Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Reboot


  • Please log in to reply
5 replies to this topic

#1 margiemorgan

margiemorgan

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:02:28 AM

Posted 06 October 2007 - 03:52 PM

My computer unexpectedly reboots at times. It might happen 2 times an hour or it might not happen but once per day. It does not seem associated with any one program.

I have done a hijackthis, spybot and am using AVG virus software. I have scanned in regular and safe mode.

My event log says:

The Retrospect WD Service failed to start due to the following error: The system cannot find the path specified. The event ID is 7000.

I went to msdos and ran the following command: sc delete RetroWDSvc

Thought everything would be fine but it rebooted again. My event log has generated the same error.

Maybe I am not looking at the correct event log but this is the one that pops up right before the computer reboots.

Any ideas on how I can find what program is causing the problem?

Thanks

Margie

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,554 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:28 AM

Posted 06 October 2007 - 04:25 PM

You're referring to two different things...as if they are one.

a. Error messages are the messages that flash/popup while either booting or working in XP. Some are brief, some are persistent.

b. Event Viewer is a log of some error messages and other items which XP is designed to bring to a user's attention, in an effort to help troubleshoot actual and potential problems. Event viewer may not contain every error message ever generated, but it will contain some system errors that never generate error messages.

Microsoft Windows XP - Using Event Viewer - http://www.microsoft.com/resources/documen...r.mspx?mfr=true

One thing that prevents some errors from being reflected in EV is...the user. By default, there is a setting which tells the system to reboot when it crashes; in cases where this setting is the default (most systems), there will be no error entry in EV and the system will simply reboot.

That can be remedied, Disable Auto Reboot On System Crash - http://www.theeldergeek.com/auto_reboot_on_system_crash.htm

Once the setting is changed, there should be some data in Event Viewer. If you list the module and eventid here, someone will try to help. A verbatim copy of the EV entry would be even better.

From what I can see, that service/process relates to a backup service for Western Digital drives, see references at http://support.wdc.com/download/downloadxml.asp

Event ID 7000 just shows that XP has noted that a service failed to start for whatever reason.

And...there is no DOS in XP. So I wonder what you really did.

Anyway, if it were me...I would either patch/update the Retrospect software or remove it from my system. What's probably happening is that there is a reg entry for it to run and it's no longer on your system. The reg entry can be removed by using a utility like Autoruns.

You might also just take a look in Services on your system and see if it needs to be put on Auto start.

Those are my best guesses :thumbsup:.

Louis

#3 margiemorgan

margiemorgan
  • Topic Starter

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:02:28 AM

Posted 06 October 2007 - 09:00 PM

Louis,

Thanks for your reply. I meant that I went to the command prompt and typed the command there. I always consider that msdos, sorry for the confusion.

The error does not show up on the 'blue screen of death'. it is in the event log.

Under Startup and Recovery, System Startup, System failure, the Automatically Restart option has already been unchecked.

What next?

#4 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:02:28 AM

Posted 07 October 2007 - 07:10 AM

I'd suggest following hamluis' advice about the Western Digital service:

Anyway, if it were me...I would either patch/update the Retrospect software or remove it from my system.


Also, I would suggest that you check your Event Viewer again for errors related to this issue: http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/

And I would check your system for memory dump files (search for *.dmp or *.mdmp). If you find them, use this link to analyze them ( http://www.bleepingcomputer.com/forums/top...tml#entry409491 ) and then post the results here for us to have a look at.

Edited by usasma, 07 October 2007 - 07:11 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#5 margiemorgan

margiemorgan
  • Topic Starter

  • Members
  • 95 posts
  • OFFLINE
  •  
  • Local time:02:28 AM

Posted 07 October 2007 - 09:17 AM

The computer rebooted this morning at 8:40 am. I found this log that was created at about that time. Here is the last few entries of the log.

Sun Oct 07 08:44:47 2007.88921) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:47 2007.89015) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:47 2007.89125) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:47 2007.89125) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:47 2007.89171) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:47 2007.89281) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:48 2007.89859) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:48 2007.90187) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:49 2007.90625) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:44:54 2007.95718) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:47:39 2007.255078) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:48:20 2007.296890) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Sun Oct 07 08:58:20 2007.896937) : NT Event Log Consumer: could not retrieve sid, 0x80041002


I have searched for all dumps created today and there were none. It rebooted yesterday and I could not find any dumps created for that date either.

Today when it rebooted, there were no error logs created in the event viewer.

I have removed Retropsect - I forgot to tell you that in the last post.

Any other suggestions?

Thanks for you help so far.

Margie

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 56,554 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:28 AM

Posted 07 October 2007 - 10:46 AM

As near as I can guess:

The NT Event Log is a basic part of XP and failure by it (for whatever reason) results in no Event Viewer data. It's also a subset of Windows Management Instrumentation.

http://msdn2.microsoft.com/en-us/library/aa392282.aspx

http://searchwincomputing.techtarget.com/s...1065292,00.html

Unfortunately, I'm not knowledgeable enough to know what to make of a system with NT Event problems.

I would go into services and see if the Event Log Service is on auto. It should be. If not, change it.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users