C
Chris
I am trying to help a guy with some odd computer problems. His wife is
the main user of the computer and unfortunately she was out of town when
I looked at the computer. She has full admin rights on her account. I
would have liked to ask if I could remove some things from startup. I
did try diagnostic mode and it didn't seem to have any problems there.
I've been working with PCs a long time, and I just can't figure out
where to start on this one. Any ideas would be much appreciated!
The computer has seemingly random problems. They include:
applications randomly crashing
programs not closing when the computer shuts down -- having to force
quit them.
Internet Explorer sometimes not working ("cannot load page") and other
times working.
The computer is running AOL 9 with the AOL security software (by McAfee)
which is up to date and doesn't say it has found any viruses. It is
also running Windows Defender (not sure if running that along with the
AOL security software is causing problems...) It also has Corel Office
9 which starts some taskbar things plus a little calendar program when
the computer boots.
I ran Hijack This! and it doesn't seem to find anything out of the
ordinary. No BHO's or other stuff.
It has some weird things in the error log which I will post below.
Before I left, I started memtest86 to see if I can eliminiate bad memory
as being a problem.
If anyone has ideas on what to check, please let me know! Thanks!
Here are some messages from the logs. I have tried to show unique
messages and some duplicates have been removed:
--------------------------
Event Type: Warning Event Source: Userenv Event Category: None Event ID:
1524 Date: 10/13/2006 Time: 6:17:49 PM User: SOCKSIE\Betsy Computer:
SOCKSIE Description: Windows cannot unload your classes registry file -
it is still in use by other applications or services. The file will be
unloaded when it is no longer in use.
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Application Error Event Category: (100)
Event ID: 1000 Date: 10/13/2006 Time: 5:55:28 PM User: N/A Computer:
SOCKSIE Description: Faulting application svchost.exe, version 5.1.2600.
2180, faulting module mswsock.dll, version 5.1.2600.2180, fault address
0x0000882a.
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp. Data: 0000: 41 70 70 6c 69 63 61 74
Applicat 0008: 69 6f 6e 20 46 61 69 6c ion Fail 0010: 75 72 65 20 20
73 76 63 ure svc 0018: 68 6f 73 74 2e 65 78 65 host.exe 0020: 20 35
2e 31 2e 32 36 30 5.1.260 0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 6d 73 77 73 6f 63 n mswsoc 0038: 6b 2e 64 6c 6c 20 35 2e
k.dll 5. 0040: 31 2e 32 36 30 30 2e 32 1.2600.2 0048: 31 38 30 20 61
74 20 6f 180 at o 0050: 66 66 73 65 74 20 30 30 ffset 00 0058: 30 30
38 38 32 61 00882a
Event Type: Error Event Source:
Application Hang Event Category: (101) Event ID: 1002 Date: 10/10/2006
Time: 1:09:48 PM User: N/A Computer: SOCKSIE Description: Hanging
application Photoshop.exe, version 9.0.0.0, hang module hungapp, version
0.0.0.0, hang address 0x00000000.
For more information, see Help and
Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000:
41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 48 61 6e 67 ion
Hang 0010: 20 20 50 68 6f 74 6f 73 Photos 0018: 68 6f 70 2e 65 78 65
20 hop.exe 0020: 39 2e 30 2e 30 2e 30 20 9.0.0.0 0028: 69 6e 20 68
75 6e 67 61 in hunga 0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0 0038: 2e
30 20 61 74 20 6f 66 .0 at of 0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000
Event Type: Warning Event
Source: Userenv Event Category: None Event ID: 1517 Date: 10/10/2006
Time: 1:01:36 PM User: NT AUTHORITY\SYSTEM Computer: SOCKSIE
Description: Windows saved user SOCKSIE\Betsy registry while an
application or service was still using the registry during log off. The
memory used by the user's registry has not been freed. The registry will
be unloaded when it is no longer in use.
This is often caused by
services running as a user account, try configuring the services to run
in either the LocalService or NetworkService account.
For more
information, see Help and Support Center at http://go.microsoft.com/
fwlink/events.asp.
