[sammyg]

Hi. I'm having a similar problem as was posted in http://forums.techguy.org/windows-nt...artup-but.html

Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x71ab6a55.

Type: Error
User: N/A
Source: Application Error
Category:None
Event ID:1000

Windows XP Home SP3

Explorer.exe crashes on startup, Dr. Watson (Error Reporting?) also crashes, explorer.exe restarts and crashes one or two more times and then seems to run ok.

Before this happened, I updated my computer on several issues:
Upgraded and installed Spybot S&D 1.6.2, and then ran full scans
Attempted but failed inexplicably to install WGAPluginInstall (Windows Genuine Advantage Validation--unknown Microsoft Knowledge Base KB number)

One other thing occurred prior... I noticed that my disk drive activity light was illuminated/flickering when the drive was not active, so I disabled the drive. This did not help, and so I immediately reenabled the drive. Could that cause the problem? Is there some reason why the drive would do this?

After this occurred, I attempted to run a Diagnostic Startup from MSConfig. This was unhelpful, and furthermore, I (embarrassingly) forgot whether or not all of the WIN and BOOT files should be checked when I reset.

I then attempted to run System Restore, and then to my horror, the computer claimed that I had turned it off!! (Which I swear I never did.) System Restore refused to turn itself back on (something about a user name not being able to get turned on again). However, after a few minutes, System Restore inexplicably started working, but since it had been turned off, all of the old Restore points disappeared (except for one automatically created that moment, after the problem occurred--quite useless).

I noted in the other thread http://forums.techguy.org/windows-nt...artup-but.html that this occurred to the other user immediately after installing SP3. I successfully installed SP3 several months ago and never had this or any other problem.
Thank you for your help.

[rainforest123]

s:
Hello & Welcome to Tech Guy Forum.

If you have a Windows install CD, which Dell might have labeled, white & blue, as Operating System Disk, or can make a recovery console CD http://mysite.verizon.net/vzeoslyq/w..._Wont_Boot.htm
, you can use the rec con to access system restore.

http://support.microsoft.com/?kbid=307654

RF123

[sammyg]

I can get System Restore to open if I wait a few minutes, but all of the old restore points are gone.

[rainforest123]

s:
Thanks for referencing the other TGF member's thread.

Please tell us about your problem.
When does the message appear? What activity is occurring in your computer? What are you doing? Is your computer sitting without you doing anything?

When did it begin?
Can you relate the onset to the installation or removal of hardware or software, to include Windows updates, AntiVirus updates, Spybot updates, other updates?

For example, how much time had passed between the onset of the problems and the updates you noted?

You could try uninstalling Spybot S & D.

open internet explorer
go to www.microsoft.com/updates
upper right, left click "microsoft updates"
upper left, look for review my update history
follow the prompts
when the link becomes active, open it
look for failed updates
in the status column, left click "failed" or "error"
note the information about the failure.
Provide that information to us.

""Is there some reason why the drive would do this?
How did you disable the drive?

The next time your HDD activity LED is illuminated, open Task Manager.
Processes tab
Left click "cpu" column header, which you may need to do 2x, until you see the service / process that is occupying your CPU, and presumably your HDD.

Running Diagnostic Startup removes your previous restore points.

What are the brand & model of your computer? If not OEM, what are the brand and model of your HDD?

Run HDD diags. If your OEM has none, or if you can't find any at your HDD manufacturer's site, go to www.hgst.com . Hitachi purchased IBM's HDD line.
support
downloads
download DFT that co incides with your PC's hardware; if you have a floppy disk drive, FDD, download the floppy based DFT.
If you do not have a FDD, download the .iso version of DFT.
You will need CD burning software, such as Nero or Roxio to create a bootable CD.
A free program, ISO burner exists, but I have never used it.
create bootable disk
Boot to said bootable disk
Run DFT.

Backup your data.
Run error checking.
Open "my computer"
RIGHT click your C: drive
properties
"Tools" tab
"error checking" > check now
click both boxes
You will be notified that EC needs complete access to your HDD & asks if you want to schedule EC upon next reboot.
YES
reboot when convenient

You will find the resutls:
start > run
type: eventvwr.exe
maximize screen
On left, left click "applications"
On right, look for "winlogon"
On right, RIGHT click "winlogon"
Properties
On right side, look for button with 2 pieces of paper
That will copy information displayed to your PC's clipboard
Paste into notepad, or return to this thread & post results in this thread

Go to www.memtest.org
Download their test.
Run Memtest for > 8 hrs, or until errors appear.


