BleepingComputer.com: Stop: c0000145 Application Error, every other boot, Window XP

I've searched the web for authoritative treatment of this subject and found nothing other than the sledge hammer approach of doing a clean install. I have a Lenovo 0468-05U which translates into a 3000' N100. It was having a strange problem of the desktop freezing (meaning accepting no input) whenever automatic updates were enabled. This problem was solved by clearing the updates cache and running "sfc /scannow". But immediately afterwards I noticed that chkdsk would not run at startup when requested, and that when requested the system got a BSOD c0000145 Application Error on every other boot.

I've run memory diagnostics; all OK.
I,ve scanned for viruses - Avast Free, Adware Free, Malware Bytes Free - Nothing but cookies.
I've run chkdsk /r from the recovery console. - does not fix the problem.

Seems clear I have a relatively simple problem of misconfigufred startup, chkdsk, or disk boot files, and I wish to affect a non-format repair. Can anyone assist with this?

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/430906 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

See http://www.bleepingcomputer.com/forums/topic430906.html for a more detailed description of the problem. I have backed up the computer to where it was just before I encountered the Stop x0000145 Application Error Problem. The problem now is that chkdsk will not run at startup when requested. If I load the recovery console from a Windows XP SP3 install CD and run "chkdsk /r" chances are I will then have the Stop c0000145 Application Error Problem (instead of a solved chkdsk problem). As instructed, I have created this Malware report with logs. I still believe I have a software configuration problem or a hard disk configuration problem, not a malware problem, but I appreciate all the effort it must take to look through all this data. Note that the hidden files /preboot/..., /minint/..., and /rrbackup/... are all somehow related to Lenovo Rescue and Recovery.

My ark.txt file was too big to upload with the rest. I'll try to add it to a reply.

This post has been edited by Andrew: 16 December 2011 - 12:44 PM
Reason for edit: Mod Edit: Merged Second Topic - AA

Yes, I would still like help with this problem. I did back up my computer to an earlier stage before the STOP: c0000145 Application Error started showing up. At this stage, chkdsk does not run at startup when requested, unless I boot into safe mode command prompt. If I try booting into safe mode command prompt, I don't get there. Instead, after listing all the boot files loaded, I can see by the disk activity that the chkdsk is running, but there is no UI. When it finishes the system automatically reboots. The dirty flag does not get reset. I have to do that manually using chkntfs. If I try to solve this problem by booting from a Windows XP SP3 CD, running the recovery console, then running CHKDSK /R, then most likely I will reproduce my original documented problem.

I hope I don't have to spell this out in monotonous detail. I request chkdsk in the normal way. Then I do a shutdown, restart. Windows restarts. Chkdsk does not run.


I do not have an original Windows CD in any useful form. I do have a set of 5 CDs which would restore my computer to the original installation of XP Pro SP2 that it came with, but that is so far away from my current installation as to render it practically useless. I would estimate the format and start from there alternative as a 120 man hour assignment.


As instructed I did post an associated Virus, Malware problem with logs. It was titled "Pursuing Chkdsk problem - Possible Virus". See like below.

http://www.bleepingcomputer.com/forums/topic432009.html/page__p__2506166__fromsearch__1#entry2506166 See previous reply.

This post has been edited by Andrew: 16 December 2011 - 12:45 PM

Hello, my name is Elise and I'll assist you with this issue.

It is possible that the autochk.exe file somehow has become corrupted, lets see if we can find out more.

COMBOFIX
---------------
Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

Elise,

Here is the ComboFix report. Thanks for your help.

How is the disk check problem at this point?

No change.

Please click Start > Run, type cmd and press enter.

Type the following, press enter and let me know what comes back:

fsutil dirty query c:

I have requested a chkdsk C: at next startup, but C: is not dirty.

Have you done chkdsk /r (chkdsk c: does not fix anything, only scans).

Elise,

As documented in the thread, the last time I did a chkdsk /r, it did not resolve the problem and it put me in the situation in which every other boot produced the Stop: c0000145 Blue Screen error. To recover from this I had to restore my entire hard disk to a point in time prior to the chkdsk /r. I was hoping to solve this problem without going through this particular long loop. I'm willing to try it again, but only if we've run out of ideas.

The chkdsk I requested which does not run (unless I reboot requesting the safe mode command prompt) is a chkdsk /f, so if it ran, it would do something.

Checkdisk usually shouldn't cause that kind of problem. This forum deals with malware removal, which is not the case. We can try to troubleshoot this, or we can close this topic and you can repost about this problem in a more appropriate forum to see if the cause can be determined.

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Elise,

I ran "chkdsk /r" in the recovery console. It found and repaired errors, but had no positive affect on the behavior of chkdsk at startup when requested. So where do we go from here?

Can you run bluescreenview as well as requested?