Question Suddenly my apps are "corrupted or unreadable" again ?

[BrixtonPunk]

OK so today I had a bunch of apps on the taskbar start giving me the message 'The file or directory is corrupted or unreadable' same result if I go to the start menu and start them from there or try from the actual .exe file in Program Files.
Also the setup files for those apps are 'The file or directory is corrupted or unreadable'

This is the third time I've had this
First and second time I fixed it by reinstalling the apps and thought its just a glitch but now it seems to be a regular thing and I have no idea what is causing it
I restarted windows explorer and all the apps lost their icons when they stopped functioning normally
I think its about 70% of my apps some are not affected at all

I did a sfc /scannow and got Windows Resource Protection did not find any integrity violations.
then a chkdsk and got Windows has scanned the file system and found no problems.
I did a malwarebytes scan and it came back with nothing.
And a reboot solved nothing.
I'm on Windows 11, update KB5044033
my CPU is an AMD Ryzen 7 5700G with Radeon Graphics 3.80 GHz
Ram 32gb

Anyone got any idea what might be the cause?

 

[JohnBonhamsGhost]

check the physical disk for malfunction

 

[johnbl]

interesting problem since it occurs across different directories.
there can be various reasons for this.

(if the problem is not malware like ransomware)

i would first google for crystaldisinfo.exe download and run it and look at the smart data for your drive.
if your drive is a old mechanical hdd the drive head might be missing the sector alignment markers on the disk due to normal drive wear in its bearings. this starts out as a small problem and gets worse over time. the utility should give you a indication of the drive health.

if the drive health is good, then i can explain what to look for next.
if the drive health is bad, you still have some hope and I can explain what to do next.

for the simple case where you have a HDD and the drive is just starting to fail. Turn off windows sleep functions and let the system run over night without sleeping. Do this because windows will go idle and 5 minutes after idle it will attempt to do a backgroud repair of the drive. It will attempt to read each sector of the drive, if one cluster gets a CRC error windows will attempt to read it over and over until it gets a clean copy. if it gets a clean copy it will write the data to a new location and mark the old location on the drive as a bad cluster. This process can take several hours to complete. This process can be starved out if your system goes to sleep quickly.

anyway, checking the drive health is the first step to judge how much life is left in the drive.

there are other causes but you should tell us about your boot drive first

Note: you did the sfc.exe /scannow and the system chkdsk but you should have also run cmd.exe as an admin and run
DISM.exe /Online /Cleanup-Image /RestoreHealth

this would have check/fixed any modified windows core files by comparing them/fixing them from a known good source
(microsoft server)
I would also delete the pagefile.sys reboot and create another one to help dump any malware infection of the virtual memory.

 

[BrixtonPunk]

interesting problem since it occurs across different directories.
there can be various reasons for this.

(if the problem is not malware like ransomware)

i would first google for crystaldisinfo.exe download and run it and look at the smart data for your drive.
if your drive is a old mechanical hdd the drive head might be missing the sector alignment markers on the disk due to normal drive wear in its bearings. this starts out as a small problem and gets worse over time. the utility should give you a indication of the drive health.

if the drive health is good, then i can explain what to look for next.
if the drive health is bad, you still have some hope and I can explain what to do next.

Pretty sure its not malware or ransomware, I did run various antivirus
It's a fairly new 1TB SSD
The machine was only bought in May this year
Ive d/l the CrystalDiskInfo it says good 100%
----------------------------------------------------------------------------
CrystalDiskInfo 9.5.0 Beta3 (C) 2008-2024 hiyohiyo
Crystal Dew World: https://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 11 Pro 23H2 [10.0 Build 22631] (x64)
Date : 2024/10/19 22:22:05

-- Controller Map ----------------------------------------------------------
+ Standard SATA AHCI Controller [ATA]
- ST4000VN006-3CW104
+ Standard NVM Express Controller [SCSI]
- KINGSTON SNV2S1000G
- Microsoft Storage Spaces Controller [SCSI]
- Xvdd SCSI Miniport [SCSI]

