CHKDSK will not run on reboot after `CHKDSK.EXE /F` command.

myron-szy used Ask the Experts™
Got an annoying problem.  DEFRAG states that `CHKDSK /F` has got to be run.  So I issue the command `CHKDSK /F` and agree to the question that the volume will be checked on reboot, but this does not happem.  Under the `Session Manager` branch `BootExecute` is correctly set, but it does not happen.  I checked the volume and `autochk.exe`, `chkdsk.exe` and `chkntfs.exe` are present.  I have used `SFC /SCANNOW` then tried the colume check again.  Help....
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Hi chkdsk /f will lock the hdd unitl it completes try running a chkdsk /r
dis-able Norton if you have it running at start up.
Is this a shared cluster disc?

Try and run it in read mode only go to start>run>type in cmd press enter then in the black box type in chkdsk only press enter
you can also run it in recovery console
How to install and use the Recovery Console in Windows XP;en-us;307654&FR=1&PA=1&SD=HSCH

310353 - How to Perform a Clean Boot in Windows XP;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP;en-us;310560&FR=1&PA=1&SD=HSCH


Thanks Merete.  You are aware that the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute` value is correctly set and the binaries are valid, but the `BootExecute` referenced programs don't start-up with Windows XP starts?  Windows XP loads up the GUI bypassing the full mid-boot environment.  I've read several entries about using `CHKDSK /R` from the Recovery Console.  It's someone else's computer and I got to get to it to try that particular solution.  `CHKDSK /R`may work within the Recovery Console, but this question will not be resolved if I can't get the normal `CHKDSK /F` to do it's volume checking tasks during the boot-up phase of the operating system.
yes I am familiar with that fact. I was suggesting a read only chkdsk in windows may assist to unlock something that is preventing the chkdsk /f to function.
run this command line:    fsutil dirty query c
Hang in there we''ll sort it.

You can use your xp cd to access the recovery console if the owner's is not available. So long as they match operating systems and sp.
Description of Enhanced Chkdsk, Autochk, and Chkntfs Tools in Windows 2000


Exactly where on the disk is the `volume dirty` bit set?  I'll try the fsutil command nex time I'm at the problem computer.  The SysInternals forum has useful information, but after reading it I've realised I've done the documented procedures and some extra. Mansfield's problem is exactly the same. It looks like the commands located in `BootExecute` are totally ignored, hence authchk and anything else won't work.  If this is the case then this is actually a catastrophic failure expecially when updates are installed or other programs are installed that need to run pre-boot processes.

Something I may try is use the `/SOS` option in the BOOT.INI file ( to try see how things are loading up.  I'm starting to suspect that this problem goes well beyond simply chkdsk not checking the volume at start-up.
CHKNTFS.EXE: What You Can Use It For

chkdsk c: /f /r
adds the following entry to the BootExecute value:    autocheck autochk /r \??\C:
Because this entry is actually placed in the registry, the chkdsk /f /r is unaffected by any chkntfs commands. The only way to disable a chkdsk /f /r is to remove the line from the BootExecute value that references this command.

The Chkntfs.exe utility treats all drives as local to the node. This includes Microsoft Cluster Server (MSCS) physical disk resources on a shared drive array. When using Chkntfs.exe to exclude shared drives on a cluster, you must run the exlusion command on each node. This must be done to ensure each node's registry will have the proper entries. You can only run the command for the shared drive(s) that node owns. If the node does not own the physical disk resource you will receive an error.

