windows 8 update failed (error code 800703F1)

amin · Aug 15, 2014

Greetings Sysnative..:wave:
im facing win 8 update error 800703F1
am attaching CBS and DISM here

thanks for your help guys..

wmorri · Aug 16, 2014

Hi,

Welcome to Sysnative.

I am going to move your thread to the Update Forum.

Go The Power · Aug 18, 2014

Hello amin and welcome to the forum :)

Lets get a full scan down of SFC and go from there :)

SFC /SCANNOW

Right click on the

button
Click on Command prompt (Admin) => Press Yes on the prompt
Inside the Command Prompt windows copy and paste the following command SFC /SCANNOW
Please wait for this to Finish before continuing with rest of the steps.

Convert CBS.log to CBS.txt

Right click on the

button
Click on Run => Inside the run box copy and paste the following command:
Code:
```
cmd /c copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"
```
Press Enter
Once this has completed please go to your Desktop and you will find CBS.txt => Please upload CBS.txt to this thread

Please Note:: if the file is too big to upload to you next post please upload via Dropbox or ge.tt

amin · Aug 18, 2014

Thanks Go The Power.
i followed the steps but,
When i want to run the SFC /SCANNOW command,the cmd shows this message "Windows Resource Protection could not perform the requested operation."
i have no idea what it means..:huh:
is it prevent it from perform the full scan?

Go The Power · Aug 19, 2014

Hello Amin,

Hmm strange, did this happen as soon as you ran SFC SCANNOW or part way through?

Can you please follow the previous steps for "Convert CBS.log to CBS.txt", lets see if there are any indications in the log as to why this failed :)

amin · Aug 20, 2014

Hello Go The Power,

It happened part way through after i ran SFC SCANNOW,

A few seconds after i ran the command the message appeared.

Thanks..:smile9:

Go The Power · Aug 21, 2014

Hello Amin

looks like there might be an issues withe registry hive COMPONENTS which is stopped SFC from running

Code:

2014-08-19 02:08:53, Info                  CBS    Failed to load the COMPONENTS hive from 'C:\windows\System32\config\COMPONENTS' into registry key 'HKLM\COMPONENTS'. [HRESULT = 0x800703f1 - ERROR_BADDB]
2014-08-19 02:08:53, Info                  CBS    Failed to load component store [HRESULT = 0x800703f1 - ERROR_BADDB]

SFCFix Collect CBS

Download SFCFix.exe (by niemiro) and save this to your Desktop.
Download SFCFix.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
On your Desktop, you should now see two files: SFCFix.exe and SFCFixScript.txt.
Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
SFCFix will now begin to upload your CBS logfiles to our server.
Upon completion, a log should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

If all goes well, you should see that your logfiles have now been added to your thread.

LogBot · Aug 22, 2014

Logfile submission from amin

Logfile submission from amin.

The logfiles are available at: https://www.sysnative.com/niemiro/fileDistribution/2014-08/612.zip

amin · Aug 22, 2014

Code:

SFCFix version 2.3.0.0 by niemiro.
Start time: 2014-08-22 15:17:52.871
Using .txt script file at C:\Users\USER\Desktop\SFCFixScript.txt [0]








Collect:: directive completed successfully.








Successfully processed all directives.
SFCFix version 2.3.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2014-08-22 15:19:14.512
Script hash: 
----------------------EOF-----------------------

Go The Power · Aug 25, 2014

Hello Amin,

Event Log Viewer

Please download VEW.exe from Here and save it to your desktop.
Go to your desktop and right click on VEW.exe and choose Run as Administrator
Once open set the following settings
- 'Select log to query'
  1. Tick Application
  2. Tick System
- 'Select Type to list'
  1. Tick Critical
  2. Tick Error
  3. Tick Information
  4. Tick Warning
- 'Number or date events'
  1. Tick Number of Events and set it to 20
Click on Run
Once completed a notepad file will open. Please copy and paste the contents of VEW.txt back into this thread.

amin · Aug 26, 2014

Hello Go The Power,
The Content after i ran the VEW.txt

Code:

Vino's Event Viewer v01c run on Windows 7 in English
Report run at 26/08/2014 3:51:32 PM


Note: All dates below are in the format dd/mm/yyyy


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 26/08/2014 6:59:06 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: glcnd.exe, version: 6.2.9200.20780, time stamp: 0x51ede615 Faulting module name: glcnd.exe, version: 6.2.9200.20780, time stamp: 0x51ede615 Exception code: 0xc0000005 Fault offset: 0x00000000001e9caf Faulting process id: 0x1290 Faulting application start time: 0x01cfc0fa86617d64 Faulting application path: C:\Program Files\WindowsApps\Microsoft.Reader_6.2.9200.20780_x64__8wekyb3d8bbwe\glcnd.exe Faulting module path: C:\Program Files\WindowsApps\Microsoft.Reader_6.2.9200.20780_x64__8wekyb3d8bbwe\glcnd.exe Report Id: 780d313e-2cee-11e4-8121-083e8eadc632 Faulting package full name: Microsoft.Reader_6.2.9200.20780_x64__8wekyb3d8bbwe Faulting package-relative application ID: Microsoft.Reader


