[RKinner]

Lot of errors. Let's see if the hard drive has a problem:


1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file. If it doesn't complain go on to the next step)




1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron

[Advertisements]

Lot of errors. Let's see if the hard drive has a problem:


1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file. If it doesn't complain go on to the next step)




1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron

The force is strong in this one

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 03/08/2013 22:32:12

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 03/08/2013 21:28:09
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 03/08/2013 21:00:58
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 03/08/2013 22:34:58

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 03/08/2013 21:23:08
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 124 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache


Log: 'Application' Date/Time: 03/08/2013 17:31:37
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 2008 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Edited by baddabing101, 03 August 2013 - 03:35 PM.

[baddabing101]

Lot of errors. Let's see if the hard drive has a problem:


1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file. If it doesn't complain go on to the next step)




1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron

The force is strong in this one

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 03/08/2013 22:32:12

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 03/08/2013 21:28:09
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 03/08/2013 21:00:58
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 03/08/2013 22:34:58

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 03/08/2013 21:23:08
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 124 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache


Log: 'Application' Date/Time: 03/08/2013 17:31:37
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 2008 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Edited by baddabing101, 03 August 2013 - 03:35 PM.

[RKinner]

The HP CUE DeviceDiscovery Service service hung on starting.

This one always seems to cause trouble. Put services.msc in the search box and wait until it finds it then right click and run as admin. Find the HP CUE DeviceDiscovery and right click and select Properties then change the Startup Type: to Disabled then Apply and OK.

The spoolsv.exe error is a bit odd.

Submit c:\Windows\System32\spoolsv.exe to virustotal.com and let's see what they say. I would like the report even if they say 0/42.

I would uninstall Bonjour. It's just some junk from Apple and was causing errors. You will get a new one next time you update Apple software.

Try to do a Search and see if it still hangs or crashes Explorer. Sometimes it's one of the NO items in ShellExView. You can Disable all of them and restart. See if that makes a difference.

Did you get a chance to run RegSeeker? Did it find anything?

Did you ever get Java 7 update 25 to install?

[baddabing101]

The HP CUE DeviceDiscovery Service service hung on starting.

This one always seems to cause trouble. Put services.msc in the search box and wait until it finds it then right click and run as admin. Find the HP CUE DeviceDiscovery and right click and select Properties then change the Startup Type: to Disabled then Apply and OK.

The spoolsv.exe error is a bit odd.

Submit c:\Windows\System32\spoolsv.exe to virustotal.com and let's see what they say. I would like the report even if they say 0/42.

I would uninstall Bonjour. It's just some junk from Apple and was causing errors. You will get a new one next time you update Apple software.

Try to do a Search and see if it still hangs or crashes Explorer. Sometimes it's one of the NO items in ShellExView. You can Disable all of them and restart. See if that makes a difference.

Did you get a chance to run RegSeeker? Did it find anything?

Did you ever get Java 7 update 25 to install?

when i do a search via start button windows explorer crashes, taskbar disappears and reloads. is there another way to locate the file?

how do i submit that file?

bonjour has been uninstalled

Edited by baddabing101, 07 August 2013 - 06:13 AM.

[baddabing101]

The HP CUE DeviceDiscovery Service service hung on starting.

This one always seems to cause trouble. Put services.msc in the search box and wait until it finds it then right click and run as admin. Find the HP CUE DeviceDiscovery and right click and select Properties then change the Startup Type: to Disabled then Apply and OK.

The spoolsv.exe error is a bit odd.

Submit c:\Windows\System32\spoolsv.exe to virustotal.com and let's see what they say. I would like the report even if they say 0/42.

I would uninstall Bonjour. It's just some junk from Apple and was causing errors. You will get a new one next time you update Apple software.

Try to do a Search and see if it still hangs or crashes Explorer. Sometimes it's one of the NO items in ShellExView. You can Disable all of them and restart. See if that makes a difference.

Did you get a chance to run RegSeeker? Did it find anything?