Fsutil: dirty

Top Expert 2006

Myron do you have your xp disc? if you do just boot from it and goto the recovery console and run the chkdsk if not pop the drive into another computer and issue the command this should resolve the issue.
I mentioned running in recovery already venom


The computer in question is purchased from a shop and has a recovery disc.  There is no XP disc to boot from so I will either have to use my WinInternals disc or a Windows XP Professional disc to fire up the recovery console.  The problem computer has no passwords set so the recovery console from the CD should work.  Also, Merete (10/22/2006 04:08AM BST) thanks for that advise, but already been down that route without success.
are you positive >>Got an annoying problem.  DEFRAG states that `CHKDSK /F` has got to be run<< that its stating a chkdsk /f and not chkdsk /r
Otherwise take out the hdd slave it and then run a chkdsk from the master C:\

you dont have to insert the>>  .exe btw just chkdsk /f  
in run>cmd> type in chkdsk and nothing else  press enter this should perform a read only


I've been onto the computer yesterday (UK time) and did some investigating and gethered evidence.  I managed to use the reocvery console to perform a `CHKDSK /P` and this checked the volume, but did not cure the problem.  I added the optio to show the notmal boot-up sequence on screen and also log the load event.  `NTBTLOG.TXT` shows the necessary drivers are loaded, but the following happens (after `CHKDSK /F` is issued on the normal command prompt) at boot-up.

Checking file system on C:
The type of the file system is NTFS.
Cannot open volume for direct access.
Windows has finished checking the disk.
Checking file system on C:
The volume is clean.
Windows has finished checking the disk.

Registry setting is:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager
"BootExecute"= REG_MULTI_SZ:
 autocheck autochk /p \??\C:
 autocheck autochk *

The `BootExecute` value did not reset back to just `autocheck autochk *`.

I have grabbed the `software` and `system` registry hives from the problem computer that I can load into REGEDIT.  What do I look for?


Forgot to mention I'm very good at advanced trouble shooting, except this one has really got me stumpe, but now I have a clue as an anchor.  The question now is why is the volume can't be locked for direct access when it should be.  At such an early stage in the OS book-up, what's locking the volume and preventing direct access?


ZoneAlarm has never been on this problem computer
Is this a large hdd or raid?
I use this little program JDiskReport  if I need to look at hdd

When Autochk runs against a volume at boot time it records its output to a file called Bootex.log in the root of the volume being checked. The Winlogon service then moves the contents of each Bootex.log file to the Application Event log. One event log message for each volume checked is recorded as follows:
Event ID: 1001
Source: Winlogon
Description: This includes file system type; drive letter or GUID, and volume name or serial number to help determine what volume Chkdsk ran against.
Also included is whether Chkdsk ran because a user scheduled it or because the dirty bit was set.
unless there is a shedualed chkdsk still inplace in the regestry.

Control disk check at boot after incorrect shutdown::
After an incorrect/improper shutdown, then Windows will perform a CHKDSK of the partitions marked with a dirty-bit at boot to ensure disk stability.
One can also force CHKDSK to run at next boot if running CHKDSK /F on a partition that is "locked" by running applications. When booting the CHKDSK is not started before a timer has expired, allowing the user to avoid running CHKDSK at boot.
To skip disk checking, press any key within 10 seconds.
The timer is in seconds and can be controlled with this DWORD :

[HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \Session Manager]
AutoChkTimeOut=10 (Default = 10, Disable Countdown=0)

More info MS KB Q191603
More info MS KB Q173322

Note if using an USB keyboard without legacy support then one might not be able skip the the disk checking,
 More Info MS KB Q240658

Note one can also use the command CHKNTFS.EXE to configure the time, along with excluding certain drives from boot up check, or forcing boot check of drives. (Running CHKNTFS.EXE /? you will see all parameters). The CHKNTFS.EXE will change the following MULTI_SZ registry key (Use regedt32), which can be changed to force CHKDSK on all drives at boot:
[HKEY_LOCAL_MACHINE \SYSTEM \CurrentControlSet \Control \Session Manager]
BootExecute = "autocheck autochk /f *" (Default = "autocheck autochk *")

Disabling Autochk Causes Incorrect Volume Set Size
More Info MS KB Q235376>

Note if having trouble with constantly/continuously/nonexisting checking of drives at startup, then run this command to reset the above registry value to default:
Note if wanting to query / set the dirty bit on a volume, then one can use the resource kit utility fsutil.