-- Disk List ---------------------------------------------------------------
(01) KINGSTON SNV2S1000G : 1000.2 GB [1/1/0, sq] - nv
(02) ST4000VN006-3CW104 : 4000.7 GB [0/0/0, pd1]
(03) WDC WD80EMAZ-00WJTA0 : 8001.5 GB [2/0/0, sa1]

----------------------------------------------------------------------------
(01) KINGSTON SNV2S1000G
----------------------------------------------------------------------------
Model : KINGSTON SNV2S1000G
Firmware : CBG04418


Disk Size : 1000.2 GB
Interface : NVM Express
Standard : NVM Express 1.4
Transfer Mode : PCIe 3.0 x4 | PCIe 4.0 x4
Power On Hours : 452 hours
Power On Count : 133 count
Host Reads : 3223 GB
Host Writes : 3047 GB
Temperature : 31 C (87 F)
Health Status : Good (100 %)
Features : S.M.A.R.T., TRIM, VolatileWriteCache




I did a chkdsk on C (after a restart)
I'ts in german as that was the install language
but heres the deepl translation


File system on C: is checked.
The file system type is NTFS.
The volume name is Windoze.


A volume check is scheduled.
The disc scan is now being performed.

Phase 1: The base file system structure is examined...
Instance identifier for file 0x1a804 is cleaned up.
577024 data records processed.

File check completed.
Phase duration (file record check): 4.68 seconds.
25482 large data records processed.

Phase duration (recovery for orphaned file record): 10.35 milliseconds.
0 invalid data records processed.

Phase duration (check for incorrect file data record): 1.40 milliseconds.

Phase 2: The file name link is analysed...
369 analysis data records processed.

750102 Index entries processed.

Index check completed.
Phase duration (index check): 13.88 seconds.
0 non-indexed files checked.

Phase duration (reconnection for orphaned data set): 435.18 milliseconds.
0 non-indexed files recovered.

Phase duration (recovery for orphaned data set): 2.40 seconds.
369 analysis datasets processed.

Phase duration (check of analysis point and object ID): 5.39 milliseconds.

Phase 3: Security descriptors are examined...
1480 unused index entries from index $SII of file 0x9 are cleaned up.
1480 unused index entries from index $SDH of file 0x9 are cleaned up.
1480 Unused security descriptors are cleaned up.
Safety description check completed.
Phase duration (check for security descriptor): 67.02 milliseconds.
86540 data files processed.

Phase duration (data attribute check): 1.50 milliseconds.
CHKDSK checks USN-Journal...
The check of USN-Journal has been completed.

Corrections have been made to the file system.
No further action is required.

975865855 KB total storage space on the data carrier
500132864 KB in 265483 files
207928 KB in 86541 indices
0 KB in bad sectors
680755 KB used by the system
65536 KB used by the log file
474844308 KB available on the data carrier

4096 bytes in each allocation unit
243966463 Allocation units on the data carrier in total
118711077 Allocation units available on the data carrier
Total duration: 21.62 seconds (21624 ms).

Internal information:
00 ce 08 00 b9 5e 05 00 86 97 09 00 00 00 00 00 00 .....^..........
1e 01 00 00 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 ....S...........
</Data>
</EventData>
</Event>

Any ideas? Thanks

 

[johnbl]

the next thing I would do is attempt to update the firmware of each drive.
starting with the drive C:

then update the BIOS, for the cases of BIOS bugs
then update the motherboard cpu chipset driver
then update any motherboard drivers for storage.
I assume you are not using RAID.

which device is your boot device for windows?

if drive c is the KINGSTON SNV2S1000G
is there any chance the drive electronics is overheated? then next time the problem occurs, power off the machine, wait 20 minutes for it to cool down. then boot and see if the problem still occurs.

