Must restart with Last Known Good Config

On 7/21/2007, I changed the batteries and the channel on my wireless mouse. Since then, my computer periodically restarts by itself. I can only restart using Last Known Good Configuration. On restart, a Windows popup says that I have recovered from a serious error. The error report says I have a device driver problem but all my devices say that they are working properly. With IBM tech support (like pulling teeth even though I have 2 more years on my extended warranty), I installed the wireless mouse driver. My restart problem persists. My system will not let me use system restore. I ran a CheckIt diagnostics today which stated that all hardware passed. Thanks for replying.

Respun

 

What do you see in the Event Viewer at those times? eventvwr.msc from Run window. Look under both System and Application.

 

Your system probably crashes, but is set to automatically reboot on crash, and that crash happens on a shutdown w/o you noticing.
Try unchecking the box in startup and recovery on your systems' property sheet in the control panel that states "Automatically restart" on System failure. Also while you are in there, change the write debugging information to full memory dump.
Both of these options should allow you to catch the error.

Also the event log may also report some information on your system error.

 

Here's what I found in my Event logs since my syndrome began last Saturday. Apologies if most (all) is irrelevant. I don't know how to sort the meaningful from the drivel:

I have several instances of the following events under Application:

Source Evnt Agnt:
1) ID 1015: "TraceLevel parameter not located in registry; Default trace level used is 32.â€
2) ID 1003: "TraceFileName parameter not located in registry; Default trace file used is ." This latter is not a typo "“ that is actually how the description stops.
Source Userenv:
1) ID: 1524: "Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.â€
2) ID 1517: "Windows saved user [my name] registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use. This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.â€

I have several instances of the following events under System:

Warning ID 2511: "The server service was unable to recreate the share Kazaa Media because the directory C:\Documents and Settings\[my name]\Start Menu\Programs\Kazaa Media Desktop no longer exists. Please run "net share Kazaa Media /delete" to delete the share, or recreate the directory C:\Documents and Settings\[my name]\Start Menu\Programs\Kazaa Media Desktop." I "uninstalled Kazaa years ago; I don’t know how to implement this instruction.

Error, Event Category (102), ID 1003: Error code 1000007e, parameter1 c0000005, parameter2 805c607b, parameter3 f8b3f93c, parameter4 f8b3f638. Data:

0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303120 37303030
0020: 50202065 6d617261 72657465 30632073
0030: 30303030 202c3530 63353038 62373036
0040: 3866202c 39663362 202c6333 33623866
0050: 38333666

Error, Source DCOM, ID 10005: "DCOM got error "The service did not respond to the start or control request in a timely fashion. "attempting to start the service iPod Service with arguments " " in order to run the server:{063D34A4-BF84-4B8D-B699-E8CA06504DDE}.â€

Error, Source: Service Control Manager, ID 7009: "Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.â€

Error, Source: Service Control Manager, ID 7000: "The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.â€

Error, Source: PlugPlayManager, ID 11: "The device Root\LEGACY_SSFS0509\0000 disappeared from the system without first being prepared for removal.

 

Eric, if I uncheck the "auto restart" on system failure, what will happen with the next crash? If it doesn't restart, what do I do next? Nervous!

 

I just now retarted my system following removing old Java applications in Add/Remove programs. Again, I could only reboot using Last Known Good Configuration (I have not as yet unchecked "auto restart" on crash as I am waiting for further instructions on this option from Eric). Here is everything that showed up in the Event Viewer logs:

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 7/28/2007
Time: 7:49:51 AM
Description: Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 7/28/2007
Time: 7:49:55 AM
Description: Windows saved user [my name] registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use. This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Event Type: Warning
Event Source: EvntAgnt
Event Category: None
Event ID: 1003
Date: 7/28/2007
Time: 7:52:28 AM
Description: TraceFileName parameter not located in registry; Default trace file used is .

Event Type: Warning
Event Source: EvntAgnt
Event Category: None
Event ID: 1015
Date: 7/28/2007
Time: 7:52:28 AM
Description: TraceLevel parameter not located in registry; Default trace level used is 32.

