Wednesday, May 6, 2009

Event ID 1530 :: User Profile Service

My Experience:
This warning appeared multiple times in my event log:

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterward.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-793170598-2248495922-3383009104-1011_Classes:
Process 972 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-793170598-2248495922-3383009104-1011_CLASSES


The Cause:
It is a side effect of upgrading directly from XP to Vista. There is an old utility UPHClean which is trying to do the same thing that was built into Vista. More information here.

The Fix:
Sadly, there is no fix, but it's simply how the operating system works. Do note that not all 1530 events are the same. The ones from winlogon.exe and svchost.exe can be safely ignored because this is normal behavior.

My Results:
Though it is adding to the numbers of events I have in my loge, I'm having no issues.

Friday, May 1, 2009

svchost.exe (netsvcs) Eating Memory and Resources

My Experience:
My computer would slow down tremendously at random times so that I could barely do

The Cause:

The Fix:

My Results:

Cannot Move/Edit/Delete Files

My Experience:
I had problems moving, editing, and most of all deleting files that my computer told me that I had no permissions to. The way to give yourself permissions is grueling pain and takes about 10 clicks and typing. Oh, the misery.

The Cause:
Vista permissions weren't built to mesh with XP very well or in general so it doesn't allow you to do things that you should be able to do.

The Fix:
Best. Download. Ever. I take no credit for this little program/registry edit, and I love whoever made it. This simple button gets put in your right click menu and allows you to take permission of a file or a whole folder and all the files underneath it in one click... well two technically.

Click here to Take Ownership of Vista


My Results:
I've used this countless times to edit and delete files. For all the posts I have about removing things from the shell right click menu, this is 100x better than those are bad.

Virus Protection Not Found

My Experience:
Every time that I restart my computer, an annoying little pop up box would appear to tell me that I have no virus protection program on my computer when I obviously do have McAfee Security Center.

The Cause:
This gets pretty far down into being plain stupidity. Windows Defender does not refresh and update the fact that you have Virus software installed correctly.

The Fix:
There are several ways to avoid this problem, but I have found no way for Security Center to truly recognize the installed antivirus software.

The simplest way is to open Security Center by clicking the bubble that pops up and clicking "Change the way Security Center alerts me". Then select one of the other options so you do not see the annoying bubble at teh buttom of your screen. You may also miss other important notifications with this method.


This solution was advised, but did not end up working for me: restart the Security Center properly so that it can re-search for your antivirus software.
  1. Click the start menu and type "services" then press enter.
  2. Find the "Security Center" service and right click it and press properties then select "Disabled" from the Startup Type menu.
  3. Restart your computer.
  4. Type "services" and enter into the start menu again.
  5. Find the "Security Center" service and right click > properties. Set the Startup Type to "Automatic (Delayed Start)".
My Results:
not done

Event ID 8193, 8210 :: System Restore

My Experience:
I was unable to create Restore Points. The following errors were in the Event Log:

Source: System Restore
Event ID 8193

Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x81000101).
OR
Failed to create restore point on volume (Process = C:\Windows\system32\svchost.exe -k netsvcs; Descripton = Windows Update; Hr = 0x81000101).
OR
Failed to create restore point on volume (Process = [some file and process] ; Descripton = [description]; Hr = [hexadecimal number]).

Source: System Restore
Event ID 8210

The scheduled restore point could not be created. Additional information: (0x81000101). [alternatively (0x800423f3)]


The Cause:

The Fix:

My Results:

Event ID 1008, 1010 :: Perflib

My Experience:
I experienced the following errors in the Event Log.

Source: Perflib
Event ID 1008

The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

Source: Perflib
Event ID 1010

The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.


The Cause:
The file at C:\Windows\system32\emdmgmt.dll is part of the ReadyBoost system in order to make your computer go faster by using flash memory or other things to speed up processes that usually wriet to your disk which is one of the slowest things your computer does.

It was weird because I don't even use this service, I have tried but all my flash drives and external HD were not fit for ReadyBoost.

The Fix:
- Disable readyboost

My Results: