Avast breaking chkdsk & systemrestore (2019-07)

Avast Free Antivirus / Premium Security
1

Hi.

I keep Avast Free AV up-to-date on my Win 7 Pro (x64). I recently had a BSOD due to (as displayed by BlueScreenView):

KMODE_EXCEPTION_NOT_HANDLED 0x0000001e ntoskrnl.exe+6f440

Windows Rebooted, as expected, and unexpectedly) said “you need to do a chkdsk, don’t touch anything and we’ll auto start it, etc, etc, etc” [paraphrased].
Then, it failed. The message displayed read as follows:

> Cannot open volume for direct access. > Autochk cannot run due to an error caused by a recently installed software package. > Use the system restore feature from the control panel to restore the system to a point prior to the recent software package installation.
and booted "normally."

Sysrestore refused to restore.

"Windows has detected file system corruption on local disk (C:). You must check the disk for errors before it can be restored."

Every single time I tried to run Chkdsk, it failed with the exact same error message. Chkdsk (without switches; in read-only mode) found 4 files which had lost their something-or-other and restored them to a “Found” folder. The problem continued.

I tried uninstalling all newly-installed programs I could think of. I tried a clean boot with all non-MS services disabled. Nothing helped. Autochk would not run, and sysrestore could not restore.

I even went and made myself a repair disk (via recdisc), but saw someone with a similar problem complain that Avast was the issue.

I then thought, “Why not? It can’t hurt. If nothing else works, I have to restore to a Macrium Image from 2017 ( :frowning: )”, uninstalled Avast, and was able to run Autochk (Chkdsk). Those 4 orphan files were returned to the proper spot.

Please be aware of this issue.
I have not yet dared to reinstall Avast. I reenabled all services.

Also, FWIW, Event Viewer had said that it needed to run chkdsk on Drive C. since Saturday, July 14. I do not know if that is when the problem (with Avast) started.

Any advice would be greatly appreciated.

PS: I am considering moving to McAfee, as my internet provider gives me a “free” install of McAfee Internet Security Suite.

I do not know if reinstalling Avast would re-corrupt my drive.

PPS: I do not know if Avast corrupted Drive C, or if it merely kept Chkdsk & System restore from running.
The orphaned files (recovered Post-Avast removal) were:

Recovering orphaned file Microsoft-Windows-IE-Troubleshooters-Package-wrapper~31bf3856ad364e35~amd64~~6.1.7601.17514.cat (28625) into directory file 3610. Recovering orphaned file MID66D~1.CAT (28625) into directory file 3610. Recovering orphaned file Package_50_for_KB2973351~31bf3856ad364e35~amd64~~6.1.1.1.cat (31328) into directory file 3610. Recovering orphaned file PA70B5~1.CAT (31328) into directory file 3610. 4 unindexed files scanned. CHKDSK is recovering remaining unindexed files. 2 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)... 486144 file SDs/SIDs processed. Cleaning up 1101 unused index entries from index $SII of file 0x9. Cleaning up 1101 unused index entries from index $SDH of file 0x9. Cleaning up 1101 unused security descriptors. ... Correcting errors in the master file table's (MFT) BITMAP attribute.
2

Hi Microfish,
Please try to boot into safemode and run chkdsk. There shouldnt be any 3-third party drivers or services running so chkdsk may fix the corruption. MFT bitmat stores information about free disk blocks and any user mode application cant access it. This kind of error might also point to broken disk sectors (please make a backup of your files !). Can you also upload memory.dmp dump file for analysis.

The default location of the dump file is %SystemRoot%memory.dmp i.e C:\Windows\memory.dmp if C: is the system drive. Windows can also capture small memory dumps which occupy less space. These dumps are created at %SystemRoot%Minidump.dmp (C:\Window\Minidump.dump if C: is the system.

Please zip the memory.dmp file as Microfish_BSOD_7_2019.zip and upload it to avast ftp server.
(https://support.avast.com/en-eu/article/FTP-file-upload)
Thank you for report.

3

I tried to reproduce the problem - but failed. Windows 7 chkdsk starts normally with Avast installed here…

4

Has the OP tried running System File Checker (SFC)?

Run > cmd* > sfc /scannow

  • must be run as admin or, like chkdsk, or it won’t work from Command Prompt or PowerShell.

Easiest way to do this if you do not know how is instead type “cmd” in the Windows Start > SEARCH box then right click on “cmd”, which should be at the top of the search results, and use the “Run as adminstrator” option to launch it.

As for chkdsk - it sounds like it is being used (in read mode only) after the PC is booted. If that is correct it can’t do any repairs to the system drive, for fairly obvious reasons. You need to schedule a boot time chkdsk scan.

Computer > right click on the primary drive (usually C:) > Properties > Tools tab > Error Checking > Check Now button. Tick both options to fix file system errors and attempt recover from bad sectors > Start.

You won’t be allowed to do that but you can schedule a next boot time scan. Do it.

I’d suggest putting in a new restore point before doing any of this as a safety measure.

5

Sorry for the late reply. I greatly thank you for your responses!

I did run SFC /scannow from Command Prompt (as admin), nothing was found. Also, I was using chkdsk /r, which prompted to schedule chkdsk to run on boot. I then reboooted and ran the scan, and this is when it gave that error message :

> Cannot open volume for direct access. > Autochk cannot run due to an error caused by a recently installed software package. > Use the system restore feature from the control panel to restore the system to a point prior to the recent software package installation.
I tried this whole process [i]at least[/i] a half-dozen times. Apologies for not being clearer at first.

I had not thought about making a restore point first, but that would have been a good thing to try.

I uninstalled Avast and found that I could now run chkdsk. I ran chkdsk, created a new restore point, ran sysrestore to verify it would work, reinstalled Avast Free (it seems to have updated to a different base program, so maybe I wasn’t as updated as I thought. For this I do apologize.), and now chkdsk and sysrestore run properly. I do not know what the issue was. (I sometimes get a bluescreen if Firefox is open for too long, but I was getting notices that I needed to run chkdsk two days prior to these events.) Windows appears to be working properly. I am not blaming Avast for causing the corruption, and perhaps if I had set it to “boot after windows boots” or tried safe mode it would have worked.

Now, however, steam games take a long time to open the first time. Maybe if I scan my entire system the active file shields (set to scan on execution and opening) would whitelist or exclude those files?

6

This has a faint whiff of a quiet post glitch fix having been applied. If something suddenly stops working after an update then just as suddenly starts working correctly again, particularly after another apparent update, my suspicions, rightly or wrongly, are always raised.

It could just have been an odd error produced because of an existing installation’s corruption, who knows? But you can be pretty sure, whatever the case, we’re not going to get an explanation about what provoked this behaviour.

Anyway, glad to hear that it has now been fixed.

7

Yes. Everything seems to be running completely correctly now.

Thank you!