you can use a cooler or heat gun on the part to see if you can prevent or cause the problem

note: https://www.tomshardware.com/reviews/kingston-nv2-ssd
venders that make cheap drives with mixed component can have strange issues. timing issues, firmware issues. heating can cause the connections to expand and mis connect to the socket. since windows image may already be loaded into RAM from the pagefile.sys the system can appear to run fine until you actually need to access a new file from the disk. Then you get a error.
I used to see this on some SATA drives, they would disconnect and you had to enable hotswap on the sata port before the drive could reconnect. otherwise the system would bugcheck a few hours after the disconnection depending on the size of the RAM and what files were being accessed by windows/

nvme drives are not hot swapable. if the device heats up and disconnects its connector it would not auto reconnect until the machine is power cycled. I am not sure what windows plug and play would do. I guess I would run windows control panel device manager, make sure you go to the view menu and check show hidden devices then look at the device tree and see if the drive is greyed out (to indicated it was removed)

the hotswap (remove) of one of these devices could lead to corruption of the filesystem that would be fixed by chkdsk on the next boot of the drive (dirty bit would be set)

edit: guess there are hot swap device that now work with nvme devices now. I am out of date

 

[johnbl]

if you want to test and make a HIGHER rate of failures:
you might also consider downloading microsoft RAMmap from here
https://learn.microsoft.com/en-us/sysinternals/downloads/rammap
extract the rammap64.exe and run it as an admin.
find the menu item empty and run all of the items.

ie run it, wait 5 minutes and see if the drive heating up is the cause of the failure when you run a app. (otherwise the app might already be in standby memory and would not fail since it does not need to be loaded from storage)

note: i have seen nvme drives fail, and the fix was to just reposition the drive in the slot a bit more centered before it was screwed down. ie loosen the screw and just flick the card with your finger to change the alignment in the slot slightly and tighten the screw.

 

[BrixtonPunk]

the next thing I would do is attempt to update the firmware of each drive.
starting with the drive C:

then update the BIOS, for the cases of BIOS bugs
then update the motherboard cpu chipset driver
then update any motherboard drivers for storage.
I assume you are not using RAID.

which device is your boot device for windows?

if drive c is the KINGSTON SNV2S1000G
is there any chance the drive electronics is overheated? then next time the problem occurs, power off the machine, wait 20 minutes for it to cool down. then boot and see if the problem still occurs.

you can use a cooler or heat gun on the part to see if you can prevent or cause the problem

note: https://www.tomshardware.com/reviews/kingston-nv2-ssd
venders that make cheap drives with mixed component can have strange issues. timing issues, firmware issues. heating can cause the connections to expand and mis connect to the socket. since windows image may already be loaded into RAM from the pagefile.sys the system can appear to run fine until you actually need to access a new file from the disk. Then you get a error.
I used to see this on some SATA drives, they would disconnect and you had to enable hotswap on the sata port before the drive could reconnect. otherwise the system would bugcheck a few hours after the disconnection depending on the size of the RAM and what files were being accessed by windows/

nvme drives are not hot swapable. if the device heats up and disconnects its connector it would not auto reconnect until the machine is power cycled. I am not sure what windows plug and play would do. I guess I would run windows control panel device manager, make sure you go to the view menu and check show hidden devices then look at the device tree and see if the drive is greyed out (to indicated it was removed)

the hotswap (remove) of one of these devices could lead to corruption of the filesystem that would be fixed by chkdsk on the next boot of the drive (dirty bit would be set)

edit: guess there are hot swap device that now work with nvme devices now. I am out of date

if you want to test and make a HIGHER rate of failures:
you might also consider downloading microsoft RAMmap from here
https://learn.microsoft.com/en-us/sysinternals/downloads/rammap
extract the rammap64.exe and run it as an admin.
find the menu item empty and run all of the items.

ie run it, wait 5 minutes and see if the drive heating up is the cause of the failure when you run a app. (otherwise the app might already be in standby memory and would not fail since it does not need to be loaded from storage)

note: i have seen nvme drives fail, and the fix was to just reposition the drive in the slot a bit more centered before it was screwed down. ie loosen the screw and just flick the card with your finger to change the alignment in the slot slightly and tighten the screw.