Log: 'Application' Date/Time: 26/08/2014 6:47:35 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0x117c Faulting application start time: 0x01cfc0f99cf6d3f4 Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: dc19b615-2cec-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 26/08/2014 6:26:32 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0xe7c Faulting application start time: 0x01cfc0f6ac1f4ab3 Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: eb9a64fa-2ce9-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 26/08/2014 2:37:41 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: BTWUIExt.exe, version: 12.0.0.4300, time stamp: 0x50a57e1c Faulting module name: KERNELBASE.dll, version: 6.2.9200.16451, time stamp: 0x50988aa6 Exception code: 0xe0434352 Fault offset: 0x000000000003811c Faulting process id: 0x8dc Faulting application start time: 0x01cfc0d674f641e0 Faulting application path: C:\Program Files\Lenovo\Bluetooth Software\BTWUIExt.exe Faulting module path: C:\windows\system32\KERNELBASE.dll Report Id: f326eccb-2cc9-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 26/08/2014 2:37:39 AM
Type: Error Category: 0
Event: 1026 Source: .NET Runtime
Application: BTWUIExt.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Windows.Markup.XamlParseException
Stack:
   at System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
   at System.Windows.Markup.WpfXamlLoader.LoadBaml(System.Xaml.XamlReader, Boolean, System.Object, System.Xaml.Permissions.XamlAccessLevel, System.Uri)
   at System.Windows.Markup.XamlReader.LoadBaml(System.IO.Stream, System.Windows.Markup.ParserContext, System.Object, Boolean)
   at System.Windows.Application.LoadBamlStreamWithSyncInfo(System.IO.Stream, System.Windows.Markup.ParserContext)
   at System.Windows.Application.LoadComponent(System.Uri, Boolean)
   at System.Windows.Application.DoStartup()
   at System.Windows.Application.<.ctor>b__1(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.DispatcherOperation.InvokeImpl()
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Windows.Threading.DispatcherOperation.Invoke()
   at System.Windows.Threading.Dispatcher.ProcessQueue()
   at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   at System.Windows.Application.RunInternal(System.Windows.Window)
   at System.Windows.Application.Run()
   at BTWUIExt.App.Main()




Log: 'Application' Date/Time: 26/08/2014 2:26:51 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0x484 Faulting application start time: 0x01cfc0d52e06698e Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: 6fa592e8-2cc8-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 26/08/2014 12:28:28 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0xf88 Faulting application start time: 0x01cfc0c4a692f408 Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: e5a52569-2cb7-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 6:54:48 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: MPLAB.exe, version: 8.86.0.0, time stamp: 0x4fd5dda2 Faulting module name: MPEditorStg.dll, version: 1.2.0.0, time stamp: 0x4fd5df04 Exception code: 0xc0000005 Fault offset: 0x00013ddd Faulting process id: 0x84c Faulting application start time: 0x01cfc031631c6bc5 Faulting application path: C:\Program Files (x86)\Microchip\MPLAB IDE\Core\MPLAB.exe Faulting module path: C:\Program Files (x86)\Microchip\MPLAB IDE\Core\MPEditorStg.dll Report Id: b39e1585-2c24-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 6:49:10 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: setup.exe_MPLAB Tools v, version: 14.0.0.162, time stamp: 0x4626bfd3 Faulting module name: ISSetup.dll, version: 14.0.0.162, time stamp: 0x4626b2af Exception code: 0xc0000005 Fault offset: 0x00093159 Faulting process id: 0x11cc Faulting application start time: 0x01cfc030a857ba5d Faulting application path: D:\SEM 5 Software\SOFTWARE EC501\MPLAB IDE\setup.exe Faulting module path: D:\SEM 5 Software\SOFTWARE EC501\MPLAB IDE\ISSetup.dll Report Id: ea9bbd55-2c23-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 6:48:38 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0xe04 Faulting application start time: 0x01cfc03098a1bb04 Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: d76f2a8a-2c23-11e4-8121-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 6:46:25 AM
Type: Error Category: 0
Event: 11905 Source: MsiInstaller
Product: MPLAB Tools v8.86 -- Error 1905.Module C:\Program Files (x86)\Microchip\MPLAB IDE\Core\MPDisplay2.dll failed to unregister.  HRESULT -2147220472.  Contact your support personnel.


Log: 'Application' Date/Time: 25/08/2014 6:46:25 AM
Type: Error Category: 0
Event: 11905 Source: MsiInstaller
Product: MPLAB Tools v8.86 -- Error 1905.Module C:\Program Files (x86)\Microchip\MPLAB IDE\PICkit 2\PICkit2.dll failed to unregister.  HRESULT -2147220472.  Contact your support personnel.


Log: 'Application' Date/Time: 25/08/2014 6:44:24 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: setup.exe_MPLAB Tools v, version: 14.0.0.162, time stamp: 0x4626bfd3 Faulting module name: ISSetup.dll, version: 14.0.0.162, time stamp: 0x4626b2af Exception code: 0xc0000005 Fault offset: 0x00093159 Faulting process id: 0x1020 Faulting application start time: 0x01cfc02ff4c2458b Faulting application path: D:\SEM 5 Software\SOFTWARE EC501\MPLAB IDE\setup.exe Faulting module path: D:\SEM 5 Software\SOFTWARE EC501\MPLAB IDE\ISSetup.dll Report Id: 4013d2b0-2c23-11e4-8120-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 6:42:32 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program setup.exe version 14.0.0.162 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: 5ec  Start Time: 01cfc02f21c43f78  Termination Time: 4294967295  Application Path: C:\Users\USER\AppData\Local\Temp\{12729754-3801-491F-A0AF-45A4EB6A4407}\setup.exe  Report Id: fb8e7fad-2c22-11e4-8120-083e8eadc632  Faulting package full name:   Faulting package-relative application ID:  


Log: 'Application' Date/Time: 25/08/2014 6:42:30 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program setup.exe version 14.0.0.162 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: db8  Start Time: 01cfc02f02a17e13  Termination Time: 4294967295  Application Path: C:\Users\USER\AppData\Local\Temp\{5849E6D8-9959-428C-817B-8A0F120C6D35}\setup.exe  Report Id: f94d7f46-2c22-11e4-8120-083e8eadc632  Faulting package full name:   Faulting package-relative application ID:  


