[Durre]

Hello there,

Let me start off by saying that recently my topic at the Virus, Spyware Malware Removal forum has been solved and closed.
The topic can be found here. Thus, my laptop should be free of any infections. Some startup management and program removal
has been performed as well in that topic to reduce boot time and increase performance.

Since all malware related issues have been resolved, that topic could be closed. Yet I'm still having another, non-malware related, issue currently. About one or two weeks ago the behaviour of SearchIndexer.exe changed and it started using up to 50% or more of my CPU. The Windows Indexing Service seemed to get stuck at certain files and reinitiate the indexing process from scratch randomly. I've been going through some research and topics on the web with no avail thus far. Actions I have taken to get rid of this problem are the following:

• Interrupt indexing and restart the process (from the point where it got interrupted) either using Task Manager or Control Panel > Indexing Options.
• Set indexing options back to default and build the index from scratch.
• Remove the folder C:\ProgramData\Microsoft\Search\Data\Applications\Windows and restart indexing from scratch.

The laptop has been running over night to let indexing continue. It used to get stuck at a certain point and then it would start using up to 50% or more of the CPU. Right now it's just going really slow (but still making progress) and it's also using up to 50% or more of the CPU. 6135 or 6136 files have been indexed this last attempt over a total of 8 idle hours (it's going back and forth between the two numbers, which I suppose shouldn't happen).

Research on my own account has led me to believe it is often related to a problem with Outlook (taking Outlook out of the files to be indexed could help) or it could be related to some registry issues. Those are the two topics I have seen reappearing when reasearching online. However, I don't use Outlook and never will on this laptop. So I don't know why it would be related for my particular case. I don't know either if registry problems could screw up the indexing processes, yet my knowledge isn't good enough to dive into that subject on my own. That's why I am here, to ask for a little bit of help on this problem and to find the real cause. As 50% or more of the CPU is being used constantly, it makes it hard for me to perform certain tasks, like recording. If no solution can be found, I am willing to disable the indexing option in Vista. But I'd rather have ot solved if it can be solved.

A big thank you ahead!

[Advertisements]

Could this be a corrupted file system problem? Try running chkdsk /r from an Elevated Command prompt, see if that fixes it.

To open an Elevated Command prompt, click Start then Accessories. Right click on Command Prompt and select Run as Administrator.

...>chkdsk /r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Respond Y then reboot and chkdsk will run at boot. See if that finds and fixes anything.

[Ztruker]

Could this be a corrupted file system problem? Try running chkdsk /r from an Elevated Command prompt, see if that fixes it.

To open an Elevated Command prompt, click Start then Accessories. Right click on Command Prompt and select Run as Administrator.

...>chkdsk /r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Respond Y then reboot and chkdsk will run at boot. See if that finds and fixes anything.

[Durre]

Thank you for your very quick response. I ran "chkdsk /r" from an Elevated Command prompt and rebooted. Upon booting, the program displayed following message: 'no system files have been damaged' or something with same meaning, as it displayed it in my mother tongue and often the English phrasing is different. I don't see any log file, so I suppose that it doesn't leave that for the user to investigate.

EDIT

After rebooting, indexing didn't restart. There is no SearchIndexer.exe in the Task Manager and looking into Control Panel > Indexing Options it says indexing has been stopped. I didn't pause or stop the indexing by hand before rebooting, nor did I afterwards.

Edited by Durre, 19 March 2012 - 12:11 PM.

[Ztruker]

Seems you are not alone. Lots of posts about this problem. Unfortunately no real fixes that I could find.

Do you use Search a lot? If so, do you search for files or content within files.

If just for files, then I would disable Indexing and install a program called Everything. FOr finding files it's unbeatable;

If you search within files for data then still disable Indexing and give Agent Ransack a try.

Edit: Re sfc log: How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program generates in Windows Vista

[Ztruker]

Just saw your edit. Does that mean Indexing is not running at all or not using any CPU?

