Corrupt files on multiple installs

[birdman]

Hello, I am hoping to find some help here.

I am constantly getting corrupted files on my Windows installs.

A little background:

About 2 months ago my laptop got a virus. I couldn't remove it so I restored my Win 7 OS using a WHS 2011 backup. In a few days windows found some corrupt file errors and corrected them with check disk but would not boot into windows (Safe Mode or even command prompt). I thought the backup might be corrupted so I did a fresh install of windows 7. After a few days windows ran into more corrupt file errors that would keep it from booting.

So I thought my Win 7 install .iso might be corrupted, I redownloaded the .iso and did a fresh install again. Again more corrupt file errors keeping me from booting. Tried the Win 8 .iso and after a day Win 8 found more corrupt file errors but this time I was able to boot into Win 8. The corrupted files kept Win 8 from resolving DNS so no internet or network access. (Strange)

The windows dvd's cannot repair the issue in any case. So I thought it is a hardware or driver issue. I installed Ubuntu linux and have been running Prime95 for the past 27 hours with no errors.

These corrupt file errors only occur after some time. So everything is running fine, then I might come to my computer in the morning with an error message.

My thoughts/questions:

Is it possible that my WHS 2011 box is serving a virus to this laptop via its Connector app? If this is the case why is my other Win 7 laptop unaffected?

If the hardware is fine why would my other laptop, which has all the same programs installed not have any problems?

Linux runs just fine on that machine, which makes me think my problem is software and not hardware.

Sorry for the long post, and thanks for any advice.

[CharlotteTheHarlot]

Certainly anything is possible. Have you mentioned the source of the WHS 2011 backup image? If it is homegrown you have to ask yourself if there is any chance that you backed up an infected or compromised installation. Only you can answer that. If it is an OEM image it is possible but unlikely that they distributed a virus. I seem to remember Compaq or IBM doing this on their recovery discs at least once back in the Win9x or WinXP era. I suspect that nowadays it would be noticed quickly and customers notified and it would be news all over the net. But yes, it is possible to preserve malware in a backup only to have it reappear later.

You really first have to rule out the hardware as a problem before wondering about a bad ISO, backup or malware or other software setting.

You said "windows found some corrupt file errors and corrected them with check disk", which 99% of the time indicates a physical problem with either the hard disk or less likely the NTFS metafiles. It is possible that a virus changed part of the boot sector but this wouldn't be a show-stopper because you can easily restore the MBR from the recovery console. Someone correct me if I am wrong, but I am not aware of any version of Windows picking this up (rewritten MBR) and then going to CHKDSK. This sounds more like a HDD problem.

Anyway, you should definitely schedule a full CHKDSK ( see options ) which depending on disk size could take a long time. Later run the specific HDD manufacturer bootup diagnostics on that disk. Hopefully you have at least one more working computer (desktop) available. The HDD could be placed in another computer as a 'slave' auxiliary disk and tested from there because this would eliminate a corrupt BIOS or incorrect setting as a possibility (RAID/IDE/AHCI or bad autodetect or failing battery or defective CMOS). But if another different HDD worked in this 'bad' computer without any errors that would likely rule a BIOS problem out.

I think CHKDSK /r will get you started, add the volume if there is more than one. But also locate and burn the diagnostics for that HDD onto a bootable media. It pays to be extremely thorough with debugging hardware problems because later on they will be masked by the OS or other software, driving the user to madness changing various Windows settings for nothing.

[birdman]

Thank you for your reply.

I did use chkdsk /r /f and it repairs/deletes corrupted files that it finds. I also used Intel's SSD toolbox to check for bad sectors and read the SMART data, it says the drive is healthy and has about 1/2 of its life left. I also made sure to delete all backups from WHS 2011.

Since the device is a laptop I cannot swap much hardware besides the SSD and memory. I don't have spare memory but I ran test using each stick of memory by itself without any errors.

I am ready to believe the laptops main board is ready to die. I'm sure it is possible to fail after years of heat. I think I should rule out a virus because new installs off the OEM DVD still produce errors.

Trouble shooting this type of stuff has been a real learning experience for me. And I have always been wary of taking my computer to a "professional" repair shop for fear they will just tell me what I already suspect.