Log: 'Application' Date/Time: 25/08/2014 6:42:27 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program IObitUninstaler.exe version 3.2.10.2466 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.  Process ID: 1190  Start Time: 01cfc02f1803e175  Termination Time: 4294967295  Application Path: C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe  Report Id: f36376a0-2c22-11e4-8120-083e8eadc632  Faulting package full name:   Faulting package-relative application ID:  


Log: 'Application' Date/Time: 25/08/2014 6:36:41 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: MPLAB.exe, version: 8.86.0.0, time stamp: 0x4fd5dda2 Faulting module name: MPEditorStg.dll, version: 1.2.0.0, time stamp: 0x4fd5df04 Exception code: 0xc0000005 Fault offset: 0x00013ddd Faulting process id: 0x2f4 Faulting application start time: 0x01cfc02ecf75e2ee Faulting application path: C:\Program Files (x86)\Microchip\MPLAB IDE\Core\MPLAB.exe Faulting module path: C:\Program Files (x86)\Microchip\MPLAB IDE\Core\MPEditorStg.dll Report Id: 2c1808e7-2c22-11e4-8120-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 6:15:36 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0xdbc Faulting application start time: 0x01cfc02bfaafaba2 Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: 39de0689-2c1f-11e4-8120-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


Log: 'Application' Date/Time: 25/08/2014 12:25:39 AM
Type: Error Category: 2414
Event: 2486 Source: Microsoft-Windows-Immersive-Shell
App Microsoft.Reader_8wekyb3d8bbwe!Microsoft.Reader did not launch within its allotted time.


Log: 'Application' Date/Time: 25/08/2014 12:14:02 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: DLCXtime.exe, version: 1.31.0.0, time stamp: 0x45331a17 Faulting module name: DLCXuldr.dll, version: 1.31.0.0, time stamp: 0x45331a50 Exception code: 0xc0000005 Fault offset: 0x0000000000017398 Faulting process id: 0x5a4 Faulting application start time: 0x01cfbff979530d6f Faulting application path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXtime.exe Faulting module path: C:\windows\system32\spool\DRIVERS\x64\3\DLCXuldr.dll Report Id: b75ef8bf-2bec-11e4-8120-083e8eadc632 Faulting package full name:  Faulting package-relative application ID: 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Information Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 26/08/2014 7:33:03 AM
Type: Information Category: 0
Event: 8224 Source: VSS
The VSS service is shutting down due to idle timeout. 


Log: 'Application' Date/Time: 26/08/2014 7:24:10 AM
Type: Information Category: 0
Event: 1007 Source: Microsoft-Windows-CEIP
Customer Experience Improvement Program data was successfully sent to Microsoft.


Log: 'Application' Date/Time: 26/08/2014 7:23:32 AM
Type: Information Category: 0
Event: 903 Source: Microsoft-Windows-Security-SPP
The Software Protection service has stopped. 


Log: 'Application' Date/Time: 26/08/2014 7:23:32 AM
Type: Information Category: 0
Event: 16384 Source: Microsoft-Windows-Security-SPP
Successfully scheduled Software Protection service for re-start at 2014-09-01T06:48:31Z. Reason: RulesEngine.


Log: 'Application' Date/Time: 26/08/2014 7:23:01 AM
Type: Information Category: 0
Event: 1003 Source: Microsoft-Windows-Security-SPP
The Software Protection service has completed licensing status check. Application Id=0ff1ce15-a989-479d-af46-f275c6370663 Licensing Status=
1: 064383fa-1538-491c-859b-0ecab169a0ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 090506fc-50f8-4c00-b8c7-91982a2a7c99, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 0bc1dae4-6158-4a1c-a893-807665b934b2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 0c4e5e7a-b436-4776-bb89-88e4b14687e2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 149dbce7-a48e-44db-8364-a53386cd4580, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 1b686580-9fb1-4b88-bfba-eae7c0da31ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 2030a84d-d6c7-4968-8cec-cf4737acc337, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: 26b6a7ce-b174-40aa-a114-316aa56ba9fc, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: 2b88c4f2-ea8f-43cd-805e-4d41346e18a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 2f756d47-e1b1-4d2a-922b-4d76f35d007d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: 3a3eb072-b131-430d-8157-2a582beb9682, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 3ad61e22-e4fe-497f-bdb1-3e51bd872173, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: 41499869-4103-4d3b-9da6-d07df41b6e39, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
14: 46d2c0bd-f912-4ddc-8e67-b90eadc3f83c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
15: 4cb3d290-d527-45c2-b079-26842762fdd3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
16: 54517397-284b-44cb-99eb-723b39dcb3a0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
17: 65c607d5-e542-4f09-ad0b-40d6a88b2702, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
18: 6ae65b85-e04e-4368-80a7-786d5766325e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
19: 6e5db8a5-78e6-4953-b793-7422351afe88, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
20: 7a75647f-636f-4607-8e54-e1b7d1ad8930, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
21: 82e42cb5-1741-46fb-8f2f-ac8414741e8d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
22: 87d2b5bf-d47b-41fb-af62-71c382f5cc85, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
23: 881d148a-610e-4f0a-8985-3be4c0db2b09, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
24: 8ded1da3-5206-4540-a862-e8473b65d742, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
25: a8119e32-b17c-4bd3-8950-7d1853f4b412, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
26: b322da9c-a2e2-4058-9e4e-f59a6970bd69, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 257726)(?)(?)(?)(?)])(1 )(2 )]
27: b6b47040-b38e-4be2-bf6a-dabf0c41540a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
28: bacd4614-5bef-4a5e-bafc-de4c788037a2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
29: bb00f022-69da-4be3-968d-d9bcd41cf814, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
30: c5a706ac-9733-4061-8242-28eb639f1b29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
31: db56dec3-34f2-4bc5-a7b9-ecc3cc51c12a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
32: dfc5a8b0-e9fd-43f7-b4ca-d63f1e749711, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
33: e3dacc06-3bc2-4e13-8e59-8e05f3232325, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
34: e538d623-c066-433d-a6b7-e0708b1fadf7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
35: ff02e86c-fef0-4063-b39f-74275cddd7c3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]






