Event viewer-Application, what is this?

Hi All: EDIT: Another bonehead mistake, I said "system event" this is in applications, event viewer. not system. I have editited the entire post to reflect "applications "

I installed a new program, "ConfigSafe" that crashed my machine with BSOD. Twice.

I uninstalled the program in safe mode, the only way I could get into XP.

Next, on boot, I am getting an approximate 60 second or more delay between the XP splash screen and the loading of personal settings, with black screen during delay before cursor and hour glass. Previous delay 3-5 seconds.

Looking in event viewer-applications, I see this:

Event Type: Information
Event Source: MSDTC
Event Category: TM
Event ID: 4097
Date: 4/4/2004
Time: 4:30:11 PM
User: N/A
Computer: CATASTROPHY
Description:
MS DTC started with the following settings:

Security Configuration (OFF = 0 and ON = 1):
Network Administration of Transactions = 1,
Network Clients = 0,
Distributed Transactions using Native MSDTC Protocol = 1,
Transaction Internet Protocol (TIP) = 0,
XA Transactions = 1

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


This is the first time I have seen this event. MSFTs help site no help. Could it be cause of delay?

System restore to before install of "ConfigSafe" yields no improvement. Multiple reboots no help.

Can anybody figure out and tell me what is going on here??

All replies will be appreciated.

Martin

 

Are you running an SQL server?

For most configurations of XP, the Distributed Transaction Coordinator service does not need to run at all. And, yes, especially if the service is trying to find non-existent information, it could slow boot by a great deal.

"Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start."

Go to Control Panel, Admin Services.

Double-click the DTC service and set it to Manual or Disabled. Stop it if it is running. Apply.

If you need the service for something, you will find out eventually.

 

Hi Abraxas: Not running SQL server, don't even know what one is. Any connection to home networking? Have 3 XP machines networked.

Disabled MS DTC services. Not in application events now. No apparent effect on machine, no effect on boot.

Still looking at a black screen for a full 65 seconds betweeen Windows splash screen and "Loading your personal settings" desktop appearance.

No question that installation of "ConfigSafe" cause of BSOD, twice, loading after install, program taking system snapshot, BSOD. Uninstall left this problem on next boot.

Suspect some registry change, but what? Any other Ideas?

TIA

Martin

 

Hi Tony: Thanks for the response. Since I uninstalled it and don't want to even go to the install file to find the version, I'm not sure what version I have. I do know the site says works for XP. Had to enter OS to download. Paid the $29.00, not a trial. Getting a refund is on the back burner for the moment.

I had this program previously, came pre-installed on my first machine, an IBM Aptiva with Windows 98. I had used it successfully on that machine and liked its functionality.

Any time I ever really needed System Restore, it failed to do the job. Just like this time. I did a system restore after uninstallation of ConfigSafe in an attempt to cure this problem. No help, not that I expected positive results.

ConfigSafe was useful in that it listed what registry changes had been made and allowed roll back so that you could see what was happening, what keys are/were being/had been changed instead of the blindness, in the dark of System Restore.

I just fininished running SFC, with some puzzling results. Here are the sequential entries in system events:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/5/2004
Time: 9:22:49 AM
User: N/A
Computer: CATASTROPHY
Description:
Windows File Protection scan found that the system file c:\windows\system32\nv4_disp.dll has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.5303.

Next:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/5/2004
Time: 9:22:49 AM
User: N/A
Computer: CATASTROPHY
Description:
The protected system file c:\windows\system32\nv4_disp.dll could not be restored to its original, valid version. The file version of the bad file is 6.14.10.5303 The specific error code is 0x00000000 [The operation completed successfully.


Next:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 4/5/2004
Time: 9:22:50 AM
User: N/A
Computer: CATASTROPHY
Description:
Windows File Protection scan found that the system file c:\windows\system32\drivers\nv4_mini.sys has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.5303.

Next:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 4/5/2004
Time: 9:22:50 AM
User: N/A
Computer: CATASTROPHY
Description:
The protected system file c:\windows\system32\drivers\nv4_mini.sys could not be restored to its original, valid version. The file version of the bad file is 6.14.10.5303 The specific error code is 0x00000000 [The operation completed successfully.
].

And Finally:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 4/5/2004
Time: 9:26:02 AM
User: N/A
Computer: CATASTROPHY
Description:
Windows File Protection file scan completed successfully.

Completed Successfully??? I don't think so!! Must be some MSFT code writer blowing his own horn!

File was restored/wasn't restored, was restored/wasn't restored. What a bunch of ****!!! Clicking help link in the event yeilds the "sorry no more information on this event" as usual.

Still as frustrated as ever. Will write to imaginelan and see what help they offer.

