Windows 8 - Anyone checked their event logs?

Arthur Hucksake · 29 Oct 2012 at 09:57

Hi folks,

Been with Win 8 for just over a day now, after severe grief with two installs going bad. (Upgrade doesn't work at all, 2nd I should have run Windows update before installing newer nvidia drivers).... I am left with an OS in reasonable working order.

But look at this....

taskhostex (1768) An attempt to open the file "C:\Users\Damien\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).

Or how about some of this....

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-2217591357-3541557252-3149719819-1001:
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall

And alarmingly this huge list.

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
50 user registry handles leaked from \Registry\User\S-1-5-21-2217591357-3541557252-3149719819-1001:
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\Root
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\Root
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\Root
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\Internet Explorer\Main\FeatureControl
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\CA
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\CA
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\CA
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\trust
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\trust
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\trust
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\MY
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\SystemCertificates\MY
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 992 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates
Process 680 (\Device\HarddiskVolume1\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2217591357-3541557252-3149719819-1001\Software\Policies\Microsoft\SystemCertificates

Can anybody share some insight into this alarming number of errors on a clean install?

On Win 7 I only ever got one error relating to having disabled hibernation. (And for awhile one relating to MSE)

Arthur Hucksake · 29 Oct 2012 at 15:31

Nobody?

Getting allsorts of weird errors with this OS.

Reminds me of when I first ever used Vista. lol

theheyes · 29 Oct 2012 at 15:42

So is this an upgrade from an existing version or a fresh one?

Glaucus · 29 Oct 2012 at 15:44

Arthur Hucksake said:
Nobody?

Getting allsorts of weird errors with this OS.

Reminds me of when I first ever used Vista. lol

You keep saying this rubbish.
It's nothing like vista, have you seen how many of us have installed it fine.
Vista was a new kernal number, which broke nearly everything. W8 is just a revision, breaks a few things only and most companies have drivers/uodates out.

kitch9 · 29 Oct 2012 at 15:50

When you say fresh install is that from a complete format with none of your programs installed?

If you've installed programs were they all honestly from legit sources or is there some, uhm, not so legit?

If some are not so legit, I'd be tempted to run Malwarebytes to check there's not rogue spyware constantly accessing files its not allowed to.

Arthur Hucksake · 29 Oct 2012 at 16:32

kitch9 said:
When you say fresh install is that from a complete format with none of your programs installed?

If you've installed programs were they all honestly from legit sources or is there some, uhm, not so legit?

If some are not so legit, I'd be tempted to run Malwarebytes to check there's not rogue spyware constantly accessing files its not allowed to.

Yes, this is with the clean install option. Nothing carried over.

I did try and do the carry over option before but everything was horrendously broken.

Arthur Hucksake · 29 Oct 2012 at 16:34

Glaucus said:
You keep saying this rubbish.
It's nothing like vista, have you seen how many of us have installed it fine.
Vista was a new kernal number, which broke nearly everything. W8 is just a revision, breaks a few things only and most companies have drivers/uodates out.

And you keep defending this POS operating system. Worried about your share options? What is your agenda.

If people are having issues, isn't it good to share them?

There is absolutely no real good reason to upgrade from Windows 7.

It's a bit faster and smoother, but who's going to notice if they are using SSD drives?

Arthur Hucksake · 29 Oct 2012 at 16:35

kitch9 said:
When you say fresh install is that from a complete format with none of your programs installed?

If you've installed programs were they all honestly from legit sources or is there some, uhm, not so legit?

If some are not so legit, I'd be tempted to run Malwarebytes to check there's not rogue spyware constantly accessing files its not allowed to.

All of my programs are legit. Not a single dodgy one.

Unless drivers, Chrome, Origin and Steam are considered dodgy.

Glaucus · 29 Oct 2012 at 16:38

Arthur Hucksake said:
And you keep defending this POS operating system. Worried about your share options? What is your agenda.

If people are having issues, isn't it good to share them?

There is absolutely no real good reason to upgrade from Windows 7.

It's a bit faster and smoother, but who's going to notice if they are using SSD drives?

Lol, there's a whole thread on teh features, there is a lot of new features in it. Is is the largest windows update, probably ever or at least since win95.

Ever wonder why your experince differs from pretty much everyone else? That should tell you something.

Also most other people go I have this issue, any solutions or help. You just come across as ****ging it off not wanting to solve it at all.

Lssas.exe for example is to do with windows login or can be infected by a worm, which would show those errors.