More info MS KB Q235771 BUG: Rchelp.Sys Can Cause CHKDSK to Run Continuously
More info MS KB Q831426  Chkdsk.exe or Autochk.exe starts when you try to shut down or restart your computer

See if this helps


Just a single IDE drive:  Maxtor 6V160E0
Only thing logged in the application log is the Recovery Console's CHKDSK session. does not apply in this instance. does not apply in this instance.
The dirty bit on the volume is not set. does not apply in this instance.
AutoCheck has never been disabled in the way described.  Actually, AutoCheck has simply never been disabled. does not apply in this instance.
The stated system service `rchelp` does not exist in the list of system services. does not apply in this instance.
The operating system has not fully started at the point the problem manifests itself so the Task Scheduler is not running so can't launch CHKDSK, CHKNTFS or AUTHCHK at that time.  In keeping an open mind, next time I encouter this problem computer I will check what tasks are scheduled to run at `system startup` in the task scheduler.

I'm already aware of the `Troubleshooting Disks and File Systems` TechNet article.  MBR and BootSector have already been repaired/replaced.  One of the things I do in due course.

This one seem to be a tough nut to crack.

Question is why "Cannot open volume for direct access" when the operating is booting up from cold?  I'm trying to figure out what could be locking the volume to be checked at such an early time in the boot-up process to prevent AUTHCHK from performing it's tasks.  That is if this is the case.  I've come across instances in the past where error message does not describe the actual and true underlying cause of the error.
yes I have seen this problem before too it was very difficult to fix it could be a big page file that has fragmented and windows is locked in this, cant defrag it and wont until  chkdsk fixes it , chkdsk cant untiluntil defrag wont defrag until chkdsk.
Slaving it was my solution.
That way I could take at real look at the hdd contents also use disc manager in administrative tools computer
I was able to defrag it and then run a chkdsk.

hmm a bit wobbly there sorry typing too fast, fingers cold lol.
From my friends Elder Geeks .It really is the best place to be a member of as well. ;)

Click [Start] then [Run] and enter compmgmt.msc in the [Open:] line to open Computer Management Console
In the left pane, click [Disk Defragmenter] under the [Storage] section.
In the right pane, click the drive that contains the page file and click [Analyze]

In a few minutes you'll be presented with a dialog box where you can click on [View Report]. Scroll down until you come to the pagefile section. It will tell you the size of the pagefile and the fragmentation status. Great. Just click on defragment and the drive and page file will be defragmented, right? Wrong.

Disk Management


Why would a fragmented page file cause the system drive to be locked against direct access?  I've seen a few file systems that I have eventually tidied up that have ended up having a page file with alot more than 50 fragments and all that happened was the computer ran slowly until I defragmented the page file.  I'll check it but I suspect that if I try and defragment the page file I'll end up with the same problem where the drive is locked againft direct access and and page file defragmenter can't do it's job.

Oh...  The computer is still under warranty and has the warranty seal on it.  Opening it up to perform out-of-body maintenance on the hard disc is not an option for several months without killing the warranty and problems like what I got here is not covered by the warranty.  I'm also trying my damn hardest not to resort to the factory restore DVD.  The guy has too much stuff to loose.  Use an external hard disk?  He's got financial problems.

Besides, I really want to know the root cause of this problem.
Top Expert 2006

microsoft just says to update the service packs;en-us;823439&Product=winxp

to get rid of the access denied and it should complete OR you can do as i said and slave the drive and do it from another computer this will also clear the issue.
Top Expert 2006

Root cause of the problem is a dirty volume something is out of place and setting off the dirty volume alarm for windows the only way to fix this is to either A get checkdisk running on that computer or B run chkdsk /r from another computer this will clear the issue.
so do I, what causes it.
What is running prior to the system actually starting?
When the computer is first turned on, the system performs a Power-On Self Test (POST) and starts the actual BIOS routine
Start-Up Files You Should Know

Have you checked the boot.ini in safemode.