Event Type: Warning Event Source: Userenv Event
Category: None Event ID: 1517 Date: 10/9/2006 Time: 10:15:47 PM User:
NT AUTHORITY\SYSTEM Computer: SOCKSIE Description: Windows saved user
SOCKSIE\Betsy registry while an application or service was still using
the registry during log off. The memory used by the user's registry has
not been freed. The registry will be unloaded when it is no longer in
use.
This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.
For more information, see Help and Support
Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Application Hang Event Category: (101) Event ID: 1002 Date:
10/5/2006 Time: 8:21:31 AM User: N/A Computer: SOCKSIE Description:
Hanging application ipostage.exe, version 6.0.1.1515, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: 0000: 41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 48 61
6e 67 ion Hang 0010: 20 20 69 70 6f 73 74 61 iposta 0018: 67 65 2e
65 78 65 20 36 ge.exe 6 0020: 2e 30 2e 31 2e 31 35 31 .0.1.151 0028:
35 20 69 6e 20 68 75 6e 5 in hun 0030: 67 61 70 70 20 30 2e 30 gapp
0.0 0038: 2e 30 2e 30 20 61 74 20 .0.0 at 0040: 6f 66 66 73 65 74 20
30 offset 0 0048: 30 30 30 30 30 30 30 0000000
Event Type: Error
Event Source: ESENT Event Category: General Event ID: 490 Date: 10/2/
2006 Time: 12:23:42 PM User: N/A Computer: SOCKSIE Description:
svchost (1168) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\
edb.log" for read / write access failed with system error 32 (0x00000020):
"The process cannot access the file because it is being used by another
process. ". The open file operation will fail with error -1032 (
0xfffffbf8).
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp.
Event Type: Warning Event Source:
Userenv Event Category: None Event ID: 1524 Date: 9/29/2006 Time: 1:26:
07 PM User: SOCKSIE\Betsy Computer: SOCKSIE Description: Windows cannot
unload your classes registry file - it is still in use by other
applications or services. The file will be unloaded when it is no longer
in use.
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp.
Event Type: Warning Event Source:
Userenv Event Category: None Event ID: 1517 Date: 9/27/2006 Time: 11:
35:05 PM User: NT AUTHORITY\SYSTEM Computer: SOCKSIE Description:
Windows saved user SOCKSIE\Betsy registry while an application or
service was still using the registry during log off. The memory used by
the user's registry has not been freed. The registry will be unloaded
when it is no longer in use.
This is often caused by services running
as a user account, try configuring the services to run in either the
LocalService or NetworkService account.
For more information, see Help
and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit Event Source: Security Event Category: Account
Logon Event ID: 680 Date: 10/13/2006 Time: 6:44:33 PM User: NT
AUTHORITY\SYSTEM Computer: SOCKSIE Description: Logon attempt by:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Betsy
Source
Workstation: SOCKSIE
Error Code: 0xC000006E
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: DCOM Event Category: None Event ID:
10010 Date: 10/13/2006 Time: 6:43:21 PM User: NT AUTHORITY\SYSTEM
Computer: SOCKSIE Description: The server {A1F4E726-8CF1-11D1-BF92-
0060081ED811} did not register with DCOM within the required timeout.
For more information, see Help and Support Center at http://go.microsoft.
com/fwlink/events.asp.
Event Type: Error Event Source: Service Control
Manager Event Category: None Event ID: 7022 Date: 10/13/2006 Time: 6:
39:21 PM User: N/A Computer: SOCKSIE Description: The Windows Image
Acquisition (WIA) service hung on starting.
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: DCOM Event Category: None Event ID:
10010 Date: 10/13/2006 Time: 6:17:15 PM User: SOCKSIE\Betsy Computer:
SOCKSIE Description: The server {A1F4E726-8CF1-11D1-BF92-0060081ED811}
did not register with DCOM within the required timeout.
For more
information, see Help and Support Center at http://go.microsoft.com/
fwlink/events.asp.
