Lenovo Desktop, XP, sp2,  with AVG 8.0 free, Spybot S&D, Spywareblaster.

I use Erunt to backup my registry (about every 3 days) and once a month I image the 
drives on my single hard disk, using DriveImage. The Erunt backup used to take only 
a few seconds and the imaging of C: drive used to take about 4 minutes. But the last 
two Erunt backups took several times longer than usual, and when I imaged my C: drive 
today, it took 31 minutes instead of the usual 3 and a half minutes! However, the 
size of the C_.dat file generated by DriveImage is not much bigger than it used to 
be. Something is evidently very wrong. 

My computer did crash in the past month due to the failure of the UPS during a power 
failure. I reported this in my Annoyances post, t1237878254, dated March 24. A user 
profile got corrupted, which I subsequently deleted after duplication. The computer 
appears to be working well enough, apart from much longer delays than usual in the 
appearance of the desktop for the old profile (but not for the newly duplicated one) 
and in the response to any command (clicking on any icon) soon after the desktop 
appears, for both profiles. Later there is no such delay. No hardware or software 
has been added in the past few weeks and the drive does not need defragging. 

For the past several days I have noticed a succession of red errors in the Event 
viewer, System section, almost all at the clock time at which the computered is turned 
on (powered on). Event 11 -- errors in the hard disk controller are reported. However, 
several runs of the Western Digital hard disk test utility have revealed no problem 
with the disk.

 I am out of my depth trying to figure out the cause of these errors and what corrective 
action to take. I do have an image of the drive going back to the time before the 
crash occurred, but not having ever done a restore of the system partition, I am 
a bit anxious about attempting it. There is no system restore point earlier than 
March 28.

I would be grateful for advice. 

raminder singh

Tip: Run a free scan for common Windows errors ad

re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 1, 2009 at 1:34 pm Posted by Jacob6601 (2174 messages posted) Start in BIOS and make sure the drive has not reverted to PIO. Re-boot a few times and check it. Run "chkdsk c: /p" ASAP afterwards to check for file system errors, not drive errors as the WD test does. You might also want to clear (delete) your swap file also. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 1, 2009 at 4:30 pm Posted by normanw (1284 messages posted) You might like to take a look at this post. On Wednesday, April 1, 2009 at 9:29 am, raminder singh wrote: >Lenovo Desktop, XP, sp2, with AVG 8.0 free, Spybot S&D, Spywareblaster. > >I use Erunt to backup my registry (about every 3 days) and once a month I image the >drives on my single hard disk, using DriveImage. The Erunt backup used to take only >a few seconds and the imaging of C: drive used to take about 4 minutes. But the last >two Erunt backups took several times longer than usual, and when I imaged my C: drive >today, it took 31 minutes instead of the usual 3 and a half minutes! However, the >size of the C_.dat file generated by DriveImage is not much bigger than it used to >be. Something is evidently very wrong. > >My computer did crash in the past month due to the failure of the UPS during a power >failure. I reported this in my Annoyances post, t1237878254, dated March 24. A user >profile got corrupted, which I subsequently deleted after duplication. The computer >appears to be working well enough, apart from much longer delays than usual in the >appearance of the desktop for the old profile (but not for the newly duplicated one) >and in the response to any command (clicking on any icon) soon after the desktop >appears, for both profiles. Later there is no such delay. No hardware or software >has been added in the past few weeks and the drive does not need defragging. > >For the past several days I have noticed a succession of red errors in the Event >viewer, System section, almost all at the clock time at which the computered is turned >on (powered on). Event 11 -- errors in the hard disk controller are reported. However, >several runs of the Western Digital hard disk test utility have revealed no problem >with the disk. > > I am out of my depth trying to figure out the cause of these errors and what corrective >action to take. I do have an image of the drive going back to the time before the >crash occurred, but not having ever done a restore of the system partition, I am >a bit anxious about attempting it. There is no system restore point earlier than >March 28. > >I would be grateful for advice. > >raminder singh > http://www.annoyances.org/exec/forum/winxp/1237350756 [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 1, 2009 at 6:32 pm Posted by raminder singh (92 messages posted) Thank you for your prompt response. I could not find the PIO/DMA option in my BIOS, though I looked at all the pages and submenus. However, I find that Ultra DMA is set in the System properties menu for IDE 1. I will read up on how to clear the swap file and report back if clearing it improves the system. Chkdsk /p is not an option available in my system. But I had run /r several times, on all the partitions. Thank you again. On Wednesday, April 1, 2009 at 1:34 pm, Jacob6601 wrote: >Start in BIOS and make sure the drive has not reverted to PIO. Re-boot a few times >and check it. >Run "chkdsk c: /p" ASAP afterwards to check for file system errors, not drive errors >as the WD test does. > >You might also want to clear (delete) your swap file also. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 1, 2009 at 6:41 pm Posted by raminder singh (92 messages posted) Thank you. I looked up the page you recommended. My drive turns out to be set to Ultra DMA, so I did not proceed further in this respect. Also, I did Defrag (with the built-in Windows utility) all the partitions before posting my problem. I had also run sfc /scannow and run both AVG and Spybot in Safe mode. Thanks again. On Wednesday, April 1, 2009 at 4:30 pm, normanw wrote: >You might like to take a look at this >post. > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 1, 2009 at 9:10 pm Posted by Jacob6601 (2174 messages posted) Swap file: Simply move it to another drive or partition to clear it. Move it back when ready to re-boot again. Unless your hard disk driver got pinged (doubtful), you probably have a hardware fault. http://support.microsoft.com/kb/154690 I would start by replacing the cable. Next, "Simplify the SCSI/IDE chain by removing devices, or move the device in question to another controller. If the problem follows the device, you should replace it." I would boot with ONLY the one drive attached, clearing the second IDE channel also. If that fails, hopefully you have a spare drive to restore your image to. Boot with ONLY that drive attached to see if it is the drive or something else. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 1, 2009 at 9:17 pm Posted by raminder singh (92 messages posted) Thank you again. I did not realize that the swap file was the same as the paging file! I had moved the paging file following the advice about event 11 I found in some webpage a couple of days ago. It did not improve matters. I am in a bit of a bind because my machine is under warranty (3 years) and 2 years of the warranty are still to go. So I do not wish to mess with the hardware. And I cannot demand the services of a service engineer because the machine does run, and the disk check utility declares that the HDD is fine! However, I inspected the insides of the box and found that there is place for but one hard disk -- the one in use -- and there are no other devices on the chain. There is also a combo DVD reader on the second IDE channel, which I can disconnect to see if it helps. If it does, I will report back. I do have a spare hard disk, but it is a PATA, and the one in place is a SATA. I don't know whether the image of the SATA drive will work if restored to a PATA drive. When I have mustered the courage, I could try! Meanwhile I will just wait for the fault to become worse. If it does, I can try a repair install. I can live with the system in its present state. On Wednesday, April 1, 2009 at 9:10 pm, Jacob6601 wrote: >Swap file: Simply move it to another drive or partition to clear it. Move it back >when ready to re-boot again. Unless your hard disk driver got pinged (doubtful), >you probably have a hardware fault. http://support.microsoft.com/kb/154690 > >I would start by replacing the cable. > >Next, "Simplify the SCSI/IDE chain by removing devices, or move the device in question >to another controller. If the problem follows the device, you should replace it." >I would boot with ONLY the one drive attached, clearing the second IDE channel also. > >If that fails, hopefully you have a spare drive to restore your image to. Boot with >ONLY that drive attached to see if it is the drive or something else. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Thursday, April 2, 2009 at 3:37 am Posted by Ricer46 (23825 messages posted) SATA - PATA swap: No Defrag was a waste of time, it never fixes severe slow downs. On Wednesday, April 1, 2009 at 9:17 pm, raminder singh wrote: >Thank you again. > >I did not realize that the swap file was the same as the paging file! I had moved >the paging file following the advice about event 11 I found in some webpage a couple >of days ago. It did not improve matters. > >I am in a bit of a bind because my machine is under warranty (3 years) and 2 years >of the warranty are still to go. So I do not wish to mess with the hardware. And >I cannot demand the services of a service engineer because the machine does run, >and the disk check utility declares that the HDD is fine! However, I inspected the >insides of the box and found that there is place for but one hard disk -- the one >in use -- and there are no other devices on the chain. There is also a combo DVD >reader on the second IDE channel, which I can disconnect