[britechguy]

The fan is definitely running and the speed varies with the reported core temperature.  When it's in the 20s and 30s you cannot hear the fan.  When you hit the 40s you start hearing the fan clearly and when it hits the 50s+ the fan speed goes up accordingly.   I see no dust clogging any inlets/outlets.

 

VEW System Log:

---------------------------------------------------------------

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 02/02/2015 4:28:47 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 02/02/2015 9:28:17 PM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID  {C97FCC79-E628-407D-AE68-A06AD6D8B4D1}  and APPID  {344ED43D-D086-4961-86A6-1106F4ACAD9B}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Log: 'System' Date/Time: 02/02/2015 9:27:38 PM
Type: Error Category: 0
Event: 7034 Source: Service Control Manager
The Realtek DHCP Service service terminated unexpectedly.  It has done this 1 time(s).

Log: 'System' Date/Time: 02/02/2015 9:27:36 PM
Type: Error Category: 0
Event: 4 Source: Microsoft-Windows-Time-Service
The time provider 'VMICTimeProvider' failed to start due to the following error: The specified module could not be found. (0x8007007E)

Log: 'System' Date/Time: 02/02/2015 9:27:25 PM
Type: Error Category: 0
Event: 7006 Source: Service Control Manager
The ScRegSetValueExW call failed for FailureActions with the following error:  Access is denied.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 02/02/2015 9:27:40 PM
Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MULTIPLE&PROD_CARD_READER&REV_1.00#058F63666433&0#.

Log: 'System' Date/Time: 02/02/2015 9:26:17 PM
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 02/02/2015 9:26:17 PM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\Windows\system32\Rtlihvs.dll
 

---------------------------------------------------------------

 

 

 

VEW Application Log:

---------------------------------------------------------------

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 02/02/2015 4:33:34 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 02/02/2015 9:30:46 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   6 user registry handles leaked from \Registry\User\S-1-5-21-3700817450-263443993-1340972289-1001:
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 1364 (\Device\HarddiskVolume2\Windows\SysWOW64\Fast Boot\FastBootAgent.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001\Software\Microsoft\SystemCertificates\My
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001\Software\Microsoft\SystemCertificates\CA
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001\Software\Microsoft\SystemCertificates\Disallowed

 

---------------------------------------------------------------

[Advertisements]

There is a newer version of Fast Boot (but not by much, I had 1.0.0 and it's 1.0.5) and I just installed that.

 

I have the latest BIOS which is 2.1.8, so there's no need to deal with that.

 

Memtest86+ is currently running.  If the "Pass" field is what denotes total progress it's at 52% after 15 minutes.  So far no errors reported.

Edited by britechguy, 02 February 2015 - 04:03 PM.

[britechguy]

There is a newer version of Fast Boot (but not by much, I had 1.0.0 and it's 1.0.5) and I just installed that.

 

I have the latest BIOS which is 2.1.8, so there's no need to deal with that.

 

Memtest86+ is currently running.  If the "Pass" field is what denotes total progress it's at 52% after 15 minutes.  So far no errors reported.

Edited by britechguy, 02 February 2015 - 04:03 PM.

[RKinner]

Found a better writeup on fixing the first error:

 

http://www.itexperie...8-a06ad6d8b4d1/

 

I have no idea what to do with the Realtek DHCP error.  You are the only one in the Google world with the error.  I think it's related to your external WIFI adapter.  Expect the other odd error about  'VMICTimeProvider' is part of it.  You might try uninstalling and reinstalling the software for the adapter.

 

To change the service associated with this error:

 

Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device WpdBusEnumRoot\UMB\2&37c186b&1&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MULTIPLE&PROD_CARD_READER&REV_1.00#058F63666433&0#.

 

 

Right click on Computer and select Manager then Services and Applications then Services.  Scroll down in the right pane until you find "Windows Driver Foundation - User-mode Driver Framework".   Right click and select Properties.  Change the Startup Type to Automatic.  OK.

 

I doubt you could see the dust on the heatsink without taking off the bottom cover.  

