Excessive Hard drive access after defragmentation

  • Thread starter Thread starter Harold A. Climer
  • Start date Start date
H

Harold A. Climer

I have an HP pavilion A1520N computer running Windows XP MCE with SP3
installed.
I have two hard drives installed with partitions C and D on the master
drive and K and L on the slave drive. I also have a Maxtor USB I TB
drive as the O drive.
The D drive is the system restore drive.
In the last week I decided to de fragment all my drives since it has
been since Christmas vacation since I did it last.
After doing this I noticed that there was a large increase in disk
access compared to before de fragmentation. At times the little yellow
disk activity light is on almost constantly on and for long periods of
time.
Originally I had my Page File on Drive C (400GB and about half full).
Today I moved the page file to Drive K( 300GB with about 50GB of files
on it). As per Microsoft article on Virtual memory etc.
I also noticed that since de fragmentation it seems as if the
computer sometimes locks up. By this I mean that after closing a
program it takes quite a while for another program to respond to a
mouse click to get it started or to access the Start menu, etc.
Harold A Climer
Dept. Of Physics Geology, and Astronomy
U.T, Chattanooga
Rm. 406A Engineering, Math & Computer Science Building
615 McCallie Ave. Chattanooga TN 37403
(e-mail address removed)
 
Harold A. Climer said:
I have an HP pavilion A1520N computer running Windows XP MCE with SP3
installed.
I have two hard drives installed with partitions C and D on the master
drive and K and L on the slave drive. I also have a Maxtor USB I TB
drive as the O drive.
The D drive is the system restore drive.
In the last week I decided to de fragment all my drives since it has
been since Christmas vacation since I did it last.
After doing this I noticed that there was a large increase in disk
access compared to before de fragmentation. At times the little yellow
disk activity light is on almost constantly on and for long periods of
time.
Originally I had my Page File on Drive C (400GB and about half full).
Today I moved the page file to Drive K( 300GB with about 50GB of files
on it). As per Microsoft article on Virtual memory etc.
I also noticed that since de fragmentation it seems as if the
computer sometimes locks up. By this I mean that after closing a
program it takes quite a while for another program to respond to a
mouse click to get it started or to access the Start menu, etc.
Harold A Climer
Dept. Of Physics Geology, and Astronomy
U.T, Chattanooga
Rm. 406A Engineering, Math & Computer Science Building
615 McCallie Ave. Chattanooga TN 37403
(e-mail address removed)
Click to expand...


It could just be pure co-incidence. Have you run 'error checking' on the
drives?

http://support.microsoft.com/kb/315265
 
Harold,

How much memory (Ram) does your PC have?
What is the size of your pagefile on the K: drive?

Also check the health of your hard drives:
HD Tune, provides drive info and has an option to test your drive.
http://www.hdtune.com/

Also SpeedFan has an online health analysis feature
(SMART tab) for hard drives. It will show how your drives
compares with other drives of the same make and model.
http://www.almico.com/speedfan.php
 
Harold

My reaction is that your problem is more likely related to something
other than defragmenting.

What do you mean by "D drive is the system restore drive"? If you mean
it is a clone of C then it may no longer be of value given you have
moved the pagefile or rather if used it the pagefile will revert to C.

BTW system restore should only be monitoring C. In particular make sure
it does not monitor the Maxtor USB drive.

Did you run Disk CleanUp ( or cCleaner ) before defragmenting?

When you moved the pagefile did you leave a small pagefile say 50 mb on
C?
http://www.aumha.org/win5/a/xpvm.htm

Is your system free from error?

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Does the CPU activity show up in Task Manager? What process is involved?


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
 
you may want to
open the task manager

and sort the processes
by cpu.

the process that is keeping
your disks busy will likely
show up as using high
cpu.

if you end those particular
tasks, you might end the
disk activity.


