[briz_dad]

I've been trouble-shooting system crashes for a while.

I am getting a lot of Microsoft Explorer crashes.

And now and then other programs crash.

I replaced the C drive less then a month ago with a clean install of the system.

I just did a memory check with Memtest86+ and received no errors... The last piece of hardware I know to check is the motherboard.

Is there something like Memtest86+ that can test the motherboard?

Sincerely,
Greg

[Advertisements]

• Please download the Event Viewer Tool by Vino Rosso VEW and save it to your Desktop:
• Double-click VEW.exe
• Under 'Select log to query', select (as appropriate):
  
  • Application
  • System
• Under 'Select type to list', select (as appropriate):
  
  • Error
  • Information
  • Warning

Then use the 'Date of events' or 'Number of events' as follows:

Either:

• Click the radio button for 'Number of events'
  Type 3 in the 1 to 20 box (or any number from 1 to 20)
  Then click the Run button.
  Notepad will open with the output log.
  
  
• Click the radio button for 'Date of events'
  In the From: boxes type today's date (presuming the crash happened today) 13 05 2011
  In the To: boxes type today's date (presuming the crash happened today) 15 05 2011
  Then click the Run button.
  Notepad will open with the output log.

Please post the Output log in your next reply

[rshaffer61]

• Please download the Event Viewer Tool by Vino Rosso VEW and save it to your Desktop:
• Double-click VEW.exe
• Under 'Select log to query', select (as appropriate):
  
  • Application
  • System
• Under 'Select type to list', select (as appropriate):
  
  • Error
  • Information
  • Warning

Then use the 'Date of events' or 'Number of events' as follows:

Either:

• Click the radio button for 'Number of events'
  Type 3 in the 1 to 20 box (or any number from 1 to 20)
  Then click the Run button.
  Notepad will open with the output log.
  
  
• Click the radio button for 'Date of events'
  In the From: boxes type today's date (presuming the crash happened today) 13 05 2011
  In the To: boxes type today's date (presuming the crash happened today) 15 05 2011
  Then click the Run button.
  Notepad will open with the output log.

Please post the Output log in your next reply

[briz_dad]

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 15/05/2011 12:55:00 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 15/05/2011 6:58:59 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module mfc90u.dll, version 9.0.30729.5570, time stamp 0x4d2c3758, exception code 0xc0000005, fault offset 0x0005ce03, process id 0x820, application start time 0x01cc124e1fbc6ba8.

Log: 'Application' Date/Time: 15/05/2011 3:52:33 PM
Type: Error Category: 0
Event: 1010 Source: Microsoft-Windows-Perflib
The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

Log: 'Application' Date/Time: 14/05/2011 3:47:22 PM
Type: Error Category: 0
Event: 1008 Source: Microsoft-Windows-Perflib
The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Log: 'Application' Date/Time: 14/05/2011 3:47:21 PM
Type: Error Category: 0
Event: 1010 Source: Microsoft-Windows-Perflib
The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

Log: 'Application' Date/Time: 13/05/2011 6:22:33 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module mfc90u.dll, version 9.0.30729.5570, time stamp 0x4d2c3758, exception code 0xc0000005, fault offset 0x0005ce03, process id 0x1474, application start time 0x01cc114593001034.

Log: 'Application' Date/Time: 13/05/2011 8:12:52 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module mfc90u.dll, version 9.0.30729.5570, time stamp 0x4d2c3758, exception code 0xc0000005, fault offset 0x0005ce03, process id 0x1110, application start time 0x01cc11350056a3fc.

Log: 'Application' Date/Time: 13/05/2011 6:14:15 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module mfc90u.dll, version 9.0.30729.5570, time stamp 0x4d2c3758, exception code 0xc0000005, fault offset 0x0005ce03, process id 0xb2c, application start time 0x01cc11239e612029.

Log: 'Application' Date/Time: 13/05/2011 4:20:25 AM
Type: Error Category: 0
Event: 1010 Source: Microsoft-Windows-Perflib
The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

Log: 'Application' Date/Time: 13/05/2011 4:12:28 AM
Type: Error Category: 0
Event: 1008 Source: Microsoft-Windows-Perflib
The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Log: 'Application' Date/Time: 13/05/2011 12:41:16 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application qbw32.exe, version 18.0.4010.606, time stamp 0x4ab16727, faulting module PAYUTIL.dll, version 18.0.4010.606, time stamp 0x4ab178cc, exception code 0xc0000005, fault offset 0x00021f49, process id 0x11ec, application start time 0x01cc11061c75ae3e.