Thanks johnbl
hmm, there appears to be no new firmware updates for either of my drives 🙁 but all the tests seem ok on the drives, constant temp of 31 on the SSD
updated all the motherboard drivers, and I've updated the bios

also unistalled ExplorerPatcher as thought the failures might have something to do with taskbar fiddling (but probably not) btw im using Open-Shell Menu to get rid of the windows tiles bull and its never had a problem before.

I still don't understand why the setup files are also corrupted even if the drive disconnects, why would they become corrupted? As even after a reboot they are corrupted.
Another thing is file explorer sometimes freezes (just the window) and have to open task manager to restart it.

I ran sfc /scannow and got back Windows Resource Protection did not find any integrity violations.
Then I ran
DISM /Online /Cleanup-Image /CheckHealth No component store corruption detected.
DISM /Online /Cleanup-Image /ScanHealth No component store corruption detected
DISM /Online /Cleanup-Image /RestoreHealth The restore operation completed successfully.
Not sure if it made a difference or not!
But I do know that my restore points from the past after I'd initially set up the machine, along with the one I did after the first apps failure when Id reinstalled all the screwed up apps about 3 or 4 weeks ago. Now I only have todays restore points from the windows update and the chipset drivers install.
so I guess the System Volume Information has been deleted and remade?
Pretty weird iyam

 

[BrixtonPunk]

I'm thinking if it happens again, I'll swap out the existing C drive SSD to a Samsung 990 Pro 1 TB SSD since they have come down in price a good bit now

 

[johnbl]

if you can not update the firmware on a electronic drive, the next step it to boot into bios and leave the machine for a few hours. This can fix conditions where a electronic drive gets behind of its firmware garbage collection. if windows is running the firmware garbage collection is started 5 minutes after windows goes idle. Sometimes sleep functions shut down the drive before the firmware completes its clean up operations.
This effect is more pronounce if you format a drive and reinstall windows. that is after you delete all of the files the drive might look empty but the firmware has to run cleanup on each module of the "disk" memory. The problem expands for the inexpensive memory because of how the memory is stacked to reduce cost and size. it the firmware gets behind it might not respond in the timeout period and you might get the error you saw. people that hit this error often reinstall windows and that makes the problem worse. people that ignore the error just think the problem went away after a few days.
you could also tell windows not to sleep your drive as fast. maybe set the drive to sleep after 30 minutes of idle. it would give the drive 25 minutes to do its cleanup operations.
note: I would expect the cheaper drives to get behind more than some of the better drives. (just because of the design decisions of making a cheap drive)

 

[BrixtonPunk]

I just noticed that a lot of .jpg's were also 'corrupted' but they would work when imported into a program, then when I reassociated them with picassa (which I use as a photo viewer) they then became un-corrupted.
Looking through my Program files and Program Files (x86) folders some programs are corrupted and some not. Weird.

 

[BrixtonPunk]

if you can not update the firmware on a electronic drive, the next step it to boot into bios and leave the machine for a few hours. This can fix conditions where a electronic drive gets behind of its firmware garbage collection. if windows is running the firmware garbage collection is started 5 minutes after windows goes idle. Sometimes sleep functions shut down the drive before the firmware completes its clean up operations.
This effect is more pronounce if you format a drive and reinstall windows. that is after you delete all of the files the drive might look empty but the firmware has to run cleanup on each module of the "disk" memory. The problem expands for the inexpensive memory because of how the memory is stacked to reduce cost and size. it the firmware gets behind it might not respond in the timeout period and you might get the error you saw. people that hit this error often reinstall windows and that makes the problem worse. people that ignore the error just think the problem went away after a few days.
you could also tell windows not to sleep your drive as fast. maybe set the drive to sleep after 30 minutes of idle. it would give the drive 25 minutes to do its cleanup operations.
note: I would expect the cheaper drives to get behind more than some of the better drives. (just because of the design decisions of making a cheap drive)

Thanks johnbl
I did what you suggested and have not had the corruption since the last one (fingers crossed, touch wood etc.) Not entirely what I did that worked or maybe a combination of, but something did!
thanks again for the help