BleepingComputer.com: Vista BlueScreen Event ID 10,10005,4609

Hello. I have searched the forum topics but haven't been able to find an answer. I hope it is ok to post this question.

I have an Acer Aspire ax1700-u3700a with Vista Home Premium 64bit 4gb ddr2

I had the computer BlueScreen last night 2x, then again this morning. The error messages in the event log are ID 10, ID 10005, and ID 4609.

I am running in safe mode with networking right now. I believe the crash corresponds to the computer going to sleep(why it all of a sudden started happening is beyond me).

I found a possible solution to try with updating the graphics driver but when I went to do that, there were no updates for the driver I have(nvidia geforce g100).

I printed out Windows Technet's support for the errors, but didn't/couldn't increase the size of the page file, do anything with free memory to end a process, or verify that the component services were set properly, etc(I'm not terribly tech-savvy at all and did not want to do something terribly wrong). I did change the Remote Procedue Call(RPC) locater to started(it previously said nothing).

I tried to contact Microsoft, but was told that since the os was installed at purchase of the computer that I needed to contact the manufacturer. I sent Acer an email but as of yet haven't heard back.

I found this site doing seaches for solutions(which was where I found about the graphics driver update)

If disabling the sleep mode is the solution, how would I do that? I looked but couldn't find anything of that but I probably wasn't looking in the right place.

Thanks for any help anyone can give me.

EDIT: 1pm I found I was using the balanced power settings. I changed the put the computer to sleep option to never, the turn off display is set to 15 mins(I didn't change that) and restarted in regular operating mode. I guess I will see if that solves any or all of my errors.
EDIT:2pm the above didn't work and the BlueScreen happened again.
Any help would be greatly appreciated. I am back in Safe Mode with Networking.
Here is the copy from Event Viewer:(these repeat each time the computer crashes.)
Log Name: Application
Source: Microsoft-Windows-WMI
Date: 3/23/2009 2:09:58 PM
Event ID: 10
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
<EventID Qualifiers="49152">10</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:58.000Z" />
<EventRecordID>5590</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data>//./root/CIMV2</Data>
<Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage &gt; 99</Data>
<Data>0x80041003</Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 3/23/2009 2:09:12 PM
Event ID: 10005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server:
{9E175B6D-F52A-11D8-B9A5-505054503030}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10005</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:12.000Z" />
<EventRecordID>89681</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">1084</Data>
<Data Name="param2">WSearch</Data>
<Data Name="param3">
</Data>
<Data Name="param4">{9E175B6D-F52A-11D8-B9A5-505054503030}</Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 3/23/2009 2:09:08 PM
Event ID: 10005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10005</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:08.000Z" />
<EventRecordID>89680</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">1084</Data>
<Data Name="param2">WSearch</Data>
<Data Name="param3">
</Data>
<Data Name="param4">{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}</Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 3/23/2009 2:09:07 PM
Event ID: 10005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server:
{145B4335-FE2A-4927-A040-7C35AD3180EF}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10005</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:07.000Z" />
<EventRecordID>89678</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">1068</Data>
<Data Name="param2">fdPHost</Data>
<Data Name="param3">
</Data>
<Data Name="param4">{145B4335-FE2A-4927-A040-7C35AD3180EF}</Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 3/23/2009 2:09:07 PM
Event ID: 10005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10005</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:07.000Z" />
<EventRecordID>89677</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">1084</Data>
<Data Name="param2">EventSystem</Data>
<Data Name="param3">
</Data>
<Data Name="param4">{1BE1F766-5536-11D1-B726-00C04FB926AF}</Data>
</EventData>
</Event>
Log Name: Application
Source: Microsoft-Windows-EventSystem
Date: 3/23/2009 2:09:07 PM
Event ID: 4609
Task Category: Event System
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043c from line 45 of d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />
<EventID Qualifiers="49152">4609</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>16</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:07.000Z" />
<EventRecordID>5586</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp</Data>
<Data Name="param2">45</Data>
<Data Name="param3">8007043c</Data>
</EventData>
</Event>
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 3/23/2009 2:09:00 PM
Event ID: 10005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
<EventID Qualifiers="49152">10005</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:09:00.000Z" />
<EventRecordID>89676</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">1084</Data>
<Data Name="param2">ShellHWDetection</Data>
<Data Name="param3">
</Data>
<Data Name="param4">{DD522ACC-F821-461A-A407-50B198B896DC}</Data>
</EventData>
</Event>
Log Name: System
Source: EventLog
Date: 3/23/2009 2:08:34 PM
Event ID: 6008
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Garlin-PC
Description:
The previous system shutdown at 2:06:44 PM on 3/23/2009 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="EventLog" />
<EventID Qualifiers="32768">6008</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-03-23T18:08:34.000Z" />
<EventRecordID>89663</EventRecordID>
<Channel>System</Channel>
<Computer>Garlin-PC</Computer>
<Security />
</System>
<EventData>
<Data>2:06:44 PM</Data>
<Data>3/23/2009</Data>
<Data>
</Data>
<Data>
</Data>
<Data>4163</Data>
<Data>
</Data>
<Data>
</Data>
<Binary>D9070300010017000E0006002C00AA02D907030001001700120006002C00AA02201C00003C00000001000000201C000000000000100E00000100000000000000</Binary>
</EventData>
</Event>

Try using this link to find information about the Blue Screen event: http://www.bleepingcomputer.com/forums/top...tml#entry409491

usasma, on Mar 23 2009, 04:54 PM, said:

Thank you for the link.

