TechSpot - PC Technology News and Analysis

This is driving me so damn crazy!

I checked the RAM, HD, Motherboard, Viruses.
ALL GOOD\CLEAN!

but it still freezes and restarts every time!

No over heating problems, room temp is very good.

I cannot complete any work I do on this PC.


I attached the log files from system/application events.
Not a long log file, cause I cleared from before and started new session yesterday so it wont be long for you to check.

pc restarted like 7 mins ago, errors should be in the logfiles.

please I need urgent help.

EDIT: Im using Windows XP Professional.

Attached Files

Husamn Logs.zip (3.7 KB, 5 views)

Attempt to expand zip attachment received error message: damaged file.

If problem is caused by new applications or updated drivers, use System Restore from an earlier date. What did you see in the events logs tied to the crash? System error? Application error? Hardware?

Zip file is working, I just tested it.
please download again.

don't think it's from any applications, I also booted in Safe Mode, and left pc open without doing anything to it, and it froze after some time.

not allot of errors in the event log, but lots of "infomation" and few "warning"

I was also unable to open the files. I extracted, but Apps and System logs wouldn't open. You shouldn't need to many Error events that you need to put them in a zip file. Here's what to do:
Right click on the Error> Properties> Click on the Copy icon below the down arrow on the right> Paste here (Ctrl V)

Note please: Ignore Warnings. Ignore Information Events. You are looking for the Error(s) that occurs at time of freeze and reboot. If you have multiple Errors with same ID#, same Source and same Description, you only need to copy one. And you can remove the lines of code following Description.

Set up Error as follows using your information. A copy will paste like this:
Event Type: Error
Event Source: Your information
Event Category: None
Event ID: Your information
Date: 7/18/2008
Time: 11:35:22 AM
User: Your information
Computer: Your computer
Description:
Your description

This is the information we need.

Right off I'll ask if you have an AMD processor and if you recently got the SP3 Windows Update. IF you did, this is the problem. Go into Add/Remove Programs in the Control Panel and uninstall KB936929

I use Intel Pentium 4, and didn't download SP3, I have this problem for a long time.

Event Logs:

System

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 7/18/2008
Time: 4:49:24 PM
User: N/A
Computer: Computer
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------


Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 7/18/2008
Time: 11:53:53 AM
User: N/A
Computer: Computer
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



------



Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 7/18/2008
Time: 9:32:11 AM
User: N/A
Computer: Computer
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



------


Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 7/17/2008
Time: 10:03:34 PM
User: N/A
Computer: Computer
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Applications

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/18/2008
Time: 4:49:04 PM
User: Computer\Computer
Computer: Computer
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


-----


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 7/18/2008
Time: 3:41:39 PM
User: N/A
Computer: Computer
Description:
Faulting application rfactor.exe, version 1.2.5.5, faulting module binkw32.dll, version 1.8.4.0, fault address 0x0000a69e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 72 66 61 ure rfa
0018: 63 74 6f 72 2e 65 78 65 ctor.exe
0020: 20 31 2e 32 2e 35 2e 35 1.2.5.5
0028: 20 69 6e 20 62 69 6e 6b in bink
0030: 77 33 32 2e 64 6c 6c 20 w32.dll
0038: 31 2e 38 2e 34 2e 30 20 1.8.4.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 61 36 t 0000a6
0050: 39 65 0d 0a 9e..


-----


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 3:21:53 PM
User: N/A
Computer: Computer
Description:
Cannot connect to VMX: J:\VMWare\XP Pro\Windows XP Professional.vmx



-----


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 3:21:52 PM
User: N/A
Computer: Computer
Description:
Request by process 1788 to open '\\.\hcmon': unrecognized pid



----


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 3:17:57 PM
User: N/A
Computer: Computer
Description:
Request by process 4076 to open '\\.\hcmon': unrecognized pid

-----

Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 10005
Date: 7/18/2008
Time: 3:07:57 PM
User: Computer\Computer
Computer: Computer
Description:
Product: DHTML Editing Component -- This installer is designed for Windows Vista.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 32 45 41 38 37 30 46 {2EA870F
0008: 41 2d 35 38 35 46 2d 34 A-585F-4
0010: 31 38 37 2d 39 30 33 44 187-903D
0018: 2d 43 42 39 46 46 44 32 -CB9FFD2
0020: 31 45 32 45 30 7d 1E2E0}


-----


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 3:04:46 PM
User: N/A
Computer: Computer
Description:
Request by process 2472 to open '\\.\hcmon': unrecognized pid