--

db·´¯`·...¸><)))º>
DatabaseBen, Retired Professional
- Systems Analyst
- Database Developer
- Accountancy
- Veteran of the Armed Forces
- Microsoft Partner
- @hotmail.com
~~~~~~~~~~"share the nirvana" - dbZen
 
Harold

My reaction is that your problem is more likely related to something
other than defragmenting.

What do you mean by "D drive is the system restore drive"? If you mean
it is a clone of C then it may no longer be of value given you have
moved the pagefile or rather if used it the pagefile will revert to C.

BTW system restore should only be monitoring C. In particular make sure
it does not monitor the Maxtor USB drive.

Did you run Disk CleanUp ( or cCleaner ) before defragmenting?

When you moved the pagefile did you leave a small pagefile say 50 mb on
C?
http://www.aumha.org/win5/a/xpvm.htm



Is your system free from error?





Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Does the CPU activity show up in Task Manager? What process is involved?
Click to expand...


The system recovery drive is the software to reinstall all the
computer software, Operating System, etc. that came with the computer
when I bought it. It is an Hewlett Packard A1520 with XP MCE.

I have checked the hard rive for errors using chkdsk and several other
program and they report no errors.

To describe the situation a bit more clearly, the excess disk access
is what a friend of mine called it when he listened to it as "disk
chatter" as if the disk drive was looking for a file.etc and could not
fined it. While this is happening there is no response to mouse clicks
on any icon on the desktop or the start button either. The taskbar
also locks up too during the disk activity.


Anther question: How does one know which processes can be closed down
and not harm the operation of my computer?
It was a lot easier to shut down processes in Windows 98 and 3.1.
What are the minimum processes I would;d need to have in XP?
Harold A Climer
Dept. Of Physics Geology, and Astronomy
U.T, Chattanooga
Rm. 406A Engineering, Math & Computer Science Building
615 McCallie Ave. Chattanooga TN 37403
(e-mail address removed)
 
I have an HP pavilion A1520N computer running Windows XP MCE with SP3
installed.
I have two hard drives installed with partitions C and D on the master
drive and K and L on the slave drive. I also have a Maxtor USB I TB
drive as the O drive.
The D drive is the system restore drive.
In the last week I decided to de fragment all my drives since it has
been since Christmas vacation since I did it last.
After doing this I noticed that there was a large increase in disk
access compared to before de fragmentation. At times the little yellow
disk activity light is on almost constantly on and for long periods of
time.
Originally I had my Page File on Drive C (400GB and about half full).
Today I moved the page file to Drive K( 300GB with about 50GB of files
on it). As per Microsoft article on Virtual memory etc.
I also noticed that since de fragmentation it seems as if the
computer sometimes locks up. By this I mean that after closing a
program it takes quite a while for another program to respond to a
mouse click to get it started or to access the Start menu, etc.
Harold A Climer
Dept. Of Physics Geology, and Astronomy
U.T, Chattanooga
Rm. 406A Engineering, Math & Computer Science Building
615 McCallie Ave. Chattanooga TN 37403
(e-mail address removed)
Click to expand...


I just now noticed something even stranger. After de fragmenting my C:
drive on Tuesday the % fragmentation was less the 1%. In less than
three days it is now up to 25%. There must be something going on.
The only thing that has changed is the de fragmenting. I have not
installed any new software of note, only the utilities mentioned in
this thread used to check for disk errors.
The disk chatter must be doing something.
Harold A Climer
Dept. Of Physics Geology, and Astronomy
U.T, Chattanooga
Rm. 406A Engineering, Math & Computer Science Building
615 McCallie Ave. Chattanooga TN 37403
(e-mail address removed)
 
AV updates, System Restore points, Log files, Hibernation file.
Click to expand...

I have the latest update for Norton Antivirus. I tried to get back to
before I defragmented the Hard Drive and it said it couldn't do it.
Does something need to be turned off so that the restore works?
What log files.?
Hibernation file?
Does the description sound as if the HD it self may be going south?













































Harold A. Climer
Dept Of Physics Geology & Astronomy
U.T. Chattanooga
Room 406A Engineering,Math & Computer Sicence Building
615 McCallie Ave.
Chattanooga TN 37403