"I then attempted to run System Restore, and then to my horror, the computer claimed that I had turned it off!! (Which I swear I never did.) "
See above.

"System Restore refused to turn itself back on (something about a user name not being able to get turned on again). However, after a few minutes, System Restore inexplicably started working, "
Welcome to computer land.

"but since it had been turned off, all of the old Restore points disappeared (except for one automatically created that moment, after the problem occurred--quite useless)."
Again, see above.

"I noted in the other thread http://forums.techguy.org/windows-nt...artup-but.html that this occurred to the other user immediately after installing SP3. I successfully installed SP3 several months ago and never had this or any other problem."

Unfortunately, there are frequently many causes for a problem, particularly when event viewer displays "application unknown".

RF123

[rainforest123]

In the future, instead of running diag startup, in the system config utility, under "selective startup", uncheck everything.

RF123

[sammyg]

RF:
The problem occurs immediately on startup. I noticed that when windows (i.e. explorer.exe) starts up, there is a small pop-up in the top left saying something about Personalized Settings: C:\Recycler\k234\...(etc. etc...) which never appeared beforehand. It appears each time explorer.exe restarts (the computer does not reboot; the desktop just flashes and reloads).

The problem occurred for the first time after I rebooted after installing Spybot S&D 1.6.2 (upgrading from 1.5.2). I updated my antivirus software. I also attempted to install a windows update. I do not directly download from the microsoft update page; I have a dialup, and it takes a solid half-hour just for microsoft to scan and tell me which updates my computer needs. Instead, I monthly download the newest updates elsewhere and save to disk.

As for the disk drive, I went into the properties and disabled it there. I then had to go to My Computer: Manage to re-enable it (You can not access the properties of the drive once it is disabled).

I can't believe I deleted my system restore points... I remember now something about diagnostic startup... Guess I should have asked here first...

Thanks,
-sammyg

[rainforest123]

s g:
I am not trying to be argumentative or critical.

After the computer turns on,
1. it goes through POST, power on self test, to verify hardware; this is before Windows loads/
1. x - multiple other steps behind the scenes.
2. Next, we usually notice the Windows XP splash screen.
3. Next, if we have > 1 user, or require a password, the Windows XP Logon screen appears.
4. Next, the Windows desktop appears.

At which point does the error message appear? From your narrative, I think it appears after the Win XP splash screen has appeared; perhaps after the desktop begins to load; perhaps before the desktop had appeared.

You note:
How did you obtain the event information, which you provided [ good job ] in #1 of this thread? I think you need to reach the desktop to access that information. Did a BSOD appear?

Have you tried to boot into safe mode?
If not, please try.
Report the results, please.

Have you tried last known good config?
If not, please try.
Report the results, please.

See this link, if you need more information.
http://www.petri.co.il/last_known_go...00_xp_2003.htm

I understand your rationale for downloading to a different computer. The risk run when doing so is importing malware. Any file on any computer can be infected.

RF123

[sammyg]

RF:

I'm sorry if I was rude. I was just laughing at myself =).

To be more specific, the computer successfully shows the desktop (wallpaper and all icons). I only have one user, so there is no windows logon. Task Manager:Processes shows explorer.exe and dwwin.exe (error reporting, I think) running immediately upon startup. When the error message appears, and I then confirm to close Explorer.exe, the icons on the desktop disappear, but the wallpaper is still visible (I'm pretty sure the screen does not even flash), and then the small popup: Personalized Settings: C:\Recycler\k123...... and the icons reappear... The error message repeats 2 or 3 times, with explorer.exe and dwwin.exe reloading as stated above, until finally, for whatever reason, the computer proceeds without dwwin.exe appearing, and explorer.exe does not crash and restart. The key thing I should point out is that Windows does in fact startup "properly" (except for the error message) and then continues to run apparently normally. Win XP does not fail to launch.

I noted that after successful restarting of explorer.exe, I only have 29 processes running in Task Manager, whereas I usually had 30. I can not determine which process is missing.

Also, WGATray (Windows Genuine Advantage) comes on briefly before the crash. I had trouble installing the new WGAPluginInstall before this trouble started (I downloaded it on another computer and saved to disk, and then tried without success to install it on my computer.) Frankly, WGA doesn't even seem important, so I wish I hadn't bothered... Should I contact Microsoft and see if they can help?