to see if it helps. If it >does, I will report back. > >I do have a spare hard disk, but it is a PATA, and the one in place is a SATA. I >don't know whether the image of the SATA drive will work if restored to a PATA drive. >When I have mustered the courage, I could try! Meanwhile I will just wait for the >fault to become worse. If it does, I can try a repair install. I can live with the >system in its present state. > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Thursday, April 2, 2009 at 10:35 am Posted by Jacob6601 (2174 messages posted) Verification of a hardware fault, in addition to the Event 11 entries, might be done with DriveImage. Go to http://www.runtime.org/driveimage-xml.htm and follow the link at "You can run DriveImage XML from a WinPE boot CD-ROM" to create a new image of your drive. There will be a normal time variance, but if it (imaging) drops back below five minutes (and that is the DriveImage you were using), xp (or the DriveImage install on c:) is at fault. If it does turn out to be xp, DriveImage (from above link) "uses Microsoft's Volume Shadow Services (VSS)" and we will need to look into restoring that. Go ahead and disconnect the DVD. If you can replace the cable without breaking seals, do it. As Ricer said, a PATA drive would not boot. Besides, you need to look at that SATA channel. You might check at Lenovo to see if they have a bootable CD for comprehensive hardware testing. Other than that, start documenting all symptoms in one place for return. Disk check utilities are guides and in no way comprehensive. Even if the drive is fine, something down the line is off. And if it is not the drive or cable, it is on the board. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Thursday, April 2, 2009 at 9:20 pm Posted by raminder singh (92 messages posted) Thank you for continuing to think about my problem and its possible resolution. Let me report some experiments (accidental and deliberate) that have been done on the system since my last post. I did disconnect the DVD. The subsequent boot resulted in the usual quota of Event 11 errors. So I reconnected it. Some 24 hours ago, while listing the programs I might have to reinstall in case something went wrong, I noted that I had updated (really installed) Openoffice from version 2.2 to 3.0 on the 13th March -- around the time when the UPS crashed (unfortunately I did not note that date). Thinking that this update might have something to do with my problems, I uninstalled Openoffice and went through the usual sequence, looking for Event 11 errors. Not finding any change, I reinstalled Openoffice. Later in the day, I happened to have removed the ADSL cable (for some unrelated reason) and turned on the UPS power (but did not press the Start button on the box) when I had to attend to some other matter. Some 15 minutes later I came back and pressed the Start button and again had to leave the computer for about 15 minutes. Then I clicked on the limited user icon (the one I usually use) to log on. The desktop came up very quickly, as usual, but I waited until the HDD light had more or less ceased to be active ( I have noticed that the HDD light remains active for over a minute or two after the hour-glass icon vanishes). Then I looked at the Event viewer log (System), to find, amazingly, no errors whatever!! This suggested that some hardware performed differently after it had warmed up? I postponed a repeat of this experiment to the next morning, because I get the most event 11 errors at the first start of the day. Since the system seemed to be behaving well, I decided to run DriveImage and image the C: drive, which had taken 31 minutes some days ago (when I first posted about my problem). The imaging went at the speed I was used to and was done in less than 5 minutes! I have no idea why, unless the uninstall and reinstall of Openoffice has some bearing on the matter. This morning I repeated the Start-with-long delays experiment, of the kind described above. It was a failure, with the event viewer log showing several Event 11 errors, disappointing me! I decided to recheck the DriveImage imaging and found that it still happens in less than 5 minutes. However, the ERUNT backup took 3 or 4 times longer than it used to, so all in not normal. Annoyances experts, I have noted, are not impressed by Registry cleaners, but should I try to use Regcleaner (I have an ancient version) to clean the registry? Finally, I attempted a re-start with minimum delays (as I used to do until 3 weeks or so ago). After the desktop showed up and the hourglass icon vanished, I clicked on the Start button intending to open the Control Panel. The computer froze and I got a BSOD with a Stop 0x0000007A or KERNEL_DATA_INPAGE_ERROR. A subsequent restart and viewing of the event viewer log expectedly showed a long string of event 11 errors. In conclusion, I have little doubt that some piece of hardware has been damaged. I will try Lenovo's website, as you suggest, to look for some comprehensive hardware testing utility. Meanwhile there is not