Event Type: Warning
Event Source: Server
Event Category: None
Event ID: 2511
Date: 7/28/2007
Time: 7:52:10 AM
Description: The server service was unable to recreate the share Kazaa Media because the directory C:\Documents and Settings\[my name]\Start Menu\Programs\Kazaa Media Desktop no longer exists. Please run "net share Kazaa Media /delete" to delete the share, or recreate the directory C:\Documents and Settings\[my name]\Start Menu\Programs\Kazaa Media Desktop.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/28/2007
Time: 7:52:25 AM
Description: The Webroot Spy Sweeper Engine service failed to start due to the following error: The system cannot find the file specified.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7009
Date: 7/28/2007
Time: 7:52:57 AM
Description: Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/28/2007
Time: 7:52:57 AM
Description: The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

 

Since Kazaa was removed, click Start>Run, type cmd then hit enter to open a command window. Copy the following command, including quotations, and paste it to the command window, then hit enter.

"net share Kazaa Media /delete "

When Kazaa was installed, it set up a network share. When it was removed, the share entry was left behind while the actual share is gone (the directory) and Windows is still trying to connect to it, hence the error. The above will remove the entry.

By disabling autorestart, rather than rebooting on a crash, you should get a blue screen that contains information about the cause. Write down that information and post it back here. You will then have to hold the power button in until the computer shuts down.

 

Hmm. I tried to delete the Kazaa entry (copied and pasted the instruction into the command window, quotes and all). I got back that the system could not find the file path specified...

I will uncheck the auto restart box and see what happens!

 

Click Start>Run, type compmgmt.msc and hit enter. It should open the Computer Managment Console. In the left pane, under System Tools, expand Shared Folders, then click on Shares. See if Kazaa Media Desktop is in the list. If so, right click the entry and select 'Stop Sharing'.

 

I have fully entered the Twilight Zone. I unchecked auto restart on failure and then restarted. No crash. No Last Known Good Config. I don't expect this good news to last. I have received an auto AOL update this morning. Could that have been the fix? Doubtful.

As for Kazaa, I looked in Shares and it was not to be found. ???

Thanks for every bit of advice.

 

You'll probably have to wait for the crash

The reason for Last Known Good coming up is the crashes themselves, which are caused by some event while within Windows. The crash prevents the regsitry hive from being properly unloaded and thus likely corrupted. That event in itself is noted and when you restart after a crash, Windows automatically wants to use the Last Known Good configuration, which is (hopefully and has been so far) a registry hive that is not corrupted. Disabling autorestart, as mentioned before, will cause a blue screen when the computer once again crashes. By initiating a reboot a short while ago rather than the machine crashing, you by-passed all of the behavior that you've been experiencing.

I'll have to do some looking around to further guide you towards resolution of Windows looking for the Kazaa share.

 

Thanks for the tutoring. And for looking for a Kazaa solution. I can add a couple of thoughts: 1) I have been reading similar problems for other AOL users -- these forums blame AOL software glitches and suggest calling AOL (now there's a nightmare); 2) three of my self-initiated reboots over the past few days have caused a normal restart -- all others have led to the dreaded Last Known Good Configuration scenario.

Hoping you and my internet connection will still be here when the next crash occurs!! Many thanks again.

 

This might be a good time to see if KazaaBeGone is of any value. It's a free download from that site (scroll down to find it).

I've used it before with success but I have not had this particular problem.

 

Good idea SD! Forgot all about that great little tool from Merijn

 

Hey thanks again! I downloaded the KazaaBeGone. It found and removed 10 files. Any way that I can run a check to see whether there are still Kazaa remnants left?

Of course I'm still living in the AOL death world, but maybe my Kazaa days are fully cleaned from my system!

 

You could do a registry search with Regseeker or something similar, but I don't feel it's necessary. KazzaBeGone was written quite well, and you can believe it's gone.

 

BSoD Report. Panic Time.

On restart, my computer gave me the blue screen crash info we have been waiting for. Deep breath. Following this, I could restart using Last Known Good Configuration. I don't know what any of the following means. All help most welcome.

