master file table corrupt Event ID 55 and WMI error event 24

[edge]

Dell Inspiron Laptop 5558 , Win 8.1, I7, 6GB RAM, 1 TB HDD

Event viewer shows the error below and also a WMI error event 24. The MFT error happened only once. I can provide detail on this error if needed. Disk management shows all partitions on the disk are healthy. I don't if this is related, I also periodically get a screen nslookup.exe popup screen. What should I do to diagnose/ repair these errors?

 

[jcgriff2]

Hi. . .

Run chkdsk /r from a CMD prompt screen.

Answer "Y" to the question; re-boot the system.

Chkdsk will run upon startup.

Regards. . .

jcgriff2

EDIT: Paste chkdsk results into your next post. You can find the results in the Event Viewer - Application

 

[edge]

Two Event 1001 entries were made and one Application Error 1000

System

- [TD="width: 130"] Provider

[TD="width: 15"][/TD]

Windows Error Reporting

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ Name ][/TD]

[/TD]

- [TD="width: 130"] EventID

[TD="width: 15"][/TD]

1001

0

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ Qualifiers ][/TD]

[/TD]

[TD="width: 130"] Level

[TD="width: 15"][/TD]

4

[/TD]

[TD="width: 130"] Task

[TD="width: 15"][/TD]

0

[/TD]

[TD="width: 130"] Keywords

[TD="width: 15"][/TD]

0x80000000000000

[/TD]

- [TD="width: 130"] TimeCreated

[TD="width: 15"][/TD]

2017-07-09T04:04:23.000000000Z

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ SystemTime ][/TD]

[/TD]

[TD="width: 130"] EventRecordID

[TD="width: 15"][/TD]

103366

[/TD]

[TD="width: 130"] Channel

[TD="width: 15"][/TD]

Application

[/TD]

[TD="width: 15"][/TD]

Security

[TD="width: 15"][/TD]

-

[TD="width: 130"] EventData [/TD]

120778797442

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

4

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

APPCRASH

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

Not available

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

0

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

svchost.exe_stisvc

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

6.3.9600.17415

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

54504177

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

ntdll.dll

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

6.3.9600.18696

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

59153753

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

c0000008

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

00000000000925fa

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\WER5B8E.tmp.appcompat.txt C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\WER5CD7.tmp.WERInternalMetadata.xml C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_stis_a3103280252faaa02a5a91ad3b1672d38e6c4e_80d5dffc_cab_0f345cd5\memory.hdmp C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_stis_a3103280252faaa02a5a91ad3b1672d38e6c4e_80d5dffc_cab_0f345cd5\triagedump.dmp

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_svchost.exe_stis_a3103280252faaa02a5a91ad3b1672d38e6c4e_80d5dffc_1208850e

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

0

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

a6d08895-645b-11e7-8373-34e6d781b465

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

0

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

a2573dca63c4cf7cb548a92d8355d6e7

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

System

- [TD="width: 130"] Provider

[TD="width: 15"][/TD]

Windows Error Reporting

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ Name ][/TD]

[/TD]

- [TD="width: 130"] EventID

[TD="width: 15"][/TD]

1001

0

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ Qualifiers ][/TD]

[/TD]

[TD="width: 130"] Level

[TD="width: 15"][/TD]

4

[/TD]

[TD="width: 130"] Task

[TD="width: 15"][/TD]

0

[/TD]

[TD="width: 130"] Keywords

[TD="width: 15"][/TD]

0x80000000000000

[/TD]

- [TD="width: 130"] TimeCreated

[TD="width: 15"][/TD]

2017-07-09T04:04:22.000000000Z

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ SystemTime ][/TD]

[/TD]

[TD="width: 130"] EventRecordID

[TD="width: 15"][/TD]

103365

[/TD]

[TD="width: 130"] Channel

[TD="width: 15"][/TD]

Application

[/TD]

[TD="width: 15"][/TD]

Security

[TD="width: 15"][/TD]

-

[TD="width: 130"] EventData [/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

0

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

APPCRASH

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

Not available

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

0

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

svchost.exe_stisvc

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

6.3.9600.17415

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

54504177

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

ntdll.dll

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

6.3.9600.18696

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

59153753

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

c0000008

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

00000000000925fa

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\WER5B8E.tmp.appcompat.txt C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\WER5CD7.tmp.WERInternalMetadata.xml C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_stis_a3103280252faaa02a5a91ad3b1672d38e6c4e_80d5dffc_cab_0f345cd5\memory.hdmp C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_stis_a3103280252faaa02a5a91ad3b1672d38e6c4e_80d5dffc_cab_0f345cd5\triagedump.dmp

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_stis_a3103280252faaa02a5a91ad3b1672d38e6c4e_80d5dffc_cab_0f345cd5

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

0

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

a6d08895-645b-11e7-8373-34e6d781b465

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

4

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"]

