Event Viewer Error (System), Source: Microsoft-Windows-Kernel-General__Windows 7 Prof

Question

I have a Dell Studio XPS 9100 Computer with Windows 7 Prof.  My computer has been running without any noticable problems.  Just before shutdown tonight, I checked the event viewer (system) and noticed the below error entry.  i have not seen this error entry before.  I should note that the only action taken today other than my normal email check with MLM, was to upgrade my CCleaner from ver 3.0 to 3.02.  I should also note that I do not clean the registry with the CCleaner program. I would appreciate any help in understanding/resolving this error entry.  Thanks, Sam.

Log Name:      System

Source:        Microsoft-Windows-Kernel-General

Date:          01/01/2011 5:32:03 PM

Event ID:      5

Task Category: None

Level:         Error

Keywords:     

User:          SYSTEM

Computer:      SAM

Description:

{Registry Hive Recovered} Registry hive (file): '??\Volume{d3353cef-e448-11df-acd3-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore{cd42efe1-f6f1-427c-b004-033192c625a4}{6DF1A9AA-6D91-454A-BA4B-7FA7CC51252E}' was corrupted and it has been recovered. Some data might have been lost.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />

    <EventID>5</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000000</Keywords>

    <TimeCreated SystemTime="2011-01-01T23:32:03.324756000Z" />

    <EventRecordID>22461</EventRecordID>

    <Correlation />

    <Execution ProcessID="1112" ThreadID="3420" />

    <Channel>System</Channel>

    <Computer>SAM</Computer>

    <Security UserID="S-1-5-18" />

  </System>

  <EventData>

    <Data Name="FinalStatus">0x8000002a</Data>

    <Data Name="ExtraStringLength">171</Data>

    <Data Name="ExtraString">??\Volume{d3353cef-e448-11df-acd3-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore{cd42efe1-f6f1-427c-b004-033192c625a4}{6DF1A9AA-6D91-454A-BA4B-7FA7CC51252E}</Data>

  </EventData>

</Event>

Answer 1

Hello ScamSam,

1.     Does your computer still work without any problems in spite of the error logs in the event viewer?

I suggest that you do a System Restore on your computer and check if it removed the error. Then you can keep track of what is happening on the computer and changes made to check what could be causing the error.

a.     Click Start, type system restore in the Start Search box, and then click System Restore in the Programs list.

b.     If you are prompted for an administrator password or confirmation, type your password or click Continue.

c.      In the System Restore dialog box, click Choose a different restore point, and then click Next.

d.     In the list of restore points, click a restore point that was created before you began to experience the issue, and then click Next.

e.     Click Finish.

You can visit the below link for more information:

http://windows.microsoft.com/en-US/windows7/products/features/system-restore

Thanks,

Irfan H, Microsoft Answers Support Engineer. Visit ourMicrosoft Answers Feedback Forum and let us know what you think.

Answer 2

I have the same message for a user on our network, since I am a support  desk specialist, and the user has been experiencing unresponsive applications and app crashes with IE 11, which is all based-on the Windows Event Log.  Otherwise, she has been working well.

I am wondering whether this isn't the result of a defective hard disk, so I plan on testing the hard drive tomorrow to see whether that is a cause.  Otherwise, I would see whether the CHKDSK doesn't work for my case:

{Registry Hive Recovered} Registry hive (file): '??\Volume{b8335dc3-7dcc-11e1-b633-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore{cd42efe1-f6f1-427c-b004-033192c625a4}{89862560-5344-47E4-A5E4-AA706C45769E}' was corrupted and it has been recovered. Some data might have been lost.

Answer 3

Hi ScamSam,

Go ahead and perform the System Restore. If that still does resolve the issue, you can always undo the changes made by system restore.  The steps are written for Vista but also apply to Windows 7.

---

Dena

Microsoft Answers Support Engineer

Visit our Microsoft Answers Feedback Forum and let us know what you think.

Answer 4

Irfan H, many thanks for your reply.  I decided to accomplish the chkdsk function and see if that would spot light any problems.  I did this at 1515 yesterday and it appeared that there was a problem after the bootup when the chkdsk message started.  The message indicated that chkdsk would start in approximately 10 seconds unless any key was pressed and then checkdisk was stop or not run.  The count down began on the screen and when it got down to 1 second it stopped changing, ande it appeared that there was a freeze of the computer or the monitor.  I was not sure and so left the computer on all night and this morning, but there was no change of the message on the monitor such as seeing stage 1, etc. 

This afternoon, I shutdown the computer with the tower power button.  After the shutdown, I disconnected the printer and external HD.  I powered up the tower, and the message came up about running the chkdsk function.  I  let this run and it took approximately three hours to complete, from stage 1 to stage 5.   I went to the event viewer log (wininit)  and basically the log did not indicate any problems (Some Information in the wininit log - 0 bad file records, 0 unindexed files, Windows has checked the file system and found no problems, and had 0 KB in bad sectors).   I also checked the application and system logs and there was not any serious errors or warnings indicated, other than the one I posted above.

I also checked Device Manager and did not see any problems.  I also checked Disk Management and all volumes were listed as Healthy.   I thought about the upgrade of CCleaner which was accomplished in the morning before the error noted in my original post, (the error occurred at : 01/01/2011 5:32:03 PM)  I also did not run the new CCleaner until well after the event viewer error time.   I also discovered when I went to System Restore, there was a system restore point accomplished at (01/01/2011 2:32 PM) because of a MS Security Essentials Update (KB2310138).  So I am for the moment, vary suspious of the MS Security update. 

My thought is to visit the MS Security Essentials forum to see if anyone has experienced any problems with this particular update.  Irfan H, based on the above new information, do you think I should still go ahead and go back to a restore point prior to the CCleaner and MS Security Essentials upgrade?  Thanks for any further help, Sam.