IC-WIN7

Printable View

Show 40 post(s) from this thread on one page

May 15th, 2014, 06:37 PM
fred scuttle

Log Name: Application
Source: VSS
Date: 13/05/2014 23:29:41
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {9d5718a5-cd2d-41d9-978e-ec0c2b3b6a88}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T22:29:41.000000000Z" />
<EventRecordID>28254</EventRecordID>
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {9d5718a5-cd2d-41d9-978e-ec0c2b3b6a88}</Data>
<Binary>2D20436F64653A20575254575254494330303030313236302D2043616C6C3A20575254575254494330303030313231342D205049443A202030303030313136342D205449443A
202030303030343036342D20434D443A2020433A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D
20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
May 15th, 2014, 06:38 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 23:23:55
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T22:23:55.000000000Z" />
<EventRecordID>28250</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
May 15th, 2014, 06:40 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 13/05/2014 23:21:30
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: Christine-PC
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
0 user registry handles leaked from \Registry\User\S-1-5-21-1867582200-139094598-4032816429-1001:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T22:21:30.852781100Z" />
<EventRecordID>28229</EventRecordID>
<Correlation ActivityID="{038BEC58-F800-0003-64AF-1D5BF66ECF01}" />
<Execution ProcessID="588" ThreadID="5684" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">0 user registry handles leaked from \Registry\User\S-1-5-21-1867582200-139094598-4032816429-1001:
</Data>
</EventData>
</Event>
May 15th, 2014, 06:41 PM
fred scuttle

Log Name: Application
Source: VSS
Date: 13/05/2014 23:05:09
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {2cf1d5c4-4cec-49a8-83a1-3a8b45abdbee}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T22:05:09.000000000Z" />
<EventRecordID>28212</EventRecordID>
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {2cf1d5c4-4cec-49a8-83a1-3a8b45abdbee}</Data>
<Binary>2D20436F64653A20575254575254494330303030313236302D2043616C6C3A20575254575254494330303030313231342D205049443A202030303030313136342D205449443
A202030303030333431362D20434D443A2020433A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B5365727669636520202020202020
2D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
May 15th, 2014, 06:41 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 22:59:38
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T21:59:38.000000000Z" />
<EventRecordID>28208</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
May 15th, 2014, 06:42 PM
fred scuttle

Log Name: Application
Source: VSS
Date: 13/05/2014 22:54:24
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {96d3af2a-33e3-4667-91d2-97a98be850dd}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T21:54:24.000000000Z" />
<EventRecordID>28183</EventRecordID>
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {96d3af2a-33e3-4667-91d2-97a98be850dd}</Data>
<Binary>2D20436F64653A20575254575254494330303030313236302D2043616C6C3A20575254575254494330303030313231342D205049443A202030303030313138342D205449443A
202030303030313233322D20434D443A2020433A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D
20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
May 15th, 2014, 06:43 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 22:50:30
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T21:50:30.000000000Z" />
<EventRecordID>28174</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
May 15th, 2014, 06:44 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 13/05/2014 22:47:39
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: Christine-PC
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
15 user registry handles leaked from \Registry\User\S-1-5-21-1867582200-139094598-4032816429-1001:
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\My
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\CA
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\Root
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\trust

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T21:47:39.996186800Z" />
<EventRecordID>28158</EventRecordID>
<Correlation ActivityID="{038FAC48-F800-0001-244D-5D7AE96ECF01}" />
<Execution ProcessID="600" ThreadID="5452" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">15 user registry handles leaked from \Registry\User\S-1-5-21-1867582200-139094598-4032816429-1001:
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\My
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\CA
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Policies\Microsoft\SystemCertificates
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\Root
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 5208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-1867582200-139094598-4032816429-1001\Software\Microsoft\SystemCertificates\trust
</Data>
</EventData>
</Event>
May 15th, 2014, 06:44 PM
fred scuttle

Log Name: Application
Source: VSS
Date: 13/05/2014 21:28:31
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {e988ad64-afd2-4733-ab75-55b6c255b7bb}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T20:28:31.000000000Z" />
<EventRecordID>28135</EventRecordID>
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {e988ad64-afd2-4733-ab75-55b6c255b7bb}</Data>
<Binary>2D20436F64653A20575254575254494330303030313236302D2043616C6C3A20575254575254494330303030313231342D205049443A202030303030313136342D205449443A2020
30303030313138302D20434D443A2020433A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202020202020202D20557365
723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
May 15th, 2014, 06:46 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 21:27:27
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T20:27:27.000000000Z" />
<EventRecordID>28131</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 21:27:27
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T20:27:27.000000000Z" />
<EventRecordID>28131</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
May 15th, 2014, 06:46 PM
fred scuttle

