Share via

Windows could not search for new updates Error code 80070426

Anonymous
2012-12-31T14:18:26+00:00

Have tried everything I've found on the internet.  This has been going on since Oct 3.  I've uninstalled everything dled around that date...like I said everything internet has suggested, still no go.  Last attempt was the following:

make sure the automatic update services has been started.  make sure that BITS is started.

  1. click start, click run, type services.msc, and then click ok.
  2. in the list of services, right-click automatic updates, and then click properties.
  3. In the startup type list, click automatic, and then click apply.
  4. if service status is set to stopped, click start, and then click ok.
  5. right-click background intelligent transfer service, and then click properties.
  6. in the startup type list, click manual, and then click apply.

or

  1. Ddwnload and install the wga diagnostic tool at http://go.microsoft.com/fwlink/?linkid=56062
  2. after running the wga diagnostic tool, click on the "windows" tab and then click on "copy to clipboard".

Here's what the diag says:

Diagnostic Report (1.9.0027.0):


Windows Validation Data-->

Validation Status: Genuine

Validation Code: 0

Cached Online Validation Code: N/A, hr = 0x80070426

Windows Product Key: *****-*****-3VR6V-DJF42-63BDV

Windows Product Key Hash: CCFAMeQeQsXiUmJUJ3pJHt2Wcas=

Windows Product ID: 89583-OEM-7354295-34497

Windows Product ID Type: 3

Windows License Type: OEM System Builder

Windows OS version: 6.0.6002.2.00010300.2.0.003

ID: {892EEF82-1DC6-4880-8D80-D5FD98462650}(1)

Is Admin: Yes

TestCab: 0x0

LegitcheckControl ActiveX: N/A, hr = 0x80070002

Signed By: N/A, hr = 0x80070002

Product Name: Windows Vista (TM) Home Premium

Architecture: 0x00000009

Build lab: 6002.vistasp2_gdr.120402-0336

TTS Error:

Validation Diagnostic:

Resolution Status: N/A

Vista WgaER Data-->

ThreatID(s): N/A, hr = 0x80070002

Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->

Cached Result: N/A, hr = 0x80070002

File Exists: No

Version: N/A, hr = 0x80070002

WgaTray.exe Signed By: N/A, hr = 0x80070002

WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->

Cached Result: N/A, hr = 0x80070002

Version: N/A, hr = 0x80070002

OGAExec.exe Signed By: N/A, hr = 0x80070002

OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->

Office Status: 109 N/A

OGA Version: N/A, 0x80070002

Signed By: N/A, hr = 0x80070002

Office Diagnostics: B4D0AA8B-604-645_B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->

Proxy settings: N/A

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Download signed ActiveX controls: Prompt

Download unsigned ActiveX controls: Disabled

Run ActiveX controls and plug-ins: Allowed

Initialize and script ActiveX controls not marked as safe: Disabled

Allow scripting of Internet Explorer Webbrowser control: Disabled

Active scripting: Allowed

Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->

Office Details: <GenuineResults><MachineData><UGUID>{892EEF82-1DC6-4880-8D80-D5FD98462650}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-63BDV</PKey><PID>89583-OEM-7354295-34497</PID><PIDType>3</PIDType><SID>S-1-5-21-3759449798-3651505042-2970044974</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv9700 (FE695UA#ABA)  </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.34    </Version><SMBIOSVersion major="2" minor="4"/><Date>20110322000000.000000+000</Date></BIOS><HWID>68323507018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

Spsys.log Content: 0x80070002

Licensing Data-->

Software Licensing service is not running.