(e-mail address removed)
 
No System Restore should work if you
have a valid restore point file. But don't
count on System Restore to fix the problem.

Log Files.
Windows Event logs.
AV software scan results log files.

Hibernation file:
Located in the root of your Windows partition.
typically C:\ and only present if you have hibernation
turned on.

Hard Drive S.M.A.R.T. Check:
HD Tune: http://www.hdtune.com/
Speedfan: (has an online report of your drives fitness:
http://www.almico.com/speedfan.php

Drive Monitoring Software:
Active Hard Disk Monitor: http://www.disk-monitor.com/

Disk Diagnostic Utilities from:
Western Digital's Data LifeGuard Diagnostics
http://support.wdc.com/download/?cxml=n&pid=999&swid=3

Seagate's SeaTools
http://www.seagate.com/www/en-us/support/downloads/seatools

Maxtor (Now Seagate SeaTools)
http://www.seagate.com/ww/v/index.j...toid=720bd20cacdec010VgnVCM100000dd04090aRCRD

Fujitsu's Utilities
http://www.fujitsu.com/us/services/computing/storage/hdd/support/utilities.html

Samsung's Disk manager software
http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm

Hitachi's Drive Fitness Test software
http://www.hgst.com/hdd/support/download.htm#DFT
 
No System Restore should work if you
have a valid restore point file. But don't
count on System Restore to fix the problem.

Log Files.
Windows Event logs.
AV software scan results log files.

Hibernation file:
Located in the root of your Windows partition.
typically C:\ and only present if you have hibernation
turned on.

Hard Drive S.M.A.R.T. Check:
HD Tune: http://www.hdtune.com/
Speedfan: (has an online report of your drives fitness:
http://www.almico.com/speedfan.php
Click to expand...


I tried Disk Diagnostic Utilities from:
Western Digital's Data LifeGuard Diagnostics
and after about 8 hours it found no errors or bad sectors.

I used event logger and found some of the following errors or
warnings.


ACEEventLog
1)
Windows Operating System
ID: 4101
Source: Ci
Version: 5.0
Component: Application Event Log
Symbolic Name: MSG_CI_SERVICE_TOO_MANY_BLOCKS
Message: The content index filter for file "%1" generated
content data more than %2 times the file's size.
The content index filter for file "c:\windows\internet
logs\zalog2009.02.07.txt" generated content data more than 8
times the file's size.

2)
Product: Windows Operating System
ID: 1015
Source: EvntAgnt
Version: 5.2
Symbolic Name: SNMPELEA_NO_REGISTRY_TRACE_LEVEL_PARAMETER
Message: TraceLevel parameter not located in registry; Default
trace level used is %1.

Explanation

Debug tracing is turned off. This is the default condition of the
system. Debug tracing should only be turned on when you are debugging
software.

These error events will continue to be logged when you restart the
computer, unless you reconfigure the Evntagnt.dl


3)Type: Error
Date: 7/13/2009
Time: 5:48:09 PM
Event: 259
Source: ColdFusion MX Application Server
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
The ColdFusion MX Application Server service could not be started.
Check the server "default" log files for more information.

4)Type: Error
Date: 7/13/2009
Time: 5:47:31 PM
Event: 4
Source: Media Center Receiver
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
TV tuner malfunction. (0xc0040597) Dazzle DVC90 TVTuner

5)Type: Warning
Date: 7/13/2009
Time: 5:43:48 PM
Event: 1517
Source: Userenv
Category: None
User: \SYSTEM
Computer: 732REDHILLFR
Description:
Windows saved user 732REDHILLFR\HP_Administrator registry while an
application or service was still using the registry during log off.
The memory used by the user's registry has not been freed. The
registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.

6)Type: Error
Date: 7/13/2009
Time: 12:00:39 PM
Event: 1002
Source: MsiInstaller
Category: None
User: 732REDHILLFR\HP_Administrator
Computer: 732REDHILLFR
Description:
Unexpected or missing value (name: 'BeavCom', value: '
Norton_Utilities') in key
'HKLM\Products\AB7687A6AC7B9CC4CABA58AB6468E55E\Features'




Lots of these
7)Type: Error
Date: 7/13/2009
Time: 8:47:05 AM
Event: 20
Source: Google Update
Category: None
User: \SYSTEM
Computer: 732REDHILLFR
Description:
The description for Event ID ( 20 ) in Source ( Google Update ) could
not be found. It contains the following insertion string(s): .
Network Request Error.
Error: 0x80040801. Http status code: 0.
Url=https://tools.google.com/service/update2
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80040801. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80040801. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80040801. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x800

