Cannot schedule chkdsk

I need to check my disks; Windows XP Professional even tells me that and
tries to run a chkdsk at boot time. I can even use the run command to
execute chkdsk (or schedule one to run at the next reboot). The problem is,
it NEVER executes. I get the blue screen announcing that the disk has been
scheduled for a maintenance check, followed by a blurb about cancelling it
striking any key. Even though I never touch the keyboard, somehow time after
time, the job gets cancelled. I cannot determine what I need to do to get
the thing to run! It seems as though something is stepping on this program
but I do not know what it is. Can anyone help? Thanks.

If a volume's dirty bit is set, this indicates that the file system may be
in an inconsistent state. The dirty bit can be set because the volume is
online and has outstanding changes, because changes were made to the volume
and the computer shutdown before the changes were committed to disk, or
because corruption was detected on the volume. If the dirty bit is set when
the computer restarts, chkdsk runs to verify the consistency of the volume.

When Autochk runs against a volume at boot time it records its output to a
file called Bootex.log in the root of the volume being checked. The Winlogon
service then moves the contents of each Bootex.log file to the Application
Event log. One event log message for each volume checked is recorded. So
check the application event log for details.

If you get an error something to the effect "cannot open volume for direct
access" There is some system/boot start device that is reading/writing to
the drive before chkdsk can get a lock on the drive. Some anti-virus
applications do this.

You can also run
chkdsk /r
from the recovery console command line. (/r implies /f and /p)

To start the Recovery Console, start the computer from the Windows XP CD-Rom
Press ENTER at the "Setup Notification" screen. Press R to repair a Windows
XP installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note: If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %systemroot% or %windir%


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
|I need to check my disks; Windows XP Professional even tells me that and
| tries to run a chkdsk at boot time. I can even use the run command to
| execute chkdsk (or schedule one to run at the next reboot). The problem
is,
| it NEVER executes. I get the blue screen announcing that the disk has
been
| scheduled for a maintenance check, followed by a blurb about cancelling it
| striking any key. Even though I never touch the keyboard, somehow time
after
| time, the job gets cancelled. I cannot determine what I need to do to get
| the thing to run! It seems as though something is stepping on this
program
| but I do not know what it is. Can anyone help? Thanks.

Dave: Thank you so very much for your knowledgeable advice, which seemed to
be so thorough, I was confident I would overcome my problem by following it.
This was not the case, however, which probably means I'm doing something
really stupid or this problem has morphed into yet something else--possibly
both! Regarding the dirty bit flag and checking the logs, I was unable to
find a log on any volume with the name "bootex.log" in either the root or any
other directory. I was also unable to locate the "application event log".
You didn't specify an exact filename but I assumed that I could probably
locate it; perhaps I was mistaken. I next tried the Recovery Console route,
which I have used for a different problem in the past. I remembered that I
had to use a floppy to load the appropriate SCSI driver for one of my
drives. I got past that point successfully only to have the system die. The
error message was "unable to load keyboard layout, KBDUS.DLL" which resulted
in a forced machine shut down. I'm not sure what this problem indicates.
There are three copies of this file on my C:\ drive, one at c:\cmdcons, one
at c:\windows\system32, and one more at c:\windows\system32\dllcache. All
three files are version 5.1.2600.0 and contain the same number of bytes. I
even tried updating my keyboard driver and retried Recovery Console but still
had no luck. I didn't encounter this before so I do not know why this is
happening. Is it possible none of these files are where they belong? If I
read your reply correctly, Recovery Console can access only certain
directories; I may be wrong about this but I thought c:\windows\system32 was
my system directory and therefore would be OK. Finally, your suggestion that
executing anti-virus software may be the culprit, although an excellent
suggested thing to check, I did not pursue. I just switched antivirus
products and between the uninstall and install when the machine was without
this software, I know I still had this problem running a scheduled chkdsk on
a reboot. So at least in my case, this is not the problem. Do you possibly
have any other ideas for me? Thank you once again.

"Dave Patrick" wrote:

If a volume's dirty bit is set, this indicates that the file system may be
in an inconsistent state. The dirty bit can be set because the volume is
online and has outstanding changes, because changes were made to the volume
and the computer shutdown before the changes were committed to disk, or
because corruption was detected on the volume. If the dirty bit is set when
the computer restarts, chkdsk runs to verify the consistency of the volume.

When Autochk runs against a volume at boot time it records its output to a
file called Bootex.log in the root of the volume being checked. The Winlogon
service then moves the contents of each Bootex.log file to the Application
Event log. One event log message for each volume checked is recorded. So
check the application event log for details.

If you get an error something to the effect "cannot open volume for direct
access" There is some system/boot start device that is reading/writing to
the drive before chkdsk can get a lock on the drive. Some anti-virus
applications do this.

You can also run
chkdsk /r
from the recovery console command line. (/r implies /f and /p)

To start the Recovery Console, start the computer from the Windows XP CD-Rom
Press ENTER at the "Setup Notification" screen. Press R to repair a Windows
XP installation, and then press C to use the Recovery Console. The Recovery
Console then prompts you for the administrator password. If you do not have
the correct password, Recovery Console does not allow access to the
computer. If an incorrect password is entered three times, the Recovery
Console quits and restarts the computer. Note: If the registry is corrupted
or missing or no valid installations are found, the Recovery Console starts
in the root of the startup volume without requiring a password. You cannot
access any folders, but you can carry out commands such as chkdsk, fixboot,
and fixmbr for limited disk repairs. Once the password has been validated,
you have full access to the Recovery Console, but limited access to the hard
disk. You can only access the following folders on your computer: drive
root, %systemroot% or %windir%


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
|I need to check my disks; Windows XP Professional even tells me that and
| tries to run a chkdsk at boot time. I can even use the run command to
| execute chkdsk (or schedule one to run at the next reboot). The problem
is,
| it NEVER executes. I get the blue screen announcing that the disk has
been
| scheduled for a maintenance check, followed by a blurb about cancelling it
| striking any key. Even though I never touch the keyboard, somehow time
after
| time, the job gets cancelled. I cannot determine what I need to do to get
| the thing to run! It seems as though something is stepping on this
program
| but I do not know what it is. Can anyone help? Thanks.

