Event 5, Kernel General

[MdM]

Hi, I wasn't sure where to put this thread, I hope it's fine in this section

I have an error in my Event Viewer, it only shows up when I'm not using my PC, about 20-30 mins after leaving it alone :

{Hive del Registro di sistema ripristinato} L'hive del Registro di sistema (file) '\??\Volume{c6b52101-eab0-11de-b7f3-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{3A8B94DA-12F2-4A87-B75E-9DC9846487F5}' era danneggiato ed è stato ripristinato. È possibile che parte dei dati sia andata perduta.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />

<EventID>5</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2009-12-21T04:51:00.084708900Z" />

<EventRecordID>6681</EventRecordID>

<Correlation />

<Execution ProcessID="3232" ThreadID="836" />

<Channel>System</Channel>

<Computer>MdM-PC</Computer>

<Security UserID="S-1-5-18" />

</System>


- <EventData>
<Data Name="FinalStatus">0x8000002a</Data>

<Data Name="ExtraStringLength">171</Data>

<Data Name="ExtraString">\??\Volume{c6b52101-eab0-11de-b7f3-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{3A8B94DA-12F2-4A87-B75E-9DC9846487F5}</Data>

</EventData>


</Event>


The first part translates into : Hive of the system registry recovered. Hive of the system registry (bla bla bla) was damaged and it's been recovered. A portion of data might have been lost.

I ran scandisk in the last 2 days and my disks are fine, in addition I had an error Event 55, NTFS - Filesystem structure is damaged and unusable. Please run chkdsk. The weird part is that this last error occured 1000, yes 1000 times in less than 1 minute. Still, running chkdsk finds no errors. I tried updating my ATA Controller driver yesterday and the ntfs error is not yet showing up, only the kernel general one.

I have hibernation off, suspension off and whatever puts my pc to sleep is off. The only active one I have is a screensaver after 10 minutes and then display turning off after 30 minutes.

Any ideas? Thanks

Edit : It looks like VSS has a role in this, in fact those errors happen right after this service is shut down by Windows. This makes me think that the Volume Shadow Service isn't working properly. I have Paragon Hard Disk Manager installed and it uses Windows Shadow Volume Service for its things (whatever they are). I will also try uninstalling it and use something else for backups and let you know if the errors persist.

 

[MdM]

NTFS error is not showing up anymore, although the Kernel General one still appears. Anyone?

 

[usasma]

Hard drive diagnostics: HD Diagnostic

 

[MdM]

Nope, my drives are good, tests were all successful, it looks like this kernel is a bad boy with my current hardware. I even get that circular context error when I logoff and logon.
What bothers me is that Windows 7 x64 runs great on my laptop, making the laptop better than my desktop and it's an Acer Aspire5920G (I love it, the best spent 800€ of my life and it was 3 years ago, it doesn't even know what a BSOD is).
There is probably something wrong with my chipset drivers, I guess I'll have to wait for better drivers released or rebuild my pc with new hardware next year.

Thanks anyway for the help, much appreciated (+1)

 

[sanford]

Hey MdM PLEASE RESPOND

Any update on your issue?

I have basically the extact same issue as you describe here, and am really trying hard to figure it out....

My system is not the same as yours hardware wise (at all), so I doubt our problem is related to specific hardware. My system is a brand new (purchased 1/31) Dell Studio xps 8100. My error seemed to show up after either installing an antivirus software (mcafee) and replaceing with Avast and or after changing the pc powers saver features (monitor sleep, system sleep, etc) to all off.

I am considering restoring the registry to before the first recorded event or possibly using a registry repair software.

Another thing in my cae is that this error shows up in the event viewer duplicated 20 times (over ~1 hour) around 20-30 minutes after the pc is booted up. The error does not recurr if the pc reamins turned on.

