BSOD BC Code d1

[pilottrist]

First time poster and useless pc knowledge, so please go easy with me.

Tun on the PC - OK
Login - OK
Using the mouse - No Problems
Type on the keyboard - PC Freezes, Blue Screen appears with the following:

OS Version: 6.0.6002.2.2.0.768.3
LocaleID: 2057

BC Code: d1
BCP1: 871FC434
BCP2: 00000002
BCP3: 00000008
BCP4: 871FC434
Service Pack 2
Product 768_1

No idea where to go now after many hours hunting the internet.
Can anyone help please?

 

[roy69]

Code D1 relates to device drivers.

The fact that you are using the keyboard would point me in that direction, however to be safe post a mini dump.

http://www.vistax64.com/crashes-debugging/282419-blue-screen-death-bsod-posting-instructions.html

 

[pilottrist]

Hi Roy61,

Thanks for getting back to me. I'm not sure I've done this correctly, but hopefullyyou can make sense of it...

View attachment Mini Dump.zip

 

[richc46]

Welcome
Its really good that you took the time to post. The culprit, as Roy said, is a driver:
KbdF.sys.
There is a possiblity that this is a keylogger..

 

[richc46]

Have you installled any keyloggin hardware on your keyboard?
Did you ever install anything to monitor your keystrokes?

 

[pilottrist]

Hi Rich,

Thanks for taking the time to reply.

No I haven't (knowingly) installed any keylogger hardware or software.

My PC was repaired recently (new motherboard!!) but worked well for a couple of week or so. The problem arose a little while ago. I carried out a system recovery/restore but to no avail. I've also noticed that the problem seems to be intermittent. Somedays it works fine, others it has a fit?!?!? Weird.

 

[richc46]

Not trying to scare but to warn so you can take action. If you did nothing someone could be logging your key strokes. Make a full anti virus scan, download and make a full scan with Malarebytes.

 

[pilottrist]

Thanks again Rich,

I couldn't find 'Malarebytes' soI downloaded Malwarebytes instead (only joking).
Quick scan didn't find anything. Restarted the PC just in case and low and behold same problem?!?!?!?

I'm leaving the country for a couple of weeks to recharge my batteries , so i'll have another look when I return.

Any other advice would be most appreciated.

 

[richc46]

Not trying to scare but to warn so you can take action. If you did nothing someone could be logging your key strokes. Make a full anti virus scan, download and make a full scan with Malarebytes.

The above relates my true concerns about your problem. I have Googled and found that many that use Kaspensky Anti Virus have reported that this malware was found. Use this link to tak an online scan. Its the last button. If negative, we will work on just solving the problem.
Free Virus Scan - Kaspersky Lab
Dont let the site fool you into buying or paying for anything, do the free scan.

 

[pilottrist]

Hi Rich,

Back from holiday and nothing changed.

I've completed the Kapersky scans as suggested with no luck. In fact they came back with a free error report.

I've even bought a new keyboard (just in case!!), but still having the same problems.

Any further suggetions would obviuosly be most welcome.

Thanks again.

 

[richc46]

Everything I see mentions virus. I am going to ask our Malware expert for assitance, please be patient.
While we wait download the free Macrium Reflect and make an image of your entire hard drive and keep it on an external hard drive. If our expert finds nothing, we will manually delete the driver. We need that back up just in case of problems.

 

[Jacee]

The error can be caused by various reasons, generally, these situations below would easily make the computer result in the KbdF.sys error:
KbdF.sys file has been corrupted or deleted on the computer mistakenly
Related registry files has been damaged or corrupted
Windows or drivers have been out of date
Improper program installation or removal
Malicious spyware or virus invasion

Let's see if VEW shows us anything useful:
download VEW by Vino Rosso http://images.malwareremoval.com/vino/VEW.exe
and save it to your desktop
Double click it to start it Note: If running Windows Vista or Windows 7 you will need to right click the file and select Run as administrator and click Continue or Allow at the User Account Control Prompt.
Click the check boxes next to Application and System located under Select log to query on the upper left
Under Select type to list on the right click the boxes next to Error and Warning Note: If running Windows Vista or Windows 7 also click the box next to Critical (not XP).
Under Number or date of events select Number of events and type 20 in the box next to 1 to 20 and click Run
Once it finishes it will display a log file in notepad
Please copy and paste its entire contents into your next reply

 

[pilottrist]

Hi Jacee,

Thanks for taking up the challenge. Here's the log file you asked for (makes absolutely no sense to me whatsoever...)

