Update to IE7 and Corrupt MFT

I just updated a neglected computer from IE6 to IE7 and ran into major
problems.

Each time the computer started the hard drive was detected as "dirty" so
chkdsk ran but either found no errors or an error in file "uppercase". Then
I got a message that the paging file was set to zero and Windows had created
a temporary one. But any attempt to set the paging file to a non-zero value
required a reboot and started me back in the loop. I also got a message from
runndll about a "Windows - Corrupt File" that told me that the file c:\$MFT
was corrupt and to run chkdsk.

You may be wondering what on earth this has got to do with IE7. Well I
googled windows corrupt file and C:\$MFT and the most popular link was to
http://www.castlecops.com/t168034-Ge...orrupt_or.html
Two people on this thread said the problem was associated with installing
IE7 so I uninstalled it. chksdk ran again on startup, said, I think, that it
corrected errors in the MFT and I have not had a problem since.

Is this an obscure known bug?
Where do I find the log of what chkdsk did on startup? The text flashes
past so quickly it is difficult to read.
I could not find any logged reference to the Windows - Corrupt File error.
Where would that be?

By the way, I copied an image of the disk to another drive and was still
stuck in the same loop. So if the MFT really was corrupt, somehow IE7
blocked the repair.

I have found the answers to some of my minor questions but not the major one
of what is going on:

For some unaccountable reason the "Windows - Corrupt File" error does not
show up as an error in the event log but as an application popup. My whole
event log is now full of these.


I found the chkdsk results in the application log under winlogon. With IE7
installed it says:
"Checking file system on C:
The type of the file system is NTFS.

The volume is dirty.
Cleaning up minor inconsistencies on the drive.

74927159 KB total disk space.
14195268 KB in 67012 files.
22056 KB in 3688 indexes.
0 KB in bad sectors.
140071 KB in use by the system.
65536 KB occupied by the log file.
60569764 KB available on disk.

4096 bytes in each allocation unit.
18731789 total allocation units on disk.
15142441 allocation units available on disk."

or

"The volume is dirty.
Cleaning up minor inconsistencies on the drive.
The upcase file content is incorrect.
Correcting errors in the uppercase file.
Windows has made corrections to the file system."
etc

After I uninstalled IE7 I got:

"The volume is dirty.
Cleaning up minor inconsistencies on the drive.
Cleaning up 496 unused index entries from index $SII of file 0x9.
Cleaning up 496 unused index entries from index $SDH of file 0x9.
Cleaning up 496 unused security descriptors.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system."

and after that there have been no problems!!!

But with IE7 installed these errors were not found so not fixed. Why?

"AlanB" <> wrote in message
news:F0176A94-8AC3-412A-8443-...
>I just updated a neglected computer from IE6 to IE7 and ran into major
> problems.
>
> Each time the computer started the hard drive was detected as "dirty" so
> chkdsk ran but either found no errors or an error in file "uppercase". Then
> I got a message that the paging file was set to zero and Windows had created
> a temporary one. But any attempt to set the paging file to a non-zero value
> required a reboot and started me back in the loop. I also got a message from
> runndll about a "Windows - Corrupt File" that told me that the file c:\$MFT
> was corrupt and to run chkdsk.



<paste>
I would try running RootKitRevealer and see what it shows
about the NTFS metadata files.

http://www.microsoft.com/technet/sys...tRevealer.mspx

BTW this assumes that the file system is NTFS.
Otherwise the message is bogus.


Good luck

Robert Aldwinckle
---
</paste>


>
> You may be wondering what on earth this has got to do with IE7. Well I
> googled windows corrupt file and C:\$MFT and the most popular link was to
> http://www.castlecops.com/t168034-Ge...orrupt_or.html
> Two people on this thread said the problem was associated with installing
> IE7 so I uninstalled it. chksdk ran again on startup, said, I think, that it
> corrected errors in the MFT and I have not had a problem since.
>
> Is this an obscure known bug?
> Where do I find the log of what chkdsk did on startup? The text flashes
> past so quickly it is difficult to read.
> I could not find any logged reference to the Windows - Corrupt File error.
> Where would that be?
>
> By the way, I copied an image of the disk to another drive and was still
> stuck in the same loop. So if the MFT really was corrupt, somehow IE7
> blocked the repair.

