Reply
Occasional Contributor
ballina
Posts: 24
Accepted Solution

Computer shuts on and off some corrupted files - no virues now

Listed below are some of the errors I found on event log in the laptop:

 

I have a Qosimo 8 megs of memory, windows 7 64 bit. Running AVAST 7.0 antivirus and Malwarebytes - both paid subscriptions. I think the model number is 830 530 I bought in 2009.

 

The shutdown problem has

been happening on and off for the last six months. I had two major instances of trojans taking over my machine and it caused constant shutdowns. AVAST worked with me on one and they had me use malwarebytes and spybot and hijack this. They took over my computer to get it up and running properly, but this new round of errors a trojan was found in the registry key and the startuptoolbar. Two nights ago I had another shut down several times and after running malwarebytes and antivirus I could find no errors so I’m leaning toward corrupted files? Is there anyway to fix these files without having to reformat the hard drive?

 

I did run a computer repair and a computer memory repair tonight using F8 and no problems were found by the computer. I’m not sure what to do with these errors in event viewer.. I get the toshiba error

quite often and it madely stops me from going online with my internet connection, and I had downloaded a newer version but same problem – I use windows repair in network and the error is always resetting the toshiba network IP. I just put a note into toshiba on that problem.

 

I also use microsoft silverlight for my fenderfuse application which needs that software operate properly. I’m not sure exactly what to do with that Custom dynamic link libraries are being loaded for every application. It states to check libraries – but what am I checking for? I do not have a lot of programs on the laptop but not sure what to look for in library?

 

Windows logs under Application

The description for Event ID 0 from source Ipod service cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

 

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event

 

The description for Event ID 0 from source SignInAssistant cannot be found. Either the component

That raises this event is not installed on your computer or the installation is corrupted. You can

Install or repair the component on the local computer.

 

If the event originated on another computer, the information had to be saved with the event. The following information was included with the event:

WLD InitializationTimerQueue. QueueWorkItem Started

 

The win logon notification subscriber <sessionEnv> was unavailable to handle anotification event.

 

The description for Event ID0 from source IViRegMgr cannot be found.

 

Same for AdobeARMservice

Same for User Profile Service

 

Critical events

 

System has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, rashed or lost power inexpertly.

 

Administrative
Events

Unloading the performance counter strings for service WmiApRpt failed. The first DWORD n the data section contains the error code.

 

The performance strings in the performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance Registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data Section, and LastHelp value is the third DWORD in the data section.

 

Several warnings on Toshiba Servicer Station. Error checking dependency (1df917db-3056-41a-bbac-0489a6b63d4dj: Unable to retrieve registry value.

 

Toshiba Service Station - skipping empty element (tsu:setup_args) (several errors on this one)

( I also installed the latest Toshiba service station and it did not fix the error problems in events log.  When I did a restore it was before softare update this was added so now my computer is working properly with windows on connecting to the internet wireless.)

 

Unloading the performance counter strings for service WmiApRpl (wmiaprpl) failed. The first Dword in the Data section contains the error code.

 

Failed extract of third-party root list from auto update cab at: www.download.windowsupdate.com/msdownload/udate/v3/static/trustedr/en/authrooststi.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

 

Biggie? Custom dynamic link libraries are being loaded for every application. The system administration should review the list of libraries to ensure they are related to trusted applications.

 

Audit events have been dropped by the transport. 0

The system has rebooted without cleanly shutting down first. Kernel-power - this has happened several times.

 

The performance strings in the Performance registry value is corrupted when process Performance extension counter provided. The BaseIndex value from the Performance registry is the first DWORD in the data section, last counter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the data section.

Sometimes my computer shuts down often on its own and I find a Trojan - other times it shuts down often during a start up and I find no viruses as was the case yesterday.  Today I did not get on the internet and the computer worked fine.  

 

 I guess I need to know if there is a way to reinstall the corrupted files without having to go back to the default settings when I got the computer.  Does toshiba have a windows repair disc that works better then what I did with using F8 and having a system repair and memory check done that found no errors?  I also installed the latest Toshiba service station and it did not fix the error problems in events log.  When I did a restore it was before this was added so now my computer is working properly with windows on connecting to the internet wireless.

 

Malwarebytes said that by looking at these event viewer logs that it does not appear that I have a virus now but I do have corrupted files and can toshiba help me in getting them fixed.  I really hate to do a complete reformat.

 

Thanks

Rose

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no virues now

Rose

 

There's a Toshiba label on the bottom of your computer, look at that and give us your exact model name and number, like Qosmio X505-Q830. Also, if yours is not a USA model we need its part number like PQX33U-00K00H.