A couple of hints about the recovery console:

Be default, it requires the PC's administator password and by default it can
only access the windows directoies. However, you can change that, but to do
so the PC must be bootable into the windows desktop. Assuming ythat you can
get there, use REGEDIT to make the following changes:

Instead, just run REGEDIT and change two things that appear on the same
page:



Start à Run à Regedit


Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\Setup\RecoveryConsole


Set the DWORD SecurityLevel value to 1



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\Setup\
RecoveryConsole



Set the DWORD SetCommand value to 1


Then, once in the recovery console, use its SET command to allow access to
more of the hard drive:

set AllowAllPaths = true

If the recovery coonsole won't load, ask yourself whether the XP CD you are
using matches the service pack level of the XP installed on the PC (i.e.,
original or SP1 or SP2). I have heard of problems if the level of the CD is
older than that of the installation. The way to get an up-to-date CD is to
"slipstream" the original CD with the latest service patch installed on the
PC. For this I recommend the nLite auto-slipstreamer. Just do not use its
full potential, whihc can also exclude parts of XP. Its defaults will merge
everthing from the service pack into the CD, make an ISO image, which you
then burn to CD using somehting like Easy CD Creator or Nero, not the XP
default software. This slipstreamed CD can be made on another PC, just be
sure to you the right version (home/pro) and the right SP:

http://www.msfn.org/articles.php?act...showarticle=49

Finally, you can have the power of the recovery console and more, by making
a BartPE bootable CDROM. This takes parts of XP, plus some freeware and
makes its own operating system, without the restrictions of the recovery
console. One of its default capabilities is to do a CHKDSK. (Hint: Bart's
GO button is like the XP Start button.)

http://www.nu2.nu/pebuilder/index.php?p=1


"hardy" wrote in message
...
I need to check my disks; Windows XP Professional even tells me that and
tries to run a chkdsk at boot time. I can even use the run command to
execute chkdsk (or schedule one to run at the next reboot). The problem
is,
it NEVER executes. I get the blue screen announcing that the disk has
been
scheduled for a maintenance check, followed by a blurb about cancelling it
striking any key. Even though I never touch the keyboard, somehow time
after
time, the job gets cancelled. I cannot determine what I need to do to get
the thing to run! It seems as though something is stepping on this
program
but I do not know what it is. Can anyone help? Thanks.

"hardy" wrote:
| Dave: Thank you so very much for your knowledgeable advice, which seemed
to
| be so thorough, I was confident I would overcome my problem by following
it.
| This was not the case, however, which probably means I'm doing something
| really stupid or this problem has morphed into yet something
else--possibly
| both! Regarding the dirty bit flag and checking the logs, I was unable to
| find a log on any volume with the name "bootex.log" in either the root or
any
| other directory.
* It won't exist. When you startup the contents of Bootex.log get moved to
the application log and the temp file is deleted.

I was also unable to locate the "application event log".
| You didn't specify an exact filename but I assumed that I could probably
| locate it; perhaps I was mistaken.
* Start|Run|eventvwr.msc to get to the Event Viewer snap-in.

I next tried the Recovery Console route,
| which I have used for a different problem in the past. I remembered that
I
| had to use a floppy to load the appropriate SCSI driver for one of my
| drives. I got past that point successfully only to have the system die.
The
| error message was "unable to load keyboard layout, KBDUS.DLL" which
resulted
| in a forced machine shut down. I'm not sure what this problem indicates.
| There are three copies of this file on my C:\ drive, one at c:\cmdcons,
one
| at c:\windows\system32, and one more at c:\windows\system32\dllcache. All
| three files are version 5.1.2600.0 and contain the same number of bytes.
I
| even tried updating my keyboard driver and retried Recovery Console but
still
| had no luck. I didn't encounter this before so I do not know why this is
| happening. Is it possible none of these files are where they belong? If I
| read your reply correctly, Recovery Console can access only certain
| directories; I may be wrong about this but I thought c:\windows\system32
was
| my system directory and therefore would be OK. Finally, your suggestion
that
| executing anti-virus software may be the culprit, although an excellent
| suggested thing to check, I did not pursue. I just switched antivirus
| products and between the uninstall and install when the machine was
without
| this software, I know I still had this problem running a scheduled chkdsk
on
| a reboot. So at least in my case, this is not the problem. Do you
possibly
| have any other ideas for me? Thank you once again.
* Yes that is exactly right, you must F6 (at setup is inspecting your
system) and load the scsi controller driver in order to start the recovery
console. I've never seen that error starting the RC. This link may help with
that. Possibly putting the required DLL on floppy.

http://msdn.microsoft.com/library/en...4aec9c.xml.asp


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

FYI this isn't necessary. In order to have access to other folders you need
to have;
Control Panel|Admin Tools|Local Security Policy Recovery console:"Allow
floppy copy and access to all drives/folders" set to enabled.