[Durre]

I'll look into the programs you suggested. I'm tempted to do as you say and disable Indexining. I often just search for files, so Everything might be just what I needed. I am indeed not the only one with this problem, I noticed that when googling the issue. I tried searching the Vista forum for the topic by using the Advanced Search option in the top right corner of this site, but I must have failed miserably. Sorry about not noticing the many related topics already

The link you posted looks quite interesting, I'll go through it after this post! EDIT: I only see a cbs.bld and CBS.txt file in the folder the link refers too. Not the cbs.log file it refers to. Am I overlooking something which is hidden in plain sight?


About my edit: at the moment Indexing is indeed not running at all. Yesterday it happened too that SearchIndexer.exe didn't start up at boot and couldn't be found in the Task Manager. However, after a quarter or so it suddenly appeared (maybe because of an action of my own). Right now my laptop has been on for more than one hour and it didn't appear in the Task Manager nor does it appear to be using CPU. The performance of the laptop is very good now and CPU usage is down to an average of 8%. Indexing options itself still says Indexing is not being executed.

EDIT: Indexing just now (21h30) started up again. I think it might be because I downloaded the Everything application (I didn't install it). I haven't done anything different from when Indexing wasn't working except downloading that file. I think adding a file to my hard drive might have caused the file system to update and start the Indexing process. It is now continuing from where it left off before rebooting. Currently it's hitting 6393 files and CPU usage is up to 50% or more again.

Edited by Durre, 19 March 2012 - 07:29 PM.

[Ztruker]

Try showing hidden folders and files, see if it shows up.

Control Panel, Folder Options, View.
Select Show hidden files, folders or drives.
Uncheck Hide Empty drives in the Computer Folder.
Uncheck Hide extensions for known file types.
Click Apply then OK.

See if it's visible now.

The easiest way to check it is to click on Start then paste this in: %windir%\logs\cbs and press Enter or click OK (or Copy the text, then press the Windows key, Ctrl+V then press Enter).

Time to disable Indexing and give Everything a try: How to Enable or Disable Search Index in Vista and Windows 7

[Durre]

As I thought it was hidden in plain sight. Unchecking "Hide extensions for known file types" did the trick and revealed that the CBS.txt was actually a CBS.log file. The other options were already set to what you suggested by myself. I feel kind of stupid for assuming it was a .txt extension based on it's icon.


I'll go ahead and install Everything tomorrow. For now Indexing is slowly progressing (hitting about 7500 files now). I'm going to leave my laptop on during the night and check back in the morning. If those hours of idle time were to no avail, Indexing will be disabled and part of its functionality will be replaced by Everything. Thank you for your advice, it looks like a very useful, handy program. I've found several good reviews. It saves me the time of trying to look for a replacement! Thank you!

Edited by Durre, 19 March 2012 - 06:28 PM.

[Ztruker]

Please let me know how you make out. I'm the curious type.

[Durre]

Okay, I surely will. On the other hand, I just ran sfc.exe and went into its log file following your link. Some damaged files have been found and could not be repaired. Would you'd like additional information on these files? I've found this link which discusses repairing the system files which could not automatically be repaired (by replacing them).

Edited by Durre, 19 March 2012 - 07:23 PM.

[eyetripoli]

If he doesn't, I do. Which files were listed? This is intriguing me.

~ieee

[Durre]

It reports the following listed below. I'm not too sure whether it auto-repaired the damaged files or not. The second part reports that a repair has been completed, although earlier on it says it cannot repair the files. I don't know anything about this subject, so I'm just putting this information out there for the people who actually understand it.