Did you ever get Java 7 update 25 to install?

Sorry for the delay.

When I attempt a search via the windows start button, windows explorer crashes, taskbar disappears and reloads. Is there another way to locate the file?

How do I submit that file?

Bonjour has been uninstalled

If regseeker has already been requested to run, then yes.

Yes, Java update 25 was successful.

Thanks


Paul.

[RKinner]

Right click on (My) Computer and select Manage. (Yes), Services and Applications then Services. Find HP CUE DeviceDiscovery Service and right click on it and select Properties. Change Startup Type: to Disabled. OK.

Easiest way to submit a file is to copy the path:

c:\Windows\System32\spoolsv.exe

Then
Go to virustotal.com with your browser. Click on Choose File then when the file chooser window opens, move down to the File Name: box and then Ctrl + v and the path should appear. Hit Open and it should return to the main page with spoolsv.exe chosen. Click on Scan it. If it knows the file already it will tell you it's already been analyzed and offer you a choice of Reanalyze and View Last Analysis. In that case click on View Last Analysis. If it doesn't know the file it will take a minute to query 46 different anti-virus companies. In either case, If the Detection ratio: is not 0 / 46 then copy the Analysis page and paste it into the forum. You can just hit Ctrl + a then Ctrl + c to copy the page then go to a reply and Ctrl + v.

Try the Fixit on http://support.micro.../windows_search See if that helps with the Search crash problem.

[baddabing101]

Right click on (My) Computer and select Manage. (Yes), Services and Applications then Services. Find HP CUE DeviceDiscovery Service and right click on it and select Properties. Change Startup Type: to Disabled. OK.

Easiest way to submit a file is to copy the path:

c:\Windows\System32\spoolsv.exe

Then
Go to virustotal.com with your browser. Click on Choose File then when the file chooser window opens, move down to the File Name: box and then Ctrl + v and the path should appear. Hit Open and it should return to the main page with spoolsv.exe chosen. Click on Scan it. If it knows the file already it will tell you it's already been analyzed and offer you a choice of Reanalyze and View Last Analysis. In that case click on View Last Analysis. If it doesn't know the file it will take a minute to query 46 different anti-virus companies. In either case, If the Detection ratio: is not 0 / 46 then copy the Analysis page and paste it into the forum. You can just hit Ctrl + a then Ctrl + c to copy the page then go to a reply and Ctrl + v.

Try the Fixit on http://support.micro.../windows_search See if that helps with the Search crash problem.

Thanks Ron. I've completed those tasks - the virust total came back with 0/45. Windows fixit couldn't detect anything and i reset the search/index to see if that would help but no effect.

As the 3 main folders pictures, music and video are used by itunes and when i connect ipad/iphone to pc had a crash at the time where it didn't sync correctly and the problem arose from that i'm sure. Is there anything i can do with the apple software to debug any clashes that might have arisen in the first instance?

Thanks,


Paul.

[RKinner]

We are not supposed to run OTL in this forum but I need to see your OTL logs so do the following and then send me a PM with the logs attached:

Download OTL from
http://www.geekstogo...timers-list-it/
and Save it to your desktop.


Copy the text in the code box:

DRIVES
nnetsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\assembly\GAC_32\*.ini
%systemroot%\assembly\GAC_64\*.ini
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.exe
%APPDATA%\*.
/md5start
SHELL32.dll

rsvpsp.dll
pnrpnsp.dll 
nwprovau.dll
nlaapi.dll
napinsp.dll
mswsock.dll
winrnr.dll
wshelper.dll
services.exe
atapi.sys
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
csrss.exe
PrintIsolationHost.exe
consrv.dll
user32.dll
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%ProgramFiles%\WINDOWS NT\*.* /s
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

Run OTL (Vista or Win 7 => right click and Run As Administrator)

Paste (Ctrl + v) the copied text in the box where it says Custom Scan/Fixes

Select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste or attach both of them into a PM.