I may sound a layman and use a different dialogue to the so called Teckies but believe me I have done plenty of hands on.
At a guess it has 3 possible causes.

Fisrt lets say the hdd was severely fragmented may or may not be the page file, but I have seen this happen where a defrag could not complete the scan, when I look at the defrag log shows the files it cannot defrag, in this instance it was the pagefile.
Then because the defrag could not finalise its assigned ( this is windowsxp) schedualed scan it probably froze and caused a reboot.
Now we have the starting point of a locked drive.
This maybe because the ram was either bad or insufficient and forced windows to do the work. But now we are stuck with incomplete defrag sitting there.
What AV is onboard, Norton can be a real pain. Same with PC doctor, <<this program I have already seen this year kill 5 hdd because of an illegal shutdown from a lockup imporper shutdown and changed the MBR.
Okay back to the subject.
Once the machine reboots up pops an errors windows survived a bad shutdown some critical state then may suggest  run the chkdsk /f
ok you agree doing the right thing, but then you reboot to start the chkdsk /f  it wont run.
Its as if the two are locked into some sort of waiting game.
Could even be the MFT has some kind of corruption.

I see your point about the warranty. If you are a qualified IT teckie though  the warranty is not void??

Run the analyze on the C partition and see what files it says has a problem. Stop any AV while doing this if they are Norton +services or PC doctor + services.
That log may hold a key.
on one machine i did save I eventually slaved the hdd and moved the page file to another hdd, then ran the chkdsk /f and recreated a new page file and defragged it.

Master File Table (MFT)

defragging the MFT


venom96737, you wrote: "you can do as i said and slave the drive and do it from another computer this will also clear the issue.".  In an earlier comment I wrote: "Opening it up to perform out-of-body maintenance on the hard disc is not an option for several months without killing the warranty and problems like what I got here is not covered by the warranty.".  At the moment slaving the drive off another computer is not an option.  The computer needs to be taken sent back to the manufacturer as it is a 1 year return-to-base warranty.  It clearly states (as clear as it can be in legal jargon) if ANYONE else breaks the seal then the warranty is void.  Also, the volume is not dirty.  (Do people acually read my comments carefully?  but all the assitance rendered is accepted with open arms.)  See part of an earlier comment, which reads: "The volume is clean."

Since performing a CHKDSK within the recovery console (booting up from the XP CD) DEFRAG now fully works until the next time the dirty bit is set, but the `Cannot open volume for direct access.` error still persists during start-up.  Looks like `autocheck autochk /p \??\C:` fails and somehow `autocheck autochk *` can check the volume dirty bit.  I used the `/SOS` option in boot.ini to banish the animated start-up logo and to reveal any messages that are usually hidden during the XP boot-up.

From what I can tell the MFT is valid and consistent.

It's not ZoneAlarm.  I've verified that ZoneAlarm has never touched this computer.  I've examined `LowerFilters` and `UpperFilters` for all the drives and I don't see anything wrong with those settings.  I could not find any suspect Non-Plug-N-Play devices with start-up set `boot` that could cause a problem.

Thing is, it looks like some service is stopping `autocheck autochk /p \??\C:` from having exclusive access to the hard disc.  There has got to be some way to record what services load and at what time.  I know about `ntbtlog.txt`, but that tells me nothing.

I've not used SafeMode to see it it works, but then if AutoChk works in safe mode it still won't work when the OS boots up normally so again that will not reveal any really information.  I suppose it will tell me if it fails or works with the basic drivers loaded.  I'll try this next time I'm by the this computer.

Something I didn't try yesterday when I was by this problem computer is disable BitDefender v9, but I can't find any reports (initial searching) about BitDefender causing this problem.
well I really want to see the end results to this too.
What format is the drive?
fat or ntfs?
I've seen this resolved by converting to ntfs.
How to convert a FAT volume or a FAT32 volume to NTFS
Note Although the chance of corruption or data loss during the conversion is minimal, we recommend that you perform a backup of the data on the volume that you want to convert before you start the conversion.

