[LavCea]

I choose Ignore

I choose Event Viewer

I'm asked to select a computer - Local Computer

I choose Finish

I choose "Save As" and save it to my desktop

Option One:

I try to choose the system logs from the open Console1.msc and I get an error message telling me Microsoft Management Console has encountered a problem and needs to close. We are sorry for the inconvenience and send an error report to Microsoft.

Option Two:

I try to open the saved Console1.msc on my desktop and received the same error message. I cannot open the saved file and I cannot navigate in the file immediately after saving the file.

[Advertisements]

GRRRRRR
OK do you have your installation disk?
Follow the next steps and we can see if this will fix the problem. I am including both with and without the XP cdrom instructions.
Let me know what the results are.





Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!

[rshaffer61]

GRRRRRR
OK do you have your installation disk?
Follow the next steps and we can see if this will fix the problem. I am including both with and without the XP cdrom instructions.
Let me know what the results are.





Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!

[LavCea]

I performed the sfc scan for XP w/o the disk. It ran and then went away. No error logs or error messages.

On a side note, I don't know if this is related or not, but everytime I go to shutdown, there is an update that is waiting to be installed.

I've check the update list on update.microsoft.com and it's telling me that the following security updates did not install because of the corresponding error codes:

KB956572 is not installing due to Error Code 0x800F01022 (Security Update)
KB952954 is not installing due to Error Code 0x80070017 (Security Update)
KB892130 is not installing due to Error Code 0xD0000006 (Windows Genuine Advantage Validation Tool)

Could this be related?

Edited by LavCea, 11 July 2009 - 01:59 PM.

[rshaffer61]

Hmm this is a nail biter.
Let's see if we can find a problem a different way.
Try this:

Download WhoCrashed from the link in my signature below
This program checks for any drivers which may have been causing your computer to crash....

Click on the file you just downloaded and run it.
Put a tick in Accept then click on Next
Put a tick in the Don't create a start menu folder then click Next
Put a tick in Create a Desktop Icon then click on Install and make sure there is a tick in Launch Whocrashed before clicking Finish
Click Analyze
It will want to download the Debugger and install it Say Yes

WhoCrashed will create report but you have to scroll down to see it
Copy and paste it into your next reply

[LavCea]

WhoCrashed Analysis Report:

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.


On Thu 7/9/2009 3:45:42 AM your computer crashed
This was likely caused by the following module: aujasnkj.sys
Bugcheck code: 0x10000050 (0xFBB08004, 0x0, 0xA8AFE6BA, 0x0)
Error: Unknown
This file could not be located on your computer, we suggest that you search on it with Google.
Click here to do a Google search on aujasnkj.sys





On Wed 5/13/2009 3:02:50 AM your computer crashed
This was likely caused by the following module: ks.sys
Bugcheck code: 0x1000007E (0xC0000005, 0xF7AB4F0D, 0xF899EC28, 0xF899E924)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\drivers\ks.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Kernel CSA Library
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Wed 4/15/2009 11:17:29 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000000A (0x5B, 0x2, 0x0, 0x804EB5CF)
Error: Unknown
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Wed 4/15/2009 11:15:05 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8060D118, 0xA9642B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Wed 4/15/2009 11:12:25 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8056E2EA, 0xA96B2B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Thu 4/2/2009 12:48:57 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8056E2EA, 0xA96A2B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Wed 4/1/2009 10:58:04 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000000A (0x5B, 0x2, 0x0, 0x804EB5CF)
Error: Unknown
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Sun 3/22/2009 6:36:52 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000000A (0x5B, 0x2, 0x0, 0x804EB5CF)
Error: Unknown
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Sun 3/1/2009 1:22:36 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8056E2EA, 0xA9E63B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Sun 3/1/2009 1:20:11 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8056E2EA, 0xAAC94B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Mon 11/17/2008 2:58:37 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8060D118, 0xA9E93B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Mon 11/17/2008 2:55:47 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000008E (0xC0000005, 0x8060D118, 0xA9EA3B08, 0x0)
Error: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.