System

- [TD="width: 130"] Provider

[TD="width: 15"][/TD]

Application Error

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ Name ][/TD]

[/TD]

- [TD="width: 130"] EventID

[TD="width: 15"][/TD]

1000

0

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ Qualifiers ][/TD]

[/TD]

[TD="width: 130"] Level

[TD="width: 15"][/TD]

2

[/TD]

[TD="width: 130"] Task

[TD="width: 15"][/TD]

100

[/TD]

[TD="width: 130"] Keywords

[TD="width: 15"][/TD]

0x80000000000000

[/TD]

- [TD="width: 130"] TimeCreated

[TD="width: 15"][/TD]

2017-07-09T04:04:07.000000000Z

[TD="width: 15"][/TD]
[TD="width: 12"][/TD]
[TD="width: 105"][ SystemTime ][/TD]

[/TD]

[TD="width: 130"] EventRecordID

[TD="width: 15"][/TD]

103362

[/TD]

[TD="width: 130"] Channel

[TD="width: 15"][/TD]

Application

[/TD]

[TD="width: 15"][/TD]

Security

[TD="width: 15"][/TD]

-

[TD="width: 130"] EventData [/TD]

svchost.exe_stisvc

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

6.3.9600.17415

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

54504177

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

ntdll.dll

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

6.3.9600.18696

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

59153753

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

c0000008

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

00000000000925fa

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

764

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

01d2f8602c51fa06

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

C:\Windows\system32\svchost.exe

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

C:\Windows\SYSTEM32\ntdll.dll

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

a6d08895-645b-11e7-8373-34e6d781b465

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[TD="width: 15"][/TD]
[TD="width: 130"][/TD]

[/TD]
[TD="width: 130"][/TD]

 

[edge]

Three additional Event 1001 were later shown in Event viewer. Let me know if you would like these posted also.

 

[edge]

chkdsk Winnit Results


Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
Cleaning up instance tags for file 0x31882.
Cleaning up instance tags for file 0x3f2b6.
677888 file records processed. File verification completed.
4612 large file records processed. 0 bad file records processed.
Stage 2: Examining file name linkage ...
779012 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered.
Stage 3: Examining security descriptors ...
Cleaning up 2610 unused index entries from index $SII of file 0x9.
Cleaning up 2610 unused index entries from index $SDH of file 0x9.
Cleaning up 2610 unused security descriptors.
Security descriptor verification completed.
50563 data files processed. CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
677872 files processed. File data verification completed.

Stage 5: Looking for bad, free clusters ...
209125454 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.

Windows has made corrections to the file system.
No further action is required.

966940671 KB total disk space.
129310184 KB in 280418 files.
353136 KB in 50564 indexes.
0 KB in bad sectors.
775531 KB in use by the system.
65536 KB occupied by the log file.
836501820 KB available on disk.

4096 bytes in each allocation unit.
241735167 total allocation units on disk.
209125455 allocation units available on disk.

Internal Info:
00 58 0a 00 ee 0c 05 00 7b bc 09 00 00 00 00 00 .X......{.......
7d 11 00 00 58 00 00 00 00 00 00 00 00 00 00 00 }...X...........

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[jcgriff2]

chkdsk looks OK to me. It did a lot of cleanup.

I think you have another thread somewhere that I answered (at another forum). I just remember the subject matter and the way you listed the event viewer record.

Are you having system issues or system performance problems?

If not, I would suggest letting this pass.

If you try and "fix" every error in the 200+ Event Viewer logs, you'll never have time to actually enjoy the system.

Sometimes [severe] errors simply occur for whatever reason and have no effect on the system as a whole.

Regards. . .

jcgriff2

 

[edge]

One problem I have is another MFT error since chkdsk was completed. Since this is a critical error I am concerned the system might not boot at some point. Should this be looked into more ?

On the plus side, the system is quicker and not as 100% disk utilization as much after chkdsk.

 

[jcgriff2]

Hi. . .

Run HDD Diagnostics on the HDD.

Run SeaTools for DOS, LONG test - https://www.sysnative.com/forums/hardware-tutorials/4072-hard-drive-hdd-diagnostics.html

Are you still seeing this particular error in the Event Viewer log(s)?

Is the Event Viewer the only place that you see an error regarding the MFT?

I found a Microsoft KB on Event ID 55 for Windows 7 systems (usually applies to other OS', but not always) - https://support.microsoft.com/en-us...windows-7-or-windows-server-2008-r2-and-windo

A brief from TechNet on WMI error event 24 - Event ID 24 — Event Filter Query Functionality

Regards. . .

jcgriff2

 

[edge]

I no longer see the MFT error in event viewer, which is the only place I see the error. I'll take a look the other items and post back.

 

[edge]

Well that didn't last long, I just got another MFT error in event viewer, which is the only place I see this error. Otherwise the system is operating normally.

 

[jcgriff2]

Run chkdsk /r again.