 

Not sure what to do about the lsass process holding open the registry.  Hopefully if the new version of Fast Boot works that will fix it too.

 

Can you run OTL quickscan again to make sure that the hosts file is back to normal?  Or you can just open it by copying the next line:

 

notepad C:\Windows\System32\Drivers\etc\hosts

 

Start, All Programs, Accessories, Command Prompt then right click and Paste or Edit then paste.  Hit Enter if notepad does not open.  A clean hosts file will look like:

 

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

#      102.54.94.97     rhino.acme.com          # source server

#       38.25.63.10     x.acme.com              # x client host

 

# localhost name resolution is handled within DNS itself.

# 127.0.0.1       localhost

# ::1             localhost

 

 

 

 

 

The lines starting with a # are comments and are ignored so essentially the file is empty.

[britechguy]

Ron,

 

          I will do as you request, but I kicked off a memtest86+ test just before 5 PM EST and it's still running.  There have been zero errors on the first two passes and it's about halfway through pass three.  I have absolutely no idea how many hours this might take, but I'm going to let it run to completion unless instructed otherwise.

[britechguy]

I have had issues with the Windows Time Service on this laptop for as long as I can remember.   I've used every trick I could find and never found a fix.  This was going on long before I started using the wireless N adapter (which I only got about two months ago).

 

Whatever's going on with the network adapter, it isn't affecting it doing its job. I actually got it once I started using Chromecast since the laptop is the conduit to the TV.  When I was trying to view HD content I'd get frequent pixelation which has cleared up completely.

 

I'll pop the bottom off on the laptop to examine the state of the heat sink and will try to post a picture.   I've put SpeedFan on all of our laptops and have been monitoring.  This one, my ancient Acer, runs around 50 degrees "at rest" and has always run hot since day one.  You can really feel the heat at the output side.  My partner's Toshiba laptop, with an AMD APU runs around 60-65 degrees routinely under only moderate load.  Does anyone publish what the "ideal" operating temperatures are for their CPUs/APUs.  It's pretty clear to me that "within normal limits" varies quite widely depending on the actual processor.

 

By the time I did those VEW runs FastBoot had already been updated, so it doesn't appear to have helped.

 

Will take a look at the hosts file, probably tomorrow.  I'm getting the distinct impression that this memtest is going to run for *quite* a while longer!

[RKinner]

Fast Boot runs as a service so we can go in just like we did for the "Windows Driver Foundation but set it to Disabled.  

 

Right click on Computer and select Manager then Services and Applications then Services.  Scroll down in the right pane until you find Fast Boot .   Right click and select Properties.  Change the Startup Type to Disabled.  Apply.  STOP the service.  OK.  Then clear the alarms and reboot.  Run VEW again and see if we still have the registry errors.  Also note if it really boots slower.  We might not need it at all.

[britechguy]

Does anyone know the typical run time for memtest86+ for 4GB of RAM?  I'm at 17 hours 15 minutes and 12 passes have been completed with zero errors.

 

I really don't know whether this will continue in an infinite loop of passes until or unless I hit ESC to stop it or not.

[britechguy]

Well, after much ongoing research I finally found the answer to my last question in the Memtest86+ forums FAQ (and only there):

 

"Memtest runs indefinitely unless you stop it. It does however repeat the same tests over and over again."

 

It's amazing to me how many tutorials exist out there on Memtest86 and Memtest86+, none of which make any mention of this, including the one I found on Geeks to Go.  Since most testing software isn't designed to run as an infinite loop unless stopped, this is an important piece of information to have.

 

Since I've run 13 full passes with zero errors over the course of 18.5 hours, and am 50% of the way through pass 14, still with no errors, I am completely satisfied that I do not have any issues with memory.

 

[britechguy]

OK, here's the latest:

 

I did the services tweak related to the WUDFRd error and also disabled Fast Boot.

 

I cleared out the System and Application Log files and rebooted the system.

