Windows 7 becomes unresponsive

Hi,

I'm having problems in my computer which I'm failing to identify.

The symptoms:

Computer turns unresponsive. It seems like a windows explorer crash or maybe a hardware problem, but I don't know how to be sure of which.

I checked the forum for explorer crashes and found a thread with some steps:

1 - Use shexview to disable extentions until the problematic one is disabled. At first I thought the problem was derived by Flash Player but it doesn't appear on the list.

2 - sfc /scannow

I used it and I have the following errors:

POQ 123 ends.
2012-04-14 21:18:30, Info CSI 000002f4 [SR] Verify complete
2012-04-14 21:18:30, Info CSI 000002f5 [SR] Repairing 1 components
2012-04-14 21:18:30, Info CSI 000002f6 [SR] Beginning Verify and Repair transaction
2012-04-14 21:18:30, Info CSI 000002f7 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2012-04-14 21:18:30, Info CSI 000002f8 [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-04-14 21:18:30, Info CSI 000002f9 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2012-04-14 21:18:30, Info CSI 000002fa [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-04-14 21:18:30, Info CSI 000002fb [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2012-04-14 21:18:30, Info CSI 000002fc Hashes for file member \??\C:\Windows\System32\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2012-04-14 21:18:30, Info CSI 000002fd Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2012-04-14 21:18:30, Info CSI 000002fe [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted
2012-04-14 21:18:30, Info CSI 000002ff Repair results created:
POQ 124 starts:

POQ 124 ends.

Can anyone point me the way to solve this or any ideas to troubleshoot the problem better, I would be highly grateful.

Thank you

First we need the actual cbs.log file.

If as it appears, there are OS files that cant be repaired you will need to do a repair install.

Hi.

Thank you for your reply. I attached the CBS.log file.

Right now I have SP1 installed, would that give problems to make a repair install since the DVD I have is not SP1?

Icebergue said:

Hi.

Thank you for your reply. I attached the CBS.log file.

Right now I have SP1 installed, would that give problems to make a repair install since the DVD I have is not SP1?

It might.

Most of these things not repaired arent critical but do add to the slowness and unresponsiveness. things like gadgets, language packs, etc.

We may be able to get more information from your event viewer logs

Please provide us with your Event Viewer administrative logs by following these steps:


Click Start Menu
Type eventvwr into Search programs and files (do not hit enter)
Right click eventvwr.exe and click Run as administrator
Expand Custom Views
Click Administrative Events
Right click Administrative Events
Save all Events in Custom View As...
Save them in a folder where you will remember which folder and save as Errors.evtx
Go to where you saved Errors.evtx
Right click Errors.evtx -> send to -> compressed (zipped) folder
Upload the .zip file here.

Here it is. It asked me if I wanted to include display information, which was by default No, but if it helps I can choose the other option.

Thank you

Hi!

I have some updates. Suddently during yesterday pc was stable all day. After I came back, it was hibernating and it didn't responded to keyboard pressing, mouse clicking, or either the power button. The only option I had was to cut the power supply, resume it and turning the pc on again. It resumed from where it was but it was extremely slow and the breaks return again. Can this indicate some hardware problem like hard drive or power supply? I'm not sure how to troubleshoot it.

Thank you

Do you still need help with this problem? If so, please provide us with your most recent Event Viewer administrative logs by following these steps:

1. Click Start Menu
2. Type eventvwr into Search programs and files (do not hit enter)
3. Right click eventvwr.exe and click Run as administrator
4. Expand Custom Views
5. Click Administrative Events
6. Right click Administrative Events
7. Save all Events in Custom View As...
8. Save them in a folder where you will remember which folder and save as Errors.evtx
9. When asked, save the display information in English.
10. Go to where you saved Errors.evtx
11. Create a new folder by right clicking in a blank area within the folder Errors.evtx is saved in. You could also click New Folder at the top of the directory under the directory path box.
12. Name the new folder Errors.
13. Place Errors.evtx and the LocaleMetaData folder into the new Errors folder.
14. Right click the Errors folder -> send to -> compressed (zipped) folder
15. Upload the .zip file here.

Hello,

I did as you said. I didn't find any solution yet and can't seem to troubleshoot the problem myself.

Any help will be appreciated. I can try to record the break occurence if it helps.

Thank you

Code:

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          4/14/2012 11:30:51 AM
Event ID:      3
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Computer:      Subzero
Description:
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

I would suggest re-installing Microsoft Security Essentials. Also, run a full scan after re-installing. To re-install, first completely uninstall the software through Start Menu -> Control Panel -> Uninstall a program. Then download the latest version and install it: Microsoft Security Essentials - Free Antivirus for Windows

Additionally, scan for viruses/malware with a full scan using the free version (do not start the trial) of Malwarebytes : Free anti-malware, anti-virus and spyware removal download.

Post back your results of both scans.


Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Use OPTION THREE of SFC /SCANNOW Command - System File Checker to provide us with the sfcdetails.txt file.

Hi,

I removed Windows Security Essentials after I saw that error, I also tried to format and reinstall the system partition but the random freezes keep coming. I am now doing a memory check with memtest86+, it's on the 3rd pass and it's showing no errors so far.

SFC showed an error because I used a patch to allow multiple remote desktop connections but didn't cause the freeze problems because they were happening before.

I suspect it's a power supply problem. My power supply it's the oldest piece of hardware I have and it's below 500W.

Is there any tests I can do to test power supply you can recommend?

I will also do the tests you asked after memtest ends which will take some time with 16 GB RAM.

Thank you