Win 7 keeps freezing, increases memory usage then reboots itself

philipmossman · 16 Jul 2012

Thanks Karl, here they are (including the Malwarebytes report which showed no problems)

Please let me know if you need anything else

Philip

karlsnooks · 16 Jul 2012

Excellent!

Now while I'm perusing those, would you please:

Care and Feeding of MGADiag tool

Credits: This is based upon information from NoelDP

To properly analyse and solve problems with Activation and Validation,
we need to see a full copy of the report produced by the MGADiag tool.

Download and save to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

After saving, run the downloaded tool.

Click on the Continue button, which will produce the report.

To copy the report to your response:
Click on the Copy button in the tool (ignore any error messages),

Enclose your response in a CODE block.
Paste (using either right-click/Paste, or Ctrl+V ) into your response.

State the Version and Edition of Windows quoted on your COA sticker
which is located on the case of your machine or
inside the battery compartment.

Do NOT quote the Key on the sticker!

COA -- Where and what is it.

karlsnooks · 16 Jul 2012

Phillip,

You have all kinds of language versions of the same program.
I don't know what country you are in but uninstall either the Dutch or the English version of windows live mesh active control for remote connections.

Here are some that need to be immediately deleted. More will follow later.

UNINSTALL

Script:


&#931;τοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις    Microsoft Corporation    27/06/2012    5.57 MB    15.4.5722.2
&#1508;קד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים    Microsoft Corporation    27/06/2012    5.57 MB    15.4.5722.2
&#36969;用遠端連線的 Windows Live Mesh ActiveX 控制項    Microsoft Corporation    12/01/2011    5.56 MB    15.4.5722.2

REBOOT

karlsnooks · 16 Jul 2012

Until problem is solved then:

CCLEANER | TOOLS icon | STARTUP tab | SCHEDULED TASKS tab |
Use DISABLE button to disable ALL

Close CCleaner.

REBOOT!

You have not disabled any programs. You have disabled the scheduled running.
Later, after your system is running smoothly, you may reenable desired programs.

karlsnooks · 16 Jul 2012

WIN | type MSCONFIG | ENTER | STARTUP tab |
Uncheck ALL

REBOOT!

You have just told Win 7 to not run unchecked programs at start up time.

You have not disabled the programs. They will be run when needed.

WIN = key with the Microsoft logo on top
=========================================
=========================================

The ASK toolbar is a known source of problems.
Please uninstall the ASK toolbar.

philipmossman · 16 Jul 2012

Hi Karl

1. Here is the result of the diagnostics

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-2QWT6-HCQXJ-9YQTR
Windows Product Key Hash: PVjSC5x6njvqunmbCY3lOD7rYDo=
Windows Product ID: 00359-OEM-8992687-00007
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {90D6E033-2A7B-4605-A088-4D22BBF7DB78}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120503-2030
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{90D6E033-2A7B-4605-A088-4D22BBF7DB78}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-9YQTR</PKey><PID>00359-OEM-8992687-00007</PID><PIDType>2</PIDType><SID>S-1-5-21-287376301-3397587456-2296879450</SID><SYSTEM><Manufacturer>ASUSTeK Computer Inc.</Manufacturer><Model>K52F</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>K52F.215</Version><SMBIOSVersion major="2" minor="6"/><Date>20110309000000.000000+000</Date></BIOS><HWID>77323C07018400FC</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>_ASUS_</OEMID><OEMTableID>Notebook</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800007-02-1033-7600.0000-2092009
Installation ID: 013133746380771701735661002002106365005396094504929060
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 9YQTR
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 16/07/2012 19:20:49

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:12:2012 20:35
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAEAAAABAAAAAwABAAEA6GE+/NIpABdC5J4EFC8sZpZz1A5cXQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            _ASUS_        Notebook
  FACP            _ASUS_        Notebook
  DBGP            _ASUS_        Notebook
  HPET            _ASUS_        Notebook
  MCFG            _ASUS_        Notebook
  ECDT            _ASUS_        Notebook
  SLIC            _ASUS_        Notebook
  SSDT            PmRef        CpuPm

2. As for details of Windows, the sticker does not specify what the numbers are, other than the Product Key (omitted as you advise). The 3 sets of characters are, from the top :

15GN005501
X16-96072
00196-132-585-444
Windows 7 Home Premium

3. I have removed those 3 programmes, I am in UK and need only English, frankly I am not sure what Mesh is even

. I have also removed the Ask toolbar, which I did not install and have removed it twice before, not sure how it gets back in

4. Now doing the CCleaner and msconfig tasks, will revert when they are done (2 reboots I understand)

Kindest regards

Philip

karlsnooks · 16 Jul 2012

re ASK.

Whenever you install a program being very careful and read the dialogs presented. I think even CCleaner will install ASK is you don't pay attention.

You can also do me a favor and ckeck over your installed program and uninstall anything you find there that you don't use/need UNLESS the program is in english from Microsoft.

Do you share your computer? Did you buy new? I'm just trying to determine how some of those programs ended up on your computer.

thanks,
karl

philipmossman · 16 Jul 2012

OK Karl, all done as instructed.

As for this computer, it is my laptop, bought new almost a year ago, recommended by the dealer (until this one I had only Compaq/HP and one Acer) the dealer told me Asus was virtually the same as Acer as they manufactured laptops for Acer, but it has never been very satisfactory. In fact when it was quite new I ran some speed tests together with my 3 year old HP dual core and there was almost no improvement! In theory nobody else uses it but when I am home it is on in the study and I imagine one of the children may do, check emails etc. but very rarely, if ever.

I'll watch out for Ask, actually since the early tests I did for you the AVG/Google search bar has appeared in new tabs which were previously blank pages, as I no longer use AVG (never have on this computer) I'll remove it.

As for installed programmes, I had already unchecked many when I was first trying to find the speed problem, even before finding this forum, I am a bit nervous disabling those I do not recognise as they may be critical. After this I'll do some searches to identify them.

Many thanks Karl, what now?

Philip

gregrocker · 16 Jul 2012

Acer is not related to Asus.

Since you've got enough experience now to qualify as a Tech Enthusiast, most of us don't run the factory preinstall which is compromised by all of the preinstalled bloatware and useless OEM utilties which have better versions built into Win7. Instead Clean Reinstall - Factory OEM Windows 7 following the steps in the blue link to get it perfect.

Until then you can apply some of the same Best Practices for Win7 by Cleaning Up Factory Bloatware - Windows 7 Forums

karlsnooks · 16 Jul 2012

please post an updated set of those three files from CCleaner.

This might give you an idea of when people have been logging in;
# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# STEP 3 ** SCRIPT OUTPUT & SCRIPT PURPOSE *******************
# ************************************************************
# --The script output and purpose is given at the very front of the script
#
# --The script output and purpose is given at the very front of the script
#
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--The system can not find the path specified
# you may need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter SET-EXECUTIONPOLICY -EXECUTIONPOLICY REMOTESIGNED
# ************************************************************

Script:


# ************************************************************
# Places LOGONTIMES.TXT on your DESKTOP
#
# Shows the date and time of logons of current user
# ************************************************************

$events = Get-WinEvent -FilterHashtable @{logname='application'; id=4101; level=4} `
-verbose:$false -erroraction:silentlycontinue 
$events | ft timecreated,message -auto -wrap > $env:userprofile\desktop\LOGONTIMES.txt 

EXIT
EXIT

# ************************************************************

I strongly recommend creating a standard user type of account for the offspring.
They need zero access to an account with admin privileges.