The service pack versions could be an issue if starting the RC from the
system drive's cmdcons folder. Starting the RC from the CD-Rom though
shouldn't make a difference.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Bob Harris" wrote:
|A couple of hints about the recovery console:
|
| Be default, it requires the PC's administator password and by default it
can
| only access the windows directoies. However, you can change that, but to
do
| so the PC must be bootable into the windows desktop. Assuming ythat you
can
| get there, use REGEDIT to make the following changes:
|
| Instead, just run REGEDIT and change two things that appear on the same
| page:
|
|
|
| Start à Run à Regedit
|
|
| Navigate to
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\Setup\RecoveryConsole
|
|
| Set the DWORD SecurityLevel value to 1
|
|
|
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\Setup\
| RecoveryConsole
|
|
|
| Set the DWORD SetCommand value to 1
|
|
| Then, once in the recovery console, use its SET command to allow access to
| more of the hard drive:
|
| set AllowAllPaths = true
|
| If the recovery coonsole won't load, ask yourself whether the XP CD you
are
| using matches the service pack level of the XP installed on the PC (i.e.,
| original or SP1 or SP2). I have heard of problems if the level of the CD
is
| older than that of the installation. The way to get an up-to-date CD is
to
| "slipstream" the original CD with the latest service patch installed on
the
| PC. For this I recommend the nLite auto-slipstreamer. Just do not use
its
| full potential, whihc can also exclude parts of XP. Its defaults will
merge
| everthing from the service pack into the CD, make an ISO image, which you
| then burn to CD using somehting like Easy CD Creator or Nero, not the XP
| default software. This slipstreamed CD can be made on another PC, just be
| sure to you the right version (home/pro) and the right SP:
|
| http://www.msfn.org/articles.php?act...showarticle=49
|
| Finally, you can have the power of the recovery console and more, by
making
| a BartPE bootable CDROM. This takes parts of XP, plus some freeware and
| makes its own operating system, without the restrictions of the recovery
| console. One of its default capabilities is to do a CHKDSK. (Hint:
Bart's
| GO button is like the XP Start button.)
|
| http://www.nu2.nu/pebuilder/index.php?p=1
|
|
| "hardy" wrote in message
| ...
| I need to check my disks; Windows XP Professional even tells me that and
| tries to run a chkdsk at boot time. I can even use the run command to
| execute chkdsk (or schedule one to run at the next reboot). The problem
| is,
| it NEVER executes. I get the blue screen announcing that the disk has
| been
| scheduled for a maintenance check, followed by a blurb about cancelling
it
| striking any key. Even though I never touch the keyboard, somehow time
| after
| time, the job gets cancelled. I cannot determine what I need to do to
get
| the thing to run! It seems as though something is stepping on this
| program
| but I do not know what it is. Can anyone help? Thanks.
|
|

Well, I opened my mouth and publicly revealed the extent of my stupidity!
Without your help, I guess I would have been searching a long time for that
Application Event Log! I admire and appreciate the patience you demonstrate
when addressing people far less conversant in operating systems. As you
suspected, my side-issue difficulties with getting into Recovery Console
stemmed from running from c:\cmdcons rather than the XP CD. The problem was
solved by using the CD and it did not require "slipstreaming" the CD as
another gentleman suggested. Thus, I have been able to run chkdsk.
Regarding why it doesn't run from Autochk is still a mystery I very much wish
to solve. Checking that Application Event Log revealed the following: under
Applications, there is an error from SecurityCenter, event ID 1802, which
reads, "The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus and Firewall."
Interestingly, this is immediately followed by the informational message from
SecurityCenter, event ID 1800, which reads, "The Windows Security Center
Service has started." I do not know if I am getting off track here or not,
but after confirming that I was reading the event log in the correct
chronological order, did the error cause Security Center to stop and then
restart, or was the fact that it had not yet started the real cause of my
error? Checking further, I looked under System events and found three
entries, the first two of which are identical: Error, ntsf, event ID 55,
category disk, which reads, "The file system structure on the disk is corrupt
and unusable. Please run the chkdsk utility on the volume F:." The third
message is a warning from dchp, event ID 1007, which has to do with the
system automatically configuring the IP address for the network card because
it did not receive an expected timely response from somebody (I am assuming
that this event is unrelated...but maybe not). It would then appear that you
were correct as originally claimed, that a third party firewall or antivirus
is grabbing the disk before the chkdsk can run. Now, in an attempt to test,
I completely uninstalled both my firewall and antivirus programs and received
the same results. Again asssuming, I am wondering if this is because these
programs often replace system DLL files that remain as residual after an
uninstall. Part of my interest in solving this problem is that even after
running chkidsk in Recovery Console, the disk remains flagged as corrupt. Do
you have any further advice on how I can solve this annoying problem?
Although someone can no doubt offer me a way of going in and manually
twiddling this bit to indicate that the disk is now OK, this is not a long
term solution and I'll be right back in the same place the next time my
machine freezes or I have a power hit. Thank you again for your helpfulness
and your patience with my foolish questions.



"Dave Patrick" wrote:

FYI this isn't necessary. In order to have access to other folders you need
to have;
Control Panel|Admin Tools|Local Security Policy Recovery console:"Allow
floppy copy and access to all drives/folders" set to enabled.