much I can do except to use the computer carefully and be prepared for a hardware breakdown with frequent backups.. Thank you for reading this long account. If anything new and interesting happens, I will report back. raminder singh On Thursday, April 2, 2009 at 10:35 am, Jacob6601 wrote: >Verification of a hardware fault, in addition to the Event 11 entries, might be done >with DriveImage. Go to http://www.runtime.org/driveimage-xml.htm >and follow the link at "You can run DriveImage XML from a WinPE boot CD-ROM" to create >a new image of your drive. There will be a normal time variance, but if it (imaging) >drops back below five minutes (and that is the DriveImage you were using), xp (or >the DriveImage install on c:) is at fault. > >If it does turn out to be xp, DriveImage (from above link) "uses Microsoft's Volume >Shadow Services (VSS)" and we will need to look into restoring that. > >Go ahead and disconnect the DVD. If you can replace the cable without breaking seals, >do it. As Ricer said, a PATA drive would not boot. Besides, you need to look at that >SATA channel. > >You might check at Lenovo to see if they have a bootable CD for comprehensive hardware >testing. Other than that, start documenting all symptoms in one place for return. >Disk check utilities are guides and in no way comprehensive. Even if the drive is >fine, something down the line is off. And if it is not the drive or cable, it is >on the board. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Thursday, April 2, 2009 at 10:37 pm Posted by Jacob6601 (2174 messages posted) Event 11 / Drive access: Since you unplugged it with positive results, you could also try pulling your network card (NIC) or disable it in BIOS. If disabling, you may have to disable it in the device manager (re-boot) also. ERUNT: I have not addressed this because it may be unrelated to the other problem, possibly caused by the profile corruption. But registry replacement is the best cleaner, and you have your ERUNT registry backups. 1. Re-create the damaged user and delete the new one you created so the profile names match the ones in your backup. 2. Run ERUNT and backup, jic. 3. Run ERDNT.EXE and restore to before ALL problems. Afterwards, apps/updates can just be re-installed over themselves (same folder). Be sure to read/print the "Emergency Scenario" restore directions under "Detailed information". Erunt: http://www.larshederer.homepage.t-online.de/erunt/ [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, April 3, 2009 at 2:10 am Posted by raminder singh (92 messages posted) I will disable the network card, and if I obtain positive results I will post back. Unfortunately, my ERUNT backups are programmed to be retained for 7 days only. So those available all belong to the period well after my problems began. I should have realized the importance of saving some old ones, but it is too late. I should have mentioned two other points in my last post. The first point is that (disk), event 11, errors are not seen *during* a session of computer use (browsing, or composing text etc.), even if the session lasts an hour. They are always seen during the first couple of minutes of logging on to a profile at startup; and when user profiles are switched. The second point is that sometimes, if there is a long string of event 11 errors, an (atapi), event 5, error also appears. I am sorry I did not mention this earlier. Thank you for your continuing help. On Thursday, April 2, 2009 at 10:37 pm, Jacob6601 wrote: >Event 11 / Drive access: Since you unplugged it with positive results, you could >also try pulling your network card (NIC) or disable it in BIOS. If disabling, you >may have to disable it in the device manager (re-boot) also. > >ERUNT: I have not addressed this because it may be unrelated to the other problem, >possibly caused by the profile corruption. But registry replacement is the best cleaner, >and you have your ERUNT registry backups. > >1. Re-create the damaged user and delete the new one you created so the profile names >match the ones in your backup. >2. Run ERUNT and backup, jic. >3. Run ERDNT.EXE and restore to before ALL problems. Afterwards, apps/updates can >just be re-installed over themselves (same folder). > >Be sure to read/print the "Emergency Scenario" restore directions under "Detailed >information". >Erunt: http://www.larshederer.homepage.t-online.de/erunt/ [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, April 3, 2009 at 3:47 am Posted by MartinM (7551 messages posted) I don't mean to jump into the excellent help Jacob is giving you but, reviewing all the information you have provided, it points to a failing disk drive or cable as a possibility. The specific errors you quote are 5: parity error and 11: HDD controller error. If the HDD is returning a lot of parity errors, and hence having to re-seek data, that could indeed slow things down enormously. It is possible that a surface scan would show up little, as the disk surface may be in fine fettle. Its also possible the the cable is playing up - they are very fragile. Mechanical problems with HDDs are common at startup - before the drive heats up and lubricants soften. Having said all that, it is odd that you are getting slow operations long after the errors have stopped showing - however some HDDs have internal mechanisms to correct errors and those would not necessarily show in the Windows Event Viewer, so maybe they are just more severe when the drive is cold. Have you acquired the disk manufacturer's diagnostic tools and run them ? They are usually pretty good. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, April 3, 2009 at 4:38 am Posted by raminder singh (92 messages posted) Thank you for explaining things to me about hard disks. I did download Western Digital's disk check utility (mine is a WD hard disk) and have run it several times. No errors were reported. Nevertheless, I suspect the disk is the culprit, having been damaged in some way by the UPS crash. The machine (and the cable) is only a year old, and on one has opened the box during this period. Still I could buy a new cable and try it out. As you will have read in my post of April 2, 9:20 pm, the slow imaging problem seems to have vanished, though I don't know why. So, at present, the only problems (event 11 and event 5) are when I log on or switch users. Otherwise the machine is not slow. Thank you for you advice. On Friday, April 3, 2009 at 3:47 am, MartinM wrote: > >I don't mean to jump into the excellent help Jacob is giving you but, reviewing all >the information you have provided, it points to a failing disk drive or cable as >a possibility. > >The specific errors you quote are 5: parity error and 11: HDD controller error. > >If the HDD is returning a lot of parity errors, and hence having to re-seek data, >that could indeed slow things down enormously. It is possible that a surface scan >would show up little, as the disk surface may be in fine fettle. > >Its also possible the the cable is playing up - they are very fragile. > >Mechanical problems with HDDs are common at startup - before the drive heats up and >lubricants soften. > >Having said all that, it is odd that you are getting slow operations long after the >errors have stopped showing - however some HDDs have internal mechanisms to correct >errors and those would not necessarily show in the Windows Event Viewer, so maybe >they are just more severe when the drive is cold. > >Have you acquired the disk manufacturer's diagnostic tools and run them ? They are >usually pretty good. > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, April 3, 2009 at 4:41 am Posted by raminder singh (92 messages posted) I tried the experiment of disabling the NIC card in the Device Manager. I did not wish to uninstall the driver since I am not too experienced and could have problems if Windows does not detect and re-install the adapter automatically. The experiment was a failure, unfortunately. The event 11 errors remain. Incidentally, I realized that I do have an ERUNT backup dating to the period before all problems occurred! It is in the image I backed up over a month ago, and DriveImage permits the extraction of individual files. I browsed the concerned .xml file and found what I was looking for. However, the Registry problem is a minor one. I will do something about it later. Right now I need to spend some time *using* the computer! Thank you for patiently reading my posts. On Friday, April 3, 2009 at 2:10 am, raminder singh wrote: >I will disable the network card, and if I obtain positive results I will post back. > >Unfortunately, my ERUNT backups are programmed to be retained for 7 days only. So >those available all belong to the period well after my problems began. I should have >realized the importance of saving some old ones, but it is too late. > >I should have mentioned two other points in my last post. > >The first point is that (disk), event 11, errors are not seen *during* a session >of computer use (browsing, or composing text etc.), even if the session lasts an >hour. They are always seen during the first couple of minutes of logging on to a >profile at startup; and when user profiles are switched. > >The second point is that sometimes, if there is a long string of event 11 errors, >an (atapi), event 5, error also appears. I am sorry I did not mention this earlier. > >Thank you for your continuing help. > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, April 3, 2009 at 5:00 am Posted by MartinM (7551 messages posted) Thanks for the reply. All HDDs fail one day, so make sure your precious data is backed up ! As long as you've done that, "wait and see" is a good idea :-) [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Saturday, April 4, 2009 at 7:06 pm Posted by raminder singh (92 messages posted) I carried out the directions in your last message (# 1238737061, April 2, 10:37pm) and after following all the steps loaded the ERUNT backup of March 7, which I extracted from the stored drive image of that date. There were some small problems with the recreated user profile bearing the name stored in the