 

VEW System Results:

--------------------------------------------------------------

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 03/02/2015 12:42:56 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 03/02/2015 5:39:51 PM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID  {C97FCC79-E628-407D-AE68-A06AD6D8B4D1}  and APPID  {344ED43D-D086-4961-86A6-1106F4ACAD9B}  to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Log: 'System' Date/Time: 03/02/2015 5:39:17 PM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID  {C97FCC79-E628-407D-AE68-A06AD6D8B4D1}  and APPID  {344ED43D-D086-4961-86A6-1106F4ACAD9B}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Log: 'System' Date/Time: 03/02/2015 5:38:42 PM
Type: Error Category: 0
Event: 7034 Source: Service Control Manager
The Realtek DHCP Service service terminated unexpectedly.  It has done this 1 time(s).

Log: 'System' Date/Time: 03/02/2015 5:38:31 PM
Type: Error Category: 0
Event: 4 Source: Microsoft-Windows-Time-Service
The time provider 'VMICTimeProvider' failed to start due to the following error: The specified module could not be found. (0x8007007E)

Log: 'System' Date/Time: 03/02/2015 5:38:25 PM
Type: Error Category: 0
Event: 7006 Source: Service Control Manager
The ScRegSetValueExW call failed for FailureActions with the following error:  Access is denied.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 03/02/2015 5:36:52 PM
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 03/02/2015 5:36:52 PM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\Windows\system32\Rtlihvs.dll
--------------------------------------------------------------

 

VEW Application Results:

--------------------------------------------------------------

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 03/02/2015 12:44:27 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 03/02/2015 5:36:44 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   7 user registry handles leaked from \Registry\User\S-1-5-21-3700817450-263443993-1340972289-1001:
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 1552 (\Device\HarddiskVolume2\Windows\System32\FBAgent.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 1552 (\Device\HarddiskVolume2\Windows\System32\FBAgent.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001\Software\Microsoft\SystemCertificates\My
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001\Software\Microsoft\SystemCertificates\CA
Process 516 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001\Software\Microsoft\SystemCertificates\Disallowed

--------------------------------------------------------------

 

I also pulled the bottom cover off of the machine to examine the dust situation.  There was virtually none on the heat sink, but some on the fan and the air exit.  Before and after photos are attached.  Things are running quite a bit cooler at the moment (low to mid 20s) but I haven't done anything "heavy duty" yet, either.  I'll keep an eye on this.  If the temps stay this much lower then it's time to clean out the partner's laptop, too.

 

Attached Thumbnails

• 
• 

[RKinner]

 

Looks like Fast Boot has a secret way to start.  This FBAgent.exe has to be from Fast Boot but it does not show up in either FRST or OTL logs.  Since you have found the latest version I would uninstall it and then clear the logs and reboot and see if we still have registry errors.  Have you noticed any problems witht he service being turned off?  Maybe we can live without it.

Process 1552 (\Device\HarddiskVolume2\Windows\System32\FBAgent.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001

Process 1552 (\Device\HarddiskVolume2\Windows\System32\FBAgent.exe) has opened key \REGISTRY\USER\S-1-5-21-3700817450-263443993-1340972289-1001

 

 

 

The interface between the fan and the heatsink is what usually gets clogged with dust.  Not sure you can see it without removing either the fan or the heatsink.  (Don't remove the heatsink)  However, if it's running cooler that's good enough.

 

 

[britechguy]

Boot up is a wee bit slower and "less smooth" without Fast Boot.

 

I forgot to mention that the hosts file is now nothing but comment lines.  It's pretty much like the one you posted with two additional comment lines, the first noting start of entries added by Spybot S&D and the second the end, with nothing in between.

 

I do think the dust was mostly on the exit holes for the air, which is an integral part of the heatsink on my computer.  It appears to be the same on my partners.  A good vacuuming of just the external openings on his reduced the operating temperature.  Mine is now running in the high 20s to low 30s with peaking in the high 40s under really heavy load.