I ran a scan using Panda, and posted that information in the "Am I Infected" forum. It looked to be mainly cookies, and some problem with Windows Defender, and something with preloaded Acer games. Once they are fixed, I will find the dmp files and run the debugger and post back here with more information. If that is not right, please correct. Thanks!

More Information:
After running the scan(Panda), and posting to am I infected(maybe I shouldn't have-very sorry if that is the case, following instructions from scan page link), I downloaded the debugger so I could do that while I was waiting to fix the infected files(cookies mainly). I was running in safe mode with networking since immediately after startup this morning, I got bsod. I cannot install the debugger in safe mode(I got an error message), so I restarted in regular mode. I was able to get the computer up and started to install the debugger, and then bsod.
How can I run the debugger to get the information from the mini dmp file I found if I have to run it in regular mode, but my computer apparantly won't stay in regular mode long enough?
Sorry for all the postings, I'm just trying to update progress, or lack of.

It's the installer that gives difficulty in Safe Mode - so you should be able to analyze the dump file in Safe Mode.
Here's the link on how to run the debugger: http://www.bleepingcomputer.com/forums/topic176011.html

I can't install the program in order to use it. I have it downloaded on my desktop, but cannot install. Normal mode doesn't last long enough to install.

And, to top it all off now, the .dmp file that I had found, is no longer there and searching for .dmp doesn't bring up anything.....

How to find BSOD error messages: http://www.bleepingcomputer.com/forums/top...tml#entry409491

Be on the lookout for a PM from me.

Info from the email:

Quote

It's a concern that the dump files are disappearing, but not as much of a concern as the memory dumps are. Luckily you've saved enough information that we can get a start on this.

It appears that the memory dump was caused by this file: SYMEFA64.SYS
My research indicates that it's a part of Norton Internet Security. Is that installed on your system?

If so, please download an antivirus solution as this "fix" will involve uninstalling the Norton products. If you don't know of one, I'd suggest that you look in our freeware topic located here: http://www.bleepingcomputer.com/forums/topic3616.html
Since you've got the 64 bit version of Vista, your choices will be limited. I personally prefer Avast Free ( http://www.avast.com/eng/download-avast-home.html ) as it's 64 bit compatible and has worked well for me for a long time.

Once you've downloaded the antivirus, remove the Norton products through Control Panel...Programs and Features...Uninstall a program. Then immediately install the new antivirus and update it. This is very important to keep you from getting infected.

Then reboot and watch to see if the BSOD's have gone away. Should you get another one, capture it before sending the error message off (copy it to another location to save it).

Yes, I do have Norton. I will download Avast, uninstall Norton, and install Avast. I will update Avast, then restart the computer in normal mode.
A couple of questions to make sure I'm doing it all right.
*Should I disable automatic restart again, in case I bsod, so I can write the info down, in case copying the error information doesn't go right?
*If I disable the automatic restart, and I bsod, how do I get out of bsod and into a safe mode option after I have taken the information down? The F8 key didn't work last time, and I had to manually shut everything down(or is that just what you do?)
Thanks again.

Ok. Working in safe mode, I unhooked my internet, uninstalled Norton, installed Avast and updated it, and restarted the computer. Right now, I am running in normal mode and so far, no bsod. I do not have the automatic restart disabled.
Since I no longer have Norton, do I need anything else for security? I guess I have Windows Defender, although the Panda scan said there was something wrong with it. I do have a couple of tracking cookies that I don't know how to deal with them. I did get a message after restarting that the firewall was off and did I want to turn it on. I said yes, so Windows Firewall is on.
I looked again for any .dmp files but still found none.
Please let me know what else I need to do.
Thanks.

More Info: still no bsod-yay!
I ran Defender and it said nothing was detected, that everything was clean.
My event Viewer is working properly, no more snap-in errors if I go to do anything.
I do have error messages there that say that Avast is not running interactive services. Should I change that? I found info at Microsoft technet that says how to do it, but it also says it could allow someone to take over the computer if it is interactive?
I have an error message about kerberos? I remember seeing those before.
There is also the error id 10 still showing up.
Also, the COM errors are still there. These are all new ones, not the older ones, they are still occurring.
I would guess that since the event viewer is working properly, that I could export the list to a .txt file, should I do that and post it here, or not?

COM errors are something that I don't mess with. I have them on my systems and everything still works OK - so I adhere to the "If it ain't broke, don't fix it" policy

As for security options, all I use is Avast, Windows Defender, and the Windows firewall - but I've got above average experience with this stuff and won't hesitate to reformat my system if needs be. You could check this forum for more advice: http://www.bleepingcomputer.com/forums/forum25.html Ask there about the Avast interactive services, I can't find them on my copy.

I've seen Kerberos errors before, but they fall into the "If it ain't broke...." category also (for me).
The key here is are there any problems using the system? If not, then the errors are likely benign, and can safely be ignored.

Wow, thanks again! The computer has been up and running fine since I got rid of Norton.
I'll leave the rest of it alone and go ask about the Avast in the link you gave me.
I can't thank you enough!

I'm glad to hear that it's working well for you! Thanks for letting us know!