Log: 'Application' Date/Time: 26/08/2014 7:23:01 AM
Type: Information Category: 0
Event: 902 Source: Microsoft-Windows-Security-SPP
The Software Protection service has started. 6.2.9200.16384


Log: 'Application' Date/Time: 26/08/2014 7:23:01 AM
Type: Information Category: 0
Event: 1003 Source: Microsoft-Windows-Security-SPP
The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status=
1: 1bb82acd-c4ad-4566-813c-55840d559460, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 71f411ae-7b4b-41bd-b68c-c519c499f950, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )]
3: 8860fcd4-a77b-4a20-9045-a150ff11d609, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 9e4b231b-3e45-41f4-967f-c914f178b6ac, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: a25f4cc7-4bd1-4124-a4b8-4e6508dbbab8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: b0f8a518-2c58-4eb8-9319-084f0eb4ddc4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]






Log: 'Application' Date/Time: 26/08/2014 7:23:01 AM
Type: Information Category: 0
Event: 1066 Source: Microsoft-Windows-Security-SPP
Initialization status for service objects. C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000




Log: 'Application' Date/Time: 26/08/2014 7:22:36 AM
Type: Information Category: 0
Event: 900 Source: Microsoft-Windows-Security-SPP
The Software Protection service is starting. Parameters:caller=WINWORD.EXE


Log: 'Application' Date/Time: 26/08/2014 7:19:12 AM
Type: Information Category: 0
Event: 903 Source: Microsoft-Windows-Security-SPP
The Software Protection service has stopped. 


Log: 'Application' Date/Time: 26/08/2014 7:19:12 AM
Type: Information Category: 0
Event: 16384 Source: Microsoft-Windows-Security-SPP
Successfully scheduled Software Protection service for re-start at 2014-09-01T06:49:11Z. Reason: RulesEngine.


Log: 'Application' Date/Time: 26/08/2014 7:18:41 AM
Type: Information Category: 0
Event: 1003 Source: Microsoft-Windows-Security-SPP
The Software Protection service has completed licensing status check. Application Id=0ff1ce15-a989-479d-af46-f275c6370663 Licensing Status=
1: 064383fa-1538-491c-859b-0ecab169a0ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 090506fc-50f8-4c00-b8c7-91982a2a7c99, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 0bc1dae4-6158-4a1c-a893-807665b934b2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 0c4e5e7a-b436-4776-bb89-88e4b14687e2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 149dbce7-a48e-44db-8364-a53386cd4580, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 1b686580-9fb1-4b88-bfba-eae7c0da31ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 2030a84d-d6c7-4968-8cec-cf4737acc337, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: 26b6a7ce-b174-40aa-a114-316aa56ba9fc, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: 2b88c4f2-ea8f-43cd-805e-4d41346e18a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 2f756d47-e1b1-4d2a-922b-4d76f35d007d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: 3a3eb072-b131-430d-8157-2a582beb9682, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 3ad61e22-e4fe-497f-bdb1-3e51bd872173, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: 41499869-4103-4d3b-9da6-d07df41b6e39, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
14: 46d2c0bd-f912-4ddc-8e67-b90eadc3f83c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
15: 4cb3d290-d527-45c2-b079-26842762fdd3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
16: 54517397-284b-44cb-99eb-723b39dcb3a0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
17: 65c607d5-e542-4f09-ad0b-40d6a88b2702, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
18: 6ae65b85-e04e-4368-80a7-786d5766325e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
19: 6e5db8a5-78e6-4953-b793-7422351afe88, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
20: 7a75647f-636f-4607-8e54-e1b7d1ad8930, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
21: 82e42cb5-1741-46fb-8f2f-ac8414741e8d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
22: 87d2b5bf-d47b-41fb-af62-71c382f5cc85, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
23: 881d148a-610e-4f0a-8985-3be4c0db2b09, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
24: 8ded1da3-5206-4540-a862-e8473b65d742, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
25: a8119e32-b17c-4bd3-8950-7d1853f4b412, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
26: b322da9c-a2e2-4058-9e4e-f59a6970bd69, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 257730)(?)(?)(?)(?)])(1 )(2 )]
27: b6b47040-b38e-4be2-bf6a-dabf0c41540a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
28: bacd4614-5bef-4a5e-bafc-de4c788037a2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
29: bb00f022-69da-4be3-968d-d9bcd41cf814, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
30: c5a706ac-9733-4061-8242-28eb639f1b29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
31: db56dec3-34f2-4bc5-a7b9-ecc3cc51c12a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
32: dfc5a8b0-e9fd-43f7-b4ca-d63f1e749711, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
33: e3dacc06-3bc2-4e13-8e59-8e05f3232325, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
34: e538d623-c066-433d-a6b7-e0708b1fadf7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
35: ff02e86c-fef0-4063-b39f-74275cddd7c3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]