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 11/09/2012 18:34:41
Note: All dates below are in the format dd/mm/yyyy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 11/09/2012 08:44:03
Type: Error Category: 0
Event: 1013 Source: MsiInstaller
SA_Error1709: StandardAction(0xC00706AD): Product: AVG 2012 -- SA_Error25101: StandardAction(0xC007620D): We have detected that Microsoft Security Essentials, is already installed on your system, therefore the installation can not continue. We recommend that you uninstall this product first and then try to launch the installation again.

Log: 'Application' Date/Time: 10/09/2012 14:24:54
Type: Error Category: 0
Event: 1024 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) - Update 'Adobe Reader X (10.1.4)' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: How to enable Windows Installer logging

Log: 'Application' Date/Time: 10/09/2012 14:24:50
Type: Error Category: 0
Event: 11328 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) -- Error 1328.Error applying patch to file C:\Config.Msi\PT9C7.tmp. It has probably been updated by other means, and can no longer be modified by this patch. For more information contact your patch vendor. System Error: -1072807676

Log: 'Application' Date/Time: 07/09/2012 11:43:46
Type: Error Category: 0
Event: 1024 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) - Update 'Adobe Reader X (10.1.4)' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: How to enable Windows Installer logging

Log: 'Application' Date/Time: 07/09/2012 11:43:41
Type: Error Category: 0
Event: 11328 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) -- Error 1328.Error applying patch to file C:\Config.Msi\PT2D15.tmp. It has probably been updated by other means, and can no longer be modified by this patch. For more information contact your patch vendor. System Error: -1072807676

Log: 'Application' Date/Time: 06/09/2012 20:55:19
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program iexplore.exe version 9.0.8112.16447 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: a70 Start Time: 01cd8c6c6c6e7ae6 Termination Time: 109

Log: 'Application' Date/Time: 06/09/2012 16:48:02
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application AcroRd32.exe, version 10.1.3.23, time stamp 0x4f7bc349, faulting module AcroRd32.dll, version 10.1.3.23, time stamp 0x4f7bd937, exception code 0xc0000005, fault offset 0x0011c243, process id 0x127c, application start time 0x01cd8c4f2646e45b.

Log: 'Application' Date/Time: 06/09/2012 13:02:29
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application AcroRd32.exe, version 10.1.3.23, time stamp 0x4f7bc349, faulting module AcroRd32.dll, version 10.1.3.23, time stamp 0x4f7bd937, exception code 0xc0000005, fault offset 0x0011c243, process id 0x1648, application start time 0x01cd8c2fc78d3588.

Log: 'Application' Date/Time: 05/09/2012 17:46:14
Type: Error Category: 3
Event: 3024 Source: Microsoft-Windows-Search
The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.
Context: Application, SystemIndex Catalog

Log: 'Application' Date/Time: 05/09/2012 13:12:51
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program iexplore.exe version 9.0.8112.16447 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1430 Start Time: 01cd8b61a3a62009 Termination Time: 162

Log: 'Application' Date/Time: 05/09/2012 11:04:18
Type: Error Category: 3
Event: 3013 Source: Microsoft-Windows-Search
The entry <MAPI://{S-1-5-21-456719513-3515247821-1769776507-1000}/PERSONAL FOLDERS($941BA282)/0/OUTBOX/????????????????????????/AT=????:JJR001.PDF> in the hash map cannot be updated.
Context: Application, SystemIndex Catalog
Details:
A device attached to the system is not functioning. (0x8007001f)