To convert an existing FAT or FAT32 volume to NTFS, follow these steps: 1. Click Start, point to All Programs, point to Accessories, and then click Command Prompt.
2. At the command prompt, type the following, where drive letter is the drive that you want to convert:
convert drive letter: /fs:ntfs
For example, type the following command to convert drive E to NTFS:
convert e: /fs:ntfs
Note If the operating system is on the drive that you are converting, you will be prompted to schedule the task when you restart the computer because the conversion cannot be completed while the operating system is running. When you are prompted, click YES.
3. When you receive the following message at the command prompt, type the volume label of the drive that you are converting, and then press ENTER:
The type of the file system is FAT.
Enter the current volume label for drive drive letter
4. When the conversion to NTFS is complete, you receive the following message at the command prompt:
Conversion complete
5. Quit the command prompt.
or there is disc manager in computer management administrative tools control panel
shown here

Top Expert 2006

Try running this command chkdsk /x

The /x will force the drive to dismount which "might" allow you to run the check

what service pack is on this computer anyway?

There was a known issue with this and the fix was to update service packs.


Service pack 2.  I already know about `chkdsk /x`.  The drive has already been CHKDSKed using the recovery console which in turn cleared the volume's `dirty bit` and DEFRAG operates as expected until the next time the dirty bit is set.  See the beginning of the second paragraph of my comment posted `10/25/2006 01:02AM BST`.

The odd one out on this computer it BitDefender and next time at at my friend's house I'm going to find and disable every bet defender driver and service and see if that helps.  Thing is, I didn't see any non-PnP drivers or services marked as starting at `boot`, I'll check again.  Everything seems to be set with a start-up type as `system`.

Another thing thst is third-party is Nero.  The InCD component is installed.  I might try and uninstall it as he's never used it, but neither `LowerFilters` or `UpperFilters` for the system hard disc have any reference to Nero.

For the device class `DiskDrive` the only `UpperFilters` entry is `PartMgr` and there is no `LowerFilters` value.
For the device class `Volumes` the only `UpperFilters` entry is `VolSnap` and there is no `LowerFilters` value.

I've ran RootKitRevelaer and nothing found there and he does have the AntiVirus program running away in the background.

Come to think about it....  His computer seems to randomly `beep` or `ping` even when it is not actually connected to the Internet.  It seems to ping more when it's busy and now and again when it's idle.  I'll run BitDefender's ful AntiVirus scan next time I'm there.  This one is also an odd-one-out.


Hmmm.....   I would love to understand this problem, but at the rate this is going at I might end up asking this guy to use the factory restore procedure.  Only problem is that this remains unsolved and can happen again.  How I would have loved it if ZoneAlarm was the cause of the problem, but ZoneAlarm has never touched this computer.
could be ram or over heating?
What is this computer make and model?

What kind of ping? or Beep
Choose the mother board  to troubleshoot bios beeps
Troubleshooting BIOS Beep Codes

BIOS Beep Codes


It's not the BIOS.  It's, for better of a description, the `Windows Default beep`.  Comes out of the sound card. I assume if I removed the WAV file from the default beep then if the PC's mainboard has a speaker attached to it it'll come out of that instead.  That's why I ran RootKitRevealer.  I thought it might be a virus of some kind hiding from BitDefender behind a RootKit, but the RootKit didn't show up anything suspicious.

I really wish I could take the hard disk out, but because of the pesky warranty (and warranty seal, which is one of those security stickers that are impossible to tamper with) I can't.  I've done that trick way too many times myself.  Taking the disk out of the affected machine, slaving it to mine using a SATA/PATA disk to USB2 adapter fixing up that way, cleaning up the regsitry hives and then re-intriducing it back into the original computer.