Log: 'Application' Date/Time: 26/08/2014 7:18:34 AM
Type: Information Category: 0
Event: 1003 Source: Microsoft-Windows-Security-SPP
The Software Protection service has completed licensing status check. Application Id=0ff1ce15-a989-479d-af46-f275c6370663 Licensing Status=
1: 064383fa-1538-491c-859b-0ecab169a0ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 090506fc-50f8-4c00-b8c7-91982a2a7c99, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 0bc1dae4-6158-4a1c-a893-807665b934b2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 0c4e5e7a-b436-4776-bb89-88e4b14687e2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 149dbce7-a48e-44db-8364-a53386cd4580, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 1b686580-9fb1-4b88-bfba-eae7c0da31ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 2030a84d-d6c7-4968-8cec-cf4737acc337, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: 26b6a7ce-b174-40aa-a114-316aa56ba9fc, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: 2b88c4f2-ea8f-43cd-805e-4d41346e18a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: 2f756d47-e1b1-4d2a-922b-4d76f35d007d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: 3a3eb072-b131-430d-8157-2a582beb9682, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 3ad61e22-e4fe-497f-bdb1-3e51bd872173, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: 41499869-4103-4d3b-9da6-d07df41b6e39, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
14: 46d2c0bd-f912-4ddc-8e67-b90eadc3f83c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
15: 4cb3d290-d527-45c2-b079-26842762fdd3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
16: 54517397-284b-44cb-99eb-723b39dcb3a0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
17: 65c607d5-e542-4f09-ad0b-40d6a88b2702, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
18: 6ae65b85-e04e-4368-80a7-786d5766325e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
19: 6e5db8a5-78e6-4953-b793-7422351afe88, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
20: 7a75647f-636f-4607-8e54-e1b7d1ad8930, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
21: 82e42cb5-1741-46fb-8f2f-ac8414741e8d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
22: 87d2b5bf-d47b-41fb-af62-71c382f5cc85, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
23: 881d148a-610e-4f0a-8985-3be4c0db2b09, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
24: 8ded1da3-5206-4540-a862-e8473b65d742, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
25: a8119e32-b17c-4bd3-8950-7d1853f4b412, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
26: b322da9c-a2e2-4058-9e4e-f59a6970bd69, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x00000000 257731)(?)(?)(?)(?)])(1 )(2 )]
27: b6b47040-b38e-4be2-bf6a-dabf0c41540a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
28: bacd4614-5bef-4a5e-bafc-de4c788037a2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
29: bb00f022-69da-4be3-968d-d9bcd41cf814, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
30: c5a706ac-9733-4061-8242-28eb639f1b29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
31: db56dec3-34f2-4bc5-a7b9-ecc3cc51c12a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
32: dfc5a8b0-e9fd-43f7-b4ca-d63f1e749711, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
33: e3dacc06-3bc2-4e13-8e59-8e05f3232325, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
34: e538d623-c066-433d-a6b7-e0708b1fadf7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
35: ff02e86c-fef0-4063-b39f-74275cddd7c3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]






Log: 'Application' Date/Time: 26/08/2014 7:18:34 AM
Type: Information Category: 0
Event: 902 Source: Microsoft-Windows-Security-SPP
The Software Protection service has started. 6.2.9200.16384


Log: 'Application' Date/Time: 26/08/2014 7:18:34 AM
Type: Information Category: 0
Event: 1003 Source: Microsoft-Windows-Security-SPP
The Software Protection service has completed licensing status check. Application Id=55c92734-d682-4d71-983e-d6ec3f16059f Licensing Status=
1: 1bb82acd-c4ad-4566-813c-55840d559460, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 71f411ae-7b4b-41bd-b68c-c519c499f950, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )]
3: 8860fcd4-a77b-4a20-9045-a150ff11d609, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 9e4b231b-3e45-41f4-967f-c914f178b6ac, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: a25f4cc7-4bd1-4124-a4b8-4e6508dbbab8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: b0f8a518-2c58-4eb8-9319-084f0eb4ddc4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )]






Log: 'Application' Date/Time: 26/08/2014 7:18:33 AM
Type: Information Category: 0
Event: 1066 Source: Microsoft-Windows-Security-SPP
Initialization status for service objects. C:\windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000




Log: 'Application' Date/Time: 26/08/2014 7:18:08 AM
Type: Information Category: 0
Event: 900 Source: Microsoft-Windows-Security-SPP
The Software Protection service is starting. Parameters:caller=WINWORD.EXE


Log: 'Application' Date/Time: 26/08/2014 6:59:55 AM
Type: Information Category: 0
Event: 1001 Source: Windows Error Reporting
Fault bucket , type 0 Event Name: WindowsUpdateFailure2 Response: Not available Cab Id: 0  Problem signature: P1: 7.8.9200.16604 P2: 800703f1 P3: 843B8B6E-C108-4E87-A67B-BD80D93ED282 P4: Install P5: 101 P6: Unmanaged P7: 800703f1 P8:  P9:  P10:   Attached files:  These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.8.9200.16604_79e8ae9814cad419a6da905c1734a556e9661a0_cab_0e0ce425  Analysis symbol:  Rechecking for solution: 0 Report Id: 6d0ad56a-2cbf-11e4-8121-083e8eadc632 Report Status: 96 Hashed bucket: 