8)Type: Error
Date: 7/10/2009
Time: 8:04:08 AM
Event: 1002
Source: Application Hang
Category: (101)
User: N/A
Computer: 732REDHILLFR
Description:
Hanging application Weather.exe, version 6.7.0.10, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.


9)Type: Error
Date: 7/10/2009
Time: 8:03:00 AM
Event: 1000
Source: Application Error
Category: (100)
User: N/A
Computer: 732REDHILLFR
Description:
Faulting application CCSVCHST.EXE, version 107.0.6.4, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.


APPLICATION LOG

1) Type: Warning
Date: 7/13/2009
Time: 6:10:00 PM
Event: 4101
Source: Ci
Category: CI Service
User: N/A
Computer: 732REDHILLFR
Description:
The content index filter for file "c:\windows\internet
logs\zalog2009.02.07.txt" generated content data more than 8
times the file's size.

2)Type: Warning
Date: 7/13/2009
Time: 5:49:44 PM
Event: 1015
Source: EvntAgnt
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
TraceLevel parameter not located in registry;
Default trace level used is 32.

3)Type: Error
Date: 7/13/2009
Time: 5:48:09 PM
Event: 259
Source: ColdFusion MX Application Server
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
The ColdFusion MX Application Server service could not be started.
Check the server "default" log files for more information.


4)Type: Error
Date: 7/13/2009
Time: 5:47:31 PM
Event: 4
Source: Media Center Receiver
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
TV tuner malfunction. (0xc0040597) Dazzle DVC90 TVTuner



5)Type: Warning
Date: 7/13/2009
Time: 5:43:48 PM
Event: 1517
Source: Userenv
Category: None
User: \SYSTEM
Computer: 732REDHILLFR
Description:
Windows saved user 732REDHILLFR\HP_Administrator registry while an
application or service was still using the registry during log off.
The memory used by the user's registry has not been freed. The
registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.



6_Type: Error
Date: 7/13/2009
Time: 12:00:39 PM
Event: 1002
Source: MsiInstaller
Category: None
User: 732REDHILLFR\HP_Administrator
Computer: 732REDHILLFR
Description:
Unexpected or missing value (name: 'BeavCom', value: '
Norton_Utilities') in key
'HKLM\Products\AB7687A6AC7B9CC4CABA58AB6468E55E\Features'




7)Type: Error
Date: 7/13/2009
Time: 7:47:05 AM
Event: 20
Source: Google Update
Category: None
User: \SYSTEM
Computer: 732REDHILLFR
Description:
The description for Event ID ( 20 ) in Source ( Google Update ) could
not be found. It contains the following insertion string(s): .
Network Request Error.
Error: 0x80040801. Http status code: 0.
Url=https://tools.google.com/service/update2
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80040801. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80040801. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying WinHTTP.
Send request returned 0x80040801. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80040801. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x800



8)Type: Error
Date: 7/12/2009
Time: 8:49:54 PM
Event: 1002
Source: Application Hang
Category: (101)
User: N/A
Computer: 732REDHILLFR
Description:
Hanging application Weather.exe, version 6.7.0.10, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.



9)Type: Error
Date: 7/12/2009
Time: 11:56:13 AM
Event: 1027
Source: Speed Disk service
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
The description for Event ID ( 1027 ) in Source ( Speed Disk service )
could not be found. It contains the following insertion string(s): .
C:



10)Type: Error
Date: 7/11/2009
Time: 11:35:03 AM
Event: 8
Source: crypt32
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
Failed auto update retrieval of third-party root list sequence number
from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested
operation.


OSESSION


1)Type: Error
Date: 6/26/2009
Time: 12:58:11 AM
Event: 7001
Source: Microsoft Office 12 Sessions
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session
lasted 282 seconds with 240 seconds of active time. This session
ended with a crash.


2)Type: Warning
Date: 6/21/2009
Time: 1:21:45 PM
Event: 7003
Source: Microsoft Office 12 Sessions
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session
was terminated unexpectedly.


SYSTEM


1)Type: Warning
Date: 7/14/2009
Time: 11:05:20 AM
Event: 51
Source: Disk
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
An error was detected on device \Device\Harddisk7\D during a paging
operation.
Note: several of these occured, but none of the software tools I used
found any errors.


2)Type: Warning
Date: 7/14/2009
Time: 10:03:28 AM
Event: 4226
Source: Tcpip
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
