PC Freezes/Restarts all the time

By husamn
Jul 18, 2008
Topic Status:
Not open for further replies.
  1. This is driving me so damn crazy!

    I checked the RAM, HD, Motherboard, Viruses.
    ALL GOOD\CLEAN!

    but it still freezes and restarts every time! :mad:

    No over heating problems, room temp is very good.

    I cannot complete any work I do on this PC.


    I attached the log files from system/application events.
    Not a long log file, cause I cleared from before and started new session yesterday so it wont be long for you to check.

    pc restarted like 7 mins ago, errors should be in the logfiles.

    please I need urgent help. :(

    EDIT: Im using Windows XP Professional.

    Attached Files:

  2. rf6647

    rf6647 TechSpot Maniac Posts: 931

    Attempt to expand zip attachment received error message: damaged file.

    If problem is caused by new applications or updated drivers, use System Restore from an earlier date. What did you see in the events logs tied to the crash? System error? Application error? Hardware?
  3. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    Zip file is working, I just tested it.
    please download again.

    don't think it's from any applications, I also booted in Safe Mode, and left pc open without doing anything to it, and it froze after some time.

    not allot of errors in the event log, but lots of "infomation" and few "warning"
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    I was also unable to open the files. I extracted, but Apps and System logs wouldn't open. You shouldn't need to many Error events that you need to put them in a zip file. Here's what to do:
    Right click on the Error> Properties> Click on the Copy icon below the down arrow on the right> Paste here (Ctrl V)

    Note please: Ignore Warnings. Ignore Information Events. You are looking for the Error(s) that occurs at time of freeze and reboot. If you have multiple Errors with same ID#, same Source and same Description, you only need to copy one. And you can remove the lines of code following Description.

    Set up Error as follows using your information. A copy will paste like this:
    Event Type: Error
    Event Source: Your information
    Event Category: None
    Event ID: Your information
    Date: 7/18/2008
    Time: 11:35:22 AM
    User: Your information
    Computer: Your computer
    Description:
    Your description

    This is the information we need.

    Right off I'll ask if you have an AMD processor and if you recently got the SP3 Windows Update. IF you did, this is the problem. Go into Add/Remove Programs in the Control Panel and uninstall KB936929
  5. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    I use Intel Pentium 4, and didn't download SP3, I have this problem for a long time.

    Event Logs:

    System

    Event Type: Error
    Event Source: NETLOGON
    Event Category: None
    Event ID: 3095
    Date: 7/18/2008
    Time: 4:49:24 PM
    User: N/A
    Computer: Computer
    Description:
    This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    ------


    Event Type: Error
    Event Source: NETLOGON
    Event Category: None
    Event ID: 3095
    Date: 7/18/2008
    Time: 11:53:53 AM
    User: N/A
    Computer: Computer
    Description:
    This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



    ------



    Event Type: Error
    Event Source: NETLOGON
    Event Category: None
    Event ID: 3095
    Date: 7/18/2008
    Time: 9:32:11 AM
    User: N/A
    Computer: Computer
    Description:
    This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



    ------


    Event Type: Error
    Event Source: NETLOGON
    Event Category: None
    Event ID: 3095
    Date: 7/17/2008
    Time: 10:03:34 PM
    User: N/A
    Computer: Computer
    Description:
    This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    Applications

    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/18/2008
    Time: 4:49:04 PM
    User: Computer\Computer
    Computer: Computer
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    -----


    Event Type: Error
    Event Source: Application Error
    Event Category: None
    Event ID: 1000
    Date: 7/18/2008
    Time: 3:41:39 PM
    User: N/A
    Computer: Computer
    Description:
    Faulting application rfactor.exe, version 1.2.5.5, faulting module binkw32.dll, version 1.8.4.0, fault address 0x0000a69e.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 46 61 69 6c ion Fail
    0010: 75 72 65 20 20 72 66 61 ure rfa
    0018: 63 74 6f 72 2e 65 78 65 ctor.exe
    0020: 20 31 2e 32 2e 35 2e 35 1.2.5.5
    0028: 20 69 6e 20 62 69 6e 6b in bink
    0030: 77 33 32 2e 64 6c 6c 20 w32.dll
    0038: 31 2e 38 2e 34 2e 30 20 1.8.4.0
    0040: 61 74 20 6f 66 66 73 65 at offse
    0048: 74 20 30 30 30 30 61 36 t 0000a6
    0050: 39 65 0d 0a 9e..