Windows Activation Technologies-->

N/A

HWID Data-->

HWID Hash Current: PAAAAAEABwABAAEAAQABAAAAAwABAAEA6GH231SLdhu84yC+gASIzAaYmGDIOEQs8vSm1Xbl3lysVniq

OEM Activation 1.0 Data-->

N/A

OEM Activation 2.0 Data-->

BIOS valid for OA 2.0: yes

Windows marker version: 0x20000

OEMID and OEMTableID Consistent: yes

BIOS Information:

  ACPI Table Name    OEMID Value    OEMTableID Value

  APIC            PTLTD              APIC 

  FACP            NVIDIA        MCP67-M

  SRAT            AMD           HAMMER 

  HPET            PTLTD         HPETTBL

  BOOT            PTLTD         $SBFTBL$

  MCFG            PTLTD           MCFG 

  TCPA            Phoeni        x     

  SSDT            PTLTD         POWERNOW

  SLIC            HPQOEM        SLIC-MPC

HELP?! Thanks.

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

39 answers

Sort by: Most helpful
  1. Anonymous
    2013-01-04T21:45:30+00:00

    They both look OK to me - which surprises me, given the error in your MGADiag report.

    (the SLSVC service  can't start unless the SPLDR driver is loaded and running - and the error in the report indicated that the service had tried to start but failed)

    an 0x80070426 error in that position almost always refers to the SLSVC (in fact, I don't recall it ever not being caused by that!)

    Let's try something.....

    Please reboot, and leave the system alone for 5 minutes to settle down.

    then run an MGADiag report. and post it.

    If the 0x80070426 error is still present, please run the following commands in a command prompt window.....

    SC QUERYEX >%userprofile%\desktop\services.log

    S C QUERYEX SLSVC

    NET START SLSVC

    then run another MGADiag report. and post that, and also please upload the new file on your desktop (services.log) that the commands created to your public SkyDrive folder or other favoured fileshare site, and post a link to it.

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2013-01-04T20:55:09+00:00

    Hi Noel...thanks for taking the time to weigh in on this.  Here's what I get when I ran your commands.  I have not done anything yet that David last suggested.  Your input is greatly appreciated. Thanks.

    Microsoft Windows [Version 6.0.6002]

    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Windows\system32>NET START SPLDR

    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.

    C:\Windows\system32>

    C:\Windows\system32>NET START SLSVC

    The Software Licensing service is starting.

    The Software Licensing service was started successfully.

    C:\Windows\system32>

    C:\Windows\system32>SC QC SPLDR

    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: SPLDR

            TYPE               : 1  KERNEL_DRIVER

            START_TYPE         : 0   BOOT_START

            ERROR_CONTROL      : 3   CRITICAL

            BINARY_PATH_NAME   :

            LOAD_ORDER_GROUP   :

            TAG                : 0

            DISPLAY_NAME       : Security Processor Loader Driver

            DEPENDENCIES       :

            SERVICE_START_NAME :

    C:\Windows\system32>

    C:\Windows\system32>SC QUERYEX SPLDR

    SERVICE_NAME: SPLDR

            TYPE               : 1  KERNEL_DRIVER

            STATE              : 4  RUNNING

                                    (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

            WIN32_EXIT_CODE    : 0  (0x0)

            SERVICE_EXIT_CODE  : 0  (0x0)

            CHECKPOINT         : 0x0

            WAIT_HINT          : 0x0

            PID                : 0

            FLAGS              :

    C:\Windows\system32>

    C:\Windows\system32>SC QC SLSVC

    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: SLSVC

            TYPE               : 10  WIN32_OWN_PROCESS

            START_TYPE         : 2   AUTO_START

            ERROR_CONTROL      : 1   NORMAL

            BINARY_PATH_NAME   : C:\Windows\system32\SLsvc.exe

            LOAD_ORDER_GROUP   : ProfSvc_Group

            TAG                : 0

            DISPLAY_NAME       : Software Licensing

            DEPENDENCIES       : RpcSs

            SERVICE_START_NAME : NT AUTHORITY\NetworkService

    C:\Windows\system32>

    C:\Windows\system32>SC QUERYEX SLSVC

    SERVICE_NAME: SLSVC

            TYPE               : 10  WIN32_OWN_PROCESS

            STATE              : 4  RUNNING

                                    (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)

            WIN32_EXIT_CODE    : 0  (0x0)

            SERVICE_EXIT_CODE  : 0  (0x0)

            CHECKPOINT         : 0x0

            WAIT_HINT          : 0x0

            PID                : 9608

            FLAGS              :

    C:\Windows\system32>

    **Since the only thing I really understood about any of that was "More help is available by typing NET HELPMSG 2182" after the first command, I've done that and copied the results below:**The requested service has already been started.Assess away.  Thanks for your time.

