michaelak

Hello :) Im having problems that a file 'fidbox.dat' is corrupted, and it appears to be causing a right kerfuffle . I've identified its something to do with Kaspersky anti virus, and it is causing chkdsk and booting in safe mode to become stuck.

Im not sure where to start trying to fix it, so I've written down everything I can remember which has happened.
I've emailed Kaspersky about it, but no reply as of yet.

The problem
-----------
The fidbox.dat file is corrupted.
This occured on Friday 28th November.

Spec details
------------
Running Kaspersky Anti Virus 7.0
Application version 7.0.0.124
Urgent update: dfg
Database published 30/11/2008
Operating system Microsoft Vista Home Service Pack 1 (build 6001), 32bit
The last two updates were installed before this problem occurred, on the 28th Nov, and they are Update for Windows Vista KB959108 and KB957321.

The circumstances
-----------------
No applications were running, and I closed the laptop lid, which should put the laptop to sleep.
I later opened the laptop and pressed the on/off button to awaken it, as usual.
The desktop appeared for about 30 seconds, then a black screen appeared. There did not appear to be any functionality, but its was humming as usual.

I switched off the laptop, and then switched it back on.
A black screen with a flashing white underscore in the top left corner appeared. I waited 15 minutes, and nothing more happened so I turned off the computer.
I then turned it back on, and the 'Windows resume loader' screen appeared. I chose the first option "continue with system resume", but this took me back to the black screen with flashing underscore.

I restarted the laptop, this time choosing the second option of the windows resume loader, 'delete restoration data and proceed to system boot menu'
The CHKDSK began, and deleted a number of corrupt attributes. CHKDSK began the 2nd stage of 3, verifying indexes.
It got as far as 70% before it stopped. I waiting 15 mins, with no avail.

I restarted, and chose to skip CHKDSK.

After windows desktop had loaded, a system tray bubble appeared with the message:
"pctsTray.exe - Corrupt file
The file or directory c:\Windows\System32\drivers\fidbox.dat is corrupt and unreadable.
Please run the CHKDSK utility"

This message appears every time a different application is run, the 'pctsTray.exe' being replaced by the application name.

I tried to run the CHKDSK facility, but get the following message:

CHKDSK is verifying files (stage 1 of 3)...
Deleted corrupt attribute list entry2 file records processed)
with type code 128 in file 28464.
Attribute record (128, "") from file record segment 72203 is corrupt.
Attribute record (128, "") from file record segment 31011sed) is corrupt.
329152 file records processed.
File verification completed.
File record segment 72203 is an orphan.
524 large file records processed.
Errors found. CHKDSK cannot continue in read-only mode.

I can run windows, and the only problems I seem to have experienced (so far) is that I cannot run a backup using Windows

Backup and Restore centre, receiving the error:
"Backup did not complete successfully.
An error occurred.
Catastrophic failure (0x8000FFFF)"

Also, all Windows restore points previous to this occurring do not exist.

Tried to run CHKDSK whilst in safe mode, but it will not boot in safe mode. It becomes 'stuck' at c:\Windows\System32\drivers\crcdisk.sys


Recent activity picked up by anti virus
(dont know if this has anything to do with it?)
---------------------------------------
Most recently identified, and now in backup:
Trojan program: Rootkit.Win32.Delf.aj
Trojan program: Trojan-Dropper.Win32.Agent.zum

But apparently these have been deleted.


I have done a full system scan, and no other activity has been detected.

Very grateful for any advice you can offer me :) I haven't attempted anything else in fear of mucking it up more.

jcgriff2

Hi. . .

The file fidbox.dat is created by Kaspersky and maintains a listing of files already scanned. They really have no business placing such a file in \windows\system32\drivers in my opinion.

The problem here sounds more like a hard drive problem since chkdsk is involved. You need to run chkdsk /r.

When booting into safemode, try the "last known good config" option instead of safemode itself. If that doesn't work, invoke the system recovery partition or use Vista DVD to boot and run hardware diagnostics.

Regards. . .

jcgriff2

.

michaelak

Hi jcgriff2, thankyou for your quick response :)

Could you explain how to run chkdsk /r ?


I have recieved some information back from kaspersky suppoer after sending them a hijackthis log, and they have asked me to delete a few things, but haven't explained why.
I'd like to see if running chkdsk will solve things, before I go deleting things which look like things I use.

Michaela

jcgriff2

Hi. . .

START | type cmd.exe into the start search box | right-click on cmd.exe above under Programs | select Run as Administrator | the black cmd/DOS screen appears | type

chkdsk /r

You'll see some messages - just re-boot; it will run on re-start

jcgriff2

.