    -----


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 3:21:53 PM
    User: N/A
    Computer: Computer
    Description:
    Cannot connect to VMX: J:\VMWare\XP Pro\Windows XP Professional.vmx



    -----


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 3:21:52 PM
    User: N/A
    Computer: Computer
    Description:
    Request by process 1788 to open '\\.\hcmon': unrecognized pid



    ----


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 3:17:57 PM
    User: N/A
    Computer: Computer
    Description:
    Request by process 4076 to open '\\.\hcmon': unrecognized pid

    -----

    Event Type: Error
    Event Source: MsiInstaller
    Event Category: None
    Event ID: 10005
    Date: 7/18/2008
    Time: 3:07:57 PM
    User: Computer\Computer
    Computer: Computer
    Description:
    Product: DHTML Editing Component -- This installer is designed for Windows Vista.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 32 45 41 38 37 30 46 {2EA870F
    0008: 41 2d 35 38 35 46 2d 34 A-585F-4
    0010: 31 38 37 2d 39 30 33 44 187-903D
    0018: 2d 43 42 39 46 46 44 32 -CB9FFD2
    0020: 31 45 32 45 30 7d 1E2E0}


    -----


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 3:04:46 PM
    User: N/A
    Computer: Computer
    Description:
    Request by process 2472 to open '\\.\hcmon': unrecognized pid



    -----


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/18/2008
    Time: 11:53:30 AM
    User: Computer\Computer
    Computer: Computer
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see

    Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    ----

    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 10:27:43 AM
    User: N/A
    Computer: Computer
    Description:
    Request by process 2816 to open '\\.\hcmon': unrecognized pid


    ----


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 10:27:26 AM
    User: N/A
    Computer: Computer
    Description:
    Cannot connect to VMX: J:\VMWare\XP Pro\Windows XP Professional.vmx



    ---


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 10:27:26 AM
    User: N/A
    Computer: Computer
    Description:
    Request by process 3732 to open '\\.\hcmon': unrecognized pid



    ---

    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/18/2008
    Time: 10:13:39 AM
    User: N/A
    Computer: Computer
    Description:
    Request by process 3024 to open '\\.\hcmon': unrecognized pid



    ---


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/18/2008
    Time: 9:31:50 AM
    User: Computer\Computer
    Computer: Computer
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see

    Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    ---


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/17/2008
    Time: 10:03:11 PM
    User: Computer\Computer
    Computer: Computer
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see

    Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



    ---


    Event Type: Error
    Event Source: vmauthd
    Event Category: None
    Event ID: 100
    Date: 7/17/2008
    Time: 9:57:06 PM
    User: N/A
    Computer: Computer
    Description:
    Request by process 1912 to open '\\.\hcmon': unrecognized pid
  6. rf6647

    rf6647 TechSpot Maniac Posts: 931

    I suggest that you create another user on the computer and determine if the new user experiences crashes, too.

    Error for netlogon, executable path '\\.\filename', and faulting program 'rfactor.exe' raise my suspicions about a troublesome network connection.

    I think you are a candidate for the 'security & web' forum @ TS. Working through a HJT log submission is my suggestion. Of course, you are expected to follow the 'preliminary malware removal procedure'.

    Executable paths and filenames in the events logs may lead you likely problem areas.
  7. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    OK will do that later tonight.

    How do I fix the network connection problem?

    Will Post this later too.
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    For Event ID: 3095, Source: NETLOGON, Description: workgroup/domain:
    As per Microsoft, this error occurs when the Netlogon service has been configured to start automatically on the stand-alone server. The Netlogon service should not be configured to start automatically on a server that is not a domain member. Configure the Netlogon service so that its startup type is set to Manual. From Event ID.net
    More information here: http://support.microsoft.com/default.aspx?scid=kb;en-us;182720
    -----------------------------------------------------------------------------------------------------
    Event ID: 1507, Source: Userenv , Description: Manual policy:
    Hold off on making any registry change for now. See if the other problems-including possible virus-can be resolved first.
    From EventID.net:
    Check de reg value for this key:
    HKLM\System\CurrentControlSet\Control\Update
    UpdateMode REG_DWORD 0ff=0, Auto=1, manual=2