BEEP codes?  I got just about all of them in SatNav PDA I perpetually carry around with me.

These `pings`/`beeps` seem to be random.  The computer could be sat there and nothing happening on the screen mose or keyboard and it goes ping.  Seems to ping a little more when it's actually doing things.  When not doing things it can actually sit there silent for a long time.  Actually, even when it it doing stuff it'll `ping` several times (randomly spaced pings) and then again stay quiet for a while.

I have gathered A LOT of information about this computer.  I'll post another comment later on with a web link to a file what will contain comprensive information about the computer.  I just got to strip out the private and personal information out of the information I'll post first.  Might not be done for today.   Watch this space . . .
what about networking it  to yours?

There maybe a small speaker on the base of the tower, there is also a small clip on the mainboard for  the beeps sounds.
Could perhaps be a thermal warning or heat warning.


I remember checking the BIOS a few times and the temperature and fan RPM readinds seemd to be within acceptible levels.  Regarding networking it to mine?  I would need to get to the file system without starting the operating system on the problem computer, but I am going to installe the free MBM5 main0board monitor on this computer and see what this reveals, if anything.


THOUGHTS: I'm going to re-check the page file, but what I may do is erase the page file to let XP Home re-create it from scratch.  Also, and hopefully I'll remember, I'll fix the page file size.  Defragging the page file may end up being a problem because the defrag might only be possible during the start-up phase of the operating system at the point the `BooxExecute` commands are executed.  Problem is the volume can't be locked for exclusive access so something like SysInternals opage defragger may not work.  Hopefuly starting the computer in safe `command line only` will allow pagefrag to start, but once pagegrad is scheduled, starting the operating in safe mode again will allow `BootExecute` commands to have exclusive access to the system volume.

Another thought is to start-up XP and configure it NOT to use a page file and if the page file is not erased by this option to use the SysInternals `contig` command to defragement the page file.  I suspect I can make a dance with page files.  Create a page file, start in the recovery console and rename the page file, start the OS to re-create the page file, defrag what was the page file, start the recovery console, take out the present page file and rename what was the page file back to making it the page file again.  Unless anyone has a better idea.  Just remember that the system volume can't be locked for exclusive access at that point so any defragging commands in `BootExecute` wont; have a hope's chance in hell of starting and completing.

I still can't see how a fragmented page file can cause the system volume to be locked at such an early state in the OS boot-up process.
Hi again, yes agree it is a bit strange, what windows myron-szy  xp home? are you on a lan?
 If this is the case unplug any external cables ethernet cables usb etc.
The chkdsk has to have 100% rights to the hdd (lock)
Xp Home could be part of it too.
Do you have an administrative account?
Last ditch idea.
Force a chkdsk /f by Modifying Default Bootup Run of CHKDSK /F

How To Move the Paging File in Windows XP


Not on a LAN.  USB ADSL modem.  Yes, an computer administrator account is used.
I want to find out WHAT is preventing autochk from applying an exclusive lock to the system volume.
All the information on the page "Modifying Default Bootup Run of CHKDSK /F" is totally useless to me because the exclusive lock can not be applied to the system volume.
well I am at loss, if you have tried everything... all my suggestions have been based on what information you have provided.
I cannot think of any others.
Your last action was to move the pagefile as I suggested earlier as this worked for me, did this help?
Sometimes getting it to work can point to why it did not.
I am out of ideas, and as you will not slave the hdd due to warranty i would suggest you take the hdd back.

Regards M

One last idea, idea ok,do you have Nortonsystem works installed?
uninstall it fully.
then use the chkdsk /f switch not .exe.
 I know all about   the `BootExecute` referenced programs don't start-up with Windows XP starts, but hey you didnt believe me when I mentioned the possible  dirty bit.
I think your looking in too deep with this problem.
However its a new hdd and you have faithfully not touched the screws even though it has screwed with you  :D


Nortonsystem works is not installed.


