Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Something Disabled Security Center, Is it related to Disk Failure?


  • Please log in to reply
1 reply to this topic

#1 mach0

mach0

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:40 AM

Posted 12 December 2012 - 10:10 PM

Hello All,

A few of days ago on booting my system, I got a blue screen saying that there were some errors and it automatically went on rectifying them. Below are the changes that seem to have occurred according to the log in Windows XP event viewer.

___________________________________________________________
Checking file system on C:
The type of the file system is NTFS.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
The segment number 0x374000000000 in file 0x373e is incorrect.
Correcting a minor error in file 14142.
The segment number 0x374100000000 in file 0x373f is incorrect.
Correcting a minor error in file 14143.
The segment number 0x374200000000 in file 0x3740 is incorrect.
Correcting a minor error in file 14144.
The segment number 0x374300000000 in file 0x3741 is incorrect.
Correcting a minor error in file 14145.
The segment number 0x376c00000000 in file 0x3742 is incorrect.
Correcting a minor error in file 14146.
The segment number 0x376d00000000 in file 0x3743 is incorrect.
Correcting a minor error in file 14147.
The segment number 0x376e00000000 in file 0x3744 is incorrect.
Correcting a minor error in file 14148.
The segment number 0x376f00000000 in file 0x3745 is incorrect.
Correcting a minor error in file 14149.
The segment number 0x379400000000 in file 0x3746 is incorrect.
Correcting a minor error in file 14150.
The segment number 0x379500000000 in file 0x3747 is incorrect.
Correcting a minor error in file 14151.
The attribute list in file 0x3747 indicates the standard information
attribute is outside the base file record segment.
Deleted corrupt attribute list for file 14151.
The segment number 0x379a00000000 in file 0x374c is incorrect.
Correcting a minor error in file 14156.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x171eb for possibly 0x4 clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x171eb for possibly 0x4 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x376c is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14188.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf47a for possibly 0x1c clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf47a for possibly 0x1c clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x376e is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14190.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf84a for possibly 0x1ee clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x3cf84a for possibly 0x1ee clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x376f is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14191.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0xb5f3b for possibly 0x4 clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0xb5f3b for possibly 0x4 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x3794 is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14228.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x2a03 for possibly 0x6 clusters.
Attribute record of type 0x80 and instance tag 0x3 is cross linked
starting at 0x2a03 for possibly 0x6 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x3
in file 0x379a is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 14234.
Cleaning up instance tags for file 0xb43c.
Deleting orphan file record segment 14157.
The object id in file 0x3745 already existed in the object
id index in file 0x19.
c8 3e 13 6c b0 1d de 11 b7 64 00 19 d1 7b ff aa .>.l.....d...{..
05 2d 00 00 bc e5 06 00 cf 98 05 01 a4 e2 06 00 .-..............
Deleting duplicate object id from file record segment 14149.
The file reference 0x100000000374c of index entry ATHPRXY.DLL of index $I30
with parent 0x1d is not the same as 0xd6400000000374c.
Deleting index entry ATHPRXY.DLL in index $I30 of file 29.
The file reference 0x12fa00000000373f of index entry _REGISTRY_USER_USRCLASS_S-1-5-20 of index $I30
with parent 0x361e is not the same as 0x100000000373f.
Deleting index entry _REGISTRY_USER_USRCLASS_S-1-5-20 in index $I30 of file 13854.
The file reference 0x12fa00000000373f of index entry _RF17F~1 of index $I30
with parent 0x361e is not the same as 0x100000000373f.
Deleting index entry _RF17F~1 in index $I30 of file 13854.
Index entry MAPPING.VER of index $I30 in file 0x371a points to unused file 0x374d.
Deleting index entry MAPPING.VER in index $I30 of file 14106.
Unable to locate the file name attribute of index entry 1033
of index $I30 with parent 0x371b in file 0x3740.
Deleting index entry 1033 in index $I30 of file 14107.
The file reference 0x1000000003742 of index entry mdm.exe of index $I30
with parent 0x371b is not the same as 0x113a000000003742.
Deleting index entry mdm.exe in index $I30 of file 14107.
The file reference 0x1000000003746 of index entry msdbg2.dll of index $I30
with parent 0x371b is not the same as 0x87f000000003746.
Deleting index entry msdbg2.dll in index $I30 of file 14107.
The file reference 0x1000000003743 of index entry pdm.dll of index $I30
with parent 0x371b is not the same as 0xea000000003743.
Deleting index entry pdm.dll in index $I30 of file 14107.
The parent 0x1000000003740 of index entry mdmui.dll of index $I30
in file 0x3741 is incorrect. The expected parent is 0x100000000373e.
Deleting index entry mdmui.dll in index $I30 of file 14142.
The parent 0xea00000000376d of index entry settings.sol of index $I30
in file 0x3775 is incorrect. The expected parent is 0xea000000003743.
Deleting index entry settings.sol in index $I30 of file 14147.
The file reference 0x2d200000000373e of index entry Dc5101.bmp of index $I30
with parent 0x5bfe is not the same as 0x100000000373e.
Deleting index entry Dc5101.bmp in index $I30 of file 23550.
The file reference 0x8db000000003747 of index entry queue.xml of index $I30
with parent 0x9d79 is not the same as 0x871000000003747.
Deleting index entry queue.xml in index $I30 of file 40313.
The file reference 0xd71000000003744 of index entry HT8579~1.LOC of index $I30
with parent 0x9f7a is not the same as 0x72000000003744.
Deleting index entry HT8579~1.LOC in index $I30 of file 40826.
The file reference 0xd71000000003744 of index entry http_www.ndtv.com_0.localstorage-journal of index $I30
with parent 0x9f7a is not the same as 0x72000000003744.
Deleting index entry http_www.ndtv.com_0.localstorage-journal in index $I30 of file 40826.
The file reference 0xe9000000003745 of index entry RT88B3~1.YML of index $I30
with parent 0x11157 is not the same as 0x7f000000003745.
Deleting index entry RT88B3~1.YML in index $I30 of file 69975.
The file reference 0xe9000000003745 of index entry rt_20090628-090315.yml of index $I30
with parent 0x11157 is not the same as 0x7f000000003745.
Deleting index entry rt_20090628-090315.yml in index $I30 of file 69975.
Cleaning up minor inconsistencies on the drive.
CHKDSK is recovering lost files.
Recovering orphaned file 1033 (14142) into directory file 14107.
Recovering orphaned file mdm.exe (14144) into directory file 14107.
Recovering orphaned file pdm.dll (14145) into directory file 14107.
Cleaning up 688 unused index entries from index $SII of file 0x9.
Cleaning up 688 unused index entries from index $SDH of file 0x9.
Cleaning up 688 unused security descriptors.
Inserting data attribute into file 14151.
Inserting data attribute into file 14188.
Inserting data attribute into file 14190.
Inserting data attribute into file 14191.
Inserting data attribute into file 14228.
Inserting data attribute into file 14234.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

