Computer Lock Up

About a week ago, my computer has started locking up.  It forces me to turn off my computer and start again from a cold boot.

However, there is no logic or consistency when this happens.  It happens when I am working with different software.  Sometimes it happens right after a cold boot.  Sometimes it happens after 5 minutes, or 10 minutes, or 20 minutes, or sometimes longer.  There is no telling when it going to freeze up;  or, on which software it is going to lock up.  But it is driving me crazy.

I have run defrag; scandisk; virus protection; on-line virus programs; adware programs, etc.  And, so far, I have found nothing.

I keep getting the following error on my system log.

2/12/2006      8:18:59 AM      Service Control Manager      Error      None      7000      N/A      MARCO      The MCSTRM service failed to start due to the following error: The system cannot find the file specified.

However, I have searched my computer and couldn’t find an MCSTRM file on my computer.

I also got the following error in the administration log.

2/12/2006      3:41:13 PM      Userenv      Warning      None      1517      NT AUTHORITY\SYSTEM      MARCO      Windows saved user MARCO-GDTEHN42L\Marco Perez registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Any workable solution would be appreciated.

Thanks.

perezm
LVL 1
perezmAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

allocationerrorCommented:
mcstrm.sys is part of the RealNetworks Virtual Path Manager®. Maybe you should try to uninstall all Real Player components. But i guess the software is already uninstalled, because "The system cannot find the file specified."
Go to Control Panel -> System -> Device Manager -> View -> Show hidden devices -> Scroll Down to Non-PnP Drivers, there should be a driver called "MCSTRM". Right-click on the driver and delete it. If you don't find that entry:
Open the registry editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Scroll and try to determine that driver. Report back.
perezmAuthor Commented:
Errors seem to be gone from system log and administration log.

However, when I run RealPlayer, I get an insufficient memory window.

When I try to run iTunes, machine locks up again.

Do I need to uninstall and install again?

AntunbCommented:
try to uninstall, reboot than install again, and see if it fixes it
Bootstrap 4: Exploring New Features

Learn how to use and navigate the new features included in Bootstrap 4, the most popular HTML, CSS, and JavaScript framework for developing responsive, mobile-first websites.

perezmAuthor Commented:
When I tried to uninstall, the computer locked up.

Although errors gone, computer still locks up.

I wonder if I have a memory problem.  Is there a way to diagnose memory that is going bad; i.e., not bad yet, but is going to be a problem?
AntunbCommented:
try running a mem test

http://www.memtest.org/
nobusCommented:
you can have contact problems - in this case, i suggest opening the box, disconnecting , inpect, clean and reseating all cables and cards and devices.
Also check if all fans are running normally, and remove all dust.
AntunbCommented:
click start >> run >> type cleanmgr
run the wizard, and remove temp files


run defrag
start >> program files >> accessories >> system tools >> defrag
jms99Commented:
When you say your computer freezes does anything work at all, ie: is the mouse curser frozen also? Does the Num/Caps/Scroll lock ligts do anything when you press them.  If these thing dont happen I can almost guarantee you have a piece of hardware overheating.  Make sure all fans are working.  CPU, Power supply, motherboard chipset if it has a fan, video card.  Put a finger on the chipsets, hard disk and heat sinks inside your PC to see if they are very hot to touch.  The one that is too hot to keep your finger on is the culprit.
perezmAuthor Commented:
The mouse arrow and hour glass shows.  I can move it around, but I can't launch anything.

It freezes up when I boot the computer (cold boot).  And, about the 5th time I open a Window, everything freezes up, except the mouse, forcing me to turn everything off and re-booting.
jms99Commented:
Forget what I said then.  You should definitly follow antunbs suggestion to run a memtest and if that comes up clean maybe have to post a hijackthis log.  Have you tried running in safe mode as a test to see if it still locks up?
perezmAuthor Commented:
I have run the memory test 3 times without any problems.

I get a message that a program is trying to find the server.  Since this is a stand alone machine, do you know why it is looking for a server?

Would running the system restore be of any value?

Do you know what the following errors are trying to tell me?

System Log:

2/13/2006      5:12:52 PM      DCOM      Error      None      10005      NT AUTHORITY\SYSTEM      MARCO-GDTEHN42L      "DCOM got error ""This service cannot be started in Safe Mode "" attempting to start the service EventSystem with arguments """" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}"
2/13/2006      5:12:43 PM      DCOM      Error      None      10005      MARCO-GDTEHN42L\Marco Perez      MARCO-GDTEHN42L      "DCOM got error ""This service cannot be started in Safe Mode "" attempting to start the service netman with arguments """" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}"


Applications.Log

2/13/2006      3:58:01 PM      Userenv      Warning      None      1517      NT AUTHORITY\SYSTEM      MARCO-GDTEHN42L      Windows saved user MARCO-GDTEHN42L\Marco Perez registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

 This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
nobusCommented:
try dcombobulator :

http://www.grc.com/dcom/

jms99Commented:
What is the program that is trying to find a server?

Fogret the DCOM events..They just arent starting in safe mode.

Did your computer behave itself in safe mode?

the userenv warning suggests there is a 3rd party app or service running that is not releasing part of your profile when you are logging off.  I doubt this is related to your PC crashing.  If you want to get rid of this one you can just change the account that every service is running with to "local service"  
Control Panel -> Administrative tools -> Services.  Look for whichever services have your account name as the logon and change the logon to local service.  Leave the ones using "network service" or "local system" alone.

Dont know if hijackthis logs are allowed here but it would definitly help...http://www.merijn.org/files/hijackthis.zip...Copy and paste the output from this.
perezmAuthor Commented:
Did your computer behave itself in safe mode?  Yes

the userenv warning suggests there is a 3rd party app or service running that is not releasing part of your profile when you are logging off.  I doubt this is related to your PC crashing.  If you want to get rid of this one you can just change the account that every service is running with to "local service"  Control Panel -> Administrative tools -> Services.  Look for whichever services have your account name as the logon and change the logon to local service.  Leave the ones using "network service" or "local system" alone.

--  Everything was already either "network service" or "local system".

Below is Logfile of HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 2:13:42 PM, on 2/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\RFA\rfagent.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\StompSoft\SpywareXterminatorV5\SpywareX.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPROV.EXE
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPRV10.EXE
C:\SpyWare Software\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn10\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn10\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [Spyware X-terminator] "C:\Program Files\StompSoft\SpywareXterminatorV5\SpywareX.exe" -w -b
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126044708984
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
jms99Commented:
It looks nice and clean but you have two antivirus progs running at the same time by the look of it.  Having more than 1 resident AV software can really cause a lot of problems.  I would suggest you remove the yahoo AV software and run hijackthis again to make sure there is no Yahoo AV running.  If you remove it from add/remove progs and there is still remenants in hijackthis just delete them from there.

Good luck.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
perezmAuthor Commented:
jms99,

You were right on the money.  When I got rid of the Yahoo AV and all its little thing in the various folders, everything straightened up fine (so far).

Thanks for all your help.
jms99Commented:
Good to hear.  Happy computing.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.