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2013-01-03T09:05:21+00:00

    David asked me for a consult :)

    Please open an Elevated Command Prompt, and run the following commands

    NET START SPLDR

    NET START SLSVC

    SC QC SPLDR

    SC QUERYEX SPLDR

    SC QC SLSVC

    SC QUERYEX SLSVC

    post the results.

    Here are some instructions to make life easier :)

    1. To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 
    2. To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 
    3. To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2013-01-03T01:46:09+00:00

    The root cause seems to be with the Software Licensing Service (and related Key Management Service). I suspect you'll soon be told by Windows your copy of Windows is not genuine.

    Firstly type in an elevated command prompt.

    sc start slsvc

    and post back straight away the output. Then do this.

    Standard Hardware Troubleshooting

    S.M.A.R.T

    Click Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator.

    Disk drives in Windows monitor themselves for impending failure. The feature is called S.M.A.R.T. It will detect impending failure 30% of the time. In an elevated command prompt type (it's one line)

    wmic /namespace:\root\wmi PATH MSStorageDriver_FailurePredictStatus get active,predictfailure,reason /format:List

    If it's on Active will be true, if not on turn it on in the computer's BIOS.

    Predict Failure should be False if everything's ok.

    In Vista and later if SMART predicts failure Windows prompts the user to run Backup.

    Run Chkdsk

    In Computer right click your drives and choose Properties, then Tools tab, then click Check Now. Tick BOTH checkboxes then Start. Reboot. This will take overnight.

    Sfc

    Check for file  corruption by clicking Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type

    sfc /scannow

    Memory Diagnostic

    If you haven't run a memory diagnostic then please do so. Click Start - Control Panel - choose Classic View in left hand pane - choose Administrative Tools -  thenMemory Diagnostics Tool.

    For Chkdsk Results

    Click Start - Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then Event Viewer then look at both the Application and System logs (under Windows Logs) for entries.

    Look for EventID is 7 and Source is Disk

    Look for EventID is 11 and Source is Disk

    Look for EventID is 51 and Source is Disk

    Look for EventID is 52 and Source is Disk

    Look for EventID is 55 and Source is NTFS

    Look for EventID is 130 and Source is NTFS

    Look for EventID is 1001 and Source is Autochk

    Look for EventID is 1001 and Source is Winlogon

    Look for EventID is 1001 and Source is WinInit

    Look for EventID is 1001 and Source is Chkdsk

    Look for EventID is 26212 and Source is Chkdsk

    Double click the entry for details on that entry.

    P.S. 7 and 55 are the auto repair codes where windows repairs disk errors silently on the fly. 52 is the SMART warning.

    Make a note of total bad blocks in the 1001 events.

    For SFC Results

    Check for file  corruption by clicking Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type

    findstr /c:"[SR] Cannot" %windir%\logs\cbs\cbs.log|more

    This will see which files are corrupted. We may be able to copy them from another computer.

    For Memory Diagnostic

    Click Start - Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then Event Viewer then look at both the Application and System logs (under Windows Logs) for entries.

    Look for EventID is 1201 or 1101 and Source is MemoryDiagnostic-Results

    Double click the entry for details on that entry.

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2013-01-02T16:12:17+00:00

    Ok, here are the results of the above:

    1. "Says Windows Update cannot establish a connection. Are you still getting 80070426 errors which are to do with the service not the connection."

    ANSWER: Yes I'm still getting the error.  That it cannot establish the connection to search for updates and listing the unknown error *426 as the reason is how it has always read and continues to even after everything I've tried including all your suggestions above.

    1. "And make sure BITS is running. sc start BITS"

    ANSWER: No issue. BITS was running properly.

