Windows 7 C: D: drive both dirty/corrupt/cyclic redundancy check

[PotatoChip]

fsutil dirty query returned both C: and D: drive as Dirty.

Desc of the problem and other information:

First started off about 6 months ago, my pc has 2 drives, C: and D: with D: being empty, nothing stored, not used for anything.
started storing files and within some time there was about a full drive of files,music, programs etc
A program (osu! a music game) was running on D: and froze. After 10 mins of freezing, ctrl+alt+del and power button not working, i stupidly decided to switch it off by the wall.
After restarting the PC, nothing much was different.
A few days later, some songs began to freeze and fail to play.
I checked it out, when clicked, it says cannot play on WMP.
some time later, some winrar files began to fail to open/extract files from. the error message was "Error, cyclic redundancy check"

after many weeks, more and more files began getting this "cyclic redundancy check" error. i have searched online and performed CHKDSK many times with /f and /r with no hope.
Downloaded malware bytes and done many deep scans and found nothing
Used Norton 360 and deep scans, etc, still nothing

reluctant to by a new hard drive, i moved most of the existing files to my C: drive...
some corrupted files such as .mp3/.iso and some other files could not be copied, they were deleted.
some small files took a LONG time to copy across, which was worrying.
after that, i performed the "fsutil dirty query" check on both drives daily. D: is Dirty, C: is NOT dirty.

Until a week ago, i was downloading some files via bit torrent which returned a "cyclic redundancy check" error.
after a few days, i turned on my PC, something popped up, a message saying;
wmpshare.exe directory xx/xx/xx/filename.mp3 is corrupt. number of these messages increased as the days passed
and soon some files were unable to be opened.

tried checkdisk again, fixed nothing.

Any advice?
also, does moving a corrupt/infected file to a clean drive "infect" the drive/ make it corrupt?
(I know some corrupt files cant be copied, but some did...i think...)

I have 2 checkdisk logs available, done between a few days to see if the corruption has "spread" as well as a testdisk log

 

[Pauli]

Until a week ago, i was downloading some files via bit torrent which returned a "cyclic redundancy check" error.

I'd say you start here; Torrent is a curse word in this Forum, I once mentioned it, and was rebuked / had my post edited by a moderator, simply because they / we don't want it. I've come to appreciate the attitude. If anyone can show me this kind of stuff is secure --- I won't believe.

I wouldn't give a penny for warnings coming from "T" sites / downloads.

You've probably got a mess of some sort and, as long as you have it... it won't be solved. These kinds of issues don't always show in a scan, just like rats don't always show in a trap. To get rid of, you need to get rid of. A clean floor is the only not to blemish your socks.

I would recommend a full re-installation, with re-formatting your disk(s). The way to be sure...

General advice? Check where you dive...

 

[Fixer1234]

performed CHKDSK many times with /f and /r with no hope.
and
tried checkdisk again, fixed nothing.

Did chkdsk find nothing or did it find problems but either didn't fix them or fixed them and more of the same returned?

Ideally, you want to figure out if the problem is hardware (hard disk failing), malware, or some type of corruption. If chkdsk found nothing, it probably isn't a hardware problem. If it found problems but didn't fix them, that's another matter.

It is possible that you are dealing with two distinct problems. You had a problem on D: and moved files to C:. Some of the corrupted files couldn't be transferred. Among those you did transfer, some could have been corrupted. Do you know for a fact that the files you are now seeing as corrupted were not among the ones you previously moved, or you used those files after transfer and they were previously OK?

Any download program can fail to properly download a file, which is what the CRC check is for. Seeing that at download time is not worrisome. Seeing unrelated files showing up with CRC errors afterwards is worrisome.

As far as your question about moving a corrupted/infected file: moving a corrupted file should not affect anything else. If it was corrupted on the old drive it will still be corrupted on the new drive. Moving an infected file can infect other files on the new drive. If I followed your description, you ran several A/V programs after the move and no malware showed up. It is possible that some corrupted files were moved but it sounds like, at that point, there was no infection and no other files should have been affected.

It sounds like you may have a different problem since the torrent download. An increasing number of corrupted files is not a good sign. Any corrupted file will, at best, be useless, so delete any file that is identified as corrupted. Rerun the A/V programs now to identify any infection that may have arrived with the torrent download. If you find an infection now, rerun the A/V scans until they report everything clean (if you get a report that infections were found but fixed, there could be active infection going on in areas after they were scanned; you want to see a start-to-finish scan with zero flags). If you can, boot in safe mode with command prompt and run the A/V scan from there.

If D: is now empty again, I would do a hard format on it (not a "quick format" that just deletes the file tables, but a complete wipe and recheck for bad sectors).

