Author Topic: Is my hard drive dying? [Solved] (Read 65415 times)

jmk909er · « **on:** February 19, 2015, 08:24:48 pm »

Hi, I have a Toshiba Laptop Satellite P744 for about 3 years now, with windows 7. I keep having this recurring situation when I login. It does not happen all the time but seems to be increasing in frequency. Here is what happens:

When I login the bottom task bar is no longer translucent, the start menu and explorer windows are all different, not translucent. It looks to me more like XP.

Shortly after starting I get an error balloon pop up from the task bar saying: "Failed to connect to a windows service, windows could not connect to the system event notification service...etc" I have a screenshot of the entire message.

Then I get another error message pop up saying: "NT Kernal System has changed since the last time you used it"

Sometimes if I restart it will start properly again in windows 7 but not all the time and sometimes I have to do a system restore to get it back and this is happening more and more. Does this mean my hard drive is dying? Is it time to replace it? My laptop is about 3 years old and I am a pretty heavy user and it runs almost all the time but I really don't know what this means.

I am placing this link to screenshots I took of all the errors:
https://www.dropbox.com/sh/r8wzb4sbd...ko-CX4eYa?dl=0

I ran across this Tweeking .com Windows Repair v2.11.1 utility and ran it twice but it did not fix it. So has anyone else run into this? Is it time for a new hard drive?

Boggin · « **Reply #1 on:** February 20, 2015, 01:52:24 am »

One way to check if your HDD is failing is to run a command prompt as an admin by going Start > type cmd.exe then right click on cmd and select Run as administrator > accept the UAC then enter chkdsk /r

You will be prompted to type y and press enter then reboot for it to run after the restart.

It's full report can be found in Event Viewer by going Start > type eventvwr and press enter.

When the logs have been read expand Windows Logs - click on Application > Action > Find > then type either chkdsk or wininit and click OK or press enter.

Close the Find box to read the report.

You can copy & paste its report into the reply box by clicking on Copy > Copy details as text in the lower right pane, place the cursor in the Reply box, right click and select Paste.

As well as any file fixes you will be looking to see how many KBs there are in bad sectors.

How far do you have to restore back to initially resolve the error - is it prior to this month's Windows Updates or a program you had installed and which AV program are you using.

Event Viewer may also have a record in Errors of the NT Kernel Event

Click on Errors then on View All Instances of This Event in the lower right pane and you can copy & paste any by the same method.

Boot up into the advanced boot options by tapping F8 as you switch on, use the cursor keys to select Safe Mode with Networking and download and run a scan with the free version of MBAM - unchecking the box to run a trial run of the Premium version. https://www.malwarebytes.org/

Let us know if MBAM has found anything.

jmk909er · « **Reply #2 on:** February 20, 2015, 01:28:16 pm »

Hi Boggin and thanks for your help. I did what you said and it took hours to run, the results will be below:

You asked: "How far do you have to restore back to initially resolve the error" It has been erroring out more and more so anytime I get a windows update or install a new program and it starts properly again I am creating a restore point. That way when I restore it doesn't have to do all the updates again. My anti virus is Symantec Endpoint Protection, I have used it for years and never had an issue with it.

The problem seems to be occurring more and more. I suspect that my hard drive is going and I would just go ahead and replace it but I don't want to do it if its not bad. Right after running the diagnostic it has booted up again with the errors. Now it seems to do this most of the time.

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 2/20/2015 11:36:05 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: jmk909er-PC
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is TI106332W0C.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
286464 file records processed.

File verification completed.
991 large file records processed.

0 bad file records processed.

0 EA records processed.

42 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
377530 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
286464 file SDs/SIDs processed.

Cleaning up 47 unused index entries from index $SII of file 0x9.
Cleaning up 47 unused index entries from index $SDH of file 0x9.
Cleaning up 47 unused security descriptors.
Security descriptor verification completed.
45534 data files processed.

CHKDSK is verifying Usn Journal...
34481280 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
286448 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
150600107 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

715239423 KB total disk space.
112291928 KB in 222340 files.
136076 KB in 45535 indexes.
0 KB in bad sectors.
410991 KB in use by the system.
65536 KB occupied by the log file.
602400428 KB available on disk.

