Toshiba Laptop - Windows 7 Home Premium SP1 - Event Log problems to isolate cause and fix

First of all, thank you so much for any insight you can give me.  Multiple systems, many new problems.  This concerns a Laptop and Laptop troubles - March 10, 2015 - Event Log  I've been having these recurring errors or warnings in Event Log for a couple of weeks.  Here are a few samples just today.   This Laptop is a Toshiba Satellite L505 W/7 SP1 all updated, with McAfee Total Protection.   All deep scans as well as Windows Defender finds no problems.  64 bit - 4 GB ram.  I use the McAfee Total Protection package on this system, and the McAfee Firewall, but sometimes a warning that none are activated and I have to force them to load.  I only choose the McAfee Firewall.   Any ideas how to guide me here?

Session "McAfee.{E4367DA7-2B80-47f3-86D2-7626A18FC6F4}" stopped due to the following error: 0xC0000188
The maximum file size for session "McAfee.{E4367DA7-2B80-47f3-86D2-7626A18FC6F4}" has been reached. As a result, events might be lost (not logged) to file "C:\ProgramData\McAfee\MCLOGS\ETW\mclogs.etl". The maximum files size is currently set to 16777216 bytes.
Name resolution for the name home.mcafee.com timed out after none of the configured DNS servers responded.
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
Name resolution for the name graph.facebook.com timed out after none of the configured DNS servers responded.
WLAN AutoConfig service has successfully stopped.
Product: QuickTime 7. The application tried to modify a protected Windows registry key \Software\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}.
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

 DETAIL -
 15 user registry handles leaked from \Registry\User\S-1-5-21-553458819-2443489251-3680392596-1001:
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\trust
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\My
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\CA
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 3356 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\Root

Thanks a bunch,.
":0)  Asta
LVL 27
Asta CuTechnical consultant & graphic designAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

nobusCommented:
i found this :   https://community.mcafee.com/thread/77007
Possible corruption of the software could cause this.   Run the "Virttual Technician" to see if it helps:  http://mvt.mcafee.com/

If that doesn't help uninstall via Control Panel, then run the MCPR cleanup tool, reboot and reinstall from your online account.

i hope it helps!
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Thanks, nobus.  Virtual technician finds no problems.  Will try the other and report back when I get back to that system.
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Posted too soon; is there some kind of limit to log size?  Perhaps I should just try to delete a log?
0
IT Pros Agree: AI and Machine Learning Key

We’d all like to think our company’s data is well protected, but when you ask IT professionals they admit the data probably is not as safe as it could be.

Asta CuTechnical consultant & graphic designAuthor Commented:
Oh no. Chatted with mcafee tech support who took over laptop control and verified that the mcafee all access total protection was working just fine. No help on the error messages or timeout issues. I Disconnected from them and rebooted  insanity ever since.
Could not fully load the desktop explorer stopped working and I had to restore it for all desktop icons to appear including all browser icons iTunes etc. after reboots same issue. Tried restore point yesterday prior to windows update but it could not complete. Stated to run chkdsk  /r and rebooted to find same problem. Explorer. Event viewer shows bonjour missing and so on
Going to run sfc /scandisk
Nightmare
Any ideas?
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Here are some of the specifics in the Event log shown as RED X ERRORS in just the last hour

The McAfee Online Backup service failed to start due to the following error:
The system cannot find the file specified
The program Explorer.EXE version 6.1.7601.17567 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 Process ID: 74c
 Start Time: 01d05c63cc944a3f
 Termination Time: 0
 Application Path: C:\windows\Explorer.EXE
 Report Id: 2f54080f-c857-11e4-8031-001e33fecfb3

Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
WLAN AutoConfig service has successfully stopped.

The UPnP Device Host service failed to start due to the following error:
The service did not start due to a logon failure.
The upnphost service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error:
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
The Superfetch service terminated with service-specific error The operation completed successfully..
DCOM got error "1069" attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.  

 DETAIL -
 15 user registry handles leaked from \Registry\User\S-1-5-21-553458819-2443489251-3680392596-1001:
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Policies\Microsoft\SystemCertificates
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\trust
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\My
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\CA
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 3208 (\Device\HarddiskVolume2\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE) has opened key \REGISTRY\USER\S-1-5-21-553458819-2443489251-3680392596-1001\Software\Microsoft\SystemCertificates\Root

Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
The Windows Defender service terminated with the following error:
%%-2147416365
The McAfee Online Backup service failed to start due to the following error:
The system cannot find the file specified.
An unspecified error occurred during System Restore: (Installed DirectX). Additional information: 0x80070057.
The McAfee Online Backup service failed to start due to the following error:
The system cannot find the file specified.
Name resolution for the name sync.adap.tv timed out after none of the configured DNS servers responded.

