PDA

View Full Version : can't run sfc /scannow from safe mode- command prompt



phkhgh
05-20-2011, 10:23 PM
Son's Dell desktop w/ XP suddenly wouldn't boot into windows. Can boot into safe mode - Windows or safe mode - command prompt.
System Restore (several points) didn't work, nor last know good configuration.

I don't believe sfc will run when in Windows safe mode - either from cmd prompt, or start>run.

Booted into safe mode - command prompt - which is supposed to be just cmd, w/o explorer starting. But sfc /scannow still won't run.
Get error like "WFP could not run the...."
Made sure the sfc.exe file existed in windows\system32 - but no way to know if it's corrupted.

Also tried using runas command from Start > Run, w/ commands to start command prompt in administrator mode. It seemed to accept that command, but sfc still wouldn't run.

So, tried (in safe mode - command prompt) using the "sfc /scanonce". I thought that was supposed to run sfc on restart- it didn't. Error msg was "WFP could not make the requested change." The MS KB http://support.microsoft.com/?kbid=310747 on SFC says the sfc /scanonce is suppose to set the reg key "SfcScan" to value = 2, and gave the full reg key path. "SfcScan" didn't exist in the key, so I added it & set value = 2. AFAIK, nothing ran on restart.

At no time did any attempts to run sfc get to point where it asked for install CD.

Found another post, that you can run sfc from the installation CD, but didn't say exactly how. Maybe they misspoke.
If it's possible to "run sfc from the CD," would he boot to safe mode - cmd prompt, then change to CD drive, and some particular folder on the CD, then run the command?

Maybe they just meant to have the CD ready, or just put it in the CD drive (after boot) - so the disk would be available. But that would require the sfc command to execute from cmd prompt - which we can't get it to do.

Any other suggestions on getting sfc to run - when machine will only boot into safe mode - command prompt?
If there's no way to run it in this circumstance, would a repair install be the next best thing, or are there other (get finished before you die) options/ tools to find the reason Windows won't boot?

Thanks.

mjc
05-21-2011, 03:10 PM
Usually, when native Windows tools, to fix things like file corruption, are disabled like this, it indicates a more serious problem...usually a very bad malware infestation.

phkhgh
05-21-2011, 06:07 PM
Thanks. Quite possible. I thought of that, so plan on running a bootable AV scanning / cleaning tool. Could also be partially corrupted disk, and corrupted parts include sfc & any necessary files it needs, if any.

If AV scanning finds nothing, I'd guess next step would be run HDD diagnostic tool (WD, I think). If passes the quick / SMART tests, question is, on the extended test, whether to choose "scan" a drive or "scan & repair errors?"

I believe it offers 2 choices there. If AV scanner finds nothing (& assume results are accurate), I'm not sure how much difference there'd be between choosing "scan & repair" w/ the HDD diag. tool, vs doing an XP repair install. If any errors the diag. tool found / repaired incl. system / boot files, I'd have to do a repair install anyway (at minimum).

If choose "scan only" w/ the diag. tool, I don't know what useful info it'd show in logs, that might prevent having to do a repair install. I've run them before, but never found errors, so don't know what kind of options you have if it finds errors, but didn't choose to "auto correct" errors found.

Any thoughts?

mjc
05-21-2011, 06:13 PM
At this point it is too early to tell...but chances are good that there will be an infection.

Basically, the 'repair' function tries to copy the data to a non-damaged sector. Often there is enough damage done to the data that the copy is worthless...but it marks that area bad, so it won't be used again.

phkhgh
05-21-2011, 06:25 PM
Thanks for that. Avira & Kaspersky both have scanning / removal tools that will run in safe mode or from boot disk. Probably run both of those. If they don't find anything, I guess corrupted files, or failing HDD is next likely issue.

mjc
05-21-2011, 06:48 PM
With failing drive being the most likely cause of the corrupted files...

phkhgh
05-21-2011, 07:47 PM
Quick note: I didn't know my son already ran a full scan w/ Kaspersky in safe mode. It found nothing. Still going to run Avira & Kaspersky's bootable scanners.

phkhgh
06-09-2011, 09:39 AM
New problems have developed in troubleshooting this issue. Have had problems getting SOME, but not all, boot disk diagnostic utilities to run correctly.
As said, successfully ran full AV scan using Kaspersky boot AV scan disk - found nothing. Scan w/ one tool doesn't absolutely rule out malware, but lowers the probability.

On the troubled XP machine, a couple of diag boot disks will run to completion, indicating the CD drive works - at least part of time.

Others, like WD Data Lifeguard Diagnostic & Avira Rescue Disk, Memtest86+ will boot, run for a few sec, then black screen. No err msgs.

I tested the Avira disk & Memtest86 boot disks on my newer desktop running Vista & they boot & run fine, so the problem isn't badly burned boot disks.

Reburned the utilities that wouldn't run on the XP machine, using DIFFERENT burner & DIFF brand CDs. They run on my Vista machine, but still won't on the troubled XP machine. They boot, run a few sec, then black screen.

1) Any ideas why 1 or 2 boot diag disks will run & others can only boot & run for a few sec on XP machine?