Log: 'Application' Date/Time: 26/08/2014 6:59:53 AM
Type: Information Category: 0
Event: 1001 Source: Windows Error Reporting
Fault bucket , type 0 Event Name: APPCRASH Response: Not available Cab Id: 0  Problem signature: P1: DLCXtime.exe P2: 1.31.0.0 P3: 45331a17 P4: DLCXuldr.dll P5: 1.31.0.0 P6: 45331a50 P7: c0000005 P8: 0000000000017398 P9:  P10:   Attached files:  These files may be available here: C:\Users\USER\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_DLCXtime.exe_5437fd651eff73d0f978d04b81905519a3b368bd_15777cb3  Analysis symbol:  Rechecking for solution: 0 Report Id: eb9a64fa-2ce9-11e4-8121-083e8eadc632 Report Status: 96 Hashed bucket: 


Log: 'Application' Date/Time: 26/08/2014 6:59:08 AM
Type: Information Category: 0
Event: 1001 Source: Windows Error Reporting
Fault bucket -516182932, type 5 Event Name: MoAppCrash Response: Not available Cab Id: 0  Problem signature: P1: Microsoft.Reader_6.2.9200.20780_x64__8wekyb3d8bbwe P2: praid:Microsoft.Reader P3: 6.2.9200.20780 P4: 51ede615 P5: glcnd.exe P6: 6.2.9200.20780 P7: 51ede615 P8: c0000005 P9: 00000000001e9caf P10:   Attached files: C:\Users\USER\AppData\Local\Temp\WERDAB.tmp.WERInternalMetadata.xml  These files may be available here: C:\Users\USER\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Reader_862682a5270e6986db8e1e6f72475d27f5b86_111112cc  Analysis symbol:  Rechecking for solution: 0 Report Id: 780d313e-2cee-11e4-8121-083e8eadc632 Report Status: 0 Hashed bucket: bedeaff8cc5dc5134a88157cee564826


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 26/08/2014 6:30:07 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   15 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\CA
Process 768 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\trust
Process 948 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Root




Log: 'Application' Date/Time: 26/08/2014 2:49:42 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   14 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\CA
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 768 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\trust
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 3744 (\Device\HarddiskVolume5\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Root




Log: 'Application' Date/Time: 26/08/2014 1:54:12 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 768 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 25/08/2014 7:20:58 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 768 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 25/08/2014 6:45:52 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   17 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 2164 (\Device\HarddiskVolume5\Windows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 1092 (\Device\HarddiskVolume5\Windows\SysWOW64\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\CA
Process 752 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\trust
Process 404 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Root




Log: 'Application' Date/Time: 25/08/2014 1:56:01 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 752 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 24/08/2014 5:26:11 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   15 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\CA
Process 412 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\trust
Process 316 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Root




Log: 'Application' Date/Time: 24/08/2014 2:02:01 PM
Type: Warning Category: 7
Event: 910 Source: ESENT
svchost (1116) The database cache size maintenance task has taken 60 seconds without completing. This may result in severe performance degradation. Current cache size is 34 buffers above the configured cache limit (191 percent of target). Cache size maintenance evicted 0 buffers, made 13184 flush attempts, and successfully flushed 0 buffers. It has run 11880 times since maintenance was triggered.


Log: 'Application' Date/Time: 24/08/2014 2:01:01 PM
Type: Warning Category: 7
Event: 910 Source: ESENT
svchost (1116) The database cache size maintenance task has taken 60 seconds without completing. This may result in severe performance degradation. Current cache size is 34 buffers above the configured cache limit (191 percent of target). Cache size maintenance evicted 70 buffers, made 13225 flush attempts, and successfully flushed 22 buffers. It has run 5948 times since maintenance was triggered.


Log: 'Application' Date/Time: 23/08/2014 7:07:43 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 412 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 23/08/2014 1:19:06 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   15 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\CA
Process 620 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Policies\Microsoft\SystemCertificates
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\trust
Process 1008 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\SystemCertificates\Root




Log: 'Application' Date/Time: 23/08/2014 2:48:46 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 432 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 22/08/2014 6:14:51 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 432 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 22/08/2014 3:19:16 PM
Type: Warning Category: 0
Event: 1 Source: Microsoft-Windows-ApplicationExperienceInfrastructure
The application (Dell Series Printer, from vendor Lexmark International) has the following problem: To function properly, Dell Series Printer must be reinstalled after you upgrade Windows.


Log: 'Application' Date/Time: 22/08/2014 10:10:10 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 636 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 22/08/2014 8:59:32 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 636 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 22/08/2014 6:13:51 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 636 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 21/08/2014 11:51:30 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   1 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 636 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall




Log: 'Application' Date/Time: 21/08/2014 6:15:45 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.     DETAIL -   13 user registry handles leaked from \Registry\User\S-1-5-21-2889107620-2721348771-4040116657-1001:
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Internet Explorer\Main
Process 636 (\Device\HarddiskVolume5\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\DownloadManager\ConfigTime
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\VS Revo Group\Revo Uninstaller Pro\RUExt
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Process 3100 (\Device\HarddiskVolume5\Windows\explorer.exe) has opened key \REGISTRY\USER\S-1-5-21-2889107620-2721348771-4040116657-1001\Software\Microsoft\Windows\Shell\Bags\1\Desktop




Log: 'Application' Date/Time: 21/08/2014 5:01:03 AM
Type: Warning Category: 7
Event: 910 Source: ESENT
svchost (1104) The database cache size maintenance task has taken 60 seconds without completing. This may result in severe performance degradation. Current cache size is 20 buffers above the configured cache limit (300 percent of target). Cache size maintenance evicted 2 buffers, made 4791 flush attempts, and successfully flushed 0 buffers. It has run 3836 times since maintenance was triggered.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 26/08/2014 6:30:06 AM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {D63B10C5-BB46-4990-A94F-E40B9D520160}  and APPID  {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Log: 'System' Date/Time: 26/08/2014 2:49:21 AM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {D63B10C5-BB46-4990-A94F-E40B9D520160}  and APPID  {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Log: 'System' Date/Time: 26/08/2014 1:54:02 AM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {D63B10C5-BB46-4990-A94F-E40B9D520160}  and APPID  {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Log: 'System' Date/Time: 26/08/2014 1:22:21 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x800703F1: Update for Windows 8 for x64-based Systems (KB2962407).