PLEASE HELP....  I don't use McAfee Backup and can't even locate and never even try to synmc anything like adap.tv
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Am reinstalling Safari etc. and running updates and sfc again.
0
nobusCommented:
can you say for sure there's no malware - virus?  it starts looking that way
you know you can run these :
http://www.malwarebytes.org/mbam.php                         MBAM
http://majorgeeks.com/RogueKiller_d6983.html                  Roguekiller
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Thanks, nobus.  chkdsk /r ran most of the night, after which updated definition files for Windows Defender started running.  Also did deep scan with All Access McAfee, etc.  Will check back with you after the system completes current scans.  I don't believe it is malware at this point, but it does act that way.
0
Asta CuTechnical consultant & graphic designAuthor Commented:
No malware found
0
Asta CuTechnical consultant & graphic designAuthor Commented:
YIKES!  Can this really be happening?  Please help.  After days of "fixes" right back here again.  Uninstalled/reinstalled the McAfee All Access package and at reboot this same problem where explorer.exe won't load.  sfc /scannow finds no problems.  Here are the same old items in the EVENT VIEWER as errors:

The McAfee Online Backup service failed to start due to the following error:
The system cannot find the file specified.
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
WLAN AutoConfig service has successfully stopped.
The program Explorer.EXE version 6.1.7601.17567 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 Process ID: 744
 Start Time: 01d05d0c7a24a397
 Termination Time: 0
 Application Path: C:\windows\Explorer.EXE
 Report Id: e6af96d5-c900-11e4-8a1a-001e33fecfb3
Name resolution for the name home.mcafee.com timed out after none of the configured DNS servers responded.
The McAfee Online Backup service failed to start due to the following error:
The system cannot find the file specified.
The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.

If this needs to be posted elsewhere or in multiple questions, please let me know.
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Whacking away at the problems, many solved, these still need help

Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
WLAN AutoConfig service has successfully stopped.
0
nobusCommented:
i found this  method :    https://social.technet.microsoft.com/Forums/windows/en-US/0c942bd9-47ad-4897-a5c2-485cc9fe681f/microsoft-security-client-oobe-stopped-due-to-the-following-error-0xc000000d?forum=w7itprosecurity
"The way I resolved the issue was to delete one file
(You will need to alter folder options to view file)
C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl
Deleted file left in recycle bin and rebooted
Checked event viewer again problem no longer there
Emptied recycle bin again rebooted
No problems on system since
Running 100%"

i hope it helps you too

other than the above, i can only suggest the obvious methods :
-uninstall mac Afee completely - use their uninstaller - then reinstalkl and test
-run sfc or a repair install :
http://www.sevenforums.com/tutorials/3413-repair-install.html            REPAIR
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html         SFC

choose the way you want to go
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Asta CuTechnical consultant & graphic designAuthor Commented:
Deleting that dll, fixed that problem.  McAfee Tech support involved yesterday removing all residual issues in the system and registry dealing with the McAfee Backup problems, so that too is now resolved.  Apparently the All Access package included backup functions, since no longer supported or used (withdrawn) and remained 'stuck' in corruption.  Stranger things have happened.

sfc /scannow has been run multiple times, along with chkdsk /r  everything showed no problems.

The only problem which remains is this:

The program Explorer.EXE version 6.1.7601.17567 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 Process ID: 76c
 Start Time: 01d05d88adccdea1
 Termination Time: 0
 Application Path: C:\windows\Explorer.EXE
 Report Id: 99554dd9-c97c-11e4-9bee-001e33fecfb3

In Action Center, nothing whatsoever about this found.

The only way to get the desktop and everything to load since the blue spinning circle persists into oblivion, is to click the start button where pop up advised Windows Explorer not responding, and I then click RESTART PROGRAM.

What is this about?

Once this is resolved, this system is back to (hopefully) fully functional and responsive.

Thank you very much.
0
Asta CuTechnical consultant & graphic designAuthor Commented:
I should add that as I was running these malware apps, a pop up stated something was a threat, but disappeared before I could read content.

I found strange items also in the startup programs analysis, removed some from automatically loading.  Testing.
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Terrific!  Stopped items from loading at startup - iCloud, McAfee SafeKey, Toshiba power saver and a few other; clearly not needed at startup.  Delete the dll and things appear vastly improved.

These are the only remnants and they are all listed as warnings versus errors.  Love it!  Will return to this system later today or in the morning and finalize this Q.

WLAN AutoConfig service has successfully stopped. These continue as warnings, and are frequent.  But don't believe it's a problem, but listening for recommendations, if I should resolve.

Name resolution for the name us.mcafee.com timed out after none of the configured DNS servers responded. Whereas this, I don't understand.  This laptop is WIFI and the connection is for ISP AT&T.  Not sure how or why this continues to time out.  Some research done in this regard earlier stated ipv6 vbs. ipv4 perhaps, since rumor is that they are upgrading, but at this point unclear.

Thank you so much.
0
Asta CuTechnical consultant & graphic designAuthor Commented:
Closing, grateful for the assistance and listening further if any additional ideas pop up about the last two items.  Perhaps they should be included in a new question.

Have a great rest of the day, nobus.

":0)  Asta
0
nobusCommented:
tx for feedback - asta - and glad to help
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.