Log Name: Application
Source: VSS
Date: 13/05/2014 18:33:05
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {961044c1-7f57-472c-800d-0a91de4db925}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T17:33:05.000000000Z" />
<EventRecordID>28095</EventRecordID>
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {961044c1-7f57-472c-800d-0a91de4db925}</Data>
<Binary>2D20436F64653A20575254575254494330303030313236302D2043616C6C3A20575254575254494330303030313231342D205049443A202030303030313230382D20

5449443A202030303030323338302D20434D443A2020433A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365

202020202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
May 15th, 2014, 06:47 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 18:29:27
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99"
could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T17:29:27.000000000Z" />
<EventRecordID>28091</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
May 15th, 2014, 06:47 PM
Midknyte

Ah. I should have said just TODAY's errors, but that's ok.
Next time, try to word wrap the lines, or just edit and paste the long lines to a second line.
Otherwise, it makes the forum screen really wide and then we have to side scroll.

I see several repeats of the same error. Just one of each is enough.

You would then need to look up the Event ID info to see if there is a fix.
Event 1002: generic app error. You can usually ignore these, but here's one thread about IE.
http://answers.microsoft.com/en-us/i...c-5d9784a9ea54

Event ID 8194 Volume Shadow Copy Service error
http://technet.microsoft.com/en-us/l...=ws.10%29.aspx

Click Start, point to Administrative Tools, and then click Services.
In the results pane, double-click Volume Shadow Copy.
In Service status, make sure that the status is Started. If the status is not Started, click Start.
Make sure Startup type is set to Manual.
Click OK.

Event ID 10
http://www.msfn.org/board/topic/1143...ificationeven/

Event ID 1530
http://answers.microsoft.com/en-us/w...2-35e3edcf8425
May 15th, 2014, 06:48 PM
fred scuttle

Log Name: Application
Source: VSS
Date: 13/05/2014 01:34:12
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {48138e75-1f79-4390-9f74-5d0ee3110d01}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T00:34:12.000000000Z" />
<EventRecordID>28055</EventRecordID>
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {48138e75-1f79-4390-9f74-5d0ee3110d01}</Data>
<Binary>2D20436F64653A20575254575254494330303030313236302D2043616C6C3A20575254575254494330303030313231342D205049443A202030303030313136342D205449443A
202030303030333739362D20434D443A2020433A5C77696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B536572766963652020202020202
02D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
</EventData>
</Event>
May 15th, 2014, 06:49 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-WMI
Date: 13/05/2014 01:33:18
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99"
could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T00:33:18.000000000Z" />
<EventRecordID>28051</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
May 15th, 2014, 06:50 PM
fred scuttle

Log Name: Application
Source: Microsoft-Windows-Search
Date: 13/05/2014 01:32:39
Event ID: 1008
Task Category: Search service
Level: Warning
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
The Windows Search Service is starting up and attempting to remove the old search index {Reason: Index Corruption}.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
<EventID Qualifiers="32768">1008</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>1</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-05-13T00:32:39.000000000Z" />
<EventRecordID>28045</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Christine-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="ExtraInfo">
</Data>
<Data Name="Reason">Index Corruption</Data>
</EventData>
</Event>
May 15th, 2014, 06:58 PM
Midknyte

That's enough logs for now. Just look at the ones for TODAY, not every single one.
I see a lot of repeats. You only need to post one instance of the error, not all.

Try looking at the fixes I mentioned (post #53). Try one fix first and see if that helps.

I still didn't see you mention Task Manager. The Task Manager would help, expecially if we knew which process was consuming a lot of resources. The Event log errors might just be minor.
May 15th, 2014, 07:32 PM
Midknyte

Next time, we mainly need the Source, Event ID and description. It's fine if you just copy and paste like so:

Log Name: Application
Source: VSS
Date: 13/05/2014 22:54:24
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Christine-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.
May 16th, 2014, 06:54 AM
fred scuttle

There are 4 instances of internet explorer,1 win explorer,desktop,McAfee,host proc,realtec, adobe.These are the processes using most ram I mentioned on page one.
The fixes on page #53 I don't understand, I need simple step by step instructions as I have very limited computer knowledge :o
May 16th, 2014, 08:31 AM
Midknyte

Quote:

There are 4 instances of internet explorer,1 win explorer,desktop,McAfee,host proc,realtec, adobe.These are the processes using most ram I mentioned on page one.

That doesn't really tell us anything. You would need to see if the process is taking an extraordinary amount of memory.

I'm not sure how much simpler I can make the fixes. I already outlined the ID 8194 fix.

