Dr. Watson log - can any7one read it and advise 1

[RBHirsch]

Well, my old shutdown crashes returned after a fair number of days without them.

The reference is again to "winlogon.exe".

Below are the first few lines of the Dr. Watson log during the last shutdown crash.

I'm only posting these few lines, as the full log is quite large.

Can anyone tell anything from the material below? Would the full log be more useful? If so, can it be pasted into a message - it's a bunch - all relating to the latest sincle incident. There's no stuff in there from prior incidents - it's a fresh log

Ron Hirsch

+++++++++++++++++++

Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.



Application exception occurred:
App: \??\C:\WINDOWS\system32\winlogon.exe (pid=868)
When: 11/5/2007 @ 11:10:14.046
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: RBH1
User Name: SYSTEM
Terminal Session Id: 0
Number of Processors: 2
Processor Type: x86 Family 15 Model 35 Stepping 2
Windows Version: 5.1
Current Build: 2600
Service Pack: 2
Current Type: Multiprocessor Free
Registered Organization:
Registered Owner: Ronald Hirsch

*----> Task List <----*
0 System Process
4 System
748 smss.exe
840 csrss.exe
868 winlogon.exe
912 services.exe
924 lsass.exe
1096 svchost.exe
1172 svchost.exe
1272 MsMpEng.exe
1328 svchost.exe
1424 svchost.exe
1536 svchost.exe
1676 aawservice.exe
2020 brsvc01a.exe
2044 brss01a.exe
160 spoolsv.exe
604 avgamsvr.exe
636 avgupsvc.exe
472 avgemc.exe
808 nvsvc32.exe
1212 svchost.exe
1252 Tablet.exe
1396 Error 0xD0000022
1740 BRMFRSMG.EXE
2448 PDSched.exe
3116 alg.exe
3468 wmiprvse.exe
3692 wuauclt.exe
3788 logonui.exe
3964 drwtsn32.exe

 

[stduc]

It would be more helpful, to me, if you uploaded a minidump somewhere and posted a link to it here - then I could analyse it for you.

[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[linney]

Exception number: c0000005 (access violation)

Sounds like a Permissions problem?

How To Reset Security Settings Back to the Defaults

http://support.microsoft.com/?id=313222#1

Have a look at the SubInAcl tool mentioned in this thread.
Not Getting a "Save As" dialog
thread779-962708

If you want the highly technical cause of the crash look in the Documents and Settings/ All Users/ Application Data/ Microsoft/ Dr Watson/ Drwtsn32.log

Find the entry that is relevant by date and time to the crash you are investigating. The exact cause of the crash is indicated by "FAULT ->" on the left of page next to line of code causing crash. This, if your as cluey as me, wont tell you much but you can use it to see if it is the same fault all the time, and further up the log you can find what processes and modules are running.

 

[RBHirsch]

Studuc,

I don't really have a place to load the file into.

Ron
+++++++++++++++++++++++

Linney,

Thahks for the links.

As has been the history of my shutdown crashing, the various MS docs talk about losing permission to access things, and causing the shutdown to crash with the "winlogon.exe" error messages.

Most of the time, logging off first, and then shutting down does stop a lot of the crashes.

I have done a full scan/chkdsk of the C drive - took a long time. No bad sectors or other problems found.

But there is something that concerns me. True Image may well be involved. It's been acting strangely since the start of these problems. I got full instructions for totally removing it, as the original uninstall left tons of stuff, since the program's uninstall wouldn't work, nor woujld any olther uninstall program work. This involved a large amount of Registry editing, which I did, after which the system was totally free of all traces of True Image version 11. I then created an image of that state, using the recovery CD, and storing the image on Drive F.

I then reinstalled TI 11, and the same problems occurred with it. The install froze at almost the end of the install, and the program windows, once opened, won't close. The program doesn't show in any of the usual "uninstall" locations. And runnng the install EXE program file doesn't offer the usual uninstall/modify/repair" options. The system doesn't recognize TI as being installed - when clicking on HELP>ABOUT, my Registration nubmer does not show - just a message implying that this is a trial verszion.

There is something that I don't recognize in this whole matter. TI has an option to create a secure zone. And, on occasions, during a shutdown crash, there have been error messages mentioning "secur_zone". The sccure zone is usually a hidden partition on the system drive, so it doesn't show in the usual file manager.

But, when I boot up via the TI recovery CD, which loads then runs TI, there is something I don't recognize in the listing of drives. All drives are shown as a single drive letter. But the C drive has another something listed below, as part of it, with the words "MBR and Track 0". This strongly resembles a hidden partition, which I never created. But, it has a size of Zero, as the size of the C partition shows exactly the same as all the other three 400 GB drives - 372 GB. And True Image, when booted via the CD, does not show that there is any "secure zone" created.

The only thing I know which is "MBR", is the Master Boot Record. But I didn't think it would show there, like that. I have a message into Acronis, asking about that.

If indeed that is a "piece" of something that should not be there, I would like to get rid of it. But the only way I know how to do that would be to format the C drive, and then restore the image I've created of the recent state after removing all of TI. I would assume that formatting that drive first, would clear out that "whatever", and that the image I created does not have that present on it.

What's the best way to format the drive, and then restore the image. Can I format the drive by using my BART CD, which I assume has a format command on it. Then I could shut down, and boot up with my TI recovery CD, and restore the latest image. How does that sound?

Ron

 

[linney]

Sounds complicated to me. The only Image I would restore would be from the XP CD, a clean install and a clean start is what your machine may need. The sad and sorry tale begs for this type of solution, and once you get into the Registry as extensively as you have (while it may be a good learning experience) the outcome usually is a corrupted system.

I don't think the MBR 0 is anything of concern, but I am not familiar with Acronis software, I just base that observation on the Terabyte Imaging software I use. I see a MBR entry above the C: drive entry on the list of drives. Possibles causes at a guess, may be that this is how the MBR is represented, or perhaps it has something to do with Extended Partitions. Anyway I do see the same type of entry as you describe. If you can, see if any one you know has an Imaging program, and see how that is displayed.

Incidentally if you want to try something besides Acronis have a look around here.

Terabyte Unlimited

http://www.terabyteunlimited.com/prodgrid.html

The Acronis forums are at Wilders.

http://www.wilderssecurity.com/

Your Acronis may have reverted to a Trial version if something is missing from the Registry, or you haven't entered the license details.

As to formatting, I would use the XP CD, if you intend to follow it by a clean install of XP. BartPE has a formatting option if you right-click on the target drive.

Some people use Darik's Boot and Nuke for a thorough formatting.

http://dban.sourceforge.net/