Windows Freezes

[Guest]

I have XP Home Edition (SP2) and am getting random freezes, Although not
always, most of them occur once the desktop has been populated with the
program icons. I have checked the error log and a pattern seems to be the
following 2 Loadperf messages:

- The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. BaseIndex value from
Performance registry is the first DWORD in Data section, LastCounter value is
the second DWORD in Data section, and LastHelp value is the third DWORD in
Data section.

- LoadPerf Unloading the performance counter strings for service WmiApRpl
(WmiApRpl) failed. The Error code is the first DWORD in Data section.


Can anyone suggest what these indicate as alikely cause please?

 

[Gerry Cornell]

Simon

Can you provide the Event ID and the Source for those Error Reports?


--

~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Guest]

Gerry

These were the messages in the Windows Error Log, No other information was
given. I didn't get an error appear on screen - the system simply locked up
and I had to reboot.

 

[Gerry Cornell]

Simon

Try looking in Event Viewer?

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer.
When researching the meaning of the error, information regarding Event
ID, Source
and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

Part of the Description of the error will include a link, which you
should double click
for further information and you can copy using copy and paste.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the
error you want to copy. In the window, which appears is a button
resembling two
pages. Double click the button and close Event Viewer. Now start your
message
(email) and do a paste into the body of the message. This will paste the
info from the
Event Viewer Error Report complete with links into the message. Make
sure this is
the first paste after exiting from Event Viewer.

In Event Viewer there is no facility to print Error Reports. A
workaround is copy and
paste the Error Report into an email, send it to yourself and print off
the copy in your
Inbox or your Sent Items folder.

--

~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Guest]

Gerry

Thanks for the advice. I had assumed that the Error Log reflected the cause
of the freeze and I have found the corresponding errors under Applications in
Event Viewer:

Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3012
Date: 27/01/2005
Time: 12:47:52
User: N/A
Computer: SIMON-DESKTOP
Description:
The performance strings in the Performance registry value is corrupted when
process Performance extension counter provider. BaseIndex value from
Performance registry is the first DWORD in Data section, LastCounter value is
the second DWORD in Data section, and LastHelp value is the third DWORD in
Data section.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 37 07 00 00 00 00 00 00 7.......
0008: 00 00 00 00 ca 03 00 00 ....Ê...


Event Type: Error
Event Source: LoadPerf
Event Category: None
Event ID: 3011
Date: 27/01/2005
Time: 12:47:52
User: N/A
Computer: SIMON-DESKTOP
Description:
Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: f2 03 00 00 3b 07 00 00 ò...;...

There is no further help for the 1st error but the suggestion for the
second is to run lodctr /r.

Regards

Simon

 

[Gerry Cornell]

Simon

Research come up with the following:

http://www.eventid.net/display.asp?eventid=3012&eventno=1160&source=LoadPerf&phase=1

How to Manually Rebuild Performance Counter Library Values
http://support.microsoft.com/default.aspx?scid=kb;en-us;300956

Use System Restore to create a restore point before tinkering.

--

~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Guest]

Hi Gerry

I followed as much of the advice as I felt safe doing - restored the
perfc009 and perfh009 files from the XP CD, reset the Lastcounter and
Lasthelp values and removed the values from the Performance subkeys. I no
longer get the messages in the Event Log although the system still keeps
freezing. I now get the following Information Message under Applications:

Event Type: Information
Event Source: ISService
Event Category: None
Event ID: 1
Date: 28/01/2005
Time: 16:58:18
User: NT AUTHORITY\SYSTEM
Computer: SIMON-DESKTOP
Description:
The description for Event ID ( 1 ) in Source ( ISService ) cannot be found.
The local computer may not have the necessary registry information or message
DLL files to display messages from a remote computer. You may be able to use
the /AUXSOURCE= flag to retrieve this description; see Help and Support for
details. The following information is part of the event: The event log file
is corrupt..

And a similar one for Ghoststartservice. Could these suggest a cause?