    1. "52 is the SMART warning. S.M.A.R.T.  The feature is called S.M.A.R.T. It will detect impending failure 30% of the time. In an elevated command prompt type (it's one line)

    wmic /namespace:\root\wmi PATH MSStorageDriver_FailurePredictStatus get active,predictfailure,reason /format:List

    ANSWER: Active On and =True. Failure=False

    1. "There was an error with a program called recordingmanager.exe. Do you use this program? If so try reinstalling."

    ANSWER: This is a realnetwork program that dled with a version of Real player.  I uninstalled it.

    1. "This repairs some of the WinSxS data structures. It also fixes some Windows Update errors.

    http://www.microsoft.com/en-us/download/details.aspx?id=504"

    ANSWER: Had to do a little searching to find the version for my system but once installed found sand fixed several things.

    ****************************************************UPDATE**************************************************

    I did all of the above and rebooted twice. 

    1. Still getting the "CAN'T SEARCH FOR WINDOWS UPDATE UNKNOWN ERROR *426" directly after reboot when windows tries to engage an automatic update search.  Same as always.

    2)Went back into my Event Log to see if warning or errors any different.  And while I no longer have several of the old issues, I'm finding I have a few I've never seen before:

    ****************Upon reboot the SYSTEM log shows 2 WARNINGS in a row:

    ****************FIRST

    Log Name:      System

    Source:        Microsoft-Windows-WLAN-AutoConfig

    Date:          1/2/2013 8:18:39 AM

    Event ID:      10002

    Task Category: None

    Level:         Warning

    Keywords:     

    User:          SYSTEM

    Computer:      Lisa-HP

    Description:

    WLAN Extensibility Module has stopped.

    Module Path: C:\Windows\System32\bcmihvsrv64.dll

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580d7dd-0379-4658-9870-d5be7d52d6de}" />

        <EventID>10002</EventID>

        <Version>0</Version>

        <Level>3</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x4000000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:18:39.795Z" />

        <EventRecordID>457498</EventRecordID>

        <Correlation />

        <Execution ProcessID="436" ThreadID="2112" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security UserID="S-1-5-18" />

      </System>

      <EventData>

        <Data Name="ExtensibleModulePath">C:\Windows\System32\bcmihvsrv64.dll</Data>

      </EventData>

    </Event>

    ****************SECOND

    Log Name:      System

    Source:        Microsoft-Windows-WLAN-AutoConfig

    Date:          1/2/2013 8:18:39 AM

    Event ID:      4001

    Task Category: None

    Level:         Warning

    Keywords:     

    User:          SYSTEM

    Computer:      Lisa-HP

    Description:

    WLAN AutoConfig service has successfully stopped.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Microsoft-Windows-WLAN-AutoConfig" Guid="{9580d7dd-0379-4658-9870-d5be7d52d6de}" />

        <EventID>4001</EventID>

        <Version>0</Version>

        <Level>3</Level>

        <Task>0</Task>

        <Opcode>2</Opcode>

        <Keywords>0x4000000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:18:39.797Z" />

        <EventRecordID>457499</EventRecordID>

        <Correlation />

        <Execution ProcessID="436" ThreadID="2112" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security UserID="S-1-5-18" />

      </System>

      <EventData>

      </EventData>

    </Event>

    **************THE NEXT HICCUP IS AN APP ERROR 1060 (never saw b4)

    Log Name:      System

    Source:        Application Popup

    Date:          1/2/2013 8:28:30 AM

    Event ID:      1060

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    \SystemRoot\SysWow64\Drivers\tcpipBM.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Application Popup" />

        <EventID Qualifiers="49152">1060</EventID>

        <Level>2</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:28:30.100Z" />

        <EventRecordID>457503</EventRecordID>

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>

        </Data>

        <Data>\SystemRoot\SysWow64\Drivers\tcpipBM.SYS</Data>

        <Binary>000000000200300000000000240400C0000000006B0300C000000000000000000000000000000000</Binary>