4096 bytes in each allocation unit.
178809855 total allocation units on disk.
150600107 allocation units available on disk.

Internal Info:
00 5f 04 00 1a 15 04 00 a8 66 07 00 00 00 00 00 ._.......f......
d4 06 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 ....*...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-02-20T19:36:05.000000000Z" />
<EventRecordID>104684</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>jmk909er-PC</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is TI106332W0C.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
286464 file records processed.

File verification completed.
991 large file records processed.

0 bad file records processed.

0 EA records processed.

42 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
377530 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
286464 file SDs/SIDs processed.

Cleaning up 47 unused index entries from index $SII of file 0x9.
Cleaning up 47 unused index entries from index $SDH of file 0x9.
Cleaning up 47 unused security descriptors.
Security descriptor verification completed.
45534 data files processed.

CHKDSK is verifying Usn Journal...
34481280 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
286448 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
150600107 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

715239423 KB total disk space.
112291928 KB in 222340 files.
136076 KB in 45535 indexes.
0 KB in bad sectors.
410991 KB in use by the system.
65536 KB occupied by the log file.
602400428 KB available on disk.

4096 bytes in each allocation unit.
178809855 total allocation units on disk.
150600107 allocation units available on disk.

Internal Info:
00 5f 04 00 1a 15 04 00 a8 66 07 00 00 00 00 00 ._.......f......
d4 06 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 ....*...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

jmk909er · « **Reply #3 on:** February 20, 2015, 01:42:48 pm »

Check out this screen video and see if this helps:
https://www.dropbox.com/s/za0n88zh7r66ay1/Error%20shots.mp4?dl=0

Boggin · « **Reply #4 on:** February 20, 2015, 04:01:44 pm »

Well, it looks like your HDD is fine.

Clicking on any of the Errors then on the blue online help link can give you more info and possible solutions.

This should give you more info on the SidebySide Event ID 35 but generally you can ignore it.

The DistributedCOM error could be a permissions issue so running Shane's Windows Repair program should fix that and possible the rest of the problems. http://www.tweaking.com/

Run a command prompt as an admin and enter netsh wlan set hostednetwork mode=disallow and that will remove the MS Virtual Miniport which is probably giving you the DHCP Client 1001 errors.

The MS Miniport can cause connectivity problems.

To reinstate it if you ever need it, just redo the command and use mode=allow.

Windows has a couple of its own tools that you could run - Go Start - click on Control Panel and under System and Security click on Find and fix problems.

Under the next System and Security click on Run maintenance tasks - Advanced - Run as administrator - Next - then do the same with Check for performance issues and that one will tell you if it found anything and if it fixed anything.

Restarting SuperFetch in Services may help with the Application Popup error

Go Start - type services.msc - press enter then scroll to SuperFetch - it should be displayed as Started and Auto - click on it then on Restart in the top left pane.

You don't need to worry about the ReadyBoot error http://support.microsoft.com/kb/2001347

The Windows Repair program can take a while to run but do all of the pre-requisites first, but creating an external full system image to either DVDs or an external HDD can side step the back ups.

Try the other bits first and then run WR if you still have problems.

Did you run a scan with the free version of MBAM ?

Shane · « **Reply #5 on:** February 21, 2015, 12:05:32 am »

chkdsk shows 0 bad sectors, so that is good. If we want to be sure the drive is ding ok we could check the smart status on it as well.

I have seen the error in windows where a service didnt start up correctly, it was the event notifier service that would do it and I traced it down to a driver for IDT audio. I would see the error after a fresh install of Windows, and replacing the drive fixed it.

I say that because it shows how even a driver can cause these problems as well.

So best thing to do is to run scans to make sure the system is clean, malwarebytes, adwcleaner and even combofix. Then once that is done you should check to make sure you have all the latest drivers.

Also another thing you can do is do a clean boot, where all 3rd party programs are disabled from startup. That can help you see if the problem is related to a 3rd party program

Shane

jmk909er · « **Reply #6 on:** February 21, 2015, 07:52:08 am »

My laptop seems to be going from bad to worse. I am considering doing a factory reset. Do you guys have any further suggestions? Afactory reset should fix it right?