In the meantime, if anybody knows how to successfully (really successfully w/o the bs) fix these files, HELP!

All responses are valued and appreciated.

Martin

 

Have you changed vid cards recently? It seems like too much of a co-incidence that you get that black screen when the video drivers would be loading and that the sfc showed problems with NVidia driver files. Especially since your sig says you are running a Radeon.

Try going to Device Manager, click View, Show Hidden Devices and see if any NVidia stuff remains. Remove it. You may even find some ConfigSafe things there.

And do a search for NVidia and remove anything you find. If you have in fact changed cards, look in Add/Remove for any NVidia entries.

Check msconfig for any NVidia tray apps that may be trying to start.

 

Hi Abraxis: Recent Video Card changes? Depends on how recent is recent?

This machine has a history of Video Card changes. Started with Nvida, Got a Radeon 7500 all in wonder, broke that card trying to reseat it because of problems, went back to the Nvidia for a while til I bought the current ATI 9800 Pro by Sapphire. Must have been in machine about a month. Probably 6 changes, back and forth between Nvidia and ATI in 6 months.

Have had system event viewer errors machine trying to load the All In Wonder Features, and of course, the device is no longer in machine.

Looking in hidden Device Manager files, non plug and play drivers. found one clearly Nvidia, PFD file, uninstalled it. The only one clearly from Nvidia. Lots of other files in there, some of the old ATI files for the All in Wonder features, I uninstalled them also. No Nvida programs trying to load at startup, none in add/remove program list.

Had an Nvidia file in C:\My drivers\Nvidia, deleted it. I believe this file was created by a driver backup program, should not be affecting machine, but deleted it anyway.

Can't find any other Nvidia drivers or programs. Did a registry search for Nvida using RegSeeker. It turned up six files, Hkey Current User, all seeming to be part of or integreted into other programs. I can't figure out how to copy and paste these files, although I have a screen shot, I can't get it into this post. AAARRRRGH!!!!!!


Just got aggrevated and deleted them all. Whoops, hope machine reboots.

Last reboot, did not get Windows splash screen, instead got a full desktop all mottled green that resolved itself into green and biege verticle lines and then turned bright white. After about 45 seconds, got all black screen, then cursor and hourglass, then the normal "loading your personal settings" window.

AARRRGH! I think I'll go kick the dog. (not really)

I'll send this post, shut down, reboot, if anything significant, I'll post, otherwise will be status quo still looking for answers. Thanks for all of your help.

Martin

 

I have done as in last post, uninstalled anythng related to Nvida and the ATI drivers for features not included on 9800 Pro. Like TV viewer.

I then Uninstalled the ATI card and reinstalled same. Windows went online for updated drivers, downloaded them from it's update site and installed them. It did not ask me nor take the drivers off of the ATI CD that was in the CDROM drive at the time. The result on boot was a screen 400x600 with 8 colors, plus an error message from Windows that the drivers it just loaded were for an earlier version of Windows and would not work with XP.

So I rolled back the drivers and am back to square one except I am now staring at a black screen for 75 full seconds before cursor and hourglass appear.

At least, one of the ATI errors displayed previously in event viewer, system is gone. Now there are only three. Also rid of the DTC error since I disabled the service. I'm not sure this is progress, adding 15 seconds to the boot time. Hopefully someone can tell me it is a step along the road to resolving the problem and the next step is???????

I am going to run SFC one more time see if those errors appear again. I will post back any significant results, othewise waiting for help.

TIA

Martin

 

Martin, a .410 shotgun or a 15 year old pick up truck might scare Catastrophy??? Got either one handy?

LOL
Johanna

 

Hey Johanna, can't blame the machine for this one, It was just me trying to install a program that would make it easy to recover from a crash just like the one the program caused!!

Talk about counter productive!!

Tony, thanks for the input, I will go there and do that, will take some time as I do have to eat and sleep besides working on this machine.

I'll post back results.

Just wondering, could I go into system32 and delete those nv display .dll files, or would that just make things worse, which I have a talent for.

 

Hi All: Tony, I looked in all those places you detailed, no references to Configsafe or Nvidia.

Some of the places you detailed do not exist on this machine. This one for example: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" No Userinit key.

Not there in "C Windows either, no Userinit.

Did a reg search for Nvidia. Found in:

HKCU\Software\Microsoft\Seach Assistant\5603, along with reference to Configsafe and other terms/programs previously seached for.

Clicked: find next, Got crash with BSOD

Page_Fault_in_Non_Paged_Area

Stop: 0X00000050 (OXFFFFEDF8, 0X00000000, 0X8053434E, 0X00000000)

This is the same thing that happened when Configsafe was taking a snapshot.

