00 @...............
4d 07 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 M...\...........
42 00 00 00 12 75 24 77 b8 87 24 00 b8 7f 24 00 B....u$w..$...$.

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

This post has been edited by al504: 17 January 2011 - 12:08 PM

You need to run checkdisk with the repair switch (chkdsk /r). What OS are you running?

I forgot to mention when i ran CHKDSK it was with the following commands chkdsk c: /f /r . I am running windows vista (32 bit)

These were the instructions I was given (the log is posted in my last post).

Run CHKDSK to check for disk errors

* Click Start and type cmd and then hit enter.
* At the command prompt, type the following command chkdsk c: /f /r and then press Enter.
* If you are prompted to schedule CHKDSK to run the next time the computer restarts (because CHKDSK may be unable to gain exclusive access to the drive under Windows), type the following text y, and then press Enter.
* At the command prompt, type exit and then press Enter.
* Restart your computer (I had to shut down and then power back on to make CHKDSK run). While Windows is loading, CHKDSK should automatically run and check the drive that you specified earlier.
This process can take up to an hour!
* When all is one and you are back into normal mode click Start and type eventvwr and then hit enter.
* Once Event Viewer is open, select Windows logs => Application => The 3th column of information in the right-hand pane is titled Source, click on the word Source at the top of the column to sort by that column.
* Scroll through the Source column to find the most recent entry titled Chkdsk or Wininit.
* Double-click Chkdsk or Wininit to open the CHKDSK results.
* Click on the Copy button and post the result in your next reply.

My fault - I didn't read the entire checkdisk report that you posted. It appears checkdisk repaired the errors it found. If everything runs smoothly now you shouldn't have any additional problems as a result of these specific errors. BTW, for future reference you just need the /r switch (not /f /r). Post back if there are any new issues.

This post has been edited by Allan: 17 January 2011 - 12:16 PM

So I dont need to run HDD Regenerator (or anything like it) any time soon? And I take it that my HDD should not be failing anytime soon?

Can I disregard the following posts by the guy who helped me remove my computer of malware:

"The chkdsk log concern me a little. - 4 KB in bad sectors."

"Once we are done with the cleaning process you can open a new topic in our internal hardware forum for advices what to do.
Until then I can only recommend you to backup all important documents (just in case something happens to the hard-disk drive).
It's not a bad idea to start collecting money for a new one... "

"If the errors are logical, but not physical I am sure that HDD regenerator will repair them all.
My boss laptop had 2 KB in bad sectors and HDD regenerator fixed about 900 errors for 8 hours and now all is ok. HDD Regenerator is very powerful and easy to use, but the application is shareware. MHDD 4.6 or HDAT2 4.53 can be useful too and they are all freeware but I am not feeling comfortable in this area, so please proceed to our Internal Hardware."

Do not run any third party utilities at this time. If you like, you can visit the website of your hd manufacturer and download and run their diagnostic tool.

As for backing up your data - that's something that should be done as a matter of course, regardless of the health of your hd. But the fact that you've run into some issues makes it that much more important. YES - backup your data - regularly - ALWAYS. Other than that, nobody knows how long your hd will or will not last. Could be years, could be minutes.

A few bad sectors on a hard drive is really not much of a concern. Chkdsk marked them out so that they are unusable in the future.
Back up you data as suggested and run chkdsk once a week or so to see if any more develop.

I have backed up my important data. And have run CHKDSK again this week (the log file is at the end of the post). It still has 4kb of bad sectors, but did not find any more, which looks like a good thing. Any further guidance or comments?


Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 1/23/2011 4:50:50 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Owner-PC
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
238400 file records processed.

2708 large file records processed.

0 bad file records processed.

0 EA records processed.

92 reparse records processed.

302500 index entries processed.

0 unindexed files processed.

238400 security descriptors processed.

Cleaning up 168 unused index entries from index $SII of file 0x9.
Cleaning up 168 unused index entries from index $SDH of file 0x9.
Cleaning up 168 unused security descriptors.
32051 data files processed.

CHKDSK is verifying Usn Journal...
36239392 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
238384 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
16846013 free clusters processed.

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

147790847 KB total disk space.
79954192 KB in 146386 files.
94884 KB in 32052 indexes.
4 KB in bad sectors.
357715 KB in use by the system.
65536 KB occupied by the log file.
67384052 KB available on disk.

4096 bytes in each allocation unit.
36947711 total allocation units on disk.
16846013 allocation units available on disk.

Internal Info:
40 a3 03 00 11 b9 02 00 f2 c3 04 00 00 00 00 00 @...............
95 04 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
42 00 00 00 12 75 c2 77 10 89 40 00 10 81 40 00 B....u.w..@...@.

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-01-23T16:50:50.000Z" />
<EventRecordID>226875</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Owner-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
238400 file records processed.

2708 large file records processed.

0 bad file records processed.

0 EA records processed.

92 reparse records processed.

302500 index entries processed.

0 unindexed files processed.