2) Suggestions for 3rd party HDD diagnostic boot disk utility we might try if can't get WD's Data Lifeguard to run?

Thanks.

Paul Komski
06-09-2011, 09:15 PM
Rather than running antiviruses I would suggest a new starting point by running Malwarebytes (http://www.filehippo.com/download_malwarebytes_anti_malware/) from SafeMode or better from SafeMode with networking if you have wired internet access. You may need to download to another PC and then transfer by USB stick or similar.

phkhgh
06-10-2011, 03:30 PM
Thanks. He said he ran Malwarebytes -nothing found - but I'm checking that correct scan settings were used so everything was scanned.

Correction: was able to run memtest86+ - found no problems.

May have figured out how to get WD Data Lifeguard to run. It *may* require setting HDD controller type to IDE.

After the above, hopefully his full version of XP x64 from DEll (not recovery disk) also has the recovery console. If not, my copy was 32 bit UPGRADE w/ SP2, so doubtful it'd let us run recovery console on his XP x64 machine.

Also, the Dell XP CD doesn't have SP2, so will probably get a "newer ver of windows already installed" msg. Then, AFAIK, have to uninstall service packs later than the CD (maybe later ver of IE /WMP) so XP CD will let you access recovery console, to run commands like chkdsk.

??? can XP service packs be uninstalled in SAFE MODE, or safe mode - cmd prompt?


Another bootable HDD diag tool I've heard of is hdat2 http://www.hdat2.com/. Any experience w/ it?

Another possible way is slipstream SP2 & his orig XP CD - to get past the "newer windows already installed." I'm not sure if it'll fit on 1 CD, or if he has a DVD ROM. If won't fit on a CD & has no DVD, then as far as slipstreaming, I guess we'd be looking at spanning disks on a windows install CD? Don't know if that's possible.

classicsoftware
06-10-2011, 03:50 PM
You can spend the next several life times trying to figure this out. My best advice is to backup your data and then re-install windows. After you re-install windows, run all of the diagnostic utilities you can before you start to reinstall your programs. Something corrupted windows and you probably will never be able to fix it. Once you have all of your programs installed, image your hard drive to re-installing wont be such a pain in the neck.

phkhgh
06-10-2011, 04:29 PM
Classic, I agree w/ you - to a point. You wouldn't really go to all the trouble of reinstalling windows on a HDD that may well be tanking, would you? I don't think most savvy users would suggest installing any OS on a disk that hadn't been checked - at least to a min level. Under the circumstances, I wouldn't.

A repair install is likely to solve the problems. That's a whole lot faster than reinstalling all software, drivers, updates - on & on.

Next time, if he doesn't image his system, he's on his own. That said, I (& many others) have had "verified" image BUs fail when tried to restore. And I know how to read instructions. Only 2 things in life are certain.

classicsoftware
06-10-2011, 05:44 PM
I disagree that a repair installation is likely to work. It's likely to make it bootable but with continued instability. Nowadays with a fast processor, you can install windows in 30 minutes and it's almost unattended. You can walk away and check on it periodically. You could also remove the drive and place it in an enclosure or insert as a slave in a different PC and test the drive. I really don't think it's the drive if it boots to safe mode. I think Windows coughed up a hairball and needs to be reinstalled. With a fresh copy of Windows and nothing else, it is much easier to figure out what hardware is causing a problem. With a repair, you are still loading all kinds of drivers and software and you will have a harder time figuring things out. It's not like you have a P4 with 512MB of RAM and 5400RPM hard drive.

phkhgh
06-11-2011, 09:47 AM
Thanks for your input - definitely take it under advisement.

One point of disagreement. Doing a clean Windows install & reinstalling/ reconfiguring every piece of software, all mgf hardware drivers, all windows updates & more takes much, much longer than a repair install. Yes, he should have imaged the disk.

Whether a repair install will fix all problems here - dunno. It does work for many users in certain situations, but depends on what's wrong.

Not sure how one arrives at a conclusion that if windows will boot in safe mode, there's nothing wrong w/ the HDD. But, doing a clean (or repair) install, THEN checking the HDD, seems backwards. It's certainly opposite of what MS & many techs recommend. I'm pretty sure I can get some kind of boot HDD diag util to run.

classicsoftware
06-11-2011, 10:25 AM
It's only because you can't seem to get the thing to boot from a CD/DVD. Also, installing the OS stresses the hard drive as well as some of the simple read tests you get with the manufacturers software.

Paul Komski
06-11-2011, 10:57 AM
I'm pretty sure I can get some kind of boot HDD diag util to run.
I have two devices that make this fairly straightforward to do: a USB DVD Drive (http://www.amazon.com/s/ref=nb_sb_ss_i_2_14?url=search-alias%3Daps&field-keywords=usb+dvd+burner&sprefix=usb+dvd+burner) and an inexpensive USB Floppy Drive (http://www.amazon.com/1-44MB-USB-External-Floppy-Drive/dp/B002NWO9EG/ref=sr_1_2?ie=UTF8&qid=1307804339&sr=8-2). Nearly all modern PCs, including netbooks, will boot from either of these.