It has also happened when using a program, "Clean Reg 3" to find obsolete entries in registry. I had used that program for a considerable length of time starting with 98SE and also XP. After using it for a period of time successfully in XP, it just started crashing machine, I quit using it.

I restarted machine in safe mode, went back to regedit, did the same search for Nvidia, same results, machine crashed, BSOD as above.

Checked events, found:

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 4/6/2004
Time: 8:10:19 AM
User: N/A
Computer: CATASTROPHY
Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

And:

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 8193
Date: 4/6/2004
Time: 8:10:19 AM
User: N/A
Computer: CATASTROPHY
Description:
Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 57 52 54 57 52 54 49 43 WRTWRTIC
0008: 32 31 31 33 00 00 00 00 2113....
0010: 57 52 54 57 52 54 49 43 WRTWRTIC
0018: 32 30 37 38 00 00 00 00 2078....

I really don't understand why a reg search would crash the machine.

Martin

 

Martin...(Twilight Zone music plays as Catastophy chucklesat the thought of Martin in her registry, again...)

Spring is the time of rebirth, and new and clean beginnings. It's when the daffe-daffo=daffa-dills, oh, you know, those pretty yellow flowers bloom- what are those dang things anyway? It is time for a clean sweep on Catastrophy (when she ain't looking, of course!) and an error free life.

btw, I met Catastrophy's little sister last night. I swear that comp was laughing at me!

Johanna

 

hi all,

I like a woman's touch in these discussions. I've been listening in with nothing to contribute to all the fun, and thinking that when I'm conftonted by a computer like catrastophy, I find it "cost effective" to spend the hour reinstalling the OS rather than spend the week spinning wheels, and ending up at the same place. Different strokes....

Like "been there, done that" as has been said elsewhre.

Have fun,

Mike

 

Yeah, easy for you guys to say just reformat!! HA!

One problem is reinstalling all the PAID FOR programs, Just finding their Product keys is the real hassel. Some of these vendors do not keep easily accessable records, some use third party collection schemes and have no idea who bought and paid for their programs.

Yes, of course I saved each and every product key, just where did I put them?

Another problem is losing a year or so of tweaking, fixing, and getting stuff to just work the way it is advertised. I have no trouble saving my data, docs, pix, video, etc. It is the lost
tweaking and setups that is the real pain. For example it took me two months to get my LAN working where it does not crash on a daily basis and all three computers can see each other. I have 0 confidence in doing that again.

Heck, just downloading the security fixes and Norton updates is a major pain.

So for now, I will continue to do battle. I'll read through this post and Tony's suggestions again and go from there.

What, me worry?? Nah, it'll all work out somehow. I got faith in transistors and MSFT!

On the topic of a registry search causing a BSOD, this has also happened before Configsafe was installed.

Curiously I did a reg seach for ATI and the search found all the ATI entries with no problems.

Do a reg seach for Nvidia=BSOD. Using RegSeeker, will do the Nvidia search, no problem. Strange?


Martin

 

martinr121,

You have my sympathy. I have found the following useful and not much work, and I think you should do these things anyway:

"I saved each and every product key, just where did I put them? "

Find them all, and write each on the label side of it's cd with a fat felt-tip marking pen, or if it's a downloaded program, store the key in a notepad file on your backup CD along with the program.

"get my LAN working "

Use alt-printscreen to capture the windows in control panel with the settings for the lan and save the pictures in a folder, or better, paste them into a wordpad file with some description, also on the backup CD.

"downloading the security fixes "

Order the free CD from msft. With a good firewall and antivirus program, I don't think there's a rush.

In my opinion, if one part of the OS is "broken ", there are likely other parts also, that you may not have noticed, and that's a big reason for suggesting the reinstall.

BTW, I wouldn't re-partition just format. XP checks your disk and will tell you if there's a problem.

Regarding the "BSOD ", you have the workaround so don't fret. Even the person(s) who wrote regedit probably can't explain the BSOD. Anyway, I suspect those babies are leftover from the programmers; I've never seen one that has information useful to a user.

 

Hi Sparrow: I appreciate your sympathy. One of these days I will get organized. I promise myself everyday. If there is a procrastinaters club, I would easily qualify to run for president, if I ever got around to filling out the forms.


Martin

 

Hi Tony: Good advice I'm sure. If I do a clean install I will follow your system. I like the idea of leaving AV till last, so many times it interferes with a clean program install.

I have always installed it 3rd, after OS & Windows updates, firewall, then AV. After that, programs. I am concerned about being online without AV. Have you had any difficulties with Virus when updating/installing programs? Some of my stuff, you have to go online to update from when program was originally downloaded.

**** internet is scary these days. Getting virus updates on an almost daily basis.

Martin