"Robert Aldwinckle" wrote:

> I would try running RootKitRevealer and see what it shows
> about the NTFS metadata files.
>

HKLM\SECURITY\Policy\Secrets\SAC* 11/08/2004 02:23 0 bytes Key name contains
embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 11/08/2004 02:23 0 bytes Key name contains
embedded nulls (*)
HKLM\SOFTWARE\Classes\webcal\URL Protocol 23/03/2006 20:08 13 bytes Data
mismatch between Windows API and raw hive data.
C:\$AttrDef 23/03/2006 19:52 2.50 KB Hidden from Windows API.
C:\$BadClus 23/03/2006 19:52 0 bytes Hidden from Windows API.
C:\$BadClus:$Bad 23/03/2006 19:52 31.25 GB Hidden from Windows API.
C:\$Bitmap 23/03/2006 19:52 2.23 MB Hidden from Windows API.
C:\$Boot 23/03/2006 19:52 8.00 KB Hidden from Windows API.
C:\$Extend 23/03/2006 19:52 0 bytes Hidden from Windows API.
C:\$Extend\$ObjId 23/03/2006 19:52 0 bytes Hidden from Windows API.
C:\$Extend\$Quota 23/03/2006 19:52 0 bytes Hidden from Windows API.
C:\$Extend\$Reparse 23/03/2006 19:52 0 bytes Hidden from Windows API.
C:\$Extend\$RmMetadata 18/05/2007 22:03 0 bytes Hidden from Windows API.
C:\$Extend\$RmMetadata\$Repair 18/05/2007 22:03 0 bytes Hidden from Windows
API.
C:\$Extend\$RmMetadata\$Repair:$Config 18/05/2007 22:03 8 bytes Hidden from
Windows API.
C:\$Extend\$RmMetadata\$Txf 18/05/2007 22:03 0 bytes Hidden from Windows API.
C:\$Extend\$RmMetadata\$TxfLog 18/05/2007 22:03 0 bytes Hidden from Windows
API.
C:\$Extend\$RmMetadata\$TxfLog\$Tops 18/05/2007 22:03 100 bytes Hidden from
Windows API.
C:\$Extend\$RmMetadata\$TxfLog\$Tops:$T 18/05/2007 22:03 1.00 MB Hidden from
Windows API.
C:\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf 19/05/2007 19:11 64.00 KB Hidden
from Windows API
C:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer000 00000000000000001 19/05/2007 19:11 10.00 MB Hidden from Windows API
C:\$Extend\$RmMetadata\$TxfLog\$TxfLogContainer000 00000000000000002 18/05/2007 22:05 10.00 MB Hidden from Windows API.
C:\$LogFile 23/03/2006 19:52 64.00 MB Hidden from Windows API.
C:\$MFT 23/03/2006 19:52 70.25 MB Hidden from Windows API.
C:\$MFTMirr 23/03/2006 19:52 4.00 KB Hidden from Windows API.
C:\$Secure 23/03/2006 19:52 0 bytes Hidden from Windows API.
C:\$UpCase 23/03/2006 19:52 128.00 KB Hidden from Windows API.
C:\$Volume 23/03/2006 19:52 0 bytes Hidden from Windows API.

Quite a few files that are both recent and not standard Windows files (which
are also included in this scan). I'll need an expert to advise me what this
means.

By the way, this scan is done after uninstalling my virus scanner (AVG 7.5
free) as a precaution then re-installing IE7 - which worked successfully at
the second attempt. So unless some expert can provide insight. all we are
left with is another documented report that certain seemingly-unrelated
problems can be "cured" by uninstalling IE7.