Log: 'Application' Date/Time: 04/09/2012 11:15:49
Type: Error Category: 0
Event: 1024 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) - Update 'Adobe Reader X (10.1.4)' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: How to enable Windows Installer logging

Log: 'Application' Date/Time: 04/09/2012 11:15:37
Type: Error Category: 0
Event: 11328 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) -- Error 1328.Error applying patch to file C:\Config.Msi\PTA2C0.tmp. It has probably been updated by other means, and can no longer be modified by this patch. For more information contact your patch vendor. System Error: -1072807676

Log: 'Application' Date/Time: 04/09/2012 11:15:31
Type: Error Category: 3
Event: 3007 Source: Microsoft-Windows-Search
Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.
Context: Application, SystemIndex Catalog

Log: 'Application' Date/Time: 04/09/2012 11:15:30
Type: Error Category: 3
Event: 3006 Source: Microsoft-Windows-Search
Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Log: 'Application' Date/Time: 01/09/2012 08:23:56
Type: Error Category: 3
Event: 3007 Source: Microsoft-Windows-Search
Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.
Context: Application, SystemIndex Catalog

Log: 'Application' Date/Time: 01/09/2012 08:23:56
Type: Error Category: 3
Event: 3006 Source: Microsoft-Windows-Search
Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.

Log: 'Application' Date/Time: 01/09/2012 07:53:22
Type: Error Category: 0
Event: 1024 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) - Update 'Adobe Reader X (10.1.4)' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: How to enable Windows Installer logging

Log: 'Application' Date/Time: 01/09/2012 07:53:12
Type: Error Category: 0
Event: 11328 Source: MsiInstaller
Product: Adobe Reader X (10.1.4) -- Error 1328.Error applying patch to file C:\Config.Msi\PTFA22.tmp. It has probably been updated by other means, and can no longer be modified by this patch. For more information contact your patch vendor. System Error: -1072807676

Log: 'Application' Date/Time: 01/09/2012 07:50:45
Type: Error Category: 3
Event: 3024 Source: Microsoft-Windows-Search
The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.
Context: Application, SystemIndex Catalog

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 11/09/2012 12:32:31
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-456719513-3515247821-1769776507-1000_Classes:
Process 3096 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000_CLASSES

Log: 'Application' Date/Time: 11/09/2012 08:41:17
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\PROGRA~1\MICROS~4\Office12\OUTLOOK.EXE' (pid 6280) cannot be restarted - Application SID does not match Conductor SID..

Log: 'Application' Date/Time: 11/09/2012 08:41:17
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\Program Files\AVG\AVG2012\avgtray.exe.old' (pid 7752) cannot be restarted - Application SID does not match Conductor SID..

Log: 'Application' Date/Time: 11/09/2012 08:41:17
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\PROGRA~1\MICROS~4\Office12\OUTLOOK.EXE' (pid 6280) cannot be restarted - Application SID does not match Conductor SID..

Log: 'Application' Date/Time: 11/09/2012 08:41:17
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\Program Files\AVG\AVG2012\avgtray.exe.old' (pid 7752) cannot be restarted - Application SID does not match Conductor SID..

Log: 'Application' Date/Time: 10/09/2012 14:24:23
Type: Warning Category: 0
Event: 36 Source: Outlook
Outlook Search has encountered an error and is temporarily disabling indexing for store C:\Users\User\Contacts\C\Users\Nic\AppData\Local\Microsoft\Outlook\Outlook.pst (error=0xc0040db9).

Log: 'Application' Date/Time: 07/09/2012 18:18:43
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-456719513-3515247821-1769776507-1000_Classes:
Process 1564 (\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000_CLASSES

Log: 'Application' Date/Time: 07/09/2012 12:48:37
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <mapi://{s-1-5-21-456719513-3515247821-1769776507-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
A server error occurred. Check that the server is available. (0x80041206)

Log: 'Application' Date/Time: 05/09/2012 17:46:14
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <iehistory://{s-1-5-21-456719513-3515247821-1769776507-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
Unspecified error (0x80004005)

Log: 'Application' Date/Time: 05/09/2012 17:44:36
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-456719513-3515247821-1769776507-1000:
Process 4284 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000