      </EventData>

    </Event>

    ************************THEN 26 #7 DISK ERRORS LIKE THIS

    Log Name:      System

    Source:        disk

    Date:          1/2/2013 8:30:37 AM

    Event ID:      7

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The device, \Device\Harddisk0\DR0, has a bad block.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="disk" />

        <EventID Qualifiers="49156">7</EventID>

        <Level>2</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:30:37.920Z" />

        <EventRecordID>457541</EventRecordID>

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>\Device\Harddisk0\DR0</Data>

        <Binary>030080000100000000000000070004C0000100009C0000C00000000000000000004EC70B00000000FB34000000000000FFFFFFFF01000000580000840200000000200A1240032040000000003C000000000000000000000018D1BA0480FAFFFF0000000000000000B0160D0980FAFFFF2067B70480FAFFFFA7E305000000000028000005E3A700000800000000000000F00003000000000B00000000000000000000000000000000</Binary>

      </EventData>

    </Event>

    ****************************THEN THIS ERROR

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:03 AM

    Event ID:      7000

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The DgiVecp service failed to start due to the following error:

    The system cannot find the device specified.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7000</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:03.000Z" />

        <EventRecordID>457587</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">DgiVecp</Data>

        <Data Name="param2">%%20</Data>

      </EventData>

    </Event>

    *************THEN THIS ONE

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:03 AM

    Event ID:      7000

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The MCSTRM service failed to start due to the following error:

    The system cannot find the file specified.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7000</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:03.000Z" />

        <EventRecordID>457593</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">MCSTRM</Data>

        <Data Name="param2">%%2</Data>

      </EventData>

    </Event>

    ********************THEN THIS ONE

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:03 AM

    Event ID:      7009

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    A timeout was reached (30000 milliseconds) while waiting for the QuickPlay Background Capture Service (QBCS) service to connect.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7009</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:03.000Z" />

        <EventRecordID>457606</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">30000</Data>

        <Data Name="param2">QuickPlay Background Capture Service (QBCS)</Data>

      </EventData>

    </Event>

    ***************THEN THIS ONE

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:03 AM

    Event ID:      7000

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The QuickPlay Background Capture Service (QBCS) service failed to start due to the following error:

    The service did not respond to the start or control request in a timely fashion.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7000</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:03.000Z" />

        <EventRecordID>457607</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">QuickPlay Background Capture Service (QBCS)</Data>

        <Data Name="param2">%%1053</Data>

      </EventData>

    </Event>

    ********************THEN THIS ONE

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:03 AM

    Event ID:      7001

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The QuickPlay Task Scheduler (QTS) service depends on the QuickPlay Background Capture Service (QBCS) service which failed to start because of the following error:

    The service did not respond to the start or control request in a timely fashion.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7001</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:03.000Z" />

        <EventRecordID>457608</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">QuickPlay Task Scheduler (QTS)</Data>

        <Data Name="param2">QuickPlay Background Capture Service (QBCS)</Data>

        <Data Name="param3">%%1053</Data>

      </EventData>

    </Event>

    ************************THEN THIS ONE

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:03 AM

    Event ID:      7023

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The description for Event ID 7023 from source Service Control Manager cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

    If the event originated on another computer, the display information had to be saved with the event.

    The following information was included with the event:

    Software Licensing

    %%3221541123

    The locale specific resource for the desired message is not present

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7023</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:03.000Z" />

        <EventRecordID>457620</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">Software Licensing</Data>

        <Data Name="param2">%%3221541123</Data>

      </EventData>

    </Event>

    *******************************THEN THIS ONE

    Log Name:      System

    Source:        Service Control Manager

    Date:          1/2/2013 8:31:44 AM

    Event ID:      7026

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The following boot-start or system-start driver(s) failed to load:

    tcpipBM

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />

        <EventID Qualifiers="49152">7026</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:44.000Z" />