 

Back up all your user files, music, pictures, etc, any files that you want to keep. After you give us your correct full model name/number and part number, we will try to perform a Toshiba recovery to restore your unit to its factory default out-of-the-box setup.

 

So, this will require you to back up all your user files before the recovery, then to reinstall all your third party software and user files after the recovery.

 

Mike

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no viruses now

Mike, I was hoping to avoid doing that.  What is strange is that my laptop has worked perfectly the last two days, however I did not go on the internet and it appears that when I do then my troubles start with Toshiba service station and the other errors that you see.  

 

I assume there is no way that I can get these corrupted files replaced?

 

I noticed when I did F8 to do system repair their was a Toshiba recovery wizard - does that do the same thing your

suggesting?  I also made 4 DVD's  when I opened up my laptop for the first time.  Will these work?

 

Meanwhile I will start copying all the personal files on my laptop.  I have to dig through my download files too as I recently did some new programs on the laptop.

Thanks

Rose

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no virues now

[ Edited ]

miker643 wrote: There's a Toshiba label on the bottom of your computer, look at that and give us your exact model name and number, like Qosmio X505-Q830. Also, if yours is not a USA model we need its part number like PQX33U-00K00H.

Until you give us the above info, try this. Click on 'Start', type in   msconfig.exe  , and click on this file, click on the 'Startup' tab at the top, scroll down and look for 'Toshiba Service Station' and remove the check mark from this, click 'Apply', click 'OK', reboot your unit. Then go on the Internet and just surf normally, do NOT try to run Toshiba Service Station. What happens?

 

You should still back up all your info (you should always have backups), it's great you already made the recovery disks, but running the recovery utility off the HDD partition will be much faster, if we still have to do it. But, let's just try the above for the moment.

 

Please get back to us with the above info, and let us know what happens with your system after we disable Toshiba Service Station.

 

Mike

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no virues now

[ Edited ]

Hi mike,

Here is the info:

Qosmio X505-Q830

Serial XXXXXXXXXXX

P/N PQX334-00K00H

 

I cannot tell if my computer was made in US or not.

 

I just shut off Toshiba service station now and I probably should do the recovery process.  So let me know

if what I said - Toshiba recovery wizard in F8 or the 4 DVD's that I made when I first started my Toshiba

is okay to use.  I'm concerned about that dynamic access affecting all my applications so best to just clean the drive and reinsert programs.

 

Thanks

Rose Gatto

 

 

 

 

[Moderator edit to remove serial.] 

Super Advisor
cbwilsha
Posts: 3,848

Re: Computer shuts on and off some corrupted files - no virues now

Mike is sleeping right now, Rose (or should be!:smileylol:). Yours is a USA model (sold here, not made here). If things are working OK now, why do a recovery? But to answer your question about recovery, either method works but I recommend ( and I believe Mike will too) using the HDD recovery method because it's much faster and doesn't rely on the ODD.  However, if you were to try the HDD method and it didn't work, you could still use the ODD method.

 

In any event, to reiterate, don't do either right now. I'm sure Mike will comment when he awakes.

 

C.B.

C.B.

Toshiba Sat. L675D-S7016 Win 8 PRO 64 Bit---Toshiba Sat. L775D-S7132 Win 7 PRO SP3 64 Bit which also has Virtual Machine with Win XP SP3---Toshiba Sat. L305-S5921 Win Vista SP2 32 Bit
Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no virues now

Rose

 

As CB mentioned, do not do the recovery just yet. We wanted to test what would happen when we disabled the Toshiba Service Station. Is your system more stable? That is, has it stopped giving you all event 'errors' you were getting before. Does everything seem to be working OK now?

 

BTW, the reason CB mentioned I was sleeping, is because I live Seoul South Korea. So, I'm asleep when you're awake and vice versa.

 

Mike

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no virues now

Event Viewer  5/14 events

Window logs

Application –

Information - Software protection service has stopped

 

Error – Unloading the performance counter strings for service wmiaprpl failed.  The first Dword in the data section contains the error code

 

The performance strings in the performance registry value is corrupted when process Performance ext

The winlogon notification subscriber <SessionEnv> was unavailable tohandle a notification events

 

Error – Your computer was not assigned an address from the network (by the DHCP) Service) for the Network Card with network address0x701A043A07AE.  Your computer willcontinue to try and obtain an address on its own from the network address (DHCP ) server.

 

Failed extract of third-party root list from auto update cab   CAPI2

 

Warning – customer dynamic link libraries are being loaded for every application.  The system Administrator should review the list of libraries to ensure they are related to Trusted Aplications.