Log: 'Application' Date/Time: 13/05/2011 12:38:48 AM
Type: Error Category: 2
Event: 4 Source: QuickBooks
The event description cannot be found.

Log: 'Application' Date/Time: 13/05/2011 12:38:48 AM
Type: Error Category: 2
Event: 4 Source: QuickBooks
The event description cannot be found.

Log: 'Application' Date/Time: 13/05/2011 12:38:48 AM
Type: Error Category: 2
Event: 4 Source: QuickBooks
The event description cannot be found.

Log: 'Application' Date/Time: 12/05/2011 10:20:45 PM
Type: Error Category: 3
Event: 3013 Source: Microsoft-Windows-Search
The entry <MAPI://{S-1-5-21-243020402-4250481716-643283683-1000}/PERSONAL FOLDERS($F07650F1)/X/INBOX/????????????????????????> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)


Log: 'Application' Date/Time: 12/05/2011 8:23:41 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application explorer.exe, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module mfc90u.dll, version 9.0.30729.5570, time stamp 0x4d2c3758, exception code 0xc0000005, fault offset 0x0005ce03, process id 0x678, application start time 0x01cc10a9e39470f4.

Log: 'Application' Date/Time: 12/05/2011 6:35:10 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application svchost.exe_SysMain, version 6.0.6001.18000, time stamp 0x47918b89, faulting module sysmain.dll, version 6.0.6002.18005, time stamp 0x49e03808, exception code 0xc0000005, fault offset 0x00013555, process id 0x3fc, application start time 0x01cc105d8ac3702e.

Log: 'Application' Date/Time: 12/05/2011 4:19:07 AM
Type: Error Category: 0
Event: 1010 Source: Microsoft-Windows-Perflib
The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

Log: 'Application' Date/Time: 12/05/2011 12:01:38 AM
Type: Error Category: 0
Event: 1008 Source: Microsoft-Windows-Perflib
The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Log: 'Application' Date/Time: 11/05/2011 11:54:20 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module mfc90u.dll, version 9.0.30729.5570, time stamp 0x4d2c3758, exception code 0xc0000005, fault offset 0x0005ce03, process id 0x10c8, application start time 0x01cc0fdf386cadbe.

Log: 'Application' Date/Time: 11/05/2011 11:53:53 PM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program YouSendIt.exe version 2.9.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1528 Start Time: 01cc10359ea2a8df Termination Time: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 12/05/2011 8:33:22 PM
Type: Error Category: 0
Event: 6008 Source: EventLog
The previous system shutdown at 1:31:45 PM on 5/12/2011 was unexpected.

Log: 'System' Date/Time: 12/05/2011 1:32:53 PM
Type: Error Category: 0
Event: 6008 Source: EventLog
The previous system shutdown at 1:49:23 AM on 5/12/2011 was unexpected.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7034 Source: Service Control Manager
The Diagnostic System Host service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Tablet PC Input Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Human Interface Device Access service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The ReadyBoost service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 6:35:27 AM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Log: 'System' Date/Time: 12/05/2011 4:16:38 AM
Type: Error Category: 0
Event: 6008 Source: EventLog
The previous system shutdown at 5:38:35 PM on 5/11/2011 was unexpected.

Log: 'System' Date/Time: 11/05/2011 9:25:12 PM
Type: Error Category: 0
Event: 1002 Source: Microsoft-Windows-Dhcp-Client
The IP address lease 192.168.2.2 for the Network Card with network address 001CDFDD3EA0 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 10/05/2011 11:20:57 PM
Type: Error Category: 0
Event: 10009 Source: Microsoft-Windows-DistributedCOM
DCOM was unable to communicate with the computer SQL34 using any of the configured protocols.

Log: 'System' Date/Time: 06/05/2011 6:24:19 PM
Type: Error Category: 0
Event: 10009 Source: Microsoft-Windows-DistributedCOM
DCOM was unable to communicate with the computer SQL34 using any of the configured protocols.