I should have followed by instincts as in my missives above I actually touch the solution.  The problem is solved, but the real reason behind the problem is still not determined.  As in exactly what service or driver was the cause of the problem.  I'll put it down to a bug within the BitDefender software.

BitDefender was the culrpit that was not allowing processes listed in `BootExecute` from obtaining exclusive access to the system volume.  Once BitDefender was fully uninstalled and the McAfee AntoVirus/AntiSpam/Firewall solution was installed then AUTOCHK and/or AUTOCHECK could gain exclusive access to the system volume and perform the volume checks and repairs.

What's been mentioned above was the only alteration to this system made to cure the problem.   The page file has not been touched and/or altered and services packs hotfixes did not need re-applying.

The random beeps are another issue.  I think once BitDefender was removed the rendom beeps vanished.  For that solution I'll search EE and the rest of the Interent ad I've noticed this unrelated problem is not unique.
Appreciate the feedback about the problem being BitDefender.
We spent a considerable amount of time trying to resolve this.
I did mention and ask repeatedly what programs could be accessing the hdd as chkdsk has to have exclusive access to the hdd so am satisified I have a solution to work with incase others have a similar issue.


What gets me is at one point starting in safe mode still did not allow exclusive access to the system volume for whatever reason.  This puzzles me as Safe Mode loads the absolute minimum and one would think that exclusive access to the hard disk would be granted, unless there was something else besides BitDefender that caused the problem.  This is why I was stumped.  I did not document every single thing I did to try resolve the problem as then this question would end up becoming huge.  In the end removal of BitDefender and introducing McAfee cured the issue.  I have a feeling that it's a combination of programs that caused the problem with BitDefender being one of them.  With one component of the total problem removed exclusive access to the system volume at OS load-up is now granted.

There still seems to be evidence of the problem, but currently nothing that will now stop Windows XP Home from behaving as expected.

Ihe investigation still continues, but the core issue is resolved, hence I've asked for the question to be closed.


Before this question is closed (and I may post another question in the future slightly related to this question) I think BitDefender triggered something (still unknown to me what this may be) within the operating system itself to keep any other processes from gaining exclusive access to the system volume irrespective if the minimal drivers and programs are loaded or not.  I suspect removing BitDefender from this particular computer has simply deactivated [made inert] the actual problem.  (A little like removing the batteries from a radio.  The radio still exists, but nothing happens.)

So, the problem is does not appear to be solved.  The problem appears to have simply `gone to bed` for an unspecified duration.

I've advised the owner of this computer that while his computer is functional to back-up everything he needs to keep (aka. "Go get an external hard drive") collect all the programs he wishes to have on his computer and then to perform a factory restore using the factory restore DVD.  Catch-up on updates, reinstall, restore and then be careful on what is loaded onto the computer.  In the past I have known program updates and even Windows updates to cause problems.  For example, over the last month I have witnessed several XP loaded computers show an error dialogue that seemed to indicate a hardware fault with either RAM or the main-board, but this outbreak started on 7 (yep, bene keeping count) unrelated computers.  Since the last round of Microsoft updates I've not seen this odd fault reoccur.

If (no proof) this is a Mocrsoft update issue then chances are it is a core part ow Windows XP that's been altered with and safe mode or not, the code containing the fault would have still loaded.  Again, still needs further investigation, not it's no longer a priority and chances are I may just let this issue lapse.