Boggin · « **Reply #7 on:** February 21, 2015, 08:31:28 am »

A factory reset can be a cure-all but I've seen where it didn't, but it's something I've done when things weren't going right although I'll restore these days with an external saved system image.

Have you run the anti-malware scans as suggested to eliminate an infection or the other suggestions ?

jmk909er · « **Reply #8 on:** February 21, 2015, 10:19:22 am »

Yeah I run Malwarebytes and Superantispyware about twice a month in addition to weekly full scans with my antivirus. I did find something in Device Drivers called Teredo Tunneling Pseudo-Interface that is showing an error. I tried to update the driver but it said it already has the latest driver. I have a screenshot.

Boggin · « **Reply #9 on:** February 21, 2015, 12:31:41 pm »

Yes, that could give you problems but that's the first time I've seen incremented MS Virtual WiFi Miniport Adapters.

Run that command that I posted in Reply #4 and that will get rid of those, unless you are using a VPN - in which case you would need one of them.

For the Pseudo Interface, these are the commands I had to do once and worked for me -

Repair of Pseudo-Interface Yellow Alert

Run a command prompt as an administrator and enter each of these commands :-

netsh

int teredo

set state disabled

Then open Device Manager/View/Show hidden devices > right click on Teredo Tunneling Pseudo-Interface and select Uninstall

Open the Cmd Prompt as an administrator again and type then Enter these cmds -

netsh

int ipv6

set teredo client

Open Device Manager/Action/Scan for hardware changes.

Then select Show hidden devices from the View menu where it should now display without the yellow alert.

With Show hidden devices enabled, check for any yellow alerts in Non-Plug and Play Drivers

jmk909er · « **Reply #10 on:** February 21, 2015, 12:56:24 pm »

OK I ran all the commands and the Teredo Tunneling Pseudo-Interface is no longer showing in device manager at all. And there are no yellow alerts in the Non-Plug and Play Drivers when viewing Show hidden devices. I went through a restart and it is loading up properly. I will go through a few start up cycles and see how it does.

By the way thanks a lot for all your help. I will report back if its fixed or not.

Boggin · « **Reply #11 on:** February 21, 2015, 01:22:28 pm »

What happened when you did Scan for hardware changes - did the Device Manager do what looked like a reset ?

I normally advise creating a restore point before uninstalling anything like that but I had success with that cmd when my Pseudo-Interface picked up a yellow alert.

Check your restore points as Windows may have recorded its uninstall.

Boggin · « **Reply #12 on:** February 21, 2015, 01:34:56 pm »

Just as a matter of interest, did you click on View/Show hidden devices as the Pseudo-Interface isn't visible in Network adapters until you do.

If it's still missing and Windows hasn't recorded its uninstall, Action/Add legacy hardware has a MS one but I've never known if that is the same as the one that is normally installed as it isn't listed as a MS adapter.

These steps will reinstall it if needed, but manually create a restore point before executing them. http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/how-to-install-teredo-tunneling-pseudo-interface/754c8f29-3a87-4e77-babd-a69c8910e17e

jmk909er · « **Reply #13 on:** February 21, 2015, 02:03:54 pm »

Hey Boggin, maybe I don't need it?? I have gone through 5 shutdowns and start ups and I have not gotten a single error and it is booting up like it is supposed to (almost seems a little faster)

I did click on View/Show hidden devices. I just now also checked it again, scan for new devices and show hidden and I don't see the Teredo Tunneling Pseudo-Interface.

Do you think I should try to reinstall it or leave it alone?

Boggin · « **Reply #14 on:** February 21, 2015, 02:21:46 pm »

While you may not need it yet, I would reinstall it http://superuser.com/questions/22290/what-is-the-teredo-tunneling-pseudo-interface

It was obviously the buggy driver that was causing the boot up problem, although I don't think you've mentioned you had this problem ?