Arthur Hucksake · 29 Oct 2012 at 16:43

Glaucus said:
Lol, there's a whole thread on teh features, there is a lot of new features in it. Is is the largest windows update, probably ever or at least since win95.

Ever wonder why your experince differs from pretty much everyone else? That should tell you something.

Also most other people go I have this issue, any solutions or help. You just come across as ****ging it off not wanting to solve it at all.

Where are these great list of suggestions? Not running dodgy software, using latest drivers for all hardware.

Your following me around threads like a troll because I am having issues with Windows 8, it's getting pretty boring tbh.

Go off and enjoy your lovely stable Windows 8 and leave me and my threads alone.

Glaucus · 29 Oct 2012 at 16:46

Following you? Notice how I check and post in pretty much all win8 threads?

Sure it's a clean install. Disconnected other drives?

As I said lssas errors like that can be caused by a worm infection.

You can get errors from overcloks which are no longer stable in new OS,
Did you check the comparability list? When you first installed it?
Have you checked you big bits of hardware for known issues, some company's are stupidly bad at providing drivers.

Have you done the win8 update that includes a fairly big patch.

kitch9 · 29 Oct 2012 at 16:49

Arthur Hucksake said:
Yes, this is with the clean install option. Nothing carried over.

I did try and do the carry over option before but everything was horrendously broken.

You appear to be having problems on what is recent standard issue hardware... If it was my pc I'd be doubting that the rig is as stable as it appears.

Due to advancements in the later Windows stability your pc can throw errors due to unstable hardware and windows will deal with it without blue screening, and instead just making a log of the error in event viewer.

Orcvader · 29 Oct 2012 at 17:01

My event logs seems fine... Surely it must point something else is wrong in your system?

stealthgeek · 29 Oct 2012 at 17:27

You can ignore those, we sometimes see those quite frequently on our Win7 clients. Its just Windows processes not letting go of files at log off, unless you are seeing some odd behaviour, I'd suggest just ignoring these.

kitch9 · 29 Oct 2012 at 17:29

Orcvader said:
My event logs seems fine... Surely it must point something else is wrong in your system?

I'd say so. The ops rig is similar to the vast majority of enthusiasts rigs out there, and Windows 8 has been in beta for the public for months so it will have been installed on thousands of rigs all with the same hardware.

Arthur Hucksake · 29 Oct 2012 at 22:13

Well, i'm back on Windows 7 and everything is great.

It baffles really.

When installing 8, I think I must have clicked the option to install drivers automatically. That may have caused problems.

The only other thing I can think of is the bios for my mobo might need updating, but many with the same board have stuck with version 2103 because Asus dropped the ball on newer updates, causing OC issues and all sorts.

I am now back on Windows 7, I have installed a bunch of apps, got Steam and Origin working. Run several runs of Windows update for SP1 and the 100 odd other updates it wanted to install and I have the grand sum of five entries in event viewer, all for non events relating to installs.

This is a PC that has not had a single BSOD going back a year or so.

Arthur Hucksake · 29 Oct 2012 at 22:15

stealthgeek said:
You can ignore those, we sometimes see those quite frequently on our Win7 clients. Its just Windows processes not letting go of files at log off, unless you are seeing some odd behaviour, I'd suggest just ignoring these.

Thanks.

When I think about it, they seem to happen in a huge sequence when rebooting. It's as if the new fast reboot times are causing things to not shut down properly.

kitch9 · 29 Oct 2012 at 22:18

Arthur Hucksake said:
Thanks.

When I think about it, they seem to happen in a huge sequence when rebooting. It's as if the new fast reboot times are causing things to not shut down properly.

So did you actually have a problem, or are you looking for problems with no idea what is actually a problem?

People seem to lose braincells around a windows launch...

Arthur Hucksake · 30 Oct 2012 at 17:01

kitch9 said:
So did you actually have a problem, or are you looking for problems with no idea what is actually a problem?

People seem to lose braincells around a windows launch...

Sometimes apps wouldn't launch properly, click on them (from desktop) and nothing would happen. Why I delved into the event viewer to begin with and spotted a host of strange messages.

Most of them relate to the registry handling and Saitek drivers. (Cyborg RAT 7 mouse I assume)

I keep my back up stuff on a seperate 1TB drive and added a "Take Ownership" context menu just to get access to all of my folders.

Between that and letting Windows update the drivers itself on install (bad idea) probably added to the problems.

Are people installing drivers for chipset / mobo such as Intel Management Engine , Intel RST etc for Win 8?

foil · 30 Oct 2012 at 17:12

Have you been using Internet Explorer?