Also Copy the next line:

tasklist /m > %userprofile%\desktop\junk.txt

Then
Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Close the command window.


ATTACH the junk.txt file on your desktop to your next Reply.




I don't know anything about Apple software so can't help you there. Have you tried System Restore to a time before your Apple problem?

[baddabing101]

Hi Ron,

OTL and Extras have been PM'd. OTL is in 2 parts as too many characters for one message.

Re iTunes - There were no restore points on my pc so couldn't do it.

Thanks,


Paul.

Attached Files

•  junk.txt   111.3KB   276 downloads

[RKinner]

This is why System Restore is empty:

Error - 8/7/2013 6:08:46 AM | Computer Name = SilverNomad | Source = volsnap | ID = 393230
Description = The shadow copies of volume C: were aborted because of an IO failure
on volume C:.

Usually means corruption on the hard drive. I don't remember if we have done check disk but if not try it.


1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. If it asks for a CD and you don't have one or it doesn't like your CD just tell it to SKIP.)

1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application.


If that didn't help or you have already done it then we need to run the extended test from the Drive maker's website.

Let's see what Speccy says about your drive:
Get the free version of Speccy:

http://www.filehippo...download_speccy (Look in the upper right for the Download
Latest Version button) Download, Save and Install it. Run Speccy. When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File, (to your desktop) note the name it gives. OK. Open the file in notepad and delete the line that gives the serial number of your Operating System. (It will be near the top about 10 lines down.) Attach the file to your next post.




Ron

[baddabing101]

getting deja vu here ron

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 08/08/2013 08:14:14

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 08/08/2013 01:00:23
Type: Warning Category: 0
Event: 129 Source: nvstor32
Reset to device, \Device\RaidPort0, was issued.


Vino's Event Viewer v01c run on Windows Vista in English
Report run at 08/08/2013 08:15:45

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 07/08/2013 21:24:44
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache


Log: 'Application' Date/Time: 07/08/2013 21:24:40
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN

Edited by baddabing101, 12 August 2013 - 06:12 AM.

[RKinner]

Your Drive is definitely getting sick:

0D Soft Read Error Rate 100 (100) Data 003697253D
BB Reported Uncorrectable Errors 253 (253) Data 0000AD0000
BC Command Timeout 088 (088) Data 00000004EC
C3 Hardware ECC Recovered 100 (100) Data 003697253D
C5 Current Pending Sector Count 100 (099) Data 0000000006

It's time to run an extended test on the drive and see if it can clean up some of the errors.

You have a Samsung
SAMSUNG HD501LJ

It appears they have been sold to Seagate and that you can use Seatools for Windows which is a nice program.

http://www.seagate.c...ols-win-master/

Accept the license then Download and save the program. Right click on it and Run As Admin.
You then reboot and the program starts to run. You want the Extended Test. This will take several hours. When it finishes it and it finds errors it will usually ask if you want it to try and fix them tell it yes.


Samsung HD501LJ drives have a really bad rep. See:
http://forum.synolog...hp?f=117&t=9748

Odds are that it will fail in the near future so it's probably time to start shopping for a replacement hard drive.


Also the PC is running a bit hot:
CPU
Intel Core 2 Duo E6850 @ 3.00GHz 59 °C
Conroe 65nm Technology

The Graphics card is nearing melt down:

Graphics
PL2202W (1680x1050@59Hz)
512MB NVIDIA GeForce 8800 GT (ASUStek Computer Inc) 78 °C

This a separate Video card and it has its own fan. Is the fan running? It should be spinning at max speed right now. If it is not then you probably need to replace the fan.


I'm going to edit your post and delete the speccy file because you left in your serial number.


Going back to your original problem. Let's try Process Monitor again. This time before you run it, pause your anti-virus, close all browsers and make sure Windows Defender service is not running. (Normally Avast should turn it off but I think I saw it running). Close any other programs that you can close to simplify the log.

