Solved

Errors in event viewer from before I bought my laptop

Posted on 2011-02-17
8
2,758 Views
Last Modified: 2012-05-11
I bought an HP laptop on 11/01/2011 and set it up and joined an sbs 2008 domain on 15/01/2011.

I have been having many problems with the machine including freezing, suddenly crashing and going to diagnostic.

When i check the event viewer I notice that there are lots of errors some dated 26/04/2010 event id 0,2 critical error,3,512 and some dated 06/08/2010 event id 0,2,3,4,1001 on the diffeent dates, the error are under to different computer names. Is this normal, could some of my problems with the machine be due to these windows setup errors at the manufacturer and do those two dates mean that the machine was setup twice.

Since setting up the machinei have been getting errors 2,33,59,1000,7000,7024,7030
 and after joining the domain I get dhcp errors daily twice or more times.
0
Comment
Question by:Carolvara
  • 4
  • 3
8 Comments
 
LVL 2

Accepted Solution

by:
krylosz earned 250 total points
ID: 34924632
These errors don't look good, but without knowing which process triggered them (event source) I can't say anything. But it's normal for some eventlog errors to appear. I have never seen a Windows machine without at least a couple.

But generally, when you look at eventid errors you always have to also consider the event source. Without that it's almost impossible to determine what is actually happening, which is hard anyway ;-)

Look at this for example:
http://www.eventid.net/display.asp?eventid=2&source=

Personally I'd call HP support and let them guide me through their onboard diagnostics. That might reveal if there's a hardware problem. If that won't reveal any errors, I would reinstall Windows from scratch and see if the errors and problems continue to appear. If they do I'd call HP support again.
0
 
LVL 21

Expert Comment

by:Larry Struckmeyer MVP
ID: 34925163
I would try very hard to return that system and get a replacement.  This sounds like it was not new, previously owned as they say in the car biz.  No reason for prior event log entries and multiple names in the event logs, unless the names are from machines you recognize, in which case they could be attempts to contact your system, which are being highlighted by some software on the system, but that is not a familiar senerio.
0
 

Author Comment

by:Carolvara
ID: 34925260
Thank you so much for you responses

Krylosz

I will revert back with the event source on monday as I no longer have the machine here with me. You say that its normal for there to be eventlog errors which i agree with that you get errors from time to time, but is it normal to have them dated 9 and 5 months before you bought your computer?

fl_flyfishing

I initially thought that maybe the errors were generated during startup before I had put in the computer name and the time had sychronised and thats why it was showing wrong date and different computer name but then that doesn't explain the time difference between the two dates and also the fact that there is a total of 3 different names including my one. I do not recorgnize any of the names and they are just an entry of letters and numbers whereas all the machines on my domain have proper names.


0
 
LVL 2

Expert Comment

by:krylosz
ID: 34941997
The different dates could be caused by an incorrect date and time settings. Are there other eventlog entries in between the entries. I mean, does it look like the computer was used in between?

I didn't catch the part about the different computer names. That sounds really strange, and I would definitely contact HP support.

It could be that these entries were generated during the imaging process at HP. But again: contact HP support.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 

Author Comment

by:Carolvara
ID: 34942001
Hi krylosz

Below are the events. I have put a number so that you can see the changing computer names I have underlined.

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          2010/04/26 10:46:50 PM
Event ID:      3
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Computer:      WIN-9QSV9Q6T0NSDescription:
Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>14</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2010-04-26T20:46:50.053227300Z" />
    <EventRecordID>1</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="200" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>WIN-9QSV9Q6T0NS</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SessionName">Microsoft-Windows-Setup</Data>
    <Data Name="FileName">C:\Windows\Panther\setup.etl</Data>
    <Data Name="ErrorCode">3221225485</Data>
    <Data Name="LoggingMode">5</Data>
  </EventData>
</Event>



Log Name:      Microsoft-Windows-PrintService/Admin
Source:        Microsoft-Windows-PrintService
Date:          2010/04/26 10:49:02 PM
Event ID:      512
Task Category: Initializing a print provider
Level:         Error
Keywords:      Router,Classic Spooler Event
User:          SYSTEM
Computer:      WIN-9QSV9Q6T0NS
Description:
InitializePrintProvider failed for provider inetpp.dll. This can occur because of system instability or a lack of system resources.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-PrintService" Guid="{747EF6FD-E535-4D16-B510-42C90F6873A1}" />
    <EventID>512</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>1</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000002800</Keywords>
    <TimeCreated SystemTime="2010-04-26T20:49:02.887460600Z" />
    <EventRecordID>2</EventRecordID>
    <Correlation />
    <Execution ProcessID="1320" ThreadID="1344" />
    <Channel>Microsoft-Windows-PrintService/Admin</Channel>
    <Computer>WIN-9QSV9Q6T0NS</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <RouterError xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
      <Name>inetpp.dll</Name>
      <Error>0x0</Error>
    </RouterError>
  </UserData>
</Event>



Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          2010/04/26 10:51:59 PM
Event ID:      3
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Computer:      WIN-RVF893O1TOO
Description:
Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>14</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2010-04-26T20:51:59.143631000Z" />
    <EventRecordID>2</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="200" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>WIN-RVF893O1TOO</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SessionName">Microsoft-Windows-Setup</Data>
    <Data Name="FileName">C:\Windows\Panther\setup.etl</Data>
    <Data Name="ErrorCode">3221225485</Data>
    <Data Name="LoggingMode">5</Data>
  </EventData>
</Event>



Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          2010/04/26 11:32:06 PM
Event ID:      2
Task Category: Session
Level:         Error
Keywords:      Session
User:          S-1-5-21-2848689877-3623026557-83684903-500
Computer:      4PPNPADIQOHB3
Description:
Session "" failed to start with the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>2</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2010-04-26T21:32:06.329280500Z" />
    <EventRecordID>4</EventRecordID>
    <Correlation />
    <Execution ProcessID="3216" ThreadID="3392" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>4PPNPADIQOHB3</Computer>
    <Security UserID="S-1-5-21-2848689877-3623026557-83684903-500" />
  </System>
  <EventData>
    <Data Name="SessionName">
    </Data>
    <Data Name="FileName">
    </Data>
    <Data Name="ErrorCode">3221225485</Data>
    <Data Name="LoggingMode">5</Data>
  </EventData>
</Event>



Log Name:      HP Power Assistant
Source:        HP PA Service
Date:          2010/04/26 11:20:34 PM
Event ID:      0
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      4PPNPADIQOHB3
Description:
System.Management.ManagementException
Not supported
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
   at HPPA_Service.CurrentConfiguration.GetPanelBrightnessPercentage()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="HP PA Service" />
    <EventID Qualifiers="0">0</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-04-26T21:20:34.000000000Z" />
    <EventRecordID>1</EventRecordID>
    <Channel>HP Power Assistant</Channel>
    <Computer>4PPNPADIQOHB3</Computer>
    <Security />
  </System>
  <EventData>
    <Data>System.Management.ManagementException
Not supported
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
   at HPPA_Service.CurrentConfiguration.GetPanelBrightnessPercentage()</Data>
  </EventData>
</Event>


Log Name:      HP Wireless Assistant
Source:        HP WA Service
Date:          2010/08/06 09:13:44 PM
Event ID:      0
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      4PPNPADIQOHB3
Description:
System.Management.ManagementException
ServiceWorkerMethod ABORTED! - Not supported
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementEventWatcher.Start()
   at MessageHandlers.MessageHandler.InitializeNetworkAdapterListener()
   at MessageHandlers.MessageHandler.beginListening()
   at HPPA_Service.HPPA_Service.initEventHandlers()
   at HPPA_Service.HPPA_Service.ServiceWorkerMethod()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="HP WA Service" />
    <EventID Qualifiers="0">0</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-08-06T19:13:44.000000000Z" />
    <EventRecordID>5</EventRecordID>
    <Channel>HP Wireless Assistant</Channel>
    <Computer>4PPNPADIQOHB3</Computer>
    <Security />
  </System>
  <EventData>
    <Data>System.Management.ManagementException
ServiceWorkerMethod ABORTED! - Not supported
   at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
   at System.Management.ManagementEventWatcher.Start()
   at MessageHandlers.MessageHandler.InitializeNetworkAdapterListener()
   at MessageHandlers.MessageHandler.beginListening()
   at HPPA_Service.HPPA_Service.initEventHandlers()
   at HPPA_Service.HPPA_Service.ServiceWorkerMethod()</Data>
  </EventData>
</Event>


Log Name:      Microsoft-Windows-Dhcp-Client/Admin
Source:        Microsoft-Windows-Dhcp-Client
Date:          2010/08/06 09:24:17 PM
Event ID:      1001
Task Category: Address Configuration State Event
Level:         Error
Keywords:      
User:          LOCAL SERVICE
Computer:      WIN-ODI6HQJFF0HDescription:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x70F39587615E.  The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>75</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2010-08-06T19:24:17.285030100Z" />
    <EventRecordID>2</EventRecordID>
    <Correlation />
    <Execution ProcessID="1060" ThreadID="3996" />
    <Channel>Microsoft-Windows-Dhcp-Client/Admin</Channel>
    <Computer>WIN-ODI6HQJFF0H</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="HWLength">6</Data>
    <Data Name="HWAddress">70F39587615E</Data>
    <Data Name="StatusCode">121</Data>
  </EventData>
</Event>
0
 

Author Comment

by:Carolvara
ID: 34943204
Hi

Ok got in touch with HP they can't explain to me why those error logs appear on the machine. They initially said don't you have a virus until we verified that 06/08/2010 is the start of warranty date shown both on this machine and on thier system so it couldn't have been a viral coincidence.

They say they can't replace the machine 39 days after purchased, they only replace within 30days. We have ran the hardware diagnostics and they passed so thier suggestion is just to reinstall the operating system.

They have also said that they really can't check in what state the machine left their warehouse but in anycase if they were errors during installation i should contact microsoft as they are the ones responsible for the software. Does that make sense at all?
0
 
LVL 2

Expert Comment

by:krylosz
ID: 34944449
This is very strange. I don't think that a virus could be involved.

Contacting MS is also a strange advice, as HP did install their OEM version of Windows and are pretty much responsible for delivering a working system to you. It's a shome that they won't take the laptop back, but you pretty much have no choice now.

The start of warrenty date is questionable. Shouldn't the start of warrenty date be the date you purchased the laptop? It certainly is my country.

But I agree with HP that you should reinstall the OD and see if the errors come back.
0
 

Author Closing Comment

by:Carolvara
ID: 35015188
We ran hardware diagnostics and it seems the hardware is fine so have reinstalled the operating system and so far so good.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

One of the features I've come to appreciate about Windows 7 and Windows Server 2008 R2 is the ability to pin applications to the task bar. As useful a feature as I've found this, it does have some quirks.  For example, have you ever tried pinning an…
Lithium-ion batteries area cornerstone of today's portable electronic devices, and even though they are relied upon heavily, their chemistry and origin are not of common knowledge. This article is about a device on which every smartphone, laptop, an…
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now