    If the reg value is set to 2, you need another key or it will generate this event. The new key is:

    HKLM\System\CurrentControlSet\Control\Update
    NetworkPath REG_SZ
    The above error is indicating you are not logging off when shutting down.
    ------------------------------------------------------------------------------------------------------------------------
    Event ID: 100, Source: vmauthd, Description: (HLM took longer than expected. (time:51) )
    If you use "VMware Authorization Service", try restarting it.
    ---------------------------------------------------------------------------------------------------------------------
    FYI: the feedback for the reply on post #5 had only this:
    This message has been processed by Symantec's AntiVirus Technology.
    Unknown00000000.data was not scanned for viruses because too many nested levels of files were found.
    For more information on antivirus tips and technology, visit
    http://ses.symantec.com/

    I don't have Symantec AV so it indicates you may also have a virus problem in addition to the Workstation/domain/netwotk problem,
  9. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    OK I did the Netlogon step:
    (It was set to Automatic)

    [​IMG]

    -------

    I also did the Regedit step:

    [​IMG]

    correct? or I did something wrong?


    I disabled VMware Authorization Service. I don't need it.


    and sorry I didn't get you in the last part, your telling me to install Symantec AV and do a scan?

    if yes, I did with AVG Free 2008 and Ad-Aware Free 2008 all clean with latest updates.

    thanks for your help.
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    No, that was a copy of what came in my email for your reply with the Events. I copied it because it looked like virus scanning prevented the reply from getting through. Since I don't use Symantec, I thought it might be from your system.

    Have you rebooted since you made the changes and accessed the system function? It looks like you have WinXP Pro so you may need to check the Workstation and Group Policy settings. I have XP Home so can't help with those settings.

    Check the Event Viewer again if there is trouble. If you need to leave Errors, I only need one copy of an Error with same ID#, Source and Description.
  11. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    oh ok.

    Yes I rebooted PC, so far its good. no errors or anything in event viewer :)

    hope it keeps up, I'll leave the PC open for 2 days and do my normal work to confirm.

    thanks.
     
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Yeah! Let me know if problems begin again.
  13. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    PC is working great until now :)

    no freezing/restarts so far.

    But I just got a warning in the System Event:

    Event Type: Warning
    Event Source: Tcpip
    Event Category: None
    Event ID: 4226
    Date: 7/19/2008
    Time: 12:29:17 PM
    User: N/A
    Computer: Computer
    Description:
    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 00 00 00 00 01 00 54 00 ......T.
    0008: 00 00 00 00 82 10 00 80 ....‚..€
    0010: 01 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........


    is it ok?
    cause before I cleared the events I had allot like this warning.
  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Here is a 'translation' of what the Event means- from EventID- I can't say it any better, so I will quote:
    Warnings will become Error Events if they are not resolved. You can ignore this 'Warning'.
  15. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    uh oh...

    Event Type: Error
    Event Source: Application Hang
    Event Category: (101)
    Event ID: 1002
    Date: 7/19/2008
    Time: 8:03:08 PM
    User: N/A
    Computer: Computer
    Description:
    Hanging application Photoshop.exe, version 10.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 48 61 6e 67 ion Hang
    0010: 20 20 50 68 6f 74 6f 73 Photos
    0018: 68 6f 70 2e 65 78 65 20 hop.exe
    0020: 31 30 2e 30 2e 30 2e 30 10.0.0.0
    0028: 20 69 6e 20 68 75 6e 67 in hung
    0030: 61 70 70 20 30 2e 30 2e app 0.0.
    0038: 30 2e 30 20 61 74 20 6f 0.0 at o
    0040: 66 66 73 65 74 20 30 30 ffset 00
    0048: 30 30 30 30 30 30 000000
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    If you are getting the Photoshop Application "Hang when you try to shut down. go into the Start menu and uncheck any Photoshop entries. The program does not need to start when you boot. If it doesn't, then it can't 'hang' when you shut down:

    Start> Run> type in ''msconfig' without the quotes> Selective Start-up> Startup tab> uncheck the process that is for this> Apply> OK.

    Reboot> Close the nag message that comes up after checking 'don't show this message again'.

    NOTE: uncheck any Adobe processes also. The "only" processes you need on Start are the antivirus program, firewall, touchpad for laptop and network process if on network. ALL else can be called up as needed.
  17. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    I Didn't find anything for Adobe Photoshop in the Msconfig startup.

    but yes, when I shutdown or restart PC..it takes AGES!