The service pack versions could be an issue if starting the RC from the
system drive's cmdcons folder. Starting the RC from the CD-Rom though
shouldn't make a difference.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Bob Harris" wrote:
|A couple of hints about the recovery console:
|
| Be default, it requires the PC's administator password and by default it
can
| only access the windows directoies. However, you can change that, but to
do
| so the PC must be bootable into the windows desktop. Assuming ythat you
can
| get there, use REGEDIT to make the following changes:
|
| Instead, just run REGEDIT and change two things that appear on the same
| page:
|
|
|
| Start Ã* Run Ã* Regedit
|
|
| Navigate to
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\Setup\RecoveryConsole
|
|
| Set the DWORD SecurityLevel value to 1
|
|
|
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\Setup\
| RecoveryConsole
|
|
|
| Set the DWORD SetCommand value to 1
|
|
| Then, once in the recovery console, use its SET command to allow access to
| more of the hard drive:
|
| set AllowAllPaths = true
|
| If the recovery coonsole won't load, ask yourself whether the XP CD you
are
| using matches the service pack level of the XP installed on the PC (i.e.,
| original or SP1 or SP2). I have heard of problems if the level of the CD
is
| older than that of the installation. The way to get an up-to-date CD is
to
| "slipstream" the original CD with the latest service patch installed on
the
| PC. For this I recommend the nLite auto-slipstreamer. Just do not use
its
| full potential, whihc can also exclude parts of XP. Its defaults will
merge
| everthing from the service pack into the CD, make an ISO image, which you
| then burn to CD using somehting like Easy CD Creator or Nero, not the XP
| default software. This slipstreamed CD can be made on another PC, just be
| sure to you the right version (home/pro) and the right SP:
|
| http://www.msfn.org/articles.php?act...showarticle=49
|
| Finally, you can have the power of the recovery console and more, by
making
| a BartPE bootable CDROM. This takes parts of XP, plus some freeware and
| makes its own operating system, without the restrictions of the recovery
| console. One of its default capabilities is to do a CHKDSK. (Hint:
Bart's
| GO button is like the XP Start button.)
|
| http://www.nu2.nu/pebuilder/index.php?p=1
|
|
| "hardy" wrote in message
| ...
| I need to check my disks; Windows XP Professional even tells me that and
| tries to run a chkdsk at boot time. I can even use the run command to
| execute chkdsk (or schedule one to run at the next reboot). The problem
| is,
| it NEVER executes. I get the blue screen announcing that the disk has
| been
| scheduled for a maintenance check, followed by a blurb about cancelling
it
| striking any key. Even though I never touch the keyboard, somehow time
| after
| time, the job gets cancelled. I cannot determine what I need to do to
get
| the thing to run! It seems as though something is stepping on this
| program
| but I do not know what it is. Can anyone help? Thanks.
|
|

When you view the logged events in Event Viewer in the upper right corner,
third button down is a copy to clipboard, then you can paste in the body of
a reply message.

Please do so for each of the different System Log events since last boot so
we can see all of the event detail.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| Well, I opened my mouth and publicly revealed the extent of my stupidity!
| Without your help, I guess I would have been searching a long time for
that
| Application Event Log! I admire and appreciate the patience you
demonstrate
| when addressing people far less conversant in operating systems. As you
| suspected, my side-issue difficulties with getting into Recovery Console
| stemmed from running from c:\cmdcons rather than the XP CD. The problem
was
| solved by using the CD and it did not require "slipstreaming" the CD as
| another gentleman suggested. Thus, I have been able to run chkdsk.
| Regarding why it doesn't run from Autochk is still a mystery I very much
wish
| to solve. Checking that Application Event Log revealed the following:
under
| Applications, there is an error from SecurityCenter, event ID 1802, which
| reads, "The Windows Security Center Service was unable to establish event
| queries with WMI to monitor third party AntiVirus and Firewall."
| Interestingly, this is immediately followed by the informational message
from
| SecurityCenter, event ID 1800, which reads, "The Windows Security Center
| Service has started." I do not know if I am getting off track here or
not,
| but after confirming that I was reading the event log in the correct
| chronological order, did the error cause Security Center to stop and then
| restart, or was the fact that it had not yet started the real cause of my
| error? Checking further, I looked under System events and found three
| entries, the first two of which are identical: Error, ntsf, event ID 55,
| category disk, which reads, "The file system structure on the disk is
corrupt
| and unusable. Please run the chkdsk utility on the volume F:." The third
| message is a warning from dchp, event ID 1007, which has to do with the
| system automatically configuring the IP address for the network card
because
| it did not receive an expected timely response from somebody (I am
assuming
| that this event is unrelated...but maybe not). It would then appear that
you
| were correct as originally claimed, that a third party firewall or
antivirus
| is grabbing the disk before the chkdsk can run. Now, in an attempt to
test,
| I completely uninstalled both my firewall and antivirus programs and
received
| the same results. Again asssuming, I am wondering if this is because
these
| programs often replace system DLL files that remain as residual after an
| uninstall. Part of my interest in solving this problem is that even after
| running chkidsk in Recovery Console, the disk remains flagged as corrupt.
Do
| you have any further advice on how I can solve this annoying problem?
| Although someone can no doubt offer me a way of going in and manually
| twiddling this bit to indicate that the disk is now OK, this is not a long
| term solution and I'll be right back in the same place the next time my
| machine freezes or I have a power hit. Thank you again for your
helpfulness
| and your patience with my foolish questions.

OK thanks. Here are the items under System, in chronological order. There
are 23 items.