Here is a cut and paste of my error:

Log Name: System
Source: Microsoft-Windows-Kernel-General
Date: 2/2/2010 10:30:37 AM
Event ID: 5
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: Laura-PC
Description:
{Registry Hive Recovered} Registry hive (file): '\??\Volume{fb13fdc4-fd83-11de-9b3d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{AC86EE02-62FE-482E-BBA6-1FE4933541B2}' was corrupted and it has been recovered. Some data might have been lost.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
<EventID>5</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2010-02-02T15:30:37.498251700Z" />
<EventRecordID>5737</EventRecordID>
<Correlation />
<Execution ProcessID="4652" ThreadID="1384" />
<Channel>System</Channel>
<Computer>Laura-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0x8000002a</Data>
<Data Name="ExtraStringLength">171</Data>
<Data Name="ExtraString">\??\Volume{fb13fdc4-fd83-11de-9b3d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{AC86EE02-62FE-482E-BBA6-1FE4933541B2}</Data>
</EventData>
</Event>

 

[MdM]

I can't remember how I solved it, actually it suddenly stopped showing up by itself. There are a lot of things I did since those days, like disabling the system restore and its shadow service then turning it back on after uninstalling and reinstalling my sata drivers. I also disabled all power saving features and left only my screensaver. I didn't check when it stopped occuring though, so I'm not sure which one was the solution. Maybe none of those was the solution and something else occured.
Anyway, we could try figure it out for your case.
First of all you can try uninstalling the antivirus and see if the error still occurs. This problem seems to be caused by an application that somehow bothers the VSS and since this error shows up for System Volume Information, it is most likely caused by the antivirus.
Let me know how it goes, if not we can try something else, I'll be here

 

[sanford]

MdM,

Thank you very much for your response and your willingness to help, I really appreciate it!

Here’s hoping my occurrences of this error will “stop showing up by itself” too! Yesterday, instead of the event log documenting 20 occurrences three minutes apart for one hour (approx 30 minutes after startup), the log had only 5 occurances. I have not done anything yet to attempt to correct this, so the system is doing something different “on its own”…

At any rate, I am convinced there is a common “cause and effect” that our systems have in common. After extensive searching, I found I other person who documented the exact same problem as us. His or her system was different than either of us hardware wise too. Since our systems are so different (AMD vs Intel, Nvidia vs radeon, etc) I tend to think this is software related inside of Windows 7. I am very suspicious of the power saving features and or settings. It is the only common denominator I can see right now between our three systems?

I don’t think drivers, antivirus software, software installs/removals, are the issue because somehow we share the EXACT error but do not have these other things in common. I will keep this thread updated on anything I learn. Please continue to share anything that you can think of.

Thanks again!

 

[MdM]

I too had days where there were few events (i.e. 5-10 errors) and days where there were a lot of events, in my case it was 1000+.... Surely uninstalling Paragon helped since I started getting less errors but that didn't solve it. Now, that's how I track down my problems : uninstalling Paragon helped a little so what does Paragon do? It installs some legacy drivers to use for its backup and monitoring purposes, so since Windows Backup also monitors for making shadow volume copies, there could have been a conflict between the two. After this, what else could interfere with the VSS? I thought maybe when my PC is idle the VSS starts and makes its backup, but due to power settings one of the devices turns off and the VSS stops before it can finish its job?
Actually, who knows, maybe if I set my monitor to shut off after 30 mins like before, this error could reappear again? But it wouldn't be the cause in that case, or there would be millions of users reporting the same problem.
I'm pretty sure this is a driver-related problem. You say we have different hardware but we didn't check it all. What about your drive/s? Mine are in the system specs (bottom-left corner of the post, above the Post Reply button), do you have one of them too? Remember I also updated my Storage Controller drivers, this could be the one that fixed it?

P.S. I'm picky about these things, I know I solved it but it still bothers me that I have no idea what fixed it, therefore I'm glad I'm trying to help you, hopefully together we can solve the mistery

 

[sanford]

MdM,

The system (actually is my wifes PC) and it is a brand new Dell XPS 8100, I think the drive is a Seagate based on the model number showing up in Windows device manager. The two things that I do see to be somewhat in common between us is we both have Samsung Syncmaster monitors (different model though) and Realtek on the soundside.

I bought the pc on Friday, Jan 29th…. First series of bootup’s that night, 2nd boots where where on Saturday the 30th…
There were no occurrences of this error on either of those days. Day three (Sunday 31st) was the first time the error occurred. No hardware changes or driver changes were made at any time. As I stated earlier the only things I can recall doing on Sunday where replacing Mcafee AV with Avast and turning off all power saving settings for the monitor, HD, etc.