TCP/IP has reached the security limit imposed on the number of
concurrent TCP connect attempts.



3)Type: Warning
Date: 7/13/2009
Time: 10:21:00 PM
Event: 36
Source: W3SVC
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
The server failed to load application '/LM/W3SVC/1/ROOT'. The error
was 'Class not registered
'.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.


4)Type: Error
Date: 7/13/2009
Time: 5:49:33 PM
Event: 7026
Source: Service Control Manager
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
The following boot-start or system-start driver(s) failed to load:
ftsata2


5)Type: Error
Date: 7/13/2009
Time: 10:16:07 AM
Event: 402
Source: smtpsvc
Category: None
User: N/A
Computer: 732REDHILLFR
Description:
Virtual Server 1:
212.180.41.254 maximum number of connections has been reached.
Connection being closed.
There about 50 of these errors recorded






































Drive Monitoring Software:
Active Hard Disk Monitor: http://www.disk-monitor.com/

Disk Diagnostic Utilities from:
Western Digital's Data LifeGuard Diagnostics
http://support.wdc.com/download/?cxml=n&pid=999&swid=3

Seagate's SeaTools
http://www.seagate.com/www/en-us/support/downloads/seatools

Maxtor (Now Seagate SeaTools)
http://www.seagate.com/ww/v/index.j...toid=720bd20cacdec010VgnVCM100000dd04090aRCRD

Fujitsu's Utilities
http://www.fujitsu.com/us/services/computing/storage/hdd/support/utilities.html

Samsung's Disk manager software
http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm

Hitachi's Drive Fitness Test software
http://www.hgst.com/hdd/support/download.htm#DFT
Click to expand...
Harold A Climer
Dept. Of Physics Geology, and Astronomy
U.T, Chattanooga
Rm. 406A Engineering, Math & Computer Science Building
615 McCallie Ave. Chattanooga TN 37403
(e-mail address removed)
 
ACEEventLog
1)
Windows Operating System
ID: 4101
Source: Ci
Version: 5.0
Component: Application Event Log
Symbolic Name: MSG_CI_SERVICE_TOO_MANY_BLOCKS
Message: The content index filter for file "%1" generated
content data more than %2 times the file's size.
The content index filter for file "c:\windows\internet
logs\zalog2009.02.07.txt" generated content data more than 8
times the file's size.
See:
http://www.microsoft.com/technet/su...em&ProdVer=5.0&EvtID=4101&EvtSrc=Ci&LCID=1033


2)
Product: Windows Operating System
ID: 1015
Source: EvntAgnt
Version: 5.2
Symbolic Name: SNMPELEA_NO_REGISTRY_TRACE_LEVEL_PARAMETER
Message: TraceLevel parameter not located in registry; Default
trace level used is %1.
Click to expand...

Event ID: 1003 and Event ID: 1015 are added to the Application log every
time that you restart Windows XP Service Pack 2
http://support.microsoft.com/kb/889082

Also:
http://www.computing.net/answers/office/microsoft-officenorton-virus-2005/6807.html

Description:
The ColdFusion MX Application Server service could not be started.
Check the server "default" log files for more information.
Google:
http://www.google.com/search?hl=en&...+not+be+started+259&btnG=Search&aq=f&oq=&aqi=

Description:
TV tuner malfunction. (0xc0040597) Dazzle DVC90 TVTuner
Google:
http://www.google.com/search?hl=en&q=TV+tuner+malfunction.+(0xc0040597)&aq=f&oq=&aqi=



Description:
Windows saved user 732REDHILLFR\HP_Administrator registry while an
application or service was still using the registry during log off.
The memory used by the user's registry has not been freed. The
registry will be unloaded when it is no longer in use.
Click to expand...

You experience log off problems on a Windows XP-based, Windows Server
2003-based, Windows 2000-based, or Windows NT 4.0-based computer
http://support.microsoft.com/kb/837115
Description:
Unexpected or missing value (name: 'BeavCom', value: '
Norton_Utilities') in key
'HKLM\Products\AB7687A6AC7B9CC4CABA58AB6468E55E\Features'
Click to expand...

Are you now or did you have Norton Utilities installed?
Lots of these
7)Type: Error
Date: 7/13/2009
Time: 8:47:05 AM
Event: 20
Click to expand...

Google Crome and FireFox, if so try uninstalling
and reinstalling.

8)Type: Error
Description:
Hanging application Weather.exe, version 6.7.0.10, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
Click to expand...
Can't help you on #8
9)Type: Error
Description:
Faulting application CCSVCHST.EXE, version 107.0.6.4, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.
Click to expand...

Ah, so you do have a Norton/Symantec product installed.
First try Symantec's "Live Chat"

If you are familiar with 'windbg' they may as you to
use it. Debugging Tools for Windows - Overview
http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx
 
Back
Top