Event ID 8194 Volume Shadow Copy Service error
http://technet.microsoft.com/en-us/l...=ws.10%29.aspx

Click Start, point to Administrative Tools, and then click Services.
In the results pane, double-click Volume Shadow Copy.
In Service status, make sure that the status is Started. If the status is not Started, click Start.
Make sure Startup type is set to Manual.
Click OK.

You can also get to Administrative Tools from Control Panel.
May 16th, 2014, 03:10 PM
Midknyte

For the IE 1002, you can try resetting IE. Run the Fixit in step 2.
http://windows.microsoft.com/en-us/w...st-performance
May 16th, 2014, 03:21 PM
Midknyte

http://support.microsoft.com/kb/947238

Quote:

Event ID 1530 is logged as a Warning event. The application that is listed in the event detail is leaving the registry handle open and should be investigated.

Looks like you can ignore the ID 1530. There isn't a whole lot you can do at the user end.
May 16th, 2014, 04:32 PM
fred scuttle

Done ID 10 and ID8194 ,now running IE Fixit.:confused:
May 16th, 2014, 04:52 PM
fred scuttle

Done IE Fixit will let you know how it goes:)
May 16th, 2014, 04:59 PM
Midknyte

Ok cool.

The ID 10 fix seems to be the most promising for your situation, but also the most difficult.
http://www.msfn.org/board/topic/1143...ificationeven/

Quote:

Worked :D Thanks. One time windows did take ages to boot up and i mean ages! but it returns to normal once done
May 17th, 2014, 06:48 PM
fred scuttle

Have spent today testing my notebook and it has been running great :)Thanks for the fix.
Only weird thing left is the Action Centre flag has been reporting issues that McAfee has been turned off but when I go into action centre
it comes back on or sometimes I need to restart to get McAfee to come back on,it's intermittent.Should I uninstall/then reinstall McAfee.:confused:
May 17th, 2014, 06:58 PM
Midknyte

Cool. Glad to hear that it's running well.

It's worth a shot to reinstall Mcafee. Something might have happened to Mcafee after all the antivirus/antimalware tools you ran. I don't think any of the other fixes would have affected Mcafee.

Use the Mcafee removal tool and then reinstall it.
http://service.mcafee.com/FAQDocumen...33&id=TS101331
May 17th, 2014, 07:12 PM
fred scuttle

Thanks,will do that and let you know tomorrow:)
May 18th, 2014, 04:42 PM
fred scuttle

Reinstalled McAfee but no change,action centre still giving warnings about McAfee.Also when I restart scandisk runs and reports 60 reparse
records processed and recovering orphaned files.:confused:
May 18th, 2014, 06:03 PM
Train

run chkdsk /f /r

May need a new hdd.
May 19th, 2014, 05:58 AM
Midknyte

Hmm. That might be why you were getting those VSS errors. chkdsk is a start. I'd also run the hard drive manufacturer's diags.
May 19th, 2014, 09:35 AM
fred scuttle

I used seatools for windows iso disc but it says it cant detect a Hard Drive,am I using the right DIAG for a Samsung drive:confused:
May 19th, 2014, 12:58 PM
Train

Try the Samsung Drive Diagnostic Utility
http://www.majorgeeks.com/files/deta...8hutil%29.html
May 19th, 2014, 01:34 PM
fred scuttle

can u tell me which program I use to open this,cant get it to open:confused:
May 19th, 2014, 02:52 PM
Midknyte

Quote:

seatools for windows iso disc

Normally, I would use a boot disc of the diags (Seatools for DOS), not the Windows version. I only use the Windows version for non-boot drives or external USB drives.
http://www.seagate.com/support/downl...ls-dos-master/

What is the model of the Samsung drive? You might need to use an older version of the Samsung diags, depending on how old your drive is.
May 19th, 2014, 03:18 PM
fred scuttle

Samsung Drive Diagnostic Utility wont run on my 64bit machine is there a link for a 64bit version.
May 19th, 2014, 03:49 PM
Midknyte

As I mentioned before, you should really be using a boot disc for diags.

You can download UBCD from the link in my signature or you can try Seatools for DOS (link in my previous post).

Either way, you need to burn the .iso as an IMAGE to a CD first. Do NOT just burn the file onto a CD as data.
http://www.howtogeek.com/howto/14183...age-to-a-disc/
May 19th, 2014, 03:55 PM
fred scuttle

I did try the boot disk you mentioned Seatools for DOS but when the program opened It said it didn't detect any hard drive.
May 19th, 2014, 04:05 PM
Midknyte

Hmm that's strange. It should have at least detected a drive was there.

You might need to temporarily set the SATA mode to IDE instead of AHCI/RAID in the BIOS. Run Seatools, and then change the SATA mode back before booting into Windows.
May 19th, 2014, 04:20 PM
fred scuttle

The bios wont let me adjust sata

Show 40 post(s) from this thread on one page