System Log:
Event Type: Error Event Source:
Service Control Manager Event Category: None Event ID: 7000 Date: 10/13/
2006 Time: 5:55:29 PM User: N/A Computer: SOCKSIE Description: The
Remote Access Connection Manager service failed to start due to the
following error: All pipe instances are busy.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Service Control Manager Event Category:
None Event ID: 7000 Date: 10/13/2006 Time: 5:55:29 PM User: N/A
Computer: SOCKSIE Description: The Remote Access Connection Manager
service failed to start due to the following error: All pipe instances
are busy.
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source:
Service Control Manager Event Category: None Event ID: 7000 Date: 10/13/
2006 Time: 5:55:28 PM User: N/A Computer: SOCKSIE Description: The
Network Location Awareness (NLA) service failed to start due to the
following error: All pipe instances are busy.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Service Control Manager Event Category:
None Event ID: 7000 Date: 10/13/2006 Time: 5:55:24 PM User: N/A
Computer: SOCKSIE Description: The Computer Browser service failed to
start due to the following error: All pipe instances are busy.
For
more information, see Help and Support Center at http://go.microsoft.com/
fwlink/events.asp.
Event Type: Error Event Source: NLA Event Category:
None Event ID: 0 Date: 10/13/2006 Time: 5:55:23 PM User: N/A Computer:
SOCKSIE Description: The description for Event ID ( 0 ) in Source ( NLA )
cannot be found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. You may be able to use the /AUXSOURCE= flag to retrieve this
description; see Help and Support for details. The following information
is part of the event: The event log file is corrupt..
Event Type: Error
Event Source: Service Control Manager Event Category: None Event ID:
7000 Date: 10/13/2006 Time: 5:55:22 PM User: N/A Computer: SOCKSIE
Description: The Background Intelligent Transfer Service service failed
to start due to the following error: The service did not respond to the
start or control request in a timely fashion.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Service Control Manager Event Category:
None Event ID: 7011 Date: 10/13/2006 Time: 5:55:22 PM User: N/A
Computer: SOCKSIE Description: Timeout (30000 milliseconds) waiting for
a transaction response from the BITS service.
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
the main user of the computer and unfortunately she was out of town when
I looked at the computer. She has full admin rights on her account. I
would have liked to ask if I could remove some things from startup. I
did try diagnostic mode and it didn't seem to have any problems there.
I've been working with PCs a long time, and I just can't figure out
where to start on this one. Any ideas would be much appreciated!
The computer has seemingly random problems. They include:
applications randomly crashing
programs not closing when the computer shuts down -- having to force
quit them.
Internet Explorer sometimes not working ("cannot load page") and other
times working.
The computer is running AOL 9 with the AOL security software (by McAfee)
which is up to date and doesn't say it has found any viruses. It is
also running Windows Defender (not sure if running that along with the
AOL security software is causing problems...) It also has Corel Office
9 which starts some taskbar things plus a little calendar program when
the computer boots.
I ran Hijack This! and it doesn't seem to find anything out of the
ordinary. No BHO's or other stuff.
It has some weird things in the error log which I will post below.
Before I left, I started memtest86 to see if I can eliminiate bad memory
as being a problem.
If anyone has ideas on what to check, please let me know! Thanks!
Here are some messages from the logs. I have tried to show unique
messages and some duplicates have been removed:
--------------------------
Event Type: Warning Event Source: Userenv Event Category: None Event ID:
1524 Date: 10/13/2006 Time: 6:17:49 PM User: SOCKSIE\Betsy Computer:
SOCKSIE Description: Windows cannot unload your classes registry file -
it is still in use by other applications or services. The file will be
unloaded when it is no longer in use.
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Application Error Event Category: (100)
Event ID: 1000 Date: 10/13/2006 Time: 5:55:28 PM User: N/A Computer:
SOCKSIE Description: Faulting application svchost.exe, version 5.1.2600.
2180, faulting module mswsock.dll, version 5.1.2600.2180, fault address
0x0000882a.