 

The performance strings in the Performance registry value is corrupted when process Performance extension counter provider.  The baseindex value from the performance registry is the first Dword in the data section, etc. – this error shows up often for today 5/14  (on line the aqnswer to this error is  -

 Performance counters are collected and used by services and applications. If they are installed incorrectly or with improper permissions, performance counters cannot be loaded, and services or applications cannot collect or interpret the data.

 

I noticed that software protection stopped and then it showed software protection working.  I did not get any critical stop errors like I did before but that is because I don’t have any Trojans or viruses.  I ran a full scan with both Avast and Malwarebytes yesterday and no problems.

 

Under system for today I see

 

The multimedia Class Scheduler Service entered the stopped state.

 

The application experienced service entered the stopped state

Under application Window logs for today

 

Fault bucket 130885241, type 5 Event Name PNDriverimportError  response: not available

 

This is a warning error:

Windows detected your registry file is still in use by other applications or services .  The file will be unloaded now.  The applicationsor services that your registry file may not function properly afterwards.

10  user registry handles leaked from \Registry\User\(this section covered several registry problems I sent the note online and this is what they state:  Cause this behavior occurs because the windows operating system automatically closes any registry handle to a user profie that is left open in an application.  User Action – this is a warning event the application that is listed in the event detail is leaving the registry hand open, and it should be investigated.

 

I don't know how serious this probems are - I didn't like seeing the software security being stopped.  But then it started up.  I have copied everything personal on this laptop so I am ready to reformat if needed.  

 

I still have the problem about IE not opening links unless I right button click to open it.  I also had to make a separate ID to run Fender Fuse software as this computer was not recognizing the USB slot where I connect the amp to the laptop.  Fender had me set up another id with minimum items and then I was able to connect to the amp and make changes.

 

Rose

 

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no virues now

[ Edited ]

Rose

 

Your machine seems to be a mess. Trying to troubleshoot the error messages you're posting, without seeing dates, times, what error message begins the plethora of error messages you list, is just too hard from a distance.

 

We're back to this. Performing a Toshiba Recovery is considered the gold standard test on whether you have actual hardware problems, or it's really software/driver/update problems.

 

Let us know when you're ready to do it.

 

Mike

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no viruses now

Mike, all that information was from 5/14/2012.  I did some trouble shooting on those messages and was able to fix one item.  There was no clear answer to fix the dynamic range problem.

 

I am ready to do the recovery, as I spent a good bit of time yesterday copying many of my personal files.  Let me know to use for the recovery

 

Rose

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no viruses now

[ Edited ]

Qosmio X505-Q830 Specifications

Qosmio X505-Q830 Downloads

 

 

If you have not all ready done so, you should make a set of Toshiba Recovery disks/media for emergency back up, as directed on page 69 of your User's Guide, you'll need at least 4 DVDs, or a 16GB+ USB thumbdrive. After creating the recovery media, put it aside and run the recovery utility from the recovery parition on your HDD as instructed on page 61 of your User's Guide.

 

Toshiba laptops are very finicky about only using Toshiba supplied hardware drivers to work properly. That's why I recommend disabling automatic Windows Updates. When the recovery utility is setting Windows up, at some point Windows will ask 'Do you want to allow automatic Windows Updates?'. Answer 'No, I will decide later'.

 

Then after Windows is finished being setup, click 'Start - All Programs - Windows Update', on the menu at left click on 'Change settings', under 'Important updates' click on the drop down menu at right and choose 'Never check for updates (not recommended)', and click OK.

 

Next, before installing any software, doing any updates or restoring your data, test your system and see if it is operating smoothly, and without your laundry list of event errors.

 

Please let us know how it turns out. If everything seems to be running well, we'll have a few more things to do before finishing off.

 

Good luck.

 

Mike

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no viruses now

I have the 4 original DVD's that I made when I first used the laptop.  So I don't need to make another set of recovery DVD's and I have copied personal documentation all ready.   

 

Page 61 offers two ways to recovery and I am assuming that by picking recovery without changing the internal storage drive partitions is the right one to pick per what I think you said in your last email.  Since I was having trouble with Toshiba service (I did a delete and reinstall taking a later date installation from Toshiba website a while back) and still had errors (you had me stop it from loading in one of our prior emails this past week)  that by doing this recovery out of the box state is the right one to do.  I hate to do new DVD's now and then pick up the application problems with the current version of Toshiba service station that is installed.