Required reading IMHO before installing IE7:

Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
http://www.ie-vista.com/known_issues.html#pre-install

[And I strongly recommend using
http://www.microsoft.com/windows/ie/default.mspx as the installation source,
not Automatic/Windows Update.]

IEBlog : IE7 Installation and Anti-Malware Applications
http://blogs.msdn.com/ie/archive/200...lications.aspx

What's New in Internet Explorer 7
http://msdn.microsoft.com/workshop/e...asp?frame=true

Release Notes
http://msdn2.microsoft.com/ie/Aa740486
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

AlanB wrote:
> I just updated a neglected computer from IE6 to IE7 and ran into major
> problems.
>
> Each time the computer started the hard drive was detected as "dirty" so
> chkdsk ran but either found no errors or an error in file "uppercase".
> Then
> I got a message that the paging file was set to zero and Windows had
> created
> a temporary one. But any attempt to set the paging file to a non-zero
> value
> required a reboot and started me back in the loop. I also got a message
> from runndll about a "Windows - Corrupt File" that told me that the file
> c:\$MFT was corrupt and to run chkdsk.
>
> You may be wondering what on earth this has got to do with IE7. Well I
> googled windows corrupt file and C:\$MFT and the most popular link was to
> http://www.castlecops.com/t168034-Ge...orrupt_or.html
> Two people on this thread said the problem was associated with installing
> IE7 so I uninstalled it. chksdk ran again on startup, said, I think, that
> it corrected errors in the MFT and I have not had a problem since.
>
> Is this an obscure known bug?
> Where do I find the log of what chkdsk did on startup? The text flashes
> past so quickly it is difficult to read.
> I could not find any logged reference to the Windows - Corrupt File error.
> Where would that be?
>
> By the way, I copied an image of the disk to another drive and was still
> stuck in the same loop. So if the MFT really was corrupt, somehow IE7
> blocked the repair.

I installed IE7. Things went badly wrong. I uninstalled IE7. Things
returned to normal. I uninstalled the antivirus program, re-installed IE7
and things were fine. I re-installed the antivirus program. Things were
still fine.

Clearly something went wrong the first time. I don't know whether the virus
scanner caused the problem or whether it was some other glitch.

The manifestation of the problem was that Windows saw a problem in C:\$MFT
(which I presume is the Master File Table). Chkdsk could not find and fix
this until I uninstalled IE7.

A quick google on the symtoms revealed that I am not the only person to
experience this problem after installing IE7. But I guess there were not
enough of us for this ever to become a known bug or issue.

"PA Bear" wrote:

> Required reading IMHO before installing IE7:
>
> Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
> http://www.ie-vista.com/known_issues.html#pre-install
>
> [And I strongly recommend using
> http://www.microsoft.com/windows/ie/default.mspx as the installation source,
> not Automatic/Windows Update.]
>
> IEBlog : IE7 Installation and Anti-Malware Applications
> http://blogs.msdn.com/ie/archive/200...lications.aspx
>
> What's New in Internet Explorer 7
> http://msdn.microsoft.com/workshop/e...asp?frame=true
>
> Release Notes
> http://msdn2.microsoft.com/ie/Aa740486
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin; DTS-L.org
>
> AlanB wrote:
> > I just updated a neglected computer from IE6 to IE7 and ran into major
> > problems.
> >
> > Each time the computer started the hard drive was detected as "dirty" so
> > chkdsk ran but either found no errors or an error in file "uppercase".
> > Then
> > I got a message that the paging file was set to zero and Windows had
> > created
> > a temporary one. But any attempt to set the paging file to a non-zero
> > value
> > required a reboot and started me back in the loop. I also got a message
> > from runndll about a "Windows - Corrupt File" that told me that the file
> > c:\$MFT was corrupt and to run chkdsk.
> >
> > You may be wondering what on earth this has got to do with IE7. Well I
> > googled windows corrupt file and C:\$MFT and the most popular link was to
> > http://www.castlecops.com/t168034-Ge...orrupt_or.html
> > Two people on this thread said the problem was associated with installing
> > IE7 so I uninstalled it. chksdk ran again on startup, said, I think, that
> > it corrected errors in the MFT and I have not had a problem since.
> >
> > Is this an obscure known bug?
> > Where do I find the log of what chkdsk did on startup? The text flashes
> > past so quickly it is difficult to read.
> > I could not find any logged reference to the Windows - Corrupt File error.
> > Where would that be?
> >
> > By the way, I copied an image of the disk to another drive and was still
> > stuck in the same loop. So if the MFT really was corrupt, somehow IE7
> > blocked the repair.
>
>