-----


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/18/2008
Time: 11:53:30 AM
User: Computer\Computer
Computer: Computer
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see

Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----

Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 10:27:43 AM
User: N/A
Computer: Computer
Description:
Request by process 2816 to open '\\.\hcmon': unrecognized pid


----


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 10:27:26 AM
User: N/A
Computer: Computer
Description:
Cannot connect to VMX: J:\VMWare\XP Pro\Windows XP Professional.vmx



---


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 10:27:26 AM
User: N/A
Computer: Computer
Description:
Request by process 3732 to open '\\.\hcmon': unrecognized pid



---

Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/18/2008
Time: 10:13:39 AM
User: N/A
Computer: Computer
Description:
Request by process 3024 to open '\\.\hcmon': unrecognized pid



---


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/18/2008
Time: 9:31:50 AM
User: Computer\Computer
Computer: Computer
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see

Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


---


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/17/2008
Time: 10:03:11 PM
User: Computer\Computer
Computer: Computer
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see

Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



---


Event Type: Error
Event Source: vmauthd
Event Category: None
Event ID: 100
Date: 7/17/2008
Time: 9:57:06 PM
User: N/A
Computer: Computer
Description:
Request by process 1912 to open '\\.\hcmon': unrecognized pid

I suggest that you create another user on the computer and determine if the new user experiences crashes, too.

Error for netlogon, executable path '\\.\filename', and faulting program 'rfactor.exe' raise my suspicions about a troublesome network connection.

I think you are a candidate for the 'security & web' forum @ TS. Working through a HJT log submission is my suggestion. Of course, you are expected to follow the 'preliminary malware removal procedure'.

Executable paths and filenames in the events logs may lead you likely problem areas.

OK will do that later tonight.

How do I fix the network connection problem?

Will Post this later too.

For Event ID: 3095, Source: NETLOGON, Description: workgroup/domain:
As per Microsoft, this error occurs when the Netlogon service has been configured to start automatically on the stand-alone server. The Netlogon service should not be configured to start automatically on a server that is not a domain member. Configure the Netlogon service so that its startup type is set to Manual. From Event ID.net
More information here: http://support.microsoft.com/default...b;en-us;182720
-----------------------------------------------------------------------------------------------------
Event ID: 1507, Source: Userenv , Description: Manual policy:
Hold off on making any registry change for now. See if the other problems-including possible virus-can be resolved first.
From EventID.net:
Check de reg value for this key:
HKLM\System\CurrentControlSet\Control\Update
UpdateMode REG_DWORD 0ff=0, Auto=1, manual=2

If the reg value is set to 2, you need another key or it will generate this event. The new key is:

HKLM\System\CurrentControlSet\Control\Update
NetworkPath REG_SZ
The above error is indicating you are not logging off when shutting down.
------------------------------------------------------------------------------------------------------------------------
Event ID: 100, Source: vmauthd, Description: (HLM took longer than expected. (time:51) )
If you use "VMware Authorization Service", try restarting it.
---------------------------------------------------------------------------------------------------------------------
FYI: the feedback for the reply on post #5 had only this:
This message has been processed by Symantec's AntiVirus Technology.
Unknown00000000.data was not scanned for viruses because too many nested levels of files were found.
For more information on antivirus tips and technology, visit
http://ses.symantec.com/

I don't have Symantec AV so it indicates you may also have a virus problem in addition to the Workstation/domain/netwotk problem,

OK I did the Netlogon step:
(It was set to Automatic)



-------

I also did the Regedit step:



correct? or I did something wrong?


I disabled VMware Authorization Service. I don't need it.


and sorry I didn't get you in the last part, your telling me to install Symantec AV and do a scan?

if yes, I did with AVG Free 2008 and Ad-Aware Free 2008 all clean with latest updates.

thanks for your help.

No, that was a copy of what came in my email for your reply with the Events. I copied it because it looked like virus scanning prevented the reply from getting through. Since I don't use Symantec, I thought it might be from your system.

Have you rebooted since you made the changes and accessed the system function? It looks like you have WinXP Pro so you may need to check the Workstation and Group Policy settings. I have XP Home so can't help with those settings.

Check the Event Viewer again if there is trouble. If you need to leave Errors, I only need one copy of an Error with same ID#, Source and Description.

oh ok.

Yes I rebooted PC, so far its good. no errors or anything in event viewer

hope it keeps up, I'll leave the PC open for 2 days and do my normal work to confirm.

thanks.

Yeah! Let me know if problems begin again.

PC is working great until now

no freezing/restarts so far.

