Gerry said:
What errors appear in Event Viewer for your first attempt to boot in
normal mode when you encountered the problem?
Please post copies of all Error and Warning Reports appearing in the
System and Application logs in Event Viewer relating to the last boot in
normal mode . No Information Reports or Duplicates please. Indicate
which also appear in a previous boot.
I have 30 warnings and 14 errors on the 30th IF that is the day of the crash
which seems like a lot to post here. The errors are all application hangs.
The errors have a 2 then 4 event pattern...the 2 are 'Userenv' and the 4 are
2'EventAgnt' and 2
'Microsoft Fax'. Here's a couple of errors that occur right after Winlogon:
Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 10/30/2008
Time: 9:47:25 PM
User: N/A
Computer: MERLIN
Description:
Fault bucket 452615105.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 34 35 32 36 31 35 31 30 45261510
0010: 35 0d 0a 5..
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 10/30/2008
Time: 10:00:33 PM
User: N/A
Computer: MERLIN
Description:
Hanging application explorer.exe, version 6.0.2900.3156, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 65 78 70 6c 6f 72 explor
0018: 65 72 2e 65 78 65 20 36 er.exe 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 33 31 35 36 20 69 6e 20 3156 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00
Here's the 2 warnings:
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 10/30/2008
Time: 10:17:25 PM
User: MERLIN\E. Brent Price
Computer: MERLIN
Description:
Windows cannot unload your classes registry file - it is still in use by
other applications or services. The file will be unloaded when it is no
longer in use.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 10/30/2008
Time: 10:17:38 PM
User: NT AUTHORITY\SYSTEM
Computer: MERLIN
Description:
Windows saved user MERLIN\E. Brent Price registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.
This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Am I doing this wrong or should I post everything?
Thanks Brent