 

Then I should check the computer out and then do I bring up Toshiba service station and let it install additional updates or should I download them and install based on the link you gave me for Toshiba updates / downloads. Or do I come back to you and do not download anything until you have me check out more activities?

 

Just want to make sure I have it right.  

Rose

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no viruses now


miker643 wrote:  run the recovery utility from the recovery parition on your HDD as instructed on page 61 of your User's Guide. (keep the default configuration, the factory default out-of-the-box setup)...

 

Next, before installing any software, doing any updates or restoring your data, test your system and see if it is operating smoothly, and without your laundry list of event errors.

 

Please let us know how it turns out. If everything seems to be running well, we'll have a few more things to do before finishing off.


 

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no viruses now

Hi Mike,

Took quite awhile for the recovery but everything went well. I have a few errors but none of the errors that I had before, which is a plus and Internet Explorer is opening links now too.

 

This is what I found in event recovery - administrative events:

 

Error 1: The ip address lease 192.168.1.2 for the network card with network address 0x701A043A07AE has been

Denied by the DHCP server 0.0.0. (The DHCP Server sent a DHCPNACK)

 

I have high speed cable and I do not have a static ip address so I’m not sure why this error came up , but it has several times already. Based on the answer below- I guess I do nothing? I have EarthLink high speed cable and they rent space on Bright House network. The servers for Earthlink are in Tampa, but if I have service issue I call bright house first.

Here is what the online reply was from Microsoft.

Event ID 1002 — DHCP Client Address Conflicts

43 out of 68 rated this helpful - Rate this topic

Updated: January 8, 2009

Applies To: Windows Server 2008 R2

Dynamic Host Configuration Protocol (DHCP) operates on a lease renewal basis. During the leasing process, IP address conflicts can occur as leases are renewed and expired. Client lease requests might be denied by the server for invalid (out of pool) or duplicate IP addresses. Multiple IP address conflict messages can indicate that your lease period, your scope, or both, need adjustment in your DHCP server configuration.

 

Error 2 - The driver detected a controller error on \Device\Harddisk2\DR2

No help from Microsoft online on this one.   This has only occurred once so

far. Now I did have my Toshiba external drive on and is this why is states hard disk 2?  It is a terabyte drive and

I had downloaded a new avast internet security files and I saved it to the external drive.  The drive is almost new as I have not used it hardly at all since I bought it.  I'm starting to use it now as a main backup on files. 

 

Warning number 1:

Possible Memory Leak. Application (C:\Windows\System32\schist.exe-K Local service Network

Restricted) (POD:828) has passed on a non-null pointer to RPC for an [out] parameter marked [allocated(all_nodes). [Allocate(all_nodes)] parameters are always reallocated; if the original pointer

Contains the address of valid memory, that memory will be leaked. The call originated on the interface with UUID {3f31c-2545-4b7b-9311-9520e8bffef6}, Method number (20). User Action: Contact your application vendor for an updated version of the application.

 

I have not seen this error before. I did upgrade my memory to 8 gigs - two 4gig Toshiba memory a year ago. Don’t know if that has anything to do with this above or not. I checked the memory sticks and they are set in well. I also verified that the laptop is seeing 8 gigs of ram. This error has only happened once and has not appeared again since I turned off the laptop and then turned it again to finish testing.  The specs on the motherboard states max is 8 gigs on this laptop.

 

Will check in tomorrow to see what else you want me to do.

Thanks

Rose

 

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no viruses now

[ Edited ]

Rose

 

First, administrative events are, generally speaking, nothing to worry about. I have hundreds of Administrative Events, never look at them, never worry about them, my machine runs fine. I have 17 of these 'Error' & 'Warning' events from today alone.

 

The Windows Logs, specifically System and Application events, are all you really need to concern yourself with.If you don't have any Errors or Warnings in those logs, don't worry about it.

 

Mike

Occasional Contributor
ballina
Posts: 24

Re: Computer shuts on and off some corrupted files - no viruses now

No errors in either logs so I thank you for all your help and I will begin to selective add updates.  I should have a ton of window update,s  as if I remember right their were 3 service paks since I bought this laptop.

Rose

Super Advisor
miker643
Posts: 3,275

Re: Computer shuts on and off some corrupted files - no viruses now

When you get your Windows Update list, carefully check both the Important and Recommended updates. Do NOT let Windows update change or update any of your laptop's hardware driver/utilities. Keep running 'Check for updates' and reboot as necessary until there are no more updates. But, NEVER let Windows Update change your hardware driver/utilities.If you get any hardware drivers, remove the installation check mark, right click on the update, left click on 'Hide update', then it will never give you this update again.

 

Mike