The other person I mentioned out there with this problem reports that his/her problem started immediately after switching from Vista to Windows 7 on an existing PC… the write up is a bit hard to follow, but they mention having manipulated power saving settings prior to the error showing up.

In my case whatever is causing this seems to be tied to bootup, they always occur about 20 minutes or so after starting up then the eventually stop on their own. They do not reoccur again unless the PC is restarted and or shut down and then started.

 

[MdM]

There is another thing I did... I didn't like Windows telling me my monitor was a Generic PnP so I downloaded the monitor driver from Samsung's support. You might try it, sounds stupid but maybe it was this one?

 

[sanford]

There is another thing I did... I didn't like Windows telling me my monitor was a Generic PnP so I downloaded the monitor driver from Samsung's support. You might try it, sounds stupid but maybe it was this one?

Actually I did update my monitor driver too, but ironically it was before my problem started...

 

[zigzag3143]

There is another thing I did... I didn't like Windows telling me my monitor was a Generic PnP so I downloaded the monitor driver from Samsung's support. You might try it, sounds stupid but maybe it was this one?

Actually I did update my monitor driver too, but ironically it was before my problem started...

Just passing through. there is a good description of the problem with some possible fixes here How do I solve 'Event ID 5' errors?

Ken

 

[sanford]

MdM,

I agree with what you have said earlier in the thread about the windows volume shadow service....

I took a good look through all my event logs, and discovered the same thing you reported about this service running right before the Kernel-general error involving the registry hive file...

Here is my thoughts (please tell me if I am "stupid", won't hurt my feelings):

The VSS is trying to make "copy" the offending registry hive file(s) and finds that they are corrupt so the service "recovers" a copy and reports this to the event viewer. This is a never ending process repeated at each after each startup, until the corrupt hive file is deleted, fixed, etc, because the VSS is not "fixing" the actual corrupted file, rather recovering and storing a copy each time it encounters the original file?

So is the solution to our problem a matter of fixing the original corrupted registry hive file by either using windows scandisk, a registry fix-it software, or by overwriting the file?

 

[MdM]

Thanks Ken but it doesn't seem to be our problem, it's another error with the same event ID.

That's my point sanford, my guess is that we're not talking corruption but modifications. An app or a driver or something, writes something inside System Volume Information, specifically if you search the long number you see in the error in the registry (the last series), you will find that it's associated to a file. It could be a permission problem, something missing, it could be anything.
You're not absolutely wrong though, registry cleaning, a scandisk and a defrag might be worth a try. Did you try uninstalling your antivirus in the meantime?

 

[sanford]

Did you try uninstalling your antivirus in the meantime?

No........ not yet anyway, I am actually afraid of causing even more problems after reading stories over at the Avast forums...

To tell you the truth, I would not mind just forgeting about the registry hive recovery error messages if I only knew if it actually needs to be fixed

 

[MdM]

If you don't try you can't fix it, nothing bad can happen, just make a Restore Point before uninstalling Avast, you can always go back if something goes wrong, like nothing happened.

 

[sanford]

LOL....... I know, your are right of course

But

I wonder what is anything could eventually happen if I don't (or better yet can't) "fix it"

 

[MdM]

That's a good point, in fact... if you read my first posts I gave up on that and ignored it since it wasn't creating problems, I disabled monitor automatic turning off and there you go. Since it occured only when resuming from standby, no standby no error and I like to pretend it was the fix

 

[sanford]

If I understand your posts throughout the thread, you are saying that you think the VSS is being interfered with, and the errors in event viewer are a byproduct right?

Why not basically the other way around.... If you take the details of the error report at face value, it seems that corrupt registry hive files exist in the system volume info folder (basically all the restore/sys backup stuff right?) and the message is reporting a "recovery" of said files. Isn't the VSS that is finding and recovering the files?

It seems like to me that until the offending files are actually removed for the registry, the VSS will continue to find and then "recover" them and inform the event viewer about its actions?

 

[MdM]

Technically yes, it's recovering the corruption and everything should be fine, until it's only this error and no bad consequences I believe it can be ignored.
The forum is here, if we find something new or if someone else comes here with the same problem, then we'll think about it