image, but after some sensible cutting, pasting and deleting, that user profile is as good as it used to be. Now, the ERUNT registry backup is rapid, as it used to be, as you had predicted. Also, the DriveImage backup is as rapid as it used to be. So, both the problems listed in the "Subject" of this thread have, happily, been solved! Please accept my sincere gratitude for guiding me through the process and for the time and effort you expended. Surprisingly, there is also a significant reduction in the number of event 11 errors that I see! If I wait a minute or two before clicking to log in, there is no more than one such error. I sent an email to Western Digital support some days ago, seeking their opinion about event 11 errors being an indication of a dying disk. The person who responded was dismissive of the suggestion and said that event viewer errors are not meant for diagnosing hardware; also, that if the WD disk check utility showed a healthy disk, there was nothing further to be said. Anyway, I am convinced that some hardware is damaged. But I can use the machine without anxiety now, and, being a retired person, waiting a couple of minutes at start up is not a problem! It remains to try out a new SATA cable as you and others have suggested. I may do so, sometime, if it is clear that I will not have to cut any cable clamps to remove the old one. Also, I will look into your suggestion and spend some time at the Lenovo website, to see if any comprehensive hardware testing utility is available for download. Thank you again. raminder singh On Thursday, April 2, 2009 at 10:37 pm, Jacob6601 wrote: >Event 11 / Drive access: Since you unplugged it with positive results, you could >also try pulling your network card (NIC) or disable it in BIOS. If disabling, you >may have to disable it in the device manager (re-boot) also. > >ERUNT: I have not addressed this because it may be unrelated to the other problem, >possibly caused by the profile corruption. But registry replacement is the best cleaner, >and you have your ERUNT registry backups. > >1. Re-create the damaged user and delete the new one you created so the profile names >match the ones in your backup. >2. Run ERUNT and backup, jic. >3. Run ERDNT.EXE and restore to before ALL problems. Afterwards, apps/updates can >just be re-installed over themselves (same folder). > >Be sure to read/print the "Emergency Scenario" restore directions under "Detailed >information". >Erunt: http://www.larshederer.homepage.t-online.de/erunt/ [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Sunday, April 5, 2009 at 7:54 am Posted by raminder singh (92 messages posted) I thought I should let you know that I found and downloaded the Lenovo System Toolbox and used it to run tests on the hard disk, CPU, memory, and the motherboard. Everything was found to be healthy in these tests. raminder singh On Saturday, April 4, 2009 at 7:06 pm, raminder singh wrote: >I carried out the directions in your last message (# 1238737061, April 2, 10:37pm) >and after following all the steps loaded the ERUNT backup of March 7, which I extracted >from the stored drive image of that date. There were some small problems with the >recreated user profile bearing the name stored in the image, but after some sensible >cutting, pasting and deleting, that user profile is as good as it used to be. > >Now, the ERUNT registry backup is rapid, as it used to be, as you had predicted. >Also, the DriveImage backup is as rapid as it used to be. So, both the problems listed >in the "Subject" of this thread have, happily, been solved! Please accept my sincere >gratitude for guiding me through the process and for the time and effort you expended. > >Surprisingly, there is also a significant reduction in the number of event 11 errors >that I see! If I wait a minute or two before clicking to log in, there is no more >than one such error. > >I sent an email to Western Digital support some days ago, seeking their opinion about >event 11 errors being an indication of a dying disk. The person who responded was >dismissive of the suggestion and said that event viewer errors are not meant for >diagnosing hardware; also, that if the WD disk check utility showed a healthy disk, >there was nothing further to be said. Anyway, I am convinced that some hardware is >damaged. But I can use the machine without anxiety now, and, being a retired person, >waiting a couple of minutes at start up is not a problem! > >It remains to try out a new SATA cable as you and others have suggested. I may do >so, sometime, if it is clear that I will not have to cut any cable clamps to remove >the old one. Also, I will look into your suggestion and spend some time at the Lenovo >website, to see if any comprehensive hardware testing utility is available for download. > >Thank you again. >raminder singh > > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Sunday, April 5, 2009 at 12:02 pm Posted by Jacob6601 (2174 messages posted) Final thoughts: While thinking on the mysterious DriveImage fix, it seems that if you had