Log: 'Application' Date/Time: 05/09/2012 11:06:56
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <mapi://{s-1-5-21-456719513-3515247821-1769776507-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
A server error occurred. Check that the server is available. (0x80041206)

Log: 'Application' Date/Time: 03/09/2012 11:09:44
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <iehistory://{s-1-5-21-456719513-3515247821-1769776507-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
The filtering was stopped because of a user action, such as stopping the crawl. (0x80040d54)

Log: 'Application' Date/Time: 03/09/2012 10:22:37
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Log: 'Application' Date/Time: 01/09/2012 08:22:32
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Log: 'Application' Date/Time: 01/09/2012 08:17:18
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Log: 'Application' Date/Time: 01/09/2012 08:12:59
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Log: 'Application' Date/Time: 01/09/2012 08:05:55
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Log: 'Application' Date/Time: 01/09/2012 07:50:45
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <iehistory://{s-1-5-21-456719513-3515247821-1769776507-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
Unspecified error (0x80004005)

Log: 'Application' Date/Time: 29/08/2012 15:48:44
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Log: 'Application' Date/Time: 28/08/2012 15:44:58
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 15 user registry handles leaked from \Registry\User\S-1-5-21-456719513-3515247821-1769776507-1000:
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\trust
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\Disallowed
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\TrustedPeople
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\My
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\CA
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Policies\Microsoft\SystemCertificates
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Policies\Microsoft\SystemCertificates
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Policies\Microsoft\SystemCertificates
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Policies\Microsoft\SystemCertificates
Process 4396 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-456719513-3515247821-1769776507-1000\Software\Microsoft\SystemCertificates\Root

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 17/07/2012 12:29:58
Type: Critical Category: 0
Event: 41 Source: Microsoft-Windows-Kernel-Power
The last sleep transition was unsuccessful. This error could be caused if the system stopped responding, failed, or lost power during the sleep transition.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 11/09/2012 12:35:24
Type: Error Category: 0
Event: 7024 Source: Service Control Manager
The AVGIDSAgent service terminated with service-specific error 3758213661 (0xE001CA1D).

Log: 'System' Date/Time: 11/09/2012 08:38:14
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x80073712: Cumulative Security Update for Internet Explorer 9 for Windows Vista (KB2722913).

Log: 'System' Date/Time: 11/09/2012 08:34:21
Type: Error Category: 0
Event: 4375 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of setting package KB2722913 (Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:21
Type: Error Category: 0
Event: 4375 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of setting package KB2722913 (Security Update) into Absent(Absent) state

Log: 'System' Date/Time: 11/09/2012 08:34:21
Type: Error Category: 0
Event: 4375 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of setting package KB2722913 (Security Update) into Absent(Absent) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-14_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-13_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-12_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-11_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-10_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-9_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-8_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-7_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-6_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-5_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-4_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-3_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-2_neutral_GDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:34:13
Type: Error Category: 0
Event: 4385 Source: Microsoft-Windows-Servicing
Windows Servicing failed to complete the process of changing update 2722913-1_neutral_LDR from package KB2722913(Security Update) into Resolving(Resolving) state

Log: 'System' Date/Time: 11/09/2012 08:29:26
Type: Error Category: 0
Event: 7024 Source: Service Control Manager
The AVGIDSAgent service terminated with service-specific error 3758213661 (0xE001CA1D).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 06/09/2012 23:17:37
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:37
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:37
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:37
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:37
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

Log: 'System' Date/Time: 06/09/2012 23:17:36
Type: Warning Category: 0
Event: 51 Source: disk
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.

 

[Jacee]

Are you using a USB drive?

 

[pilottrist]

Hi Jacee,

I do use USB drives occasionally, but not when I immediately log in. I do however have a WD hard drive connected to back up data on a continuous basis.

I've also pre-emted your potential next question which might have been to remove the drive, restart etc. but again with no definitive answer. That is to say, over the weekend, no problems???? Have logged in a number of times with no glitches whatsover.

Confused? Me too!