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6009
Date: 12/20/2004
Time: 02:53:54 PM
User: N/A
Computer: HARDYX
Description:
Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6005
Date: 12/20/2004
Time: 02:53:54 PM
User: N/A
Computer: HARDYX
Description:
The Event log service was started.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: bcm4sbxp
Event Category: None
Event ID: 7
Date: 12/20/2004
Time: 02:53:32 PM
User: N/A
Computer: HARDYX
Description:
ASUSTeK/Broadcom 440x 10/100 Integrated Controller: Network controller
configured for 10Mb full-duplex link.
Data:
0000: 00 00 00 00 02 00 5a 00 ......Z.
0008: 00 00 00 00 07 00 05 40 .......@
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 12/20/2004
Time: 02:53:49 PM
User: N/A
Computer: HARDYX
Description:
The file system structure on the disk is corrupt and unusable. Please run
the chkdsk utility on the volume F:.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0d 00 00 00 02 00 4e 00 ......N.
0008: 02 00 00 00 37 00 04 c0 ....7..À
0010: 00 00 00 00 32 00 00 c0 ....2..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 12/20/2004
Time: 02:53:49 PM
User: N/A
Computer: HARDYX
Description:
The file system structure on the disk is corrupt and unusable. Please run
the chkdsk utility on the volume F:.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0d 00 00 00 02 00 4e 00 ......N.
0008: 02 00 00 00 37 00 04 c0 ....7..À
0010: 00 00 00 00 32 00 00 c0 ....2..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1007
Date: 12/20/2004
Time: 02:54:57 PM
User: N/A
Computer: HARDYX
Description:
Your computer has automatically configured the IP address for the Network
Card with network address 00E018B54D97. The IP address being used is
169.254.61.69.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:55:41 PM
User: N/A
Computer: HARDYX
Description:
The Terminal Services service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:41 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The Fast User Switching Compatibility service was successfully sent a start
control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:55:41 PM
User: N/A
Computer: HARDYX
Description:
The Fast User Switching Compatibility service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:55:41 PM
User: N/A
Computer: HARDYX
Description:
The Telephony service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:41 PM
User: HARDYX\Paul M. Blake
Computer: HARDYX
Description:
The Remote Access Connection Manager service was successfully sent a start
control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:41 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The SAVRT service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:41 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The Network Location Awareness (NLA) service was successfully sent a start
control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:55:41 PM
User: N/A
Computer: HARDYX
Description:
The Network Location Awareness (NLA) service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:41 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The Norton Unerase Protection Driver service was successfully sent a start
control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:41 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The SSDP Discovery Service service was successfully sent a start control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:55:45 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The Application Layer Gateway Service service was successfully sent a start
control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:55:45 PM
User: N/A
Computer: HARDYX
Description:
The Application Layer Gateway Service service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:56:16 PM
User: N/A
Computer: HARDYX
Description:
The Remote Access Connection Manager service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 02:56:19 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The IMAPI CD-Burning COM Service service was successfully sent a start
control.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:56:19 PM
User: N/A
Computer: HARDYX
Description:
The IMAPI CD-Burning COM Service service entered the running state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 02:56:26 PM
User: N/A
Computer: HARDYX
Description:
The IMAPI CD-Burning COM Service service entered the stopped state.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: RemoteAccess
Event Category: None
Event ID: 20158
Date: 12/20/2004
Time: 02:56:38 PM
User: N/A
Computer: HARDYX
Description:
The user successfully established a connection to DSL
Connection using the device PPPoE7-0.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

OK - that's it, at least for the items under the System tab. You are
probably just as interested in seeing the events logged under Applications,
but because there are more of them, I'll post this first and then start
working on those. Thanks again.


"Dave Patrick" wrote:

When you view the logged events in Event Viewer in the upper right corner,
third button down is a copy to clipboard, then you can paste in the body of
a reply message.

Please do so for each of the different System Log events since last boot so
we can see all of the event detail.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| Well, I opened my mouth and publicly revealed the extent of my stupidity!
| Without your help, I guess I would have been searching a long time for
that
| Application Event Log! I admire and appreciate the patience you
demonstrate
| when addressing people far less conversant in operating systems. As you
| suspected, my side-issue difficulties with getting into Recovery Console
| stemmed from running from c:\cmdcons rather than the XP CD. The problem
was
| solved by using the CD and it did not require "slipstreaming" the CD as
| another gentleman suggested. Thus, I have been able to run chkdsk.
| Regarding why it doesn't run from Autochk is still a mystery I very much
wish
| to solve. Checking that Application Event Log revealed the following:
under
| Applications, there is an error from SecurityCenter, event ID 1802, which
| reads, "The Windows Security Center Service was unable to establish event
| queries with WMI to monitor third party AntiVirus and Firewall."
| Interestingly, this is immediately followed by the informational message
from
| SecurityCenter, event ID 1800, which reads, "The Windows Security Center
| Service has started." I do not know if I am getting off track here or
not,
| but after confirming that I was reading the event log in the correct
| chronological order, did the error cause Security Center to stop and then
| restart, or was the fact that it had not yet started the real cause of my
| error? Checking further, I looked under System events and found three
| entries, the first two of which are identical: Error, ntsf, event ID 55,
| category disk, which reads, "The file system structure on the disk is
corrupt
| and unusable. Please run the chkdsk utility on the volume F:." The third
| message is a warning from dchp, event ID 1007, which has to do with the
| system automatically configuring the IP address for the network card
because
| it did not receive an expected timely response from somebody (I am
assuming
| that this event is unrelated...but maybe not). It would then appear that
you
| were correct as originally claimed, that a third party firewall or
antivirus
| is grabbing the disk before the chkdsk can run. Now, in an attempt to
test,
| I completely uninstalled both my firewall and antivirus programs and
received
| the same results. Again asssuming, I am wondering if this is because
these
| programs often replace system DLL files that remain as residual after an
| uninstall. Part of my interest in solving this problem is that even after
| running chkidsk in Recovery Console, the disk remains flagged as corrupt.
Do
| you have any further advice on how I can solve this annoying problem?
| Although someone can no doubt offer me a way of going in and manually
| twiddling this bit to indicate that the disk is now OK, this is not a long
| term solution and I'll be right back in the same place the next time my
| machine freezes or I have a power hit. Thank you again for your
helpfulness
| and your patience with my foolish questions.

Here are the events under the Applications tab; there are 21 of them.

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 12/20/2004
Time: 02:52:05 PM
User: HARDYX\XXXX X. XXXXX
Computer: HARDYX
Description:
The following handles in user profile hive HARDYX\XXXX X. XXXXX
(S-1-5-21-515967899-1770027372-839522115-1003) have been closed because they
were preventing the profile from unloading successfully:

svchost.exe (868)
HKCU (0x1f0)


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 100
Date: 12/20/2004
Time: 02:52:10 PM
User: N/A
Computer: HARDYX
Description:
wuauclt (2212) The database engine 5.01.2600.2180 started.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 102
Date: 12/20/2004
Time: 02:52:10 PM
User: N/A
Computer: HARDYX
Description:
wuaueng.dll (2212) SUS20ClientDataSto The database engine started a new
instance (0).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ccSetMgr
Event Category: None
Event ID: 26
Date: 12/20/2004
Time: 02:53:57 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application starting