61440560 KB total disk space.
13410732 KB in 49495 files.
25200 KB in 6469 indexes.
0 KB in bad sectors.
148716 KB in use by the system.
65536 KB occupied by the log file.
47855912 KB available on disk.

4096 bytes in each allocation unit.
15360140 total allocation units on disk.
11963978 allocation units available on disk.

Internal Info:
a0 39 01 00 aa da 00 00 2c 36 01 00 00 00 00 00 .9......,6......
e5 00 00 00 02 00 00 00 da 03 00 00 00 00 00 00 ................
f4 69 b3 02 00 00 00 00 44 e0 b5 2a 00 00 00 00 .i......D..*....
b8 40 dc 07 00 00 00 00 00 00 00 00 00 00 00 00 .@..............
00 00 00 00 00 00 00 00 8e b4 6b 3d 00 00 00 00 ..........k=....
10 1e 2f 6b 00 00 00 00 80 36 07 00 57 c1 00 00 ../k.....6..W...
00 00 00 00 00 b0 86 32 03 00 00 00 45 19 00 00 .......2....E...

Windows has finished checking your disk.
Please wait while your computer restarts.
_______________________________________________________________

After the changes were finished Windows XP seemed to start normally, but my AntiVirus NOD32 4.0 did not start automatically. And every time I tried to open it manually I got the message that egui.exe is invalid.

I did a MBAM (Malware Bytes) scan and it returned three potential malwares

Vendor: PUM.Disabled.SecurityCenterDisabled
Category: Registry Data
Item: HKLM\Software\Microsoft\Security Center|UpdatesDisableNotify
Item: HKLM\Software\Microsoft\Security Center|FirewallDisableNotify
Item: HKLM\Software\Microsoft\Security Center|AntiVirusDisableNotify
_______________________________________________________________________

After some trial and error and cleaning the above in MBAM, I have been able to get Security Center to work again. And scans from MBAM and NOD etc havent shown any other Virus or Malware, People at NOD say it could be potential Disk Failure or something related. Can anyone please take a look at my EventLog and tell me what my problem could be. And if it is not a Virus, then why did it only Disable Security Center and no other application?

Thanks for your help.

BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:06:40 PM

Posted 13 December 2012 - 01:15 AM

Hello -
Now please run your own Disk Check on your system, as the automatic check may have solved the problem
Run a Disk Check on your C: drive in Windows XP:

•Click Start and open My Computer

Right-click on C: (or your main hard drive letter) and select Properties

•Click on the Tools tab

•Under Error-checking click the Check Now... button

•Mark the 2 boxes next to Automatically fix file system errors and Scan for and attempt recovery of bad sectors

•Click on the Start button

•When the message box pops up, click the Schedule disk check button and >> Restart << your computer

•Once your computer restarts it will check the drive, don't press any keys so that it is allowed to do so

This will take (on average) from 1 to 2 hours, depending on your system, to complete the 5 stages - Please let it finish all stages -
Once finished, it will reboot your system back to Normal Mode -

Thank You -






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users