I'd think that
http://blogs.msdn.com/ie/archive/200...lications.aspx
would give you the best clue, Alan.
--
~PA Bear

AlanB wrote:
> I installed IE7. Things went badly wrong. I uninstalled IE7. Things
> returned to normal. I uninstalled the antivirus program, re-installed IE7
> and things were fine. I re-installed the antivirus program. Things were
> still fine.
>
> Clearly something went wrong the first time. I don't know whether the
> virus
> scanner caused the problem or whether it was some other glitch.
>
> The manifestation of the problem was that Windows saw a problem in C:\$MFT
> (which I presume is the Master File Table). Chkdsk could not find and fix
> this until I uninstalled IE7.
>
> A quick google on the symtoms revealed that I am not the only person to
> experience this problem after installing IE7. But I guess there were not
> enough of us for this ever to become a known bug or issue.
>
> "PA Bear" wrote:
>
>> Required reading IMHO before installing IE7:
>>
>> Sandi's Installation Tips <= FOLLOW THESE TIPS TO THE LETTER!
>> http://www.ie-vista.com/known_issues.html#pre-install
>>
>> [And I strongly recommend using
>> http://www.microsoft.com/windows/ie/default.mspx as the installation
>> source, not Automatic/Windows Update.]
>>
>> IEBlog : IE7 Installation and Anti-Malware Applications
>> http://blogs.msdn.com/ie/archive/200...lications.aspx
>>
>> What's New in Internet Explorer 7
>> http://msdn.microsoft.com/workshop/e...asp?frame=true
>>
>> Release Notes
>> http://msdn2.microsoft.com/ie/Aa740486
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-Windows (IE, OE, Security, Shell/User)
>> AumHa VSOP & Admin; DTS-L.org
>>
>> AlanB wrote:
>>> I just updated a neglected computer from IE6 to IE7 and ran into major
>>> problems.
>>>
>>> Each time the computer started the hard drive was detected as "dirty" so
>>> chkdsk ran but either found no errors or an error in file "uppercase".
>>> Then
>>> I got a message that the paging file was set to zero and Windows had
>>> created
>>> a temporary one. But any attempt to set the paging file to a non-zero
>>> value
>>> required a reboot and started me back in the loop. I also got a message
>>> from runndll about a "Windows - Corrupt File" that told me that the file
>>> c:\$MFT was corrupt and to run chkdsk.
>>>
>>> You may be wondering what on earth this has got to do with IE7. Well I
>>> googled windows corrupt file and C:\$MFT and the most popular link was
>>> to
>>> http://www.castlecops.com/t168034-Ge...orrupt_or.html
>>> Two people on this thread said the problem was associated with
>>> installing
>>> IE7 so I uninstalled it. chksdk ran again on startup, said, I think,
>>> that
>>> it corrected errors in the MFT and I have not had a problem since.
>>>
>>> Is this an obscure known bug?
>>> Where do I find the log of what chkdsk did on startup? The text flashes
>>> past so quickly it is difficult to read.
>>> I could not find any logged reference to the Windows - Corrupt File
>>> error.
>>> Where would that be?
>>>
>>> By the way, I copied an image of the disk to another drive and was still
>>> stuck in the same loop. So if the MFT really was corrupt, somehow IE7
>>> blocked the repair.

