Chkdsk running on machines after a restart

[Jobos]

Well I don't know what's going on here but I've got chkdsk running on machines which have never had a problem and the whole suite and a bunch of laptops have started running chkdsk.

 

Looking through the logs I'm finding events 55 Ntfs

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume2

 

and event 1001 Wininit for the chkdsk scan which is finding unused index entries and unused security descriptors.

 

The only thing that has changed is I have approved a few wsus updates this morning. All machines affected are running Kaspersky.

[themightymrp]

I used to have a similar issue with a number of XP machines where they would insist on running a chkdsk on every boot. This method worked for me then, don't know if it will work on 7 but the command line tool still exists.

 

1) Open an elevated command prompt

2) Type in “fsutil dirty query c:” or whatever drive letter is the issue

3) It will return a message if the drive is flagged dirty or not. If you are having this problem it should say DIRTY

4) Now run “chkdsk c: /f /x”

5) When finished run the above fsutil command again. It should now say NOT DIRTY

6) Reboot and problem gone.

[Jobos]

The command still work with win 7 but even after running the chkdsk the disk is dirty again. I think the question I am asking is why has this started?

[themightymrp]

Did you try the switches mentioned above to fix the 'DIRTY' status? It could have been a windows update causing a corruption I suppose? I only had the issue with sporadic machines months apart

[Jobos]

Yes I ran chkdsk as above but as soon as it restarted the disk was dirty again. I have found that Kaspersky v6 was the problem as removing it stopped the disk check so it must be a bad av update as it was fine yesterday. I've installed KAV 8 on a few machines and not had a problem with that version.

[Jobos]

Looks like the culprit is KB2823324 which doesn't like Kaspersky.

 

https://support.kaspersky.com/9750

[elsiegee40]

Looks like the culprit is KB2823324 which doesn't like Kaspersky.

 

https://support.kaspersky.com/9750

I rather think that it's the other way round... Kaspersky doesn't like KB2823324.

 

The temporary fix is not to apply the update; it's only a security update, so nothing to worry about then....

[SHatRO]

Confirmed this is happening to me after my Windows Update today. Appears to be related to a failure during shutdown for me... disk is getting marked dirty, but is tending to be fine (I have a fast disk). Running Kaspersky 8.1.0.831 (a.b.c.d)

[Arthur]

Source: blogs.technet.com/b/msrc/archive/2013/04/11/kb2839011-released-to-address-security-bulletin-update-issue.aspx

 

We are aware that some of our customers may be experiencing difficulties after applying security update 2823324, which we provided in security bulletin MS13-036 on Tuesday, April 9. We’ve determined that the update, when paired with certain third-party software, can cause system errors. As a precaution, we stopped pushing 2823324 as an update when we began investigating the error reports, and have since removed it from the download center.

 

Contrary to some reports, the system errors do not result in any data loss nor affect all Windows customers. However, all customers should follow the guidance that we have provided in KB2839011 to uninstall security update 2823324 if it is already installed.

 

Update 2823324 addresses a Moderate-level vulnerability that requires an attacker to have physical computer access to exploit. MS13-036 remains available for download and is being pushed via updates to help protect customers against the other issues documented in the security bulletin - it no longer contains the affected update.

 

Dustin Childs

Group Manager,Response Communications

Microsoft Trustworthy Computing

[Jobos]

That doesn't sound too serious when Microsoft says that but You receive an Event ID 55 or a 0xc000021a Stop error in Windows 7 after you install security update 2823324 talks about BSOD which in anyones book is bad news

[Stupidget]

I have just removed the KB2823324 Update from a couple of machines and this has fixed the Chkdsk problem from reoccurring.

 

Thanks to everybody for assisting in getting this very annoying problem fixed

[swpmre]

Cheers. You can always rely on edugeek members!

[Arthur]

Microsoft have re-released KB2823324, so hopefully no more BSODs.

 

blogs.technet.com/b/msrc/archive/2013/04/23/new-update-available-for-ms13-036.aspx

 

Earlier in April, Microsoft released a number of security patches for its software products as part of its regular monthly "Patch Tuesday" event. A few days later, the company removed one of those security updates, KB2823324, from both its Download Center and via its automatic update system after receiving reports that it was causing some system errors with Windows users when the update was "paired with certain third-party software."

 

Today, Microsoft has now re-released that security update with the new version number of KB2840149. In a post on the Microsoft Security Response blog, Microsoft said the update still fixes the 'Moderate' software threat as KB2823324 was supposed to do but should no longer cause those system errors. (Source)