    -------------------------------------------------------

    and...

    uuh ooooooh :|


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/20/2008
    Time: 5:25:43 PM
    User: H
    Computer: computer
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
  18. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    The Photoshop program can't hang at shut down unless it's running. Are you reporting this Error as occuring at shutdown? Did you access Photoshop and not close it when finished?

    I went over this same Error in post #8. Some device you have isn't logging off of the server. Do you have something connecting to the Windows Server?

    Please don't just throw an Error Event at me. You will drive yourself and possibly me, nuts! I need to know "why" you're reporting the Error. What were the circumstances that led you to look in the Event Viewer? Or more simply put, what happened?
     
  19. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    I don't think I have something that connects to windows server.
    Could be from VMware or something?

    When I open Photoshop, sometimes it hangs and causes problems for the PC, like removing the blue side bar from folders, and make lots of icons look like this [​IMG] and everything gets slow, so I have to restart the PC and it take ages to do so.

    Note: when I click on Start > Turn Off.
    nothing appears..so I have to open task manager to restart/shutdown pc when this happens.


    this happened to me a few mins ago.

    Errors:

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7011
    Date: 7/20/2008
    Time: 8:55:15 PM
    User: N/A
    Computer: computer.
    Description:
    Timeout (30000 milliseconds) waiting for a transaction response from the libusbd service.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    -----


    Event Type: Error
    Event Source: DCOM
    Event Category: None
    Event ID: 10005
    Date: 7/21/2008
    Time: 2:38:46 PM
    User: computer.
    Computer: computer.
    Description:
    DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service Avg7Alrt with arguments "-Service" in order to run the server:
    {3486DF65-1D90-406A-A072-30629910F113}

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    ----


    Event Type: Error
    Event Source: DCOM
    Event Category: None
    Event ID: 10005
    Date: 7/21/2008
    Time: 2:38:51 PM
    User: computer.
    Computer: computer.
    Description:
    DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service Avg7Alrt with arguments "-Service" in order to run the server:
    {3486DF65-1D90-406A-A072-30629910F113}

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    ----

    Event Type: Error
    Event Source: DCOM
    Event Category: None
    Event ID: 10005
    Date: 7/21/2008
    Time: 2:38:51 PM
    User: computer.
    Computer: computer.
    Description:
    DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service Avg7Alrt with arguments "-Service" in order to run the server:
    {3486DF65-1D90-406A-A072-30629910F113}

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    ---


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/21/2008
    Time: 1:39:16 PM
    User: computer.
    Computer: computer.
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


    ----


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1507
    Date: 7/21/2008
    Time: 2:47:20 PM
    User: computer.
    Computer: computer.
    Description:
    This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
  20. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    I have already discussed Event ID1507- see post #8. As previously mentioned, if there are multiple Errors with the same ID#, the same Source and the same Description, I only need a copy of one. You have copies 3 Events#10005, exactly the same.

    For Event#10005, Source DCOM:
    Control Panel> Administrative Tools> Services> right click on DCOM> Properties> ser Startup to Automatic> Start the Service.

    But what is the problem is that it appears the AVG Anti-Virus (Avg7Alrt) may not be updating. And I am concerned about the number '7'. The most current AVG is v8, and the previous version is v7.5. You need to check your AVG AV, see what the status is and try to update it.

    Please do not re-post the Event #1507 or #10005 if the Source and Descriptions are the same as above.

    As for Photoshop itself you can try an uninstall/reinstall and see if that makes a difference.
  21. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    can't find just DCOM

    there's only (DCOM Server Process Launcher) and it's already set to Automatic and started up.
  22. rf6647

    rf6647 TechSpot Maniac Posts: 931

    What is the status for the version of AVG AV? As indicated by the description for the error, the service depends on associated drivers. At some point in the life cycle of software, support ends - servers are turned off. What do you expect to lose by updating your AV protection?
  23. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    I just downloaded AVG 8.

    Before....I disabled AVG 7 (Services and Startup) for a reason.

    but It's working now.
  24. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    This completes the review of all current, pertinent Error Events:

    Source help from EventID.net
  25. husamn

    husamn Newcomer, in training Topic Starter Posts: 90

    PC just freezed moments ago.

    nothing showed in the Event viewer.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.