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp. Data: 0000: 41 70 70 6c 69 63 61 74
Applicat 0008: 69 6f 6e 20 46 61 69 6c ion Fail 0010: 75 72 65 20 20
73 76 63 ure svc 0018: 68 6f 73 74 2e 65 78 65 host.exe 0020: 20 35
2e 31 2e 32 36 30 5.1.260 0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 6d 73 77 73 6f 63 n mswsoc 0038: 6b 2e 64 6c 6c 20 35 2e
k.dll 5. 0040: 31 2e 32 36 30 30 2e 32 1.2600.2 0048: 31 38 30 20 61
74 20 6f 180 at o 0050: 66 66 73 65 74 20 30 30 ffset 00 0058: 30 30
38 38 32 61 00882a
Event Type: Error Event Source:
Application Hang Event Category: (101) Event ID: 1002 Date: 10/10/2006
Time: 1:09:48 PM User: N/A Computer: SOCKSIE Description: Hanging
application Photoshop.exe, version 9.0.0.0, hang module hungapp, version
0.0.0.0, hang address 0x00000000.
For more information, see Help and
Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000:
41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 48 61 6e 67 ion
Hang 0010: 20 20 50 68 6f 74 6f 73 Photos 0018: 68 6f 70 2e 65 78 65
20 hop.exe 0020: 39 2e 30 2e 30 2e 30 20 9.0.0.0 0028: 69 6e 20 68
75 6e 67 61 in hunga 0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0 0038: 2e
30 20 61 74 20 6f 66 .0 at of 0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000
Event Type: Warning Event
Source: Userenv Event Category: None Event ID: 1517 Date: 10/10/2006
Time: 1:01:36 PM User: NT AUTHORITY\SYSTEM Computer: SOCKSIE
Description: Windows saved user SOCKSIE\Betsy registry while an
application or service was still using the registry during log off. The
memory used by the user's registry has not been freed. The registry will
be unloaded when it is no longer in use.
This is often caused by
services running as a user account, try configuring the services to run
in either the LocalService or NetworkService account.
For more
information, see Help and Support Center at http://go.microsoft.com/
fwlink/events.asp.
Event Type: Warning Event Source: Userenv Event
Category: None Event ID: 1517 Date: 10/9/2006 Time: 10:15:47 PM User:
NT AUTHORITY\SYSTEM Computer: SOCKSIE Description: Windows saved user
SOCKSIE\Betsy registry while an application or service was still using
the registry during log off. The memory used by the user's registry has
not been freed. The registry will be unloaded when it is no longer in
use.
This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.
For more information, see Help and Support
Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Application Hang Event Category: (101) Event ID: 1002 Date:
10/5/2006 Time: 8:21:31 AM User: N/A Computer: SOCKSIE Description:
Hanging application ipostage.exe, version 6.0.1.1515, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data: 0000: 41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 48 61
6e 67 ion Hang 0010: 20 20 69 70 6f 73 74 61 iposta 0018: 67 65 2e
65 78 65 20 36 ge.exe 6 0020: 2e 30 2e 31 2e 31 35 31 .0.1.151 0028:
35 20 69 6e 20 68 75 6e 5 in hun 0030: 67 61 70 70 20 30 2e 30 gapp
0.0 0038: 2e 30 2e 30 20 61 74 20 .0.0 at 0040: 6f 66 66 73 65 74 20
30 offset 0 0048: 30 30 30 30 30 30 30 0000000
Event Type: Error
Event Source: ESENT Event Category: General Event ID: 490 Date: 10/2/
2006 Time: 12:23:42 PM User: N/A Computer: SOCKSIE Description:
svchost (1168) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\
edb.log" for read / write access failed with system error 32 (0x00000020):
"The process cannot access the file because it is being used by another
process. ". The open file operation will fail with error -1032 (
0xfffffbf8).
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp.
Event Type: Warning Event Source:
Userenv Event Category: None Event ID: 1524 Date: 9/29/2006 Time: 1:26:
07 PM User: SOCKSIE\Betsy Computer: SOCKSIE Description: Windows cannot
unload your classes registry file - it is still in use by other
applications or services. The file will be unloaded when it is no longer
in use.
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp.