[CharlotteTheHarlot]

( Note: some of these ideas I suggested to someone else with a laptop in this thread. Also, you really should spell out all your hardware beforehand, Laptop make/model, HDD make/model, SSD or normal SATA, etc. I originally missed but now see where you said: "my other laptop". It can really save someone from a lot of typing for nothing )

Since it's a laptop you might have manufacturer diagnostics available as a download or already in place on a hidden partition available at reboot through function keys. Verify that there isn't a newer BIOS available from the laptop maker. Laptop motherboard problems are a PITA because you cannot even look for obvious damage (bad caps, loose connectors, dust, etc) without major disassembly.

Heat MUST be ruled out as a problem, and the best way I know is to remove all the bottom covers you can, clean it thoroughly with compressed air (including the side vents) and then run the laptop sitting on a powerful cooler). This is best done right after you notice strange problems so that you can see if there is sudden improvement from the increased airflow.

Memory is also a major PITA because to this very day the manufacturers haven't created a quick and reliable method to verify that their products are free from defects! It is still a matter of using Memtest and Microsoft's WMD, and hoping that you do not get a false negative. Believe it or not it is more sensible to try 2 different sets of memory in the computer and use the 2-out-of-3 wins rule (if 2 other sets of RAM has no errors in the computer assume the original RAM is bad, if 2 other sets of RAM is also bad in the computer, assume the motherboard or other hardware is bad and that the original RAM is likely ok). Of course you need extra sets of RAM (that you know is good) available to even begin this test.

Focusing on the HDD again, one possibility is to pull the hard drive and test it in another good desktop computer via an adapter (2.5" to SATA), using both manufacturer HDD diags and Windows tools (including CHKDSK again). Doing this in another computer will confine the test tto only the HDD and rule out laptop motherboard/controller issues.

As above, a spare HDD or two is also a nice thing to have because it would allow you to drop in a known good one and see if the same errors occur which would practically confirm the laptop as defective and not the disk. Increase the probability further by again using the 2-out-of-3 wins rule (if 2 other HDD's have no errors in the laptop assume the original HDD is bad, if 2 other HDD's also have problems in the laptop, assume the motherboard or other hardware is bad and that the original HDD is likely ok). Of course you would have to have spares available, and each independent test costs you more time. The problem with testing only one other disk (or set of RAM) is that we are then allowing a 50/50 coin toss to determine the outcome.

BTW, the word "healthy" in most contexts does not mean the hardware is necessarily okay. It usually just means that at that particular point in time the file system and/or S.M.A.R.T. counters are working within their boundaries. It is often seen in disk management in Windows and also in all the SMART utilities. But I see no reason yet to take either of them too seriously. I think they are only useful for flagging errors (a false positive is unlikely but always worth investigating). In other words, if disk management and/or SMART says there is a problem, they are probably correct and now you should run real diagnostics. However, if disk management and/or SMART says "healthy", they MIGHT be correct, but they might not be. This is pretty much true for all such pronouncements in Windows device manager, "This device is working properly." is not something worth betting on.

( In general this is all about avoiding false negatives. You get exposed to some deadly virus. The blood test comes back negative. I would want at least a 2nd independent test to come back negative before I'll sleep easy again. )

P.S. I believe CHKDSK /r is all you need because the /f is redundant.

[birdman]

I just wanna say thanks for the help.

I found some other desktop I could put my SSD in to test, this is what I found:

My SSD was about 60% full for a long time. Once I had the OS set up I never really installed new programs or kept any data. It appears that because of this any downloads or temporary files would write to the same few blocks near the middle of the SSD (if I think of the storage space of the SSD to be linear). So that section was where all the bad sectors were at.

I was able to replicate the file corruptions by installing all my programs/updates until I was near this "dead zone" and then download a large file which would then become corrupted. If I installed a large game instead of a large file, the game files would become corrupted.

Now this was strange to me because I thought data was written randomly but it appears that my SSD wrote data sequentially.

I am still not sure if I am correct about what happened, but I had to buy a desktop anyways because when a friend and I tried to "test" parts of the laptop by themselves we broke a pin off the CPU.