        <EventRecordID>457632</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data Name="param1">

    tcpipBM</Data>

      </EventData>

    </Event>

    *******************************THEN 10 MORE DISK 7 ERRORS LIKE THIS ONE

    Log Name:      System

    Source:        disk

    Date:          1/2/2013 8:52:24 AM

    Event ID:      7

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The device, \Device\Harddisk0\DR0, has a bad block.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="disk" />

        <EventID Qualifiers="49156">7</EventID>

        <Level>2</Level>

        <Task>0</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:52:24.206Z" />

        <EventRecordID>457670</EventRecordID>

        <Channel>System</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>\Device\Harddisk0\DR0</Data>

        <Binary>030080000100000000000000070004C0000100009C0000C00000000000000000002EBF2400000000147C010000000000FFFFFFFF01000000580000840200000000200A1240032040000000003C0000000000000000000000B84E6A0980FAFFFF00000000000000001080770980FAFFFFD0558B0980FAFFFF975F120000000000280000125F9700006000000000000000F00003000000000B00000000000000000000000000000000</Binary>

      </EventData>

    </Event>

    ................................... I ALSO HAVE SEVERAL WARNINGS IN THE APPLICATIONS EVENT LOG

    Log Name:      Application

    Source:        Microsoft-Windows-User Profiles Service

    Date:          1/2/2013 8:18:35 AM

    Event ID:      1530

    Task Category: None

    Level:         Warning

    Keywords:      Classic

    User:          SYSTEM

    Computer:      Lisa-HP

    Description:

    Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. 

     DETAIL -

     1 user registry handles leaked from \Registry\User\S-1-5-21-3759449798-3651505042-2970044974-1000:

    Process 1644 (\Device\HarddiskVolume1\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe) has opened key \REGISTRY\USER\S-1-5-21-3759449798-3651505042-2970044974-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />

        <EventID Qualifiers="32768">1530</EventID>

        <Version>0</Version>

        <Level>3</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:18:35.000Z" />

        <EventRecordID>332328</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>Application</Channel>

        <Computer>Lisa-HP</Computer>

        <Security UserID="S-1-5-18" />

      </System>

      <EventData Name="EVENT_HIVE_LEAK">

        <Data Name="Detail">1 user registry handles leaked from \Registry\User\S-1-5-21-3759449798-3651505042-2970044974-1000:

    Process 1644 (\Device\HarddiskVolume1\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe) has opened key \REGISTRY\USER\S-1-5-21-3759449798-3651505042-2970044974-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

    </Data>

      </EventData>

    </Event>

    ****************************************************************ERROR

    Log Name:      Application

    Source:        Microsoft-Windows-Security-Licensing-SLC

    Date:          1/2/2013 8:30:08 AM

    Event ID:      12291

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    Key Management Service (KMS) failed to start.

    Info:

    hr=0xC004D103

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Microsoft-Windows-Security-Licensing-SLC" Guid="{1FD7C1D2-D037-4620-8D29-B2C7E5FCC13A}" EventSourceName="Software Licensing Service" />

        <EventID Qualifiers="16384">12291</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:30:08.000Z" />

        <EventRecordID>332342</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>Application</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>hr=0xC004D103</Data>

      </EventData>

    </Event>

    *******************************************************ERROR

    Log Name:      Application

    Source:        Microsoft-Windows-Security-Licensing-SLC

    Date:          1/2/2013 8:30:38 AM

    Event ID:      1001

    Task Category: None

    Level:         Error

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    The Software Licensing service failed to start. hr=0xC004D103, [2, 6]

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Microsoft-Windows-Security-Licensing-SLC" Guid="{1FD7C1D2-D037-4620-8D29-B2C7E5FCC13A}" EventSourceName="Software Licensing Service" />

        <EventID Qualifiers="49152">1001</EventID>

        <Version>0</Version>

        <Level>2</Level>

        <Task>0</Task>

        <Opcode>0</Opcode>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:30:38.000Z" />

        <EventRecordID>332345</EventRecordID>

        <Correlation />

        <Execution ProcessID="0" ThreadID="0" />

        <Channel>Application</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>hr=0xC004D103, [2, 6]</Data>