2012-03-20 01:56:40, Info                  CSI    0000015a [SR] Verifying 100 (0x00000064) components
2012-03-20 01:56:40, Info                  CSI    0000015b [SR] Beginning Verify and Repair transaction
2012-03-20 01:56:56, Info                  CSI    0000015d [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-03-20 01:57:01, Info                  CSI    0000015f [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-03-20 01:57:01, Info                  CSI    00000160 [SR] This component was referenced by [l:160{80}]"Package_30_for_KB936330~31bf3856ad364e35~x86~~6.0.1.18000.936330-187_neutral_GDR"
2012-03-20 01:57:01, Info                  CSI    00000163 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"tcpmon.ini"; source file in store is also corrupted
2012-03-20 01:57:03, Info                  CSI    00000165 [SR] Verify complete

2012-03-20 02:03:08, Info                  CSI    000001d8 [SR] Verifying 52 (0x00000034) components
2012-03-20 02:03:08, Info                  CSI    000001d9 [SR] Beginning Verify and Repair transaction
2012-03-20 02:03:13, Info                  CSI    000001db [SR] Verify complete
2012-03-20 02:03:13, Info                  CSI    000001dc [SR] Repairing 1 components
2012-03-20 02:03:13, Info                  CSI    000001dd [SR] Beginning Verify and Repair transaction
2012-03-20 02:03:13, Info                  CSI    000001df [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-03-20 02:03:13, Info                  CSI    000001e1 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6001.18000, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-03-20 02:03:13, Info                  CSI    000001e2 [SR] This component was referenced by [l:160{80}]"Package_30_for_KB936330~31bf3856ad364e35~x86~~6.0.1.18000.936330-187_neutral_GDR"
2012-03-20 02:03:13, Info                  CSI    000001e5 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"tcpmon.ini"; source file in store is also corrupted
2012-03-20 02:03:13, Info                  CSI    000001e7 [SR] Repair complete
2012-03-20 02:03:13, Info                  CSI    000001e8 [SR] Committing transaction
2012-03-20 02:03:13, Info                  CSI    000001ec [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired

All the rest of the log file is similar to this pattern, which as far as I know means those files are in good shape.

2012-03-20 01:45:34, Info                  CSI    00000006 [SR] Verifying 100 (0x00000064) components
2012-03-20 01:45:34, Info                  CSI    00000007 [SR] Beginning Verify and Repair transaction
2012-03-20 01:45:41, Info                  CSI    00000009 [SR] Verify complete

EDIT 1 - after some research

This seems to be a rather wide spread problem (as I noticed while doing some googling). As far as I can see, the tcpmon.ini file has something to do with configuring and printing and is rather important.


EDIT 2 - after one night of idle time

I disabled Indexing as it was only hitting 10500 files this morning. It appeared to randomly get stuck at a file for a while, then slowly continue indexing and get stuck again. As soon as I disabled Indexing, CPU went down to an average of 3 to 4% when not running any applications. I disabled two other unnecessary services while I was at it to free up some more memory. I haven't yet installed Everything. I probably will do so only when I really start needing it. In the meantime regular, slow searching will do the trick as I noticed it's accurate and actually not that slow at all. I find it a bit surprising an application like Windows Search is set to automatically being run. It's performance isn't that much better than regular search and in overall it's not very stable on XP nor Vista according to the many troubleshooting topics online. In my opinion such application should be set to optional and prompt the user to enable it instead of running from day one.

Having gone through these steps, CPU usage is mighty fine. But what doesn't seem to be mighty fine is my physical memory usage. Task Manager shows the following statistics:

• Total: 3570 MB
• In cache: > 2600 MB
• Available: <100 MB (right now only 5 MB ...)

I don't know if that's normal behaviour on Vista. But having 5 MB available memory doesn't sound too good. When I boot my laptop and look up the statistics, they seem to be much better:

• Total: 3570 MB
• In cache: about 1100 MB
• Available: about 1600 MB

In a quarter to half an hour the 1600 MB will lower to beneath 100 MB and the 'in cache' memory will raise up to 2600 MB or more.

Edited by Durre, 20 March 2012 - 06:42 AM.

[Ztruker]

Vista and Windows 7 both use as much memory as possible. Much better to have often used programs resident in memory than to load them from the hard drive.