Log: 'System' Date/Time: 25/08/2014 6:50:01 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error:  The system cannot find the path specified.


Log: 'System' Date/Time: 25/08/2014 6:47:58 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The U Mobile Broadband Manager. OUC service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.


Log: 'System' Date/Time: 25/08/2014 6:47:58 AM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the U Mobile Broadband Manager. OUC service to connect.


Log: 'System' Date/Time: 25/08/2014 6:41:03 AM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {D63B10C5-BB46-4990-A94F-E40B9D520160}  and APPID  {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Log: 'System' Date/Time: 25/08/2014 12:15:31 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error:  The system cannot find the path specified.


Log: 'System' Date/Time: 25/08/2014 12:13:28 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The U Mobile Broadband Manager. OUC service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.


Log: 'System' Date/Time: 25/08/2014 12:13:28 AM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the U Mobile Broadband Manager. OUC service to connect.


Log: 'System' Date/Time: 25/08/2014 12:12:45 AM
Type: Error Category: 0
Event: 6 Source: Microsoft-Windows-Kernel-General
An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): ''.


Log: 'System' Date/Time: 24/08/2014 11:27:04 AM
Type: Error Category: 0
Event: 10016 Source: Microsoft-Windows-DistributedCOM
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {D63B10C5-BB46-4990-A94F-E40B9D520160}  and APPID  {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}  to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Log: 'System' Date/Time: 24/08/2014 9:40:35 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x800703F1: Update for Windows 8 for x64-based Systems (KB2962407).


Log: 'System' Date/Time: 23/08/2014 3:30:39 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error:  The system cannot find the path specified.


Log: 'System' Date/Time: 23/08/2014 3:28:36 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The U Mobile Broadband Manager. OUC service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.


Log: 'System' Date/Time: 23/08/2014 3:28:36 PM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the U Mobile Broadband Manager. OUC service to connect.


Log: 'System' Date/Time: 23/08/2014 3:27:57 PM
Type: Error Category: 0
Event: 6 Source: Microsoft-Windows-Kernel-General
An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): ''.


Log: 'System' Date/Time: 23/08/2014 7:55:04 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x800703F1: Update for Windows 8 for x64-based Systems (KB2962407).


Log: 'System' Date/Time: 23/08/2014 4:19:42 AM
Type: Error Category: 1
Event: 20 Source: Microsoft-Windows-WindowsUpdateClient
Installation Failure: Windows failed to install the following update with error 0x800703F1: Update for Windows 8 for x64-based Systems (KB2962407).


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Information Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 26/08/2014 7:30:29 AM
Type: Information Category: 0
Event: 7040 Source: Service Control Manager
The start type of the Windows Modules Installer service was changed from auto start to demand start.


Log: 'System' Date/Time: 26/08/2014 7:30:29 AM
Type: Information Category: 0
Event: 7040 Source: Service Control Manager
The start type of the Windows Modules Installer service was changed from demand start to auto start.


Log: 'System' Date/Time: 26/08/2014 7:30:23 AM
Type: Information Category: 0
Event: 11 Source: Microsoft-Windows-Kernel-General
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\windows\system32\config\DRIVERS (TM: {A5336B29-2C23-11E4-8121-083E8EADC632}, RM: {A5336B28-2C23-11E4-8121-083E8EADC632}) finished with result=0xC00000A2 (Internal code=7).


Log: 'System' Date/Time: 26/08/2014 7:30:23 AM
Type: Information Category: 0
Event: 15 Source: Microsoft-Windows-Kernel-General
Hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\windows\system32\config\DRIVERS was reorganized with a starting size of 5443584 bytes and an ending size of 5419008 bytes.


Log: 'System' Date/Time: 26/08/2014 7:30:23 AM
Type: Information Category: 0
Event: 11 Source: Microsoft-Windows-Kernel-General
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\windows\system32\config\SYSTEM (TM: {A5336B27-2C23-11E4-8121-083E8EADC632}, RM: {A5336B26-2C23-11E4-8121-083E8EADC632}) finished with result=0xC00000A2 (Internal code=7).


Log: 'System' Date/Time: 26/08/2014 7:30:23 AM
Type: Information Category: 0
Event: 15 Source: Microsoft-Windows-Kernel-General
Hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy7\windows\system32\config\SYSTEM was reorganized with a starting size of 20635648 bytes and an ending size of 20570112 bytes.


Log: 'System' Date/Time: 26/08/2014 7:30:05 AM
Type: Information Category: 0
Event: 11 Source: Microsoft-Windows-Kernel-General
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy9\windows\system32\config\DRIVERS (TM: {A5336B18-2C23-11E4-8121-083E8EADC632}, RM: {A5336B17-2C23-11E4-8121-083E8EADC632}) finished with result=0xC00000A2 (Internal code=7).


Log: 'System' Date/Time: 26/08/2014 7:30:05 AM
Type: Information Category: 0
Event: 11 Source: Microsoft-Windows-Kernel-General
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy9\windows\system32\config\SYSTEM (TM: {A5336B16-2C23-11E4-8121-083E8EADC632}, RM: {A5336B15-2C23-11E4-8121-083E8EADC632}) finished with result=0xC00000A2 (Internal code=7).