      </EventData>

    </Event>

    ******************************************************WARNING

    Log Name:      Application

    Source:        Application Virtualization Client

    Date:          1/2/2013 8:30:58 AM

    Event ID:      3191

    Task Category: (3)

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    {tid=B08}

    -------------------------------------------------------- Initialized client log (C:\ProgramData\Microsoft\Application Virtualization Client\sftlog.txt)

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Application Virtualization Client" />

        <EventID Qualifiers="16384">3191</EventID>

        <Level>3</Level>

        <Task>3</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:30:58.000Z" />

        <EventRecordID>332351</EventRecordID>

        <Channel>Application</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>{tid=B08}

    </Data>

        <Data>C:\ProgramData\Microsoft\Application Virtualization Client\sftlog.txt</Data>

      </EventData>

    </Event>

    ****************************************************WARNING

    Log Name:      Application

    Source:        Application Virtualization Client

    Date:          1/2/2013 8:31:13 AM

    Event ID:      3057

    Task Category: (6)

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    {tid=B08}

    The Application Virtualization Client Core initialized correctly.

    Installed Product:

    Version: 4.6.1.10263

    Install Path: C:\Program Files (x86)\Microsoft Application Virtualization Client

    Global Data Directory: C:\ProgramData\Microsoft\Application Virtualization Client\

    Machine Name: LISA-HP

    Operating System: Windows Vista 64-bit Service Pack 2.0 Build 6002

    OSD Command:

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Application Virtualization Client" />

        <EventID Qualifiers="16384">3057</EventID>

        <Level>3</Level>

        <Task>6</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:13.000Z" />

        <EventRecordID>332353</EventRecordID>

        <Channel>Application</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>{tid=B08}

    </Data>

        <Data>

        </Data>

        <Data>4.6.1.10263</Data>

        <Data>C:\Program Files (x86)\Microsoft Application Virtualization Client</Data>

        <Data>C:\ProgramData\Microsoft\Application Virtualization Client&lt;/Data>

        <Data>LISA-HP</Data>

        <Data>Windows Vista 64-bit Service Pack 2.0 Build 6002</Data>

        <Data>

        </Data>

      </EventData>

    </Event>

    **************************************************WARNING

    Log Name:      Application

    Source:        Application Virtualization Client

    Date:          1/2/2013 8:31:27 AM

    Event ID:      3211

    Task Category: (11)

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    {tid=C24}

    Attempting Transport Connection URL: http://c2r.microsoft.com/HomeStudentC2R/en-us/14.0.4763.1000/HomeStudentC2R.en-us\_14.0.6120.5005.sft Error: 2460420A-40002EE2

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="Application Virtualization Client" />

        <EventID Qualifiers="16384">3211</EventID>

        <Level>3</Level>

        <Task>11</Task>

        <Keywords>0x80000000000000</Keywords>

        <TimeCreated SystemTime="2013-01-02T13:31:27.000Z" />

        <EventRecordID>332355</EventRecordID>

        <Channel>Application</Channel>

        <Computer>Lisa-HP</Computer>

        <Security />

      </System>

      <EventData>

        <Data>{tid=C24}

    </Data>

        <Data>http://c2r.microsoft.com/HomeStudentC2R/en-us/14.0.4763.1000/HomeStudentC2R.en-us_14.0.6120.5005.sft</Data>

        <Data>2460420A-40002EE2</Data>

      </EventData>

    </Event>

    ************************************************WARNING

    Log Name:      Application

    Source:        CVHSVC

    Date:          1/2/2013 8:41:20 AM

    Event ID:      100

    Task Category: Client Virtualization Handler

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      Lisa-HP

    Description:

    Information only. C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE is trusted.

    Event Xml:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

      <System>

        <Provider Name="CVHSVC" />

        <EventID Qualifiers="16384">100</EventID>

        <Level>3</Level>

        <Task>1</Task>

    Was this answer helpful?

    0 comments No comments