But I just got a warning in the System Event:

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 7/19/2008
Time: 12:29:17 PM
User: N/A
Computer: Computer
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


is it ok?
cause before I cleared the events I had allot like this warning.

Here is a 'translation' of what the Event means- from EventID- I can't say it any better, so I will quote:
Warnings will become Error Events if they are not resolved. You can ignore this 'Warning'.

uh oh...

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 7/19/2008
Time: 8:03:08 PM
User: N/A
Computer: Computer
Description:
Hanging application Photoshop.exe, version 10.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 50 68 6f 74 6f 73 Photos
0018: 68 6f 70 2e 65 78 65 20 hop.exe
0020: 31 30 2e 30 2e 30 2e 30 10.0.0.0
0028: 20 69 6e 20 68 75 6e 67 in hung
0030: 61 70 70 20 30 2e 30 2e app 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 30 30 30 30 30 000000

If you are getting the Photoshop Application "Hang when you try to shut down. go into the Start menu and uncheck any Photoshop entries. The program does not need to start when you boot. If it doesn't, then it can't 'hang' when you shut down:

Start> Run> type in ''msconfig' without the quotes> Selective Start-up> Startup tab> uncheck the process that is for this> Apply> OK.

Reboot> Close the nag message that comes up after checking 'don't show this message again'.

NOTE: uncheck any Adobe processes also. The "only" processes you need on Start are the antivirus program, firewall, touchpad for laptop and network process if on network. ALL else can be called up as needed.

I Didn't find anything for Adobe Photoshop in the Msconfig startup.

but yes, when I shutdown or restart PC..it takes AGES!

-------------------------------------------------------

and...

uuh ooooooh :|


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/20/2008
Time: 5:25:43 PM
User: H
Computer: computer
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The Photoshop program can't hang at shut down unless it's running. Are you reporting this Error as occuring at shutdown? Did you access Photoshop and not close it when finished?

I went over this same Error in post #8. Some device you have isn't logging off of the server. Do you have something connecting to the Windows Server?

Please don't just throw an Error Event at me. You will drive yourself and possibly me, nuts! I need to know "why" you're reporting the Error. What were the circumstances that led you to look in the Event Viewer? Or more simply put, what happened?

I don't think I have something that connects to windows server.
Could be from VMware or something?

When I open Photoshop, sometimes it hangs and causes problems for the PC, like removing the blue side bar from folders, and make lots of icons look like this and everything gets slow, so I have to restart the PC and it take ages to do so.

Note: when I click on Start > Turn Off.
nothing appears..so I have to open task manager to restart/shutdown pc when this happens.

this happened to me a few mins ago.

Errors:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 7/20/2008
Time: 8:55:15 PM
User: N/A
Computer: computer.
Description:
Timeout (30000 milliseconds) waiting for a transaction response from the libusbd service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


-----


Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 7/21/2008
Time: 2:38:46 PM
User: computer.
Computer: computer.
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service Avg7Alrt with arguments "-Service" in order to run the server:
{3486DF65-1D90-406A-A072-30629910F113}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----


Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 7/21/2008
Time: 2:38:51 PM
User: computer.
Computer: computer.
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service Avg7Alrt with arguments "-Service" in order to run the server:
{3486DF65-1D90-406A-A072-30629910F113}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 7/21/2008
Time: 2:38:51 PM
User: computer.
Computer: computer.
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service Avg7Alrt with arguments "-Service" in order to run the server:
{3486DF65-1D90-406A-A072-30629910F113}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


---


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/21/2008
Time: 1:39:16 PM
User: computer.
Computer: computer.
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----


Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1507
Date: 7/21/2008
Time: 2:47:20 PM
User: computer.
Computer: computer.
Description:
This computer is in manual policy mode, but the policy file cannot be found. Windows is logging you on without applying any policy. Return value (The system cannot find the file specified. ).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I have already discussed Event ID1507- see post #8. As previously mentioned, if there are multiple Errors with the same ID#, the same Source and the same Description, I only need a copy of one. You have copies 3 Events#10005, exactly the same.

For Event#10005, Source DCOM:
Control Panel> Administrative Tools> Services> right click on DCOM> Properties> ser Startup to Automatic> Start the Service.

But what is the problem is that it appears the AVG Anti-Virus (Avg7Alrt) may not be updating. And I am concerned about the number '7'. The most current AVG is v8, and the previous version is v7.5. You need to check your AVG AV, see what the status is and try to update it.

Please do not re-post the Event #1507 or #10005 if the Source and Descriptions are the same as above.

As for Photoshop itself you can try an uninstall/reinstall and see if that makes a difference.