Event viewer

This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.


Thread Starter
May 1, 2011
Tech Support Guy System Info Utility version
OS Version: Microsoft Windows XP Home Edition, Service Pack 3, 32 bit
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz, x86 Family 15 Model 4 Stepping 1
Processor Count: 2
RAM: 1015 Mb
Graphics Card: Intel(R) 82915G/GV/910GL Express Chipset Family, 128 Mb
Hard Drives: C: Total - 232868 MB, Free - 198992 MB; D: Total - 1430796 MB, Free - 718310 MB; E: Total - 5585 MB, Free - 330 MB;
Motherboard: ASUSTeK Computer INC., Goldfish2, 1.xx, X312345678
Antivirus: avast! Antivirus, Updated: Yes, On-Demand Scanner: Enabled

While looking in Event Viewer for clues to a system lock-up, I noticed entries that have me curious. There seems to be no time correlation to the problem I was researching but concerning to me none-the-less.

In system events, there is a long string of errors.
Screen shot

In Security, a very long list of “Anonymous” logon/logoff events over a good number of hours.
Screen shot

Being a novice with event viewer, should I be worried?

May 7, 2011
I think the first screen shot is a sign of corrupted system files on the hard drive and the second screen shot is normal.

System lock ups are often due to a problem on the hard drive. Start by running a disk check as follows and then post the log.

1. Click on Start > type cmd in the search box and enter. At that c: prompt, type chkdsk /f exactly as written here with the gap before the slash, then hit Enter.
2.You will then see a message "Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)"
Type Y for yes, and press enter. Then reboot the computer into normal mode. Chkdsk will start when Windows begins loading again. Let all 5 phases run and don't use or turn off the computer. (The chkdsk process may take an hour or more to finish and may appear to freeze which is normal.)
3.Chkdsk finds any corrupted files that are causing the problem and fixes them. Read the results of each phase as it finishes. During the final phase, it will notify you if it finds any corrupted files. It also checks for bad blocks on the drive surface.
4.When the Check Disk is done, it will finish loading Windows.

To obtain the log:
Go to Start > Run and type: eventvwr.msc /s , and hit enter.
When Event Viewer opens, click on "Application", then scroll
down to "Winlogon" and double-click on it. This is the log
created after running Checkdisk, copy & paste it into your next post.


Thread Starter
May 1, 2011
Hi Mark1956,
Thanks for the reply,
Here is the chkdsk log.

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 12/8/2011
Time: 2:42:45 PM
User: N/A
Computer: HOME
Checking file system on C:
The type of the file system is NTFS.
Volume label is HP_PAVILION.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 2 unused index entries from index $SII of file 0x9.
Cleaning up 2 unused index entries from index $SDH of file 0x9.
Cleaning up 2 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

238457519 KB total disk space.
34233120 KB in 106132 files.
41748 KB in 9897 indexes.
0 KB in bad sectors.
274391 KB in use by the system.
65536 KB occupied by the log file.
203908260 KB available on disk.

4096 bytes in each allocation unit.
59614379 total allocation units on disk.
50977065 allocation units available on disk.

Internal Info:
e0 46 02 00 47 c5 01 00 9c 8b 02 00 00 00 00 00 .F..G...........
7c 01 00 00 04 00 00 00 49 01 00 00 00 00 00 00 |.......I.......
1e 39 2b 05 00 00 00 00 fe a3 25 2e 00 00 00 00 .9+.......%.....
ae e1 e7 0a 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 e6 74 d0 47 00 00 00 00 .........t.G....
e0 f3 f2 a6 00 00 00 00 b8 3a 07 00 94 9e 01 00 .........:......
00 00 00 00 00 80 6c 29 08 00 00 00 a9 26 00 00 ......l).....&..

Windows has finished checking your disk.
Please wait while your computer restarts.

May 7, 2011
Ok, the log shows a good result. Now I would check the memory by following this guide:

Preliminary checks
You should first check the model of RAM stick that you have on the manufacturers site for the recommended voltage setting and then make sure it is set correctly in the PC's Bios. An incorrect voltage setting may be the reason for your problems so test the PC's performance again if the voltage was incorrect.
Errors can also be caused by dirty contacts, mismatched sticks or using them in the wrong slots. Check all sticks are the same make and specification, check the motherboard manual for the correct slots to use. Remove all the sticks and clean the contacts with a soft pencil eraser and blow out the slots with a can of compressed air.
Download Memtest86+ from here
When the download is complete right click the file and select Extract Here and burn the image to a CD.
In windows 7 right click the extracted file, select Open With, then select Windows Disc Image Burning Tool then follow the prompts. For all other versions of windows (if you do not have an ISO burner) download this free software. ImgBurn
Install the program and start the application. Select the top left hand option to burn image file to disk and then on the next window click on the small yellow folder icon and browse to the ISO file you have downloaded. Then click on the two grey discs with the arrow in between (bottom left) and leave it to complete the operation.
Boot the PC into the Bios setup and set the CD/DVD drive to 1st in the boot sequence. Insert the disk in the drive then reboot and the disc will load into dos. Leave the test to run through at least 8 cycles or until it is showing some errors. If errors show in the test, remove all but one of your RAM sticks and repeat the test on each stick until you find the one that is faulty. This is a long slow test and should ideally be run overnight.
The memtest will not be 100% accurate but should easily detect any major faults.
Always disconnect your PC from the mains supply when removing Ram sticks and earth your hands to discharge any static electricity to avoid damage to sensitive components. If performing this test on a laptop PC you should also remove the battery before removing or replacing the RAM sticks.


Thread Starter
May 1, 2011
Hi Mark1956,
Sorry for the delay. I already had a disc w/ Memtest86 burned on it as I had used it before. It ran overnight w/ no errors. It seems my problems had to do with my backup routine. Why is a mystery. I have two desktops in the house both connected to the cable wirelessly through a Linksys router. I recently set up a workgroup and had some problems doing it as one machine runs XP Home and the other runs XP Pro. The "Home" machine has a second hard drive ("D") of 1.5 Tb where I was backing up both computers "C" drives using Ghost 15. When I stopped backing up The "Pro" machine, the "Home" machine quit having the "hang" problems which I was trying to solve that started all this with Event Viewer. Strangely, I can backup the "Pro" manually with no problem but not on a schedule with Ghost. I guess I'll just have to remember to do it every couple of days.
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online