I wouldn't worry about it unless you start having Virtual memory problems.

[Durre]

Yesh, I read about that. I'm a bit disappointed they hand you something without really providing you with easy tools to monitor it. Vista provides this feature to load often used programs into memory to speed up responsiveness, but as a user you don't get the tools to check what memory is actually being used and what is merely loaded in cache because the user might use this or that application. Agreed, Task Manager shows total, cached and available memory. But neither of them gives an idea about the amount of memory really being used at the moment by the user as part of the cached memory is occupied, but not used by the user himself. It could be that I'm not understanding the whole subject correctly, but if what I say is true, then what they provide in Task Manager is a tool which can be used to analyse memory usage in systems like XP. No real pre-allocating memory there. I see the principle behind the whole cached subject: why not use what you can use? However, they should provide a tool in my opinion which allows a user to analyse what is being used and not what is being cached. Otherwise memory leaks are a real pain to discover. If one changes the principle behind the allocating of memory, one should change the principle behind the way statistics are handed to the user too.

The reason why I'm so concerned about knowing what part of my memory is being used, is that my machine's performance is sluggish at times I don't expect it to be sluggish. By going for responsiveness and the true principle of caching, I think the predictability of computers has decreased. If a user changes his behaviour of using the program for one reason or another, memory allocation won't change the way it allocates memory immediatelly. So all of a sudden a user can encounter sluggish performance because the system has been allocating memory to applications which he wasn't going to use at all. Personally, I'd rather have my machine take a few seconds to get an application running and know that that application will always take those very few seconds to get up and running. With the Vista (and Windows 7) caching system that can never be assured however. I don't see why memory can't just be free and not allocated to an application. If I could, I would rather disable using as much memory as possible and go back to how XP used it's memory. Maybe Windows 7 has better or improved ways of allocating memory, but to me it seems Vista on my laptop can't really deal with it too well.


Because right now, when I try to run certain heavy usage applications (only one at a time and no other applications except for protection services!), they run smoothly at first, then performance gets sluggish, then they run smoothly again and so on. I'm quite convinced my machine should be able to handle those applications, certainly with their options set to minimal memory requirements (e.g. reduced graphics). I don't know if those corrupt system files could have anything to do with that or memory leaks or something else. My laptop reboots on a daily basis (often more than once a day), so memory leaks from browsers should be excluded. If they do use up a lot of memory, AVG gives me a warning.


Do you have any idea if those corrupt files can be fixed? I did another scan and it seems it can't auto-fix them. I don't have an installation disk.

Edited by Durre, 20 March 2012 - 08:53 PM.

[Ztruker]

tcpmon.ini is a text file, 59KB, that you should be able to open in notepad. On my Win 7 system, it starts out like this:

;
; Used by Standard TCP/IP Port Monitor to determine the type of port
;
;
; Section names should be less than 60 characters
;

[Ports]
"*SAVIN Network Printer C model*" = SAVIN_Cmodel
"*Gestetner Network Printer C model*" = Gestetner_Cmodel
"*NRG Network Printer C model*" = NRG_Cmodel
"*infotec Network Printer C model*" = infotec_Cmodel
"*LANIER Network Printer C model*" = LANIER_Cmodel
"*EasyLAN 10i2*" = IMC_10i2
"*EasyLAN Wireless*" = IMC_Wireless
"*Paxar*" = Paxar
"*ExtendNet 100zx" = TROY_100ZX
"*ExtendNet 100x" = TROY_100X
"*ExtendNet 100s" = TROY_100S
"*ExtendNet 100i" = TROY_100I
"*ExtendNet EIX" = TROY_EIX
"*ExtendNet SX" = TROY_SX
"*ExtendNet DX" = TROY_DX
"*ExtendNet MPX" = TROY_MPX

For memory utilization, does Vista have resmon.exe (Resource Monitor)? If so start it to look at memory utilization by program. Lots of info.