Log: 'System' Date/Time: 26/08/2014 6:48:04 AM
Type: Information Category: 7005
Event: 20001 Source: Microsoft-Windows-UserPnp
Driver Management concluded the process to install driver android_winusb.inf_amd64_05f4ed2dfa7ff8b9\android_winusb.inf for Device Instance ID USB\VID_04E8&PID_685C\0149C2DB05003016 with the following status: 0x0.


Log: 'System' Date/Time: 26/08/2014 6:48:03 AM
Type: Information Category: 7005
Event: 20003 Source: Microsoft-Windows-UserPnp
Driver Management has concluded the process to add Service WinUSB for Device Instance ID USB\VID_04E8&PID_685C\0149C2DB05003016 with the following status: 0.


Log: 'System' Date/Time: 26/08/2014 6:47:15 AM
Type: Information Category: 1101
Event: 7001 Source: Microsoft-Windows-Winlogon
User Logon Notification for Customer Experience Improvement Program


Log: 'System' Date/Time: 26/08/2014 6:46:48 AM
Type: Information Category: 0
Event: 1 Source: Microsoft-Windows-Power-Troubleshooter
The system has returned from a low power state.  Sleep Time: ?2014?-?08?-?26T06:30:08.970363100Z Wake Time: ?2014?-?08?-?26T06:46:46.934381800Z  Wake Source: Unknown


Log: 'System' Date/Time: 26/08/2014 6:46:48 AM
Type: Information Category: 0
Event: 18 Source: BTHUSB
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.


Log: 'System' Date/Time: 26/08/2014 6:46:47 AM
Type: Information Category: 0
Event: 10001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has successfully started.  Module Path: C:\windows\System32\bcmihvsrv64.dll 


Log: 'System' Date/Time: 26/08/2014 6:46:46 AM
Type: Information Category: 0
Event: 27 Source: Microsoft-Windows-Kernel-Boot
The boot type was 0x1.


Log: 'System' Date/Time: 26/08/2014 6:46:46 AM
Type: Information Category: 0
Event: 25 Source: Microsoft-Windows-Kernel-Boot
The boot menu policy was 0x1.


Log: 'System' Date/Time: 26/08/2014 6:46:46 AM
Type: Information Category: 0
Event: 32 Source: Microsoft-Windows-Kernel-Boot
The bootmgr spent 0 ms waiting for user input.


Log: 'System' Date/Time: 26/08/2014 6:46:46 AM
Type: Information Category: 0
Event: 18 Source: Microsoft-Windows-Kernel-Boot
There are 0x1 boot options on this system.


Log: 'System' Date/Time: 26/08/2014 6:46:46 AM
Type: Information Category: 0
Event: 30 Source: Microsoft-Windows-Kernel-Boot
The firmware reported boot metrics.


Log: 'System' Date/Time: 26/08/2014 6:46:46 AM
Type: Information Category: 0
Event: 2 Source: MEIx64
Intel(R) Management Engine Interface driver has started successfully.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 5f80 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6000 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6100 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6580 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6500 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6480 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6400 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6380 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6300 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6280 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6200 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6180 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 7:07:50 AM
Type: Warning Category: 0
Event: 153 Source: disk
The IO operation at logical block address 6080 for Disk 1 was retried.


Log: 'System' Date/Time: 26/08/2014 6:30:14 AM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\windows\System32\bcmihvsrv64.dll 


Log: 'System' Date/Time: 26/08/2014 6:25:49 AM
Type: Warning Category: 2
Event: 16 Source: Microsoft-Windows-WindowsUpdateClient
Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.


Log: 'System' Date/Time: 26/08/2014 6:25:32 AM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\windows\System32\bcmihvsrv64.dll 


Log: 'System' Date/Time: 26/08/2014 1:54:29 AM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\windows\System32\bcmihvsrv64.dll 


Log: 'System' Date/Time: 26/08/2014 12:56:33 AM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 17 seconds since the last report.


Log: 'System' Date/Time: 26/08/2014 12:56:33 AM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 17 seconds since the last report.


Log: 'System' Date/Time: 25/08/2014 7:21:12 AM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\windows\System32\bcmihvsrv64.dll

Go The Power · Aug 27, 2014

Hi amin,

There seems to be a difficult corruption going on with your components registry hive (this is where Windows updates likes to store all of its settings\configuration). I have spent some time going over the registry hive to try and pin point the corruption, but was unsuccessful.

I have contacted some of the Windows update experts to take a look at the hive to see if they will be able to load the corruption. Hopefully we should have some news for you within a couple of days.

Alex

amin · Aug 29, 2014

Hi Go The power.

Hopefully they will.
I'll be waiting for the news.

Thanks again dude.

Go The Power · Sep 5, 2014

Hello Amin,

I am afraid I dont have very good new for you, the hive is extremely corrupt, I have taken a few looks over the hive to try and find out what is causing this but have not any luck

. From here you need to try and do a repair install, if that doesnt fix the issue a full re-install is required.

windows 8 update failed (error code 800703F1)

amin

Member

Attachments

wmorri

Visiting Expert, Sysnative Administrator Emeritus

Go The Power

Senior Administrator, Windows Update Expert, Contributor

amin

Member

Go The Power

Senior Administrator, Windows Update Expert, Contributor

amin

Member

Attachments

Go The Power

Senior Administrator, Windows Update Expert, Contributor

LogBot

Well-known member

amin

Member

Go The Power

Senior Administrator, Windows Update Expert, Contributor

amin

Member

Go The Power

Senior Administrator, Windows Update Expert, Contributor

amin

Member

Go The Power

Senior Administrator, Windows Update Expert, Contributor