1. Blue Screen message:

"A problem has bee detected and windows has been shut down to prevent damage to your computer. If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps: Check to be sure you have adequate disk space. If a driver is identified in the stop message, disable the driver or check with the manufacturer for drive updates. Try changing video adapters. Check with your hardware vendor fo any BIOS updates. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, press F8 to select Advanced Startup options, and then select Safe Mode.

Technical Information:
STOP: 0x0000007E (0xC0000005, 0x805C6078, 0xF8ACF1E8, 0xF8ACEEE4) "

2. No Firewall on Restart. My Windows Live OneCare had its firewall turned to off. I promise that I did not change the settings. This happened by itself. Coincidence? I cannot get the firewall setting to turn on. The program will not respond. I get the error report "hungapp." So I'm without firewall at the moment. Geesh.

 

BSoD Report. Panic Time.

I restarted and received the much anticipated Blue Screen. I was then able to restart using Last Known Good Configuration. I don't know how to follow the BSoD instructions or what they mean. Yikes.

1. Blue Screen Message:

"A problem has been detected and windows has been shut down to prevent damage to your computer. If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps: Check to be sure you have adequate disk space. If a driver is identified in the stop message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters. Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Startup options, and then select Safe Mode.

Technical Information:
STOP: 0x0000007E (oxC0000005, 0x805C607B, 0xF8ACF1E8, 0xF8ACEEE4) "

2. No Firewall on Restart. When I restarted in Last Known Good Configuration, my firewall was turned to off. Coincidence? I use Windows Live OneCare. I cannot get the firewall to turn back on. When I open the application and select to turn the firewall on, it says that the application is not responding and I get the error report: hungapp. So, no firewall at the moment. Geesh.

 

Here goes. Wow am I in over my head. Thanks for sticking with me. Respun

1. Sytem Event Log:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 7/30/2007
Time: 7:08:04 AM
User: N/A
Description: The Symantec Core LC service terminated unexpectedly. It has done this 1 time(s).

Event Type: Warning
Event Source: Server
Event Category: None
Event ID: 2511
Date: 7/30/2007
Time: 7:24:08 AM
User: N/A
Description: The server service was unable to recreate the share Kazaa Media because the directory C:\Documents and Settings\[my name]\Start Menu\Programs\Kazaa Media Desktop no longer exists. Please run "net share Kazaa Media /delete" to delete the share, or recreate the directory C:\Documents and Settings\[my name]\Start Menu\Programs\Kazaa Media Desktop.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/30/2007
Time: 7:24:24 AM
User: N/A
Description: The Symantec Core LC service failed to start due to the following error: The system cannot find the file specified.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/30/2007
Time: 7:24:24 AM
User: N/A
Description: The Webroot Spy Sweeper Engine service failed to start due to the following error: The system cannot find the file specified.

2. Application Event Log:

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 7/30/2007
Time: 7:09:21 AM
User: NT AUTHORITY\SYSTEM
Description: Windows saved user [my name] registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use. This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Event Type: Warning
Event Source: EvntAgnt
Event Category: None
Event ID: 1003
Date: 7/30/2007
Time: 7:24:21 AM
User: N/A
Description: TraceFileName parameter not located in registry; Default trace file used is .

Event Type: Warning
Event Source: EvntAgnt
Event Category: None
Event ID: 1015
Date: 7/30/2007
Time: 7:24:21 AM
User: N/A
Description: TraceLevel parameter not located in registry; Default trace level used is 32.

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 7/30/2007
Time: 7:45:41 AM
User: N/A
Description: Hanging application WinSSUI.exe, version 1.6.2111.12, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 57 69 6e 53 53 55 WinSSU
0018: 49 2e 65 78 65 20 31 2e I.exe 1.
0020: 36 2e 32 31 31 31 2e 31 6.2111.1
0028: 32 20 69 6e 20 68 75 6e 2 in hun
0030: 67 61 70 70 20 30 2e 30 gapp 0.0
0038: 2e 30 2e 30 20 61 74 20 .0.0 at
0040: 6f 66 66 73 65 74 20 30 offset 0
0048: 30 30 30 30 30 30 30 0000000

[I realize that this happened much after the restart, but I included it because on restart my firewall has turned itself to off -- Windows Live OneCare -- and I cannot get the firewall to turn back on. I get an application not responding error message from Windows.]