238400 security descriptors processed.

Cleaning up 168 unused index entries from index $SII of file 0x9.
Cleaning up 168 unused index entries from index $SDH of file 0x9.
Cleaning up 168 unused security descriptors.
32051 data files processed.

CHKDSK is verifying Usn Journal...
36239392 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
238384 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
16846013 free clusters processed.

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

147790847 KB total disk space.
79954192 KB in 146386 files.
94884 KB in 32052 indexes.
4 KB in bad sectors.
357715 KB in use by the system.
65536 KB occupied by the log file.
67384052 KB available on disk.

4096 bytes in each allocation unit.
36947711 total allocation units on disk.
16846013 allocation units available on disk.

Internal Info:
40 a3 03 00 11 b9 02 00 f2 c3 04 00 00 00 00 00 @...............
95 04 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
42 00 00 00 12 75 c2 77 10 89 40 00 10 81 40 00 B....u.w..@...@.

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

FWIW: Bad Sectors On Hard Drives - http://www.pcstats.com/articleview.cfm?articleid=1583&page=3

http://www.dewassoc.com/kbase/hard_drives/hard_disk_sector_structures.htm

Louis

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 3/15/2012 4:43:49 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: master_eklay
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
49664 file records processed.

File verification completed.
34 large file records processed.

0 bad file records processed.

2 EA records processed.

44 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
74108 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
49664 file SDs/SIDs processed.

Cleaning up 124 unused index entries from index $SII of file 0x9.
Cleaning up 124 unused index entries from index $SDH of file 0x9.
Cleaning up 124 unused security descriptors.
Security descriptor verification completed.
12223 data files processed.

CHKDSK is verifying Usn Journal...
6657776 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0x1e3c49000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x1e3c56000 for 0x1000 bytes.
Windows replaced bad clusters in file 42837
of name \pagefile.sys.
49648 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
36481233 free clusters processed.

Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

156233727 KB total disk space.
10153336 KB in 37141 files.
27956 KB in 12224 indexes.
4 KB in bad sectors.
127495 KB in use by the system.
65536 KB occupied by the log file.
145924936 KB available on disk.

4096 bytes in each allocation unit.
39058431 total allocation units on disk.
36481234 allocation units available on disk.

Internal Info:
00 c2 00 00 e0 c0 00 00 b0 81 01 00 00 00 00 00 ................
4c 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 L...,...........
30 8e 1f 00 50 01 1e 00 70 1a 1e 00 00 00 1e 00 0...P...p.......

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-03-14T20:43:49.000000000Z" />
<EventRecordID>277</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>master_eklay</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
49664 file records processed.

File verification completed.
34 large file records processed.

0 bad file records processed.

2 EA records processed.

44 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
74108 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
49664 file SDs/SIDs processed.

Cleaning up 124 unused index entries from index $SII of file 0x9.
Cleaning up 124 unused index entries from index $SDH of file 0x9.
Cleaning up 124 unused security descriptors.
Security descriptor verification completed.
12223 data files processed.

CHKDSK is verifying Usn Journal...
6657776 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0x1e3c49000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0x1e3c56000 for 0x1000 bytes.
Windows replaced bad clusters in file 42837
of name \pagefile.sys.
49648 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
36481233 free clusters processed.

Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

156233727 KB total disk space.
10153336 KB in 37141 files.
27956 KB in 12224 indexes.
4 KB in bad sectors.
127495 KB in use by the system.
65536 KB occupied by the log file.
145924936 KB available on disk.

4096 bytes in each allocation unit.
39058431 total allocation units on disk.
36481234 allocation units available on disk.

Internal Info:
00 c2 00 00 e0 c0 00 00 b0 81 01 00 00 00 00 00 ................
4c 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 L...,...........
30 8e 1f 00 50 01 1e 00 70 1a 1e 00 00 00 1e 00 0...P...p.......

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>




PLSSS.. HELP ME CLEAR THE 4KB BAD SECTOR.... IM REALY PISSED WITH THIS $KB BAD SECTOR>>> HELP ME PLS....

Hi

I'm not sure what you are looking for.

It looks like you tried reformatting the drive between the last two reports that you posted. Is that correct?

If you did not choose a 'quick format' then it would have tried to recover the bad sectors and thus they would probably show up on a scan when being used like they appeared to do in your latest report. That's because they are only kind of bad and survived the testing of the format but not the frequent read/writes of being part of your page file (as your report indicates they were).

A bad sector is physical damage where the sector can no longer reliably hold a data value because it is incapable of maintaining a proper magnetic state. In old drives, they slipped through the manufacturing process and were expected. In modern drives, they usually are an indication that the platter is beginning to degrade or suffering physical damage of some sort (could be lots of things). Often they multiply but sometimes they stabilize and the drives are good for years more of use. It depends on what caused them.

Once chkdsk marks a sector as bad your file system has a hidden file called $BITMAP that tells the OS not to use the bad sectors. They don't go away or get fixed, they just don't get used.

James