Event Type: Warning Event Source:
Userenv Event Category: None Event ID: 1517 Date: 9/27/2006 Time: 11:
35:05 PM User: NT AUTHORITY\SYSTEM Computer: SOCKSIE Description:
Windows saved user SOCKSIE\Betsy registry while an application or
service was still using the registry during log off. The memory used by
the user's registry has not been freed. The registry will be unloaded
when it is no longer in use.
This is often caused by services running
as a user account, try configuring the services to run in either the
LocalService or NetworkService account.
For more information, see Help
and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit Event Source: Security Event Category: Account
Logon Event ID: 680 Date: 10/13/2006 Time: 6:44:33 PM User: NT
AUTHORITY\SYSTEM Computer: SOCKSIE Description: Logon attempt by:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Betsy
Source
Workstation: SOCKSIE
Error Code: 0xC000006E
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: DCOM Event Category: None Event ID:
10010 Date: 10/13/2006 Time: 6:43:21 PM User: NT AUTHORITY\SYSTEM
Computer: SOCKSIE Description: The server {A1F4E726-8CF1-11D1-BF92-
0060081ED811} did not register with DCOM within the required timeout.
For more information, see Help and Support Center at http://go.microsoft.
com/fwlink/events.asp.
Event Type: Error Event Source: Service Control
Manager Event Category: None Event ID: 7022 Date: 10/13/2006 Time: 6:
39:21 PM User: N/A Computer: SOCKSIE Description: The Windows Image
Acquisition (WIA) service hung on starting.
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: DCOM Event Category: None Event ID:
10010 Date: 10/13/2006 Time: 6:17:15 PM User: SOCKSIE\Betsy Computer:
SOCKSIE Description: The server {A1F4E726-8CF1-11D1-BF92-0060081ED811}
did not register with DCOM within the required timeout.
For more
information, see Help and Support Center at http://go.microsoft.com/
fwlink/events.asp.
System Log:
Event Type: Error Event Source:
Service Control Manager Event Category: None Event ID: 7000 Date: 10/13/
2006 Time: 5:55:29 PM User: N/A Computer: SOCKSIE Description: The
Remote Access Connection Manager service failed to start due to the
following error: All pipe instances are busy.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Service Control Manager Event Category:
None Event ID: 7000 Date: 10/13/2006 Time: 5:55:29 PM User: N/A
Computer: SOCKSIE Description: The Remote Access Connection Manager
service failed to start due to the following error: All pipe instances
are busy.
For more information, see Help and Support Center at http://
go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source:
Service Control Manager Event Category: None Event ID: 7000 Date: 10/13/
2006 Time: 5:55:28 PM User: N/A Computer: SOCKSIE Description: The
Network Location Awareness (NLA) service failed to start due to the
following error: All pipe instances are busy.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Service Control Manager Event Category:
None Event ID: 7000 Date: 10/13/2006 Time: 5:55:24 PM User: N/A
Computer: SOCKSIE Description: The Computer Browser service failed to
start due to the following error: All pipe instances are busy.
For
more information, see Help and Support Center at http://go.microsoft.com/
fwlink/events.asp.
Event Type: Error Event Source: NLA Event Category:
None Event ID: 0 Date: 10/13/2006 Time: 5:55:23 PM User: N/A Computer:
SOCKSIE Description: The description for Event ID ( 0 ) in Source ( NLA )
cannot be found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. You may be able to use the /AUXSOURCE= flag to retrieve this
description; see Help and Support for details. The following information
is part of the event: The event log file is corrupt..
Event Type: Error
Event Source: Service Control Manager Event Category: None Event ID:
7000 Date: 10/13/2006 Time: 5:55:22 PM User: N/A Computer: SOCKSIE
Description: The Background Intelligent Transfer Service service failed
to start due to the following error: The service did not respond to the
start or control request in a timely fashion.
For more information,
see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error Event Source: Service Control Manager Event Category:
None Event ID: 7011 Date: 10/13/2006 Time: 5:55:22 PM User: N/A
Computer: SOCKSIE Description: Timeout (30000 milliseconds) waiting for
a transaction response from the BITS service.
For more information, see
Help and Support Center at http://go.microsoft.com/fwlink/events.asp.