As for the CD drive, I did not mean that the drive is active for no reason, rather the light goes off for no reason. Probably just a fluke; should have ignored it. Task Manager shows no erroneous CPU usage.

I have not yet tried Safe Mode. Do I access that by hitting F12 (Boot Menu, I think) on Startup (your #1--POST)? What is a BSOD? The error message is a popup: Explorer.exe experienced a problem and was forced to close. We are sorry for the inconvenience... or something like that. I have not tried Last good config... According to the link you supplied, that resets every time the computer "successfully" (which technically my computer does in fact do) restarts, so would that help?

I truly thank you for your help. I realize how difficult it must be without being able to see anything yourself firsthand. I went into eventvwr.exe and found several warnings and error messages; I will post them in another thread momentarily.

-sammyg

[sammyg]

This is a list of all of the error messages stored in my computer. Some probably are not relevant, but I am posting everything here so as to help with diagnosis. I get an individual error message 2 or 3 times on startup, so I apologize if I post redundant messages. These are not in chronological order.
-sammyg

*******************************************************
1) Scandisk Error Check Results: As requested, here is the report on latest Error Check. One strange thing I noticed is in Step 3 of 5, I don't ever recall seeing "Usn Journal Verification" before.

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 3/11/2009
Time: 9:32:05 PM
User: N/A
Computer: SG6562
Description:
Checking file system on C:
The type of the file system is NTFS.
Cleaning up minor inconsistencies on the drive.
Cleaning up 86 unused index entries from index $SII of file 0x9.
Cleaning up 86 unused index entries from index $SDH of file 0x9.
Cleaning up 86 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

29254364 KB total disk space.
15018828 KB in 166929 files.
51104 KB in 14275 indexes.
0 KB in bad sectors.
296692 KB in use by the system.
65536 KB occupied by the log file.
13887740 KB available on disk.

4096 bytes in each allocation unit.
7313591 total allocation units on disk.
3471935 allocation units available on disk.

Internal Info:
b0 ea 02 00 df c3 02 00 71 b9 03 00 00 00 00 00 ........q.......
92 08 00 00 02 00 00 00 80 04 00 00 00 00 00 00 ................
a0 d2 ad 08 00 00 00 00 00 06 9b 83 00 00 00 00 ................
20 1c 89 19 00 00 00 00 60 18 e8 b6 06 00 00 00 .......`.......
80 36 26 46 02 00 00 00 40 34 74 a9 09 00 00 00 .6&F....@4t.....
99 9e 36 00 00 00 00 00 90 38 07 00 11 8c 02 00 ..6......8......
00 00 00 00 00 30 ad 94 03 00 00 00 c3 37 00 00 .....0.......7..

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



*******************************************************
2) Explorer.exe crash message: Although this message is similar to the others, it does contain Event Category: (100) which I believe most of the others say None.

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 3/10/2009
Time: 12:49:22 AM
User: N/A
Computer: SG6562
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 20 30 2e ure 0.
0018: 30 2e 30 2e 30 20 69 6e 0.0.0 in
0020: 20 75 6e 6b 6e 6f 77 6e unknown
0028: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0030: 20 61 74 20 6f 66 66 73 at offs
0038: 65 74 20 30 30 30 30 30 et 00000
0040: 30 30 30 000


****************************************************
3) Explorer.exe crash message: I hope I am not being redundant, but this appears somewhat different from the other one above (#2).

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 3/11/2009
Time: 9:42:55 PM
User: N/A
Computer: SG6562
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x71ab6a55.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 37 31 61 fset 71a
0050: 62 36 61 35 35 0d 0a b6a55..

*******************************************************
4) Winlogin: This is the record of Explorer.exe successfully restarting.

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1002
Date: 3/11/2009
Time: 9:43:20 PM
User: N/A
Computer: SG6562
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

*******************************************************
5) LoadPerf: Never heard of this before... I think this was just a warning message, not an error. The only significance is the time: right at startup, around the time that explorer.exe was having trouble.

Event Type: Information
Event Source: LoadPerf
Event Category: None
Event ID: 1000
Date: 3/10/2009
Time: 12:51:14 AM
User: N/A
Computer: SG6562
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data contains the new index values assigned to this service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 14 00 00 ....