On Mon 11/17/2008 2:52:56 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000000A (0x5B, 0x2, 0x0, 0x804EB5CF)
Error: Unknown
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

13 crash dumps have been found and analyzed. Note that it's not always possible to state with certainty whether a reported driver is really responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

[rshaffer61]

aujasnkj.sys is possibly a virus

This crash happened 7\9\09
Is that when this issue started by chance?

[LavCea]

No. The owner said she's been having issues for the past few months. I was asked to look at the computer a few days ago because the updates weren't happening, videos wouldn't play, and the owner purchased Norton Antivirus 2009 but the install would not complete. After numerous runs of CHKDSK, I finally got the computer to get updates up to the point of the three above where the installs continue to fail. The next update is XP SP3.

I got to a point where I need help cause when I tried to check the event viewer, that's when I knew whatever the solution is, it's above my paygrade. This is where you come in.

Edited by LavCea, 11 July 2009 - 04:05 PM.

[LavCea]

okay rshaffer61

I installed and ran MalwareBytes and it found 22 errors. I cleaned those and was able to perform the following:

Run
mmc
Add eventvwr.msc
Save as Console1.msc on my desktop and I was able to open the event view with the logs for 7/11/09.

I still cannot perform the following:

run
eventvwr.msc

still getting the same error that MMC cannot open C:\WINDOWS\System32\eventvwr.msc

When viewing the the event log, there where numerous entries for the following:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


after going to the website provided I have this:


Details
Product: Windows Operating System
ID: 7
Source: Disk
Version: 5.2
Symbolic Name: IO_ERR_BAD_BLOCK
Message: The device, %1, has a bad block.

Explanation
The device has a bad block of memory, which Windows attempted to read. The data might be missing or corrupted.

Does this mean the hard drive is failing?

[rshaffer61]

Have you tried this?

Go to
Start and then to Run
Type in Chkdsk /r Not the space between k and /
Click Enter ...It will probably ask if you want to do this on the next reboot...click Y

If the window doesn't shutdown on its own then reboot the system manually. On reboot the system will start the chkdsk operation
This one will take longer then chkdsk /f

Note... there are 5 stages...
It may appear to hang at a certain percent for a hour or more or even back up and go over the same area...this is normal...
DO NOT SHUT YOUR COMPUTER DOWN WHILE CHKDSK IS RUNNING OR YOU CAN HAVE SEVERE PROBLEMS
This can take several hours to complete.
When completed it will boot the system back into windows.

Let me know if this fixes the problem

[rshaffer61]

This sounds like a potential for a failing hd.
My suggestion is to backup all important data as soon as you can. I would also like to suggest the following to see if we can fix a whocrashed error I see from 5/13/09


Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Download Auslogics Defrag from the link in my signature below. Auslogics Defrag in my opinion is better because:

It does a more comprehensive job at Defragging
It will actually show you what it is doing
At the end of working it will show you how much speed you picked up
You can view a online log of the files that Auslogics defragged

Let me know if anything improves.


I also saw a lot of NToskrnl errors in your whocrashed log.
This also could mean a OS problem or more important it can verify that your HD is starting to fail

[LavCea]

I performed the ATF Cleaner and the defrag and a lot of junk was cleaned out and cleaned off the drive. I am still unable to use the eventvwr.msc nor am I able to perform any of the updates listed above.

Do you have any thing else I can try?

I know I'm going to backup the hard drive and if there are no other solutions, then it's replacing the hard drive next.

[rshaffer61]

Two options at this point.
Malware Forum and Repair Installation and in that order.


I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post the reguested logs in THAT forum. If you are unable to run any of the tools then start a new topic in the malware forum and put this in the subject line...I am unable to run any malware tools

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[diabillic]

Get the spyware removed from your machine. Then run the following from a command line:

regsvr32 C:\Windows\system32\msxml3.dll

[LavCea]

Get the spyware removed from your machine. Then run the following from a command line:

regsvr32 C:\Windows\system32\msxml3.dll

Okay. I did this and it says this succeeded.

[rshaffer61]

Did what?
Ran the command?
You haven't done what I suggested in my post number 27.
If the command did not fix the issue then you need to have your system checked out by a Malware Tech to make sure it is clean and healthy.