I'll be helping him with the back-up, factory restore and resotration procedures.  Not the best solution as I still don't know what the problem is.  I just know that uninstalling BitDefender somehow deactivated the problem.
I do indeed agree with you myron-szy, just the other day I received the notice to install IE7 and refused it for now, and then last night my emails nolonger would receive as you can imagine participating in EE .
Outlook Express associates with IE6. I do wonder if these updates have some regestry keys that can perform requests for MS.
These updates constantly rewrite the regestry causing windows to perform in different ways.
Well the so called proof is in the amount of evidence that most problems start after updates.
Why my email client went toes up after this update was stopped does beg an explaination.
I resolved it by regestry mechanic, and re-installing IE and Outlook express removed my store folder to a safer place. Still have IE6 :)

Some of these so called pretect programs when installed and we agree to the EUL we give them permission to have deep access to the entire systems.
These days to have a fully functioning computer at all times we need to have 2 computers side by side and one hdd fully functiong backed up and stored.
This is how I get round these problems. When I clean install the first time I keep that entire system backed up to a new hdd. When one fails I swap them slave the other save off the new files if necessay then format it and backup again from dosc manager.
Good Luck and have nice day.
Regards M


Interesting.  I've installed IE7 on my main machine after trying it on a virtual computer and everything is working exactly as expected.  I too have a back-up computer next to me and I regularly back-up my important and critical data to it over the LAN.  The virtual machines I have set-up for testing is Linux, Windows XP, Windows 98SE, Windows v1.0 (Yes.... Version one) and MS-DOS 6.22.  I've now fully migrated to IE7 and the latest Mozilla Firefox.

What you should have done is, as much an inconvenience it is it to firstly take a SR checkpoint and then use NTBACKUP (a much under used tool) to at least create a System State backup.

Only once in all the years experience of Microsoft Operating systems I encounterd a critiacal failure of XP Pro.  Performing an ASR and then restoring the stsrem state brought the computer 100% back to life and I didn't even get stressed.  Just want to make myself some brews and watch a TV program or two.

Before installing IE7 I also started the computer onto the recovery console and took exact copies of the `SYSTEM` and `SOFTWARE` registry hive files.  Just in case I ned to compare that was with what is.  I can load the saved hives in RegEdit, export the necessary parts and use something like WinDiff to run comparisons.

I'm no stranger to repairing dead systems.  I've repaired too many screwed up OSs than I can care to remember.   So many that I now have starting thinging that it would be easier and simpler to work as an assistant at a kindergarden!

With the computer what would not release the system partition for AUTOCHK to examine, if the sumptoms are no longer there then there is nothing to fix, but during my analasis of the problem I uncovered small mits and pieces of information to suggest that the interaction between XP and BitDefender is flawed.  But this was not the case.  I know I saw BitDefender working on this problem computer without problems.  I still have very detailed (and a lot of it) configuration information while this fault existed.  OVer time I'll examine this to see if I can find the remaining [now inert] pieces of the puzzle.

I'm about 95% convinced that BitDefender simply `activated` the fault within XP.  Removing BitDefender `deactivated` the fault.  (Like removing the ignition key from a car's ignition lock.  Car goes off, but the car still exists, just will not go anywhere until the key in put in tle ignotion lock and turned to power up the vehicle.)  McAfee AV does things differently so the OS fault remains deavtivated and inert.
interesting conversation, I dont think it would possible to examin the actual faults unless you re-create it.
BitDefender was like adding a new driver behind the wheel, the car was still moving but lost its direction.
yes one must remember this is an electrical unit as well and is its base core function , I know it sounds deep but if the flow is minutely stopped or altered it effects the the processes from ram to cmos to paged memory and adds some small regestry key who knows the language.
But each time we reboot this electricity skims over every circute and reports it findings.
But of course windows just cannot think for itself. It is a facinating subject.
Even the so called true programmers and experts of windows are blown away by the facts they find when examining the circutes of used systems and how they work. In true honesty we only harness the knowledge.
Thank you for an enjoyable read. :)


The Windows operating system is simply getting too complicated.
ahaahah you love it


No, I don't.  I have a real life to lead.  A least my action of replacing BitDefender caused the problem to become disabled thus for now this is considered solved.  If and when I have some spare time I'll re-examine the information I got from that computer when the fault was active.  This is something that is not a priority for me and a task that's going to take me, on and off, several weeks.
Closed, 250 points refunded.
Community Support Moderator

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial