NOD32 build 621 and reproducible volume bitmap corruptions

I have noticed that the combination of NOD32 3 (latest build 621) and Diskeeper 2008 Professional on Win XP Pro causes irrepairable corruptions of the volume bitmap that simply cannot be fixed, even after removing both suspected offenders.

Has anyone else experienced this? Since I noticed the problems only after updating NOD32, I wonder whether NOD32 might not be the problem.

I have now seen the identical hard drive problem on two completely different systems that previously never had any issues (I run chkdsk and perform backups on a regular weekly basis). On both systems, I returned the hard drives to the factory state after a physical reformat several times and the problems repeatedly recurred with these two programs.

When I first noticed this on my laptop, the problem was so perplexing that Lenovo recommended sending in the laptop for repair of suspected hard drive or controller defects (and I have not yet received it back).

Subsequently, I rebuild my desktop PC from scratch using factory CD's and I installed these two programs after running all OS and manufacturer updates, and boom, the identical problem occurred again.

Now every time I run chkdsk, it recovers lost files, discovers free space marked as allocated in the master file table (MFT) and volume bitmaps, and problems with the file system. Oddly enough, running chkdsk /F at boot time does not find any problems. Using a Symantec Recovery CD to boot, Norton Disc Doctor finds problems that it claims to fix with the security descriptors (which by the way do not show in the report). All system tests with PC Doctor, and memory tests pass without indicating any hardware errors. Having the same error on two systems leads me to believe that it must be either NOD32 b621 or Diskeeper. However, the combination of Diskeeper (same version) with NOD32 b621's predecessor did not produce any problems.

Any advise, help, pointers would be greatly appreciated.

Thanks.

 

Have you tried adding Diskeeper to the AV exclusion list etc.

 

Thanks for asking. Yes, in subsequent installations I added all files in the Diskeeper Pro directories to NOD32's exclusion list.

 

Have you tried latest build of Nod32 v3 > 642?

 

Yes I have. I have in the interim done almost two dozen system rebuilds. I can now say that this issue was definitely NOT caused by any of the NOD32 builds and was a Diskeeper problem. I wound up sending one PC in that was under the manufacturer's warranty to get fixed and I was surprised that it came back with a new hard drive. After much tinkering, I simply replaced the other hard drive too. Lesson learned if you use Diskeeper: DO NOT USE BOOT TIME DEFRAGMENTATION! I still use Diskeeper as it is by far the best disk defragmentation utility out there (albeit a newer build that is supposed to address that problem, but the last I checked not publicly available) .

 

Ah thanks for the info.

 

defraging while having a antivirus running might mess things up, try turn antivirus off while defragging

 

I don't think that's necessary. I'm running .42 and Diskeeer 2008, and I'm not having any problems whatsoever. Anyhow, he seems to have identified the problem.

 

I solve that by moving to Jkdefrag ( with command line option or with this nice GUI )

 

This would be hard to apply when using Diskeeper, which runs as a background service and keeps your disk defragmented. I ran the boot time defragmantation in order to fix MFT fragmentation. Again, the problem was caused by the BOOT TIME DEFRAGMENTATION function. Even Diskeeper support told me not to use boot-time defrag, which begs the question, why in the heck do they even include the functionality?

 

Odd indeed.

 

This freeware doesn't support this functionality:

> Source

 

With great respect Darken it is also the VSS compatability mode that is causing a lot of people grief. Additionally nmadani was advised not to use the Boot time defrag which is yet another program feature

I gave Diskeeper away as it just doesn't work on my system as advertised. It also has a nasty habit of corrupting recovery image files eg. Ghost or Acronis.

My suggestion is to break the developer created myth of the absolute necessity to have yet another piece of software that sits there defragmenting your system - it just isn't that mission critical.

I now run jKdefrag GUI on Vista with now problems and as needed - not as an always running Service. It's free and it hasn't corrupted anything

 

Do you have sources (direct links) of these informations?

 

Darken, See Microsoft Knowledge Base 312067, MS Forums and at least http://nemesisv.blogspot.com/2008/02/whs-vs-defrag-with-diskeeper-or.html

This last link encapsulates the problem neatly "Due to the VSS or shadow copy function, when the defrag tries to move the file, VSS thinks the files has been changed and tries to keep track of the changes. Now you see the problem? So much so that the WHS actually locks up due to a deadlock.

But searching on the MS Forum :

"As all defragmenters use Microsoft's defrag APIs, until MS makes changes in those APIs or changes how VSS works so that it can detect defrag activity on 4k cluster size drives as they do with 16k> cluster size drives, you will always run the risk on Vista, 2003, 2008 and Home Server of restore points/shadow copies being purged when you defragment. The best that defrag vendors can try to do is work around this by detecting if a VSS enabled drive has a "non-optimal" cluster size and try to do something to mitigate file movement..."

Vista operates the same way. The simple point is that both Raxco with PerfectDisk and Diskeeper are aware that the best they can do is minimise file movement (http://www.raxco.com/products/perfectdisk2k/whitepapers/Unique_Differences_PD8_DK2008.pdf).

However my point is in the effectiveness that this is implemented. With the latter I didn't think it worked very well.

On top of this is the fact that Windows does not mange the Shadow copies very well and you can use up all space allocated and overwrite without a true first in first out.

I'll let you chase down the corrupt image file issue links on the basis that I don't post without a foundation

 

Hummm, I think this "old" problem affects only...

• Microsoft Windows Server 2003, Standard Edition
• Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
• Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
• Microsoft Windows Small Business Server 2003 Standard Edition
• Microsoft Windows Small Business Server 2003 Premium Edition
+ Home Server

Also, read this ticket on this blog > http://www.diskeeperblog.com/archives/2007/11/diskeeper_2008_1.html + this ticket > http://www.diskeeperblog.com/archives/2007/12/dk08_feature_sp.html

For me, this problem is gone and after many tests with Windows Vista and Diskeeper 2008 Pro "trial". All seems to works fine without any data loss.

 

Darken, I note that the relevant phrase appears to be implementation "...in such as way [as to] minimize the FSCTL_MOVE_FILE(mechanism in Windows used by defragmenters)/VSS conflict."

As I understand it the conflict is still there as is the FIFO issue.

I certainly respect your views and if Diskeeper is your cup of tea then it's up to you.

Regardless of whether it causes problems or not, what I am additionally suggesting is that people examine the need to purchase a very expensive piece of software when a perfectly adequate piece of freeware exists.

I am yet to see any significant (please note careful use of this word) differences in boot or access times on any of my systems as between the free and the paid.

Plus 5 seconds to the desktop doesn't cause me to worry

 

Good question for the "implemention" to minimize FSCTL_MOVE_FILE/VSS conflict. But, this user shadek seems to have no problem with Diskeeper 2008. I don't know if this user uses Windows Vista.