 

I will attach four files, all VEW runs I did after tweaking certain bits.   I definitely got rid of that COM Server error message, which is a plus.  I still wish I could get the Windows Time Service to work.

 

Attached Files

•  VEW_System_608PM_FastBoot_Off.txt   1.58KB   305 downloads
•  VEW_Application_609PM_FastBoot_Off.txt   2.02KB   304 downloads
•  VEW_System_620PM_FastBoot_On_Wireless_Dongle_Out.txt   1.74KB   358 downloads
•  VEW_Application_620PM_FastBoot_On_Wireless_Adapter_Out.txt   2.02KB   300 downloads

[RKinner]

I want to see what the dcom error is:

 

Copy the next 4 lines;

 

reg query HKCR\Clsid\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} /s > \junk.txt
reg query HKCU\Software\Classes\clsid\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} /s  >> \junk.txt
dir \Windows\system32\thumbcache.dll >> \junk.txt
notepad \junk.txt

 

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied lines should appear.

 

Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply. 

 

It looks like we are down to one error in the registry on shutdown.  Not sure what causes that.  Is it any better on shutdown?

 

 

Tell me about your time problem.  Exactly what happens when you try to get it to sync to network time?  Have you tried any of the other time sources?  Time.nist.gov?

[britechguy]

First, here's the output in junk.txt:

------------------------------------------------------------------------

HKEY_CLASSES_ROOT\Clsid\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    (Default)    REG_SZ    Thumbnail Cache Class Factory for Out of Proc Server
    AppID    REG_SZ    {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}

HKEY_CLASSES_ROOT\Clsid\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\InprocServer32
    (Default)    REG_SZ    C:\Windows\system32\thumbcache.dll
    ThreadingModel    REG_SZ    Apartment

 Volume in drive C is OS
 Volume Serial Number is FCCE-EF2E

 Directory of C:\Windows\system32

11/20/2010  08:27 AM           112,640 thumbcache.dll
               1 File(s)        112,640 bytes
               0 Dir(s)  59,402,821,632 bytes free

-------------------------------------------------------------------------------------------

Here's what showed up when running in the command prompt:
C:\Users\BPV>reg query HKCR\Clsid\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} /s > \j
unk.txt

C:\Users\BPV>reg query HKCU\Software\Classes\clsid\{AB8902B4-09CA-4bb6-B78D-A8F5
9079A8D5} /s  >> \junk.txt
ERROR: The system was unable to find the specified registry key or value.

C:\Users\BPV>dir \Windows\system32\thumbcache.dll >> \junk.txt

C:\Users\BPV>notepad \junk.txt
----------------------------------------------------------------------------------------

 

With regard to the time server, it's been a long while since I last encountered the time server "could not start" message when I was digging around.  I just now tried going into Date & Time in the Control Panel.  I tried syncing with time.windows.com and time.nist.com.  In both cases I got a failure message on the actual sync/update dialog but, when you dismiss it, a contradictory message on the date/time dialog itself.  See the attached images.

 

Let me shut down again to get a better impression.  I think it's faster, actually, but that hasn't been my focus.

 

Attached Thumbnails

• 
• 
• 
• 

[britechguy]

Just did a shutdown (complete) and start up.   I would not say that either is significantly different than it was when I was not actively experiencing "runaway disk activity" when shutting down [which makes the process draw out much, much longer].

 

I think the both the start up and shut down processes take longer than I feel they should, but I can live with them.

[RKinner]

The DCOM error is definitely the thumbnail server.  Not sure what is wrong with it.  Perhaps a thumbs.db file somewhere is corrupt.  We could turn them off, do a disk clean up and turn them on again and see if that clears up the error.

 

http://www.techsuppo...hem-windows.htm

 

 

 

The second entry in junk.txt- the one that failed - is not supposed to be there.  It is only present when a certain sneaky infection is present.

 

http://blog.trendmic...tart-mechanism/

 

 

 

 

 

 

 

Your time seems to work about as well as mine.  Mine also does the it failed but I synced up stuff.

 

 

 

Have you had any episodes of high disk usage recently?