Did you run the hostednetwork command as that can also aid boot up as they won't be there looking for an IP address.

jmk909er · « **Reply #15 on:** February 21, 2015, 02:57:13 pm »

Everything got unstable and locked up so I restored to yesterday. The Teredo Tunneling Pseudo-Interface is showing again but still has the error

Boggin · « **Reply #16 on:** February 21, 2015, 03:29:43 pm »

How do you mean it got unstable and locked up - did it do this on its own after booting up or when you were doing something ?

I should think Event Viewer would have recorded that so check to see what it has.

While the chkdsk /r gave you a clean bill of health, see what a sfc /scannow run from an admin command prompt reports.

This article will show you how to view the trimmed CBS Log if it reports anything other than no integrity violations.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

jmk909er · « **Reply #17 on:** February 21, 2015, 04:10:55 pm »

Hey I found a solution to get the Teredo Tunneling Pseudo-Interface fixed and clear the error here:
https://www.youtube.com/watch?v=m8UdZ0PZm6Q

I did this and the error is now clear

It got unstable while doing stuff

I'll try this for a while and see how it goes

Boggin · « **Reply #18 on:** February 21, 2015, 04:46:07 pm »

I noticed that one was listed as the MS Teredo Tunnelling Adapter although I missed what it said about the error at the end.

Is yours now listed as a MS one ?

As I'd said earlier, you can get the MS one through Device Manager/Action/Add legacy hardware

Click Next > Next > Next > scroll to Network Adapter in the left pane > Next > Microsoft > scroll the right pane and click on MS Teredo Tunneling Adapter > Next and follow the prompts.

jmk909er · « **Reply #19 on:** February 21, 2015, 04:50:34 pm »

Yes to you last post I did that but it would install it with the error

jmk909er · « **Reply #20 on:** February 21, 2015, 05:02:09 pm »

Here are the errors now in the event viewer:
https://www.dropbox.com/s/c5pjuxsxked4ev2/event%20viewer.mp4?dl=0

Boggin · « **Reply #21 on:** February 22, 2015, 01:09:54 am »

Now that you are back to the yellow alert on Pseudo-Interface, create a restore point and try the instructions for its reinstall.

If that works, create another restore point to consolidate that then go Start - type msconfig and press enter.

Under the Startup tab note which boxes are checked and items running then click on Disable all -Apply - OK - then reboot to see if the computer performs any better.

If your AV program is listed in the Startup items it will reinstate itself.

If the computer no longer locks up then add one Startup item back at a time until it starts playing up again and then leave that one unchecked.

If it continues to play up with all of the Startup items disabled then under the Services tab check the box to Hide all MS services.

It is imperative that you do this before disabling the remainder otherwise you'll have serious problems.

Again, check to see what is checked and shows as Running or Stopped before disabling all.

If this gives the desired result then add the items back either singly or a few at a time, rebooting and running for a period to see if it remains stable.

If you add a few back at a time and the problem reoccurs then you will need to vet those.

What were you doing last time when the freeze occurred ? - repeating this after adding items back could replicate the freeze if any are responsible.

jmk909er · « **Reply #22 on:** February 22, 2015, 07:57:35 am »

Hi Boggin, the yellow alert is no longer showing after making a correction in the registry. Also I have been checking the error about the boot driver and I can't find anything definitive on that exact driver "yyfeapq" I am pretty sure it is for one of my Brother or HP printers.

It is booting up properly now. I am going to try it for a while like this and see if I have any issues.

Boggin · « **Reply #23 on:** February 22, 2015, 12:33:07 pm »

See if DriverView lists that and then you'll be able to ID its origin. http://www.majorgeeks.com/files/details/driverview.html

I think you can set it to hide MS drivers so that will make the search easier.

If your printer(s) aren't switched on before you switch the computer on, then it will initially try to load it.

I have an Epson printer that has a card reader which Windows has assigned as Z: Drive and it usually pops up to tell me that it unable to load all drives when it has finished booting.

jmk909er · « **Reply #24 on:** February 22, 2015, 07:38:22 pm »

Hey Boggin I think my laptop has even more issues than I think. I have been going back in the event viewer and seeing many errors not just for boot up but others. I have attached a log that you can view (hopefully) I don't want to keep wasting your time. I think maybe I should do a factory reset???