Log: 'System' Date/Time: 05/05/2011 6:49:47 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Microsoft Network Inspection service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

[rshaffer61]

Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!


Thanks to Broni for the instructions



Revised and Simplified:


Do you have a valid XP CD?

If so, place it in your CD ROM drive and follow the instructions below:

• Click on Start and select Run... type sfc /scannow (note the space) (Let this run undisturbed until the window with the blue progress bar goes away)

SFC - Which stands for System File Checker,
retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.
If you want to see what was replaced, right-click My Computer and click on Manage. In the new window that appears, expand the Event Viewer (by clicking on the + symbol next to it) and then click on System.

[briz_dad]

Microsoft Windows [Version 6.0.6002]
Copyright © 2006 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired
them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log

C:\Windows\system32>


(should I upload the CBS log file?)

[rshaffer61]

Sure just attach it if you can. I would like to see what it repaired. Thank you and great job.

[briz_dad]

The file is 34.5 MB; too large to attach... I can use YouSendIt.com to send it to you if you give me an email address to send to.

I am interested if you find something referring to my back-up program: Rebit.

Sincerely,
Greg

[Digerati]

System crashes, freezes, and sudden reboots can be caused by all sorts of things, which makes them that much more difficult to troubleshoot.

Why did you replace the hard drive? Did the problem start before or after replacing the drive?

What are your temperatures? Is the interior clean of heat trapping dust?

Did you let MemTest86+ run for several passes?

Have you scanned for malware?

I would swap in a known good power supply before I started buying any more new hardware.

[briz_dad]

problems happened before new C drive

installed new C drive because a disc check would stall on 75% when run

Also, was recommended to install new C drive by Rebit tech who was looking at log files

Did 21 passes on the MemTest

Don't know interior temp - i've been keeping interior fairly clean

Also; currently using Microsoft Security Essentials - up to date and scanned recently - nothing found

Edited by briz_dad, 15 May 2011 - 04:18 PM.

[rshaffer61]

You should be able to open the log and get a screenshot of it. Then attach screenshot.
If to many entries then we can assume it fixt them correctly.
You might try rerunning sfc to make sure it got everything but I don't think it will find anything else.
Try these steps:


Download Speedfan (The download link is to the right), and install it. Once it's installed, run the program and post here the information it shows.
The information I want you to post is the stuff that is circled in the example picture I have attached.
To make sure we are getting all the correct information it would help us if you were to attach a screenshot like the one below of your Speedfan results.

To do a screenshot please have click on your Print Screen on your keyboard.

• It is normally the key above your number pad between the F12 key and the Scroll Lock key
• Now go to Start and then to All Programs
• Scroll to Accessories and then click on Paint
• In the Empty White Area click and hold the CTRL key and then click the V
• Go to the File option at the top and click on Save as
• Save as file type JPEG and save it to your Desktop
• Attach it to your next reply

Go to

Start and then to Run
Type in Chkdsk /r Note the space between k and /
Click Enter ...It will probably ask if you want to do this on the next reboot...click Y
If the window doesn't shutdown on its own then reboot the system manually. On reboot the system will start the chkdsk operation
This one will take longer then chkdsk /f

Note... there are 5 stages...
It may appear to hang at a certain percent for a hour or more or even back up and go over the same area...this is normal...
DO NOT SHUT YOUR COMPUTER DOWN WHILE CHKDSK IS RUNNING OR YOU CAN HAVE SEVERE PROBLEMS
This can take several hours to complete.
When completed it will boot the system back into windows.

Reboot after your done running chkdsk /r...
then Go to Start...Run and type: eventvwr.msc press Enter
When Event Viewer opens, click on Applications... then scroll down to [b]Winlogon]/b] and double-click on it. This is the log created after running Checkdisk...copy and paste the log back here


We will advise after studying the log.

[briz_dad]

Okay - the speedfan reading is happening now. I won't be able to reboot my system until this evening (PST) for the other reading.



Let me know if the speedfan info is showing anything.

More to come,
Greg

[rshaffer61]

When was thee last time you cleaned out the inside of the system using a can of compressed air and making sure the CPU fan is turning correctly?

[briz_dad]

about 3 weeks ago... does it look like it is running hot?

[rshaffer61]

Yep I would just to be sue and make sure to pay close attention to the CPU fan and heattsink.

[briz_dad]

ok