Event Type: Information
Event Source: SNDSrvc
Event Category: None
Event ID: 26
Date: 12/20/2004
Time: 02:53:58 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application starting

Event Type: Information
Event Source: SPBBCSvc
Event Category: None
Event ID: 0
Date: 12/20/2004
Time: 02:53:58 PM
User: N/A
Computer: HARDYX
Description:
Service started

Event Type: Information
Event Source: ccSetMgr
Event Category: None
Event ID: 1
Date: 12/20/2004
Time: 02:53:58 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application started

Event Type: Information
Event Source: ccEvtMgr
Event Category: None
Event ID: 26
Date: 12/20/2004
Time: 02:53:59 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application starting

Event Type: Information
Event Source: SNDSrvc
Event Category: None
Event ID: 1
Date: 12/20/2004
Time: 02:53:59 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application started

Event Type: Information
Event Source: ccEvtMgr
Event Category: None
Event ID: 1
Date: 12/20/2004
Time: 02:54:00 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application started

Event Type: Information
Event Source: NPFMntor
Event Category: None
Event ID: 26
Date: 12/20/2004
Time: 02:54:59 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application starting

Event Type: Information
Event Source: NPFMntor
Event Category: None
Event ID: 1
Date: 12/20/2004
Time: 02:54:59 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
Application started

Event Type: Information
Event Source: NProtectService
Event Category: None
Event ID: 3
Date: 12/20/2004
Time: 02:55:00 PM
User: NT AUTHORITY\SYSTEM
Computer: HARDYX
Description:
The service was started.

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1001
Date: 12/20/2004
Time: 02:55:03 PM
User: N/A
Computer: HARDYX
Description:
User profile hive cleanup service version 1.5.5.21 started successfully.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 100
Date: 12/20/2004
Time: 02:55:09 PM
User: N/A
Computer: HARDYX
Description:
wuauclt (2260) The database engine 5.01.2600.2180 started.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 102
Date: 12/20/2004
Time: 02:55:09 PM
User: N/A
Computer: HARDYX
Description:
wuaueng.dll (2260) SUS20ClientDataSto The database engine started a new
instance (0).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 12/20/2004
Time: 02:55:09 PM
User: N/A
Computer: HARDYX
Description:
The Windows Security Center Service was unable to establish event queries
with WMI to monitor third party AntiVirus and Firewall.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0e 10 04 80 ...€

Event Type: Information
Event Source: SecurityCenter
Event Category: None
Event ID: 1800
Date: 12/20/2004
Time: 02:55:09 PM
User: N/A
Computer: HARDYX
Description:
The Windows Security Center Service has started.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Ci
Event Category: CI Service
Event ID: 4137
Date: 12/20/2004
Time: 03:01:18 PM
User: N/A
Computer: HARDYX
Description:
CI has started for catalog c:\system volume information\catalog.wci.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 103
Date: 12/20/2004
Time: 03:01:21 PM
User: N/A
Computer: HARDYX
Description:
wuaueng.dll (2260) SUS20ClientDataSto The database engine stopped the
instance (0).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 101
Date: 12/20/2004
Time: 03:01:21 PM
User: N/A
Computer: HARDYX
Description:
wuauclt (2260) The database engine stopped.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




"Dave Patrick" wrote:

When you view the logged events in Event Viewer in the upper right corner,
third button down is a copy to clipboard, then you can paste in the body of
a reply message.

Please do so for each of the different System Log events since last boot so
we can see all of the event detail.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| Well, I opened my mouth and publicly revealed the extent of my stupidity!
| Without your help, I guess I would have been searching a long time for
that
| Application Event Log! I admire and appreciate the patience you
demonstrate
| when addressing people far less conversant in operating systems. As you
| suspected, my side-issue difficulties with getting into Recovery Console
| stemmed from running from c:\cmdcons rather than the XP CD. The problem
was
| solved by using the CD and it did not require "slipstreaming" the CD as
| another gentleman suggested. Thus, I have been able to run chkdsk.
| Regarding why it doesn't run from Autochk is still a mystery I very much
wish
| to solve. Checking that Application Event Log revealed the following:
under
| Applications, there is an error from SecurityCenter, event ID 1802, which
| reads, "The Windows Security Center Service was unable to establish event
| queries with WMI to monitor third party AntiVirus and Firewall."
| Interestingly, this is immediately followed by the informational message
from
| SecurityCenter, event ID 1800, which reads, "The Windows Security Center
| Service has started." I do not know if I am getting off track here or
not,
| but after confirming that I was reading the event log in the correct
| chronological order, did the error cause Security Center to stop and then
| restart, or was the fact that it had not yet started the real cause of my
| error? Checking further, I looked under System events and found three
| entries, the first two of which are identical: Error, ntsf, event ID 55,
| category disk, which reads, "The file system structure on the disk is
corrupt
| and unusable. Please run the chkdsk utility on the volume F:." The third
| message is a warning from dchp, event ID 1007, which has to do with the
| system automatically configuring the IP address for the network card
because
| it did not receive an expected timely response from somebody (I am
assuming
| that this event is unrelated...but maybe not). It would then appear that
you
| were correct as originally claimed, that a third party firewall or
antivirus
| is grabbing the disk before the chkdsk can run. Now, in an attempt to
test,
| I completely uninstalled both my firewall and antivirus programs and
received
| the same results. Again asssuming, I am wondering if this is because
these
| programs often replace system DLL files that remain as residual after an
| uninstall. Part of my interest in solving this problem is that even after
| running chkidsk in Recovery Console, the disk remains flagged as corrupt.
Do
| you have any further advice on how I can solve this annoying problem?
| Although someone can no doubt offer me a way of going in and manually
| twiddling this bit to indicate that the disk is now OK, this is not a long
| term solution and I'll be right back in the same place the next time my
| machine freezes or I have a power hit. Thank you again for your
helpfulness
| and your patience with my foolish questions.