*******************************************************
6) System Restore: This looks like the problem that kept System Restore from running on startup.

Event Type: Error
Event Source: sr
Event Category: None
Event ID: 1
Date: 3/2/2009
Time: 6:54:38 PM
User: N/A
Computer: SG6562
Description:
The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'EraserUtilDrv10910.sys' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 06 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 01 00 00 c0 .......?
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

*******************************************************
7) Symantec Antivirus: This appears to be a recurring Warning; I never noticed any problem beforehand, and if I hadn't been looking through the old logs for problems, would never have found it. But maybe there is some significance. I think there are several dozen of these warnings in the log for each startup.

Event Type: Warning
Event Source: Symantec AntiVirus
Event Category: None
Event ID: 6
Date: 3/9/2009
Time: 3:18:49 PM
User: N/A
Computer: SG6562
Description:


Could not scan 2 files inside C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Wrongapppath53.zip due to extraction errors encountered by the Decomposer Engines.

******************************************************
8) Security Alert: This Security Failure regularly occurs on startup.

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 3/11/2009
Time: 9:32:34 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SG6562
Description:
IPSec Services: IPSec Services failed to get the complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the applied IPSec filters. Please run IPSec monitor snap-in to further diagnose the problem.



For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

*******************************************************
9) Userenv: This log appears for every time the computer is shut down.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 3/11/2009
Time: 8:19:32 PM
User: NT AUTHORITY\SYSTEM
Computer: SG6562
Description:
Windows saved user SG6562\Me registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[rainforest123]

s:
I took no offense. I wanted to be sure that I did not offend you.

"I'm glad we have that straight."

HDD diag
Best choice is from your OEM or the HDD manufacturer.
Next choice: Hitachi, which purchased IBM's line.
I have used Hitachi's DFT on many non Hitachi brand HDDs.
www.hgst.com > support > downloads
Download DFT; for floppy disk if your PC has a FDD; the .iso if your PC doesn't have a FDD.
You will need optical disk burning software. The cd burning software built into XP will not burn .iso files.
I have heard of ISO burner, but never used it. I use Nero & Roxio.
You need to create a bootable CD.
You may need to enter your BIOS to set the Boot device order to look at the optical drive before the HDD.

Ah HA!
"I had trouble installing the new WGAPluginInstall before this trouble started"
Look through here, please.
http://www.google.com/search?hl=en&a...i=&safe=images

Safe mode > immediately upon reboot, tap the F8 key once a second until the startup menu appears.
use up / down arrow keys to select / highlight "safe mode"
enter
log in
acknowledge that the computer is running in safe mode.
watch for error messages
report results.

XP SP3 is supposed to fix some WGA & some explorer.exe issues
http://support.microsoft.com/kb/946480

http://support.microsoft.com/kb/913460/

http://support.microsoft.com/kb/938828/

I will plow through [ no offense ] your event viewer entries with more attention, later.

Do the above.

I am betting on your HDD as the culprit, based on event #1

RF123

[rainforest123]

All about WGA.

If your HDD passes diags, read this.
http://support.microsoft.com/ph/9860

RF123

[rainforest123]

s g:
How did you run WGA?

start > programs / all programs > accessories > system tools > activate

Or from the Microsoft web site. Earlier today, I obtained Windows updates and WGA appeared. ALSO, WGA Beta was offered. I declined & used
start > programs / all programs > accessories > system tools > activate

RF123

[sammyg]

When I was updating (Windows Update) another computer with a better connection, I found WGA as one of the updates present. I updated that computer, and then I jotted down all of the KB (Knowledge Base Files) for what appeared to be relevant updates for my computer and saved them to my disk for use later. I attempted to open the file when I got home, but the program refused to run.

[rainforest123]

Try activating Windows from system tools.

If you receive a report that Windows has been activated, reboot, to normal mode.
Copy the files from the disk / drive to your HDD. Right click each file; left click "properties" to verify that the files are not "read onlY"

Try to install an update.

RF123

[rainforest123]

s:
"program refused to run"
Was there an error message?

1. Activate Windows from system tools, as above. If successful,
copy files from CD to your HDD.
RIGHT click a file. Left click properties.
Verify it is not read only. If it is, left click on the "read only" box.
Left click "ok".
RIGHT click the file.
Left click "run" or "run as administrator".

If it still fails, return to the event viewer and look for errors that occurred at the time you tried to run the update.

RF123