"PA Bear" wrote:

> I'd think that
> http://blogs.msdn.com/ie/archive/200...lications.aspx
> would give you the best clue, Alan.
> --
> ~PA Bear
>
Not really. The only active anti-malware I was running at the time was AVG
Antivirus v 7.5 in the default configuration. I have done the same update a
dozen times before with AVG running so unless recent updates have caused AVG
to go "wrong" then it is not that as such. AVG is used quite widely as it is
free for non-commercial use. So if it has gone wrong lately we will start to
get more reports of the same issue. I accept that it may be a glitch caused
by some rare combination of circumstances, one of which being the use of
anti-malware during the install.

By the way, I created a disk image by putting my hard disk in a Vista
machine with some imageing software on it. Is Vista where all those extra
hidden files came from? I posted the results from Rootkit Revealer earlier
in this thread.

AlanB wrote:
> "PA Bear" wrote:
>> I'd think that
>> http://blogs.msdn.com/ie/archive/200...lications.aspx
>> would give you the best clue, Alan.
>> --
> Not really. The only active anti-malware I was running at the time was
> AVG
> Antivirus v 7.5 in the default configuration. I have done the same update
> a
> dozen times before with AVG running so unless recent updates have caused
> AVG
> to go "wrong" then it is not that as such. AVG is used quite widely as it
> is free for non-commercial use. So if it has gone wrong lately we will
> start to get more reports of the same issue. I accept that it may be a
> glitch caused by some rare combination of circumstances, one of which
> being
> the use of anti-malware during the install.
<snip>

Each time you installed IE7, did you not see a prompt early on that advised
you to disable your anti-virus application? Did you do so?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin; DTS-L.org

"AlanB" <> wrote in message news:EBC67814-DE94-401B-9675-...
> "Robert Aldwinckle" wrote:
>
>> I would try running RootKitRevealer and see what it shows
>> about the NTFS metadata files.


I was thinking that the tool might actually confirm chkdsk's diagnosis... ; }

Otherwise I'm not sure what this is telling us.

Do you have another machine or alternate partition to compare with?
Alternatively, what are the results when you try the same diagnostic
without IE7?

FWIW I don't have any of the registry discrepancies you are being shown.
Otherwise my report (for XPsp2 with IE7) is essentially the same.

I was considering cross-posting this to
microsoft.public.windowsxp.perform_maintain
but I think too much of the discussion's context has been snipped
for that to be useful.


Good luck

Robert
---


>>
>
> HKLM\SECURITY\Policy\Secrets\SAC* 11/08/2004 02:23 0 bytes Key name contains
> embedded nulls (*)
> HKLM\SECURITY\Policy\Secrets\SAI* 11/08/2004 02:23 0 bytes Key name contains
> embedded nulls (*)
> HKLM\SOFTWARE\Classes\webcal\URL Protocol 23/03/2006 20:08 13 bytes Data
> mismatch between Windows API and raw hive data.
> C:\$AttrDef 23/03/2006 19:52 2.50 KB Hidden from Windows API.
> C:\$BadClus 23/03/2006 19:52 0 bytes Hidden from Windows API.
> C:\$BadClus:$Bad 23/03/2006 19:52 31.25 GB Hidden from Windows API.
> C:\$Bitmap 23/03/2006 19:52 2.23 MB Hidden from Windows API.
> C:\$Boot 23/03/2006 19:52 8.00 KB Hidden from Windows API.
> C:\$Extend 23/03/2006 19:52 0 bytes Hidden from Windows API.

....


Full thread can be found here:

http://www.microsoft.com/communities...3-f3080a258300