It might be possible the pagefile is corrupt. Do you have another drive you
can move it to temporararily? If not this article may help.

http://support.microsoft.com/kb/314834/EN-US/

The DHCP error just means there is no DHCP server available on your network.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| OK thanks. Here are the items under System, in chronological order.
There
| are 23 items.
| Event Type: Error
| Event Source: Ntfs
| Event Category: Disk
| Event ID: 55
| Date: 12/20/2004
| Time: 02:53:49 PM
| User: N/A
| Computer: HARDYX
| Description:
| The file system structure on the disk is corrupt and unusable. Please run
| the chkdsk utility on the volume F:.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 0d 00 00 00 02 00 4e 00 ......N.
| 0008: 02 00 00 00 37 00 04 c0 ....7..À
| 0010: 00 00 00 00 32 00 00 c0 ....2..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
|
| Event Type: Error
| Event Source: Ntfs
| Event Category: Disk
| Event ID: 55
| Date: 12/20/2004
| Time: 02:53:49 PM
| User: N/A
| Computer: HARDYX
| Description:
| The file system structure on the disk is corrupt and unusable. Please run
| the chkdsk utility on the volume F:.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 0d 00 00 00 02 00 4e 00 ......N.
| 0008: 02 00 00 00 37 00 04 c0 ....7..À
| 0010: 00 00 00 00 32 00 00 c0 ....2..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
|
| Event Type: Warning
| Event Source: Dhcp
| Event Category: None
| Event ID: 1007
| Date: 12/20/2004
| Time: 02:54:57 PM
| User: N/A
| Computer: HARDYX
| Description:
| Your computer has automatically configured the IP address for the Network
| Card with network address 00E018B54D97. The IP address being used is
| 169.254.61.69.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 00 00 00 00 ....
|
| OK - that's it, at least for the items under the System tab. You are
| probably just as interested in seeing the events logged under
Applications,
| but because there are more of them, I'll post this first and then start
| working on those. Thanks again.

This one probably means the Windows Security Center Service of SP2 is
unaware of your antivirus and or firewall. You might check the vendors web
site for an update.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| Here are the events under the Applications tab; there are 21 of them.
| Event Type: Error
| Event Source: SecurityCenter
| Event Category: None
| Event ID: 1802
| Date: 12/20/2004
| Time: 02:55:09 PM
| User: N/A
| Computer: HARDYX
| Description:
| The Windows Security Center Service was unable to establish event queries
| with WMI to monitor third party AntiVirus and Firewall.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 0e 10 04 80 ...€

ISSUE #! - Thanks for the suggestion, Dave. I have three other disks besides
my bootdisc that I could move the pagefile to. However, I'm afraid I'm not
savvy enough to know exactly how to do that. I have used the System control
panel, Advanced tab, Performance Settings, Advanced Tab, Virtual Memory area
to attempt to no avail. I was able to decrease the total size of the
pagefile. I attempted to click the No Pagefile button, but it seems I am
unable to do that since the system always comes back with a pagefile size of
767 MB regardless. I'm not sure if this is normal or not. Finally, I
followed the instructions you referred me to to wipe out the pagefile at
shutdown successfully. None of these things had any effect on the ability of
chkdsk to run at boot time. It still gets automatically cancelled.
ISSUE #2 - I have taken more time and done a more thorough search on this
problem here on the boards and have found at least two reports by others who
encountered the same problem I am having. One of them dated 11/23/04 has
still not been answered. In the other, someone advised the writer he should
back up everything and then reinstall. I am hoping it really doesn't come to
so drastic a solution. One of the things I noticed however were the
instructions repeated time and time again to individuals on how to check
their chkdsk log using event viewer. These included instructions to look
under applications for the Winlogon entry. Now earlier, I uploaded each and
every entry from event viewer per your request and perhaps you simply missed
this, but I do not find anywhere an entry for Winlogon. Is this perhaps the
root cause or a contributor to this problem I am having?

"Dave Patrick" wrote:

It might be possible the pagefile is corrupt. Do you have another drive you
can move it to temporararily? If not this article may help.

http://support.microsoft.com/kb/314834/EN-US/

The DHCP error just means there is no DHCP server available on your network.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| OK thanks. Here are the items under System, in chronological order.
There
| are 23 items.
| Event Type: Error
| Event Source: Ntfs
| Event Category: Disk
| Event ID: 55
| Date: 12/20/2004
| Time: 02:53:49 PM
| User: N/A
| Computer: HARDYX
| Description:
| The file system structure on the disk is corrupt and unusable. Please run
| the chkdsk utility on the volume F:.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 0d 00 00 00 02 00 4e 00 ......N.
| 0008: 02 00 00 00 37 00 04 c0 ....7..À
| 0010: 00 00 00 00 32 00 00 c0 ....2..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
|
| Event Type: Error
| Event Source: Ntfs
| Event Category: Disk
| Event ID: 55
| Date: 12/20/2004
| Time: 02:53:49 PM
| User: N/A
| Computer: HARDYX
| Description:
| The file system structure on the disk is corrupt and unusable. Please run
| the chkdsk utility on the volume F:.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 0d 00 00 00 02 00 4e 00 ......N.
| 0008: 02 00 00 00 37 00 04 c0 ....7..À
| 0010: 00 00 00 00 32 00 00 c0 ....2..À
| 0018: 00 00 00 00 00 00 00 00 ........
| 0020: 00 00 00 00 00 00 00 00 ........
|
| Event Type: Warning
| Event Source: Dhcp
| Event Category: None
| Event ID: 1007
| Date: 12/20/2004
| Time: 02:54:57 PM
| User: N/A
| Computer: HARDYX
| Description:
| Your computer has automatically configured the IP address for the Network
| Card with network address 00E018B54D97. The IP address being used is
| 169.254.61.69.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 00 00 00 00 ....
|
| OK - that's it, at least for the items under the System tab. You are
| probably just as interested in seeing the events logged under
Applications,
| but because there are more of them, I'll post this first and then start
| working on those. Thanks again.

While it may now be a moot point this article may help you.

http://support.microsoft.com/default...307886&sd=tech

If chkdsk never starts then the file 'Bootex.log' is not created hence there
would be nothing for the Winlogon service to move to the application log.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| ISSUE #! - Thanks for the suggestion, Dave. I have three other disks
besides
| my bootdisc that I could move the pagefile to. However, I'm afraid I'm
not
| savvy enough to know exactly how to do that. I have used the System
control
| panel, Advanced tab, Performance Settings, Advanced Tab, Virtual Memory
area
| to attempt to no avail. I was able to decrease the total size of the
| pagefile. I attempted to click the No Pagefile button, but it seems I am
| unable to do that since the system always comes back with a pagefile size
of
| 767 MB regardless. I'm not sure if this is normal or not. Finally, I
| followed the instructions you referred me to to wipe out the pagefile at
| shutdown successfully. None of these things had any effect on the ability
of
| chkdsk to run at boot time. It still gets automatically cancelled.
| ISSUE #2 - I have taken more time and done a more thorough search on this
| problem here on the boards and have found at least two reports by others
who
| encountered the same problem I am having. One of them dated 11/23/04 has
| still not been answered. In the other, someone advised the writer he
should
| back up everything and then reinstall. I am hoping it really doesn't come
to
| so drastic a solution. One of the things I noticed however were the
| instructions repeated time and time again to individuals on how to check
| their chkdsk log using event viewer. These included instructions to look
| under applications for the Winlogon entry. Now earlier, I uploaded each
and
| every entry from event viewer per your request and perhaps you simply
missed
| this, but I do not find anywhere an entry for Winlogon. Is this perhaps
the
| root cause or a contributor to this problem I am having?

Thank you for the information on how to properly relocate the pagefile. It
is comforting to learn that I was at least on the right track in my earlier
efforts. As you say, it may be moot at this point. I was informed that the
pagefile.sys had been overwritten when I reduced the size, and my [perhaps
faulty] thinking leads me to believe this would have eleviated any existing
file corruption. I can try it again however.

Regarding whether or not Bootex.log is ever written or not, all I can say is
what I earlier reported. I get a blue screen advising me that my drive needs
to be checked for consistency, followed by a warning that I can terminate
this operation if I so chose but advising me that I should allow it to
continue. This is followed by a series of periods (. . . .) allowing me time
to press any key to abort the operation. This then is followed by the notice
that the chkdsk has been cancelled. While normally appearing over some
elapsed seconds, all of this appears on my screen in a sudden flash. Now,
whether all of these messages are actually the first few operations executed
by chkdsk or whether it is the work of some other service which later calls
in chkdsk, I have no idea. I need to rely upon the Windows experts to
provide me this type of technical detail. After describing all of this to
you earlier, it was YOUR suggestion that I check the event viewer for an
entry from Winlogon. Now you seem to be short that I point out I could never
find such an entry! In the end however, it seems as though I am right where
I started.

I am sorry if my questions seem tedious. Naturally, I have no clue whether
this is an SP2 issue, a hardware issue, the result of system file corruption,
etc. I am only capable of reporting what I observe as it happens. I admit
that I am grasping at straws in an attempt to understand this problem and
clear it, however it now would seem that I am not the only one so doing.

I appreciate your time in sharing those things that you do know to help me
troubleshoot this problem. Unfortunately, aside from having eliminated your
suggested ideas about the problem, I am really no closer to having a real
solution. I am at least thankful that unlike that poor guy who wrote about
the same problem on 11/23 and went unanswered, you have at least offered me
some sort of help and I credit you for giving it your best shot.

Unless you care to offer me any last minute suggestions, it appears that I
will need to refer this issue to someone in New Delhi even though I really
dislike the thought of doing so. When I stop to consider the last time I had
to call Microsoft/India, I have to laugh at the prospect of doing it again.
At $35 for a five hour phone call routed through Bombay, I can at least be
assured of getting my money's worth.


"Dave Patrick" wrote:

While it may now be a moot point this article may help you.

http://support.microsoft.com/default...307886&sd=tech

If chkdsk never starts then the file 'Bootex.log' is not created hence there
would be nothing for the Winlogon service to move to the application log.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"hardy" wrote:
| ISSUE #! - Thanks for the suggestion, Dave. I have three other disks
besides
| my bootdisc that I could move the pagefile to. However, I'm afraid I'm
not
| savvy enough to know exactly how to do that. I have used the System
control
| panel, Advanced tab, Performance Settings, Advanced Tab, Virtual Memory
area
| to attempt to no avail. I was able to decrease the total size of the
| pagefile. I attempted to click the No Pagefile button, but it seems I am
| unable to do that since the system always comes back with a pagefile size
of
| 767 MB regardless. I'm not sure if this is normal or not. Finally, I
| followed the instructions you referred me to to wipe out the pagefile at
| shutdown successfully. None of these things had any effect on the ability
of
| chkdsk to run at boot time. It still gets automatically cancelled.
| ISSUE #2 - I have taken more time and done a more thorough search on this
| problem here on the boards and have found at least two reports by others
who
| encountered the same problem I am having. One of them dated 11/23/04 has
| still not been answered. In the other, someone advised the writer he
should
| back up everything and then reinstall. I am hoping it really doesn't come
to
| so drastic a solution. One of the things I noticed however were the
| instructions repeated time and time again to individuals on how to check
| their chkdsk log using event viewer. These included instructions to look
| under applications for the Winlogon entry. Now earlier, I uploaded each
and
| every entry from event viewer per your request and perhaps you simply
missed
| this, but I do not find anywhere an entry for Winlogon. Is this perhaps
the
| root cause or a contributor to this problem I am having?