Run Proc Mon then try your subfolder again. Please do one that doesn't have a million pictures. How about Video? Once it fails, stop Proc Mon event recording then save the full log as csv. The file will probably be too big for the forum so upload it to dropbox or other free file sharing service and give me the link in your next post.

[RKinner]

PS to above: Turns out I can't edit your post in this forum. You need to do it yourself. Use the Full Editor.

[baddabing101]

Your Drive is definitely getting sick:

0D Soft Read Error Rate 100 (100) Data 003697253D
BB Reported Uncorrectable Errors 253 (253) Data 0000AD0000
BC Command Timeout 088 (088) Data 00000004EC
C3 Hardware ECC Recovered 100 (100) Data 003697253D
C5 Current Pending Sector Count 100 (099) Data 0000000006

It's time to run an extended test on the drive and see if it can clean up some of the errors.

You have a Samsung
SAMSUNG HD501LJ

It appears they have been sold to Seagate and that you can use Seatools for Windows which is a nice program.

http://www.seagate.c...ols-win-master/

Accept the license then Download and save the program. Right click on it and Run As Admin.
You then reboot and the program starts to run. You want the Extended Test. This will take several hours. When it finishes it and it finds errors it will usually ask if you want it to try and fix them tell it yes.


Samsung HD501LJ drives have a really bad rep. See:
http://forum.synolog...hp?f=117&t=9748

Odds are that it will fail in the near future so it's probably time to start shopping for a replacement hard drive.


Also the PC is running a bit hot:
CPU
Intel Core 2 Duo E6850 @ 3.00GHz 59 °C
Conroe 65nm Technology

The Graphics card is nearing melt down:

Graphics
PL2202W (1680x1050@59Hz)
512MB NVIDIA GeForce 8800 GT (ASUStek Computer Inc) 78 °C

This a separate Video card and it has its own fan. Is the fan running? It should be spinning at max speed right now. If it is not then you probably need to replace the fan.


I'm going to edit your post and delete the speccy file because you left in your serial number.


Going back to your original problem. Let's try Process Monitor again. This time before you run it, pause your anti-virus, close all browsers and make sure Windows Defender service is not running. (Normally Avast should turn it off but I think I saw it running). Close any other programs that you can close to simplify the log.

Run Proc Mon then try your subfolder again. Please do one that doesn't have a million pictures. How about Video? Once it fails, stop Proc Mon event recording then save the full log as csv. The file will probably be too big for the forum so upload it to dropbox or other free file sharing service and give me the link in your next post.

Hi Ron,

I will run the hard drive test later this evening. The hard drive has been making some funny clicking noises for some time, which causes the pc to hang. i'm happy to replace the hard drive but have never done that before. Is it easy to copy everything across? I was going to add another 500gb (hitachi) one about 5 years ago. still have it boxed with all the leads lol

The GPU fan is on, especially after some gaming . I'll take a look inside as there is probably some dust around it and the heatsink over cpu. last time i cleaned it up - it was much smoother.

Thanks again for your help Ron. Speak tomorrow.

Edited by baddabing101, 12 August 2013 - 06:23 AM.

[RKinner]

SATA drives are much easier to play with than the old IDE. I assume you have a second SATA connector on the motherboard. Just plug up the new drive and clone it.

Something like EaseUS Disk Copy Home Edition 2.3.1 should work to clone the drive.

http://www.easeus.co...y/home-edition/


You will need to burn a bootable CD or USB drive and boot off it since you can't clone when Windows has control of the drive. Just download and Save the software then run it and choose which you option you want to use. You may need to go into your BIOS/CMOS setup and change the boot order so it looks at your USB or CD/DVD first. Then once it boots, do a Disk Copy, select the Samsung as the Source and the Hitachi as the Destination. (Make sure you get the source and destination correct or you could wipe the drive!)

Once the cloning is done it should be a simple matter of removing the old drive and moving its cables to the new. Or you can go into the BIOS/CMOS setup and change the boot order so it boots from the new drive.