If you find and clean up an underlying problem on C:, repeat the checks (chkdsk and A/V scans) daily for at least a week to verify that everything is totally clean and no new problems appear.

If you don't find any underlying cause and continue to have problems, follow Pauli's advice. But first, read advice on other threads in the forum about preparations for starting over (things like making sure you know your license key and planning for how to reinstall--recovery partition vs. Windows installation DVD). There is lots of discussion of stuff you need to know before wiping your operating system.

 

[patcooke]

You need to get the disk completely back to containing no data and no partitions. Remove all files, folders etc then remove all partitions. Create a new partition on the drive and do so with full (not quick) formatting. Run a full chkdsk on the drive and if all clear start using it to store data from a known trusted source (that is no dubious internet based sources). If all continues well then you may feel quite confident that the problem was due to "soft" corruption of files rather than "hard" corruption of the disk itself.

 

[Fixer1234]

Pat, if the problem can be demonstrated to be malware, do you really want to recommend wiping the recovery partition? I wouldn't see any reason to go that far unless a full (retail) Windows installation DVD was available. Certainly not as a first step, anyway.

 

[patcooke]

I got the impression he was saying the D drive and not the C drive was the problem.

 

[PotatoChip]

Did chkdsk find nothing or did it find problems but either didn't fix them or fixed them and more of the same returned?

Ideally, you want to figure out if the problem is hardware (hard disk failing), malware, or some type of corruption. If chkdsk found nothing, it probably isn't a hardware problem. If it found problems but didn't fix them, that's another matter.

It is possible that you are dealing with two distinct problems. You had a problem on D: and moved files to C:. Some of the corrupted files couldn't be transferred. Among those you did transfer, some could have been corrupted. Do you know for a fact that the files you are now seeing as corrupted were not among the ones you previously moved, or you used those files after transfer and they were previously OK?

Any download program can fail to properly download a file, which is what the CRC check is for. Seeing that at download time is not worrisome. Seeing unrelated files showing up with CRC errors afterwards is worrisome.

Chkdsk found lots of errors, heres the log:

Checkdisk log 1 (Both these chkdsks were done WITHOUT /f and /r)
https://drive.google.com/file/d/0B7B009wwESOaVTFkdGpIcjNScnM/edit?usp=sharing

Checkdisk log 2 (Done about 5 days after log 1)
https://drive.google.com/file/d/0B7B009wwESOacnQ0Sjc2V1lmcHc/edit?usp=sharing

Of course, i ran chkdsk upon boot as you cannot run it with /f when windows is booted.
I took 2 days and nights, i missed the completion message. When i checked my pc in the morning, it has already
rebooted into windows. so im unsure if there was errors that it couldnt fix etc. anyway to get that log?

The files that are showing as corrupt recently are NOT the ones i have moved previously from D: . Even though corrupt files shouldnt have been able to have copied to another disk, strangely some did ...
Those files often took a long time to load/ had some other defects (eg: a song that will freeze the system when played up to a point)

and as you stated, i was pretty worried after seeing CRC pop up in random RAR archives..
Please check the chkdsk log to see if hardware error?

 

[Fixer1234]

It looks like the second run found pretty much the same problems as the first, which is a good sign. It also looks like the problems are file corruption, not hardware errors, which is another good sign.

Corruption doesn't preclude moving the file unless it is corrupted in a way or to an extent that Windows can't deal with it. You originally wrote about some files taking an inordinate amount of time to move, which would be consistent with moving a corrupted file.

The logs don't list file names. What you are seeing is just the internal identification of chunks of data on the hard disk. Some of these are sequential numbers. Those chains represent larger files or pieces of files. All of the log data could actually represent just a small number of files. You can't tell from that information whether those are files you moved from D:, but it could be consistent with that, which would be another good sign.

At this point there are two very important things you need to do to clean up what's there and verify that there is not still a problem that could cause further damage.

1. Run chkdsk with the /f /r arguments to actually fix the existing corruption. I would then rerun it a day or two later to verify that it is not finding new problems.
2. Run A/V scans using several different programs. If possible, do it by booting in "safe mode with command prompt" and run them there. (Run them one at a time; don't try to run several concurrently.) If any malware is found, rerun the scan after the malware is dealt with until it runs start-to-finish without finding any problems.

Please do both of these things as soon as possible. It is the only way to be sure that you will not soon be dealing with serious issues on your primary hard disk.

Also, if you intend to reuse the D: drive for any purpose, follow Pat Cooke's advice, above, to return it to a virgin state. If the only drive letters you see are C: and D:, it probably is not partitioned, so at the very least, do a hard format of D:.