errors in the "system backup" data, that could have been causing the Volume Shadow Services (VSS) to tie up. Removing/re-installing that app caused it to write new (and thus erase older) backup points. You might try turning "system backup" off, rebooting, etc. to completely clear the data out. The event 11 and event 5 errors, and their timing, may be hard to pinpoint. I would do as you are -- simply monitor the situation as best you can. You could Use Notepad to Create a Log File, in "all users\desktop", and open it at power on/user switch for a time stamp compare as you check the event viewer less frequently. Those events could also be caused by EMI noise. Again, I would try the cable (bad shielding) first. This is a cheap try at the most likely suspect. And most stores should accept the cable for return if it does not work. It is, after all, just wire. When replacing the cable, I should have noted that there is no need to remove the old one, simply unplug at both ends. Do not try to neatly route a replacement unless the problem is fixed. You want to keep this episode in mind if you ever have network problems. That NIC causing noise on the bus would be my second suspect to the event 11 and event 5 errors. The only other thing I can think of that might change at user switch (causing noise) would be the screen. Open a command prompt and use ALT-ENTER to switch between full screen/window a few times. Open the display properties and switch to a few higher and lower resolutions. Just cancel this out at the "do you want to keep this ..." box. Now check the event viewer. Use Notepad to Create a Log File = http://support.microsoft.com/kb/260563 [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Sunday, April 5, 2009 at 6:29 pm Posted by raminder singh (92 messages posted) Thank you for your final thoughts and useful advice for dealing with future problems. I will implement your suggestions carefully. On Sunday, April 5, 2009 at 12:02 pm, Jacob6601 wrote: >Final thoughts: > >While thinking on the mysterious DriveImage fix, it seems that if you had errors >in the "system backup" data, that could have been causing the Volume Shadow Services >(VSS) to tie up. Removing/re-installing that app caused it to write new (and thus >erase older) backup points. You might try turning "system backup" off, rebooting, >etc. to completely clear the data out. > >The event 11 and event 5 errors, and their timing, may be hard to pinpoint. I would >do as you are -- simply monitor the situation as best you can. You could Use Notepad >to Create a Log File, in "all users\desktop", and open it at power on/user switch >for a time stamp compare as you check the event viewer less frequently. > >Those events could also be caused by EMI noise. Again, I would try the cable (bad >shielding) first. This is a cheap try at the most likely suspect. And most stores >should accept the cable for return if it does not work. It is, after all, just wire. > >When replacing the cable, I should have noted that there is no need to remove the >old one, simply unplug at both ends. Do not try to neatly route a replacement unless >the problem is fixed. > >You want to keep this episode in mind if you ever have network problems. That NIC >causing noise on the bus would be my second suspect to the event 11 and event 5 errors. > >The only other thing I can think of that might change at user switch (causing noise) >would be the screen. Open a command prompt and use ALT-ENTER to switch between full >screen/window a few times. Open the display properties and switch to a few higher >and lower resolutions. Just cancel this out at the "do you want to keep this ..." >box. Now check the event viewer. > >Use Notepad to Create a Log File = http://support.microsoft.com/kb/260563 [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Sunday, April 5, 2009 at 10:28 pm Posted by normanw (1284 messages posted) Thank you for your reply posting the results and also for your detailed replies to all the other suggestions given. This sort of feedback is all too rare, yet it is a common courtesy to those people trying to help and may also act as a useful case-history for others experiencing similar problems. Worst of all, of course are those posters who simply leave a message along the lines of "All fixed, not to worry," ignoring the fact that their fix may be valuable information for other users. Very egoistical! On Wednesday, April 1, 2009 at 6:41 pm, raminder singh wrote: >Thank you. I looked up the page you recommended. My drive turns out to be set to >Ultra DMA, so I did not proceed further in this respect. > >Also, I did Defrag (with the built-in Windows utility) all the partitions before >posting my problem. I had also run sfc /scannow and run both AVG and Spybot in Safe >mode. > >Thanks again. > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Monday, April 6, 2009 at 6:52 am Posted by raminder singh (92 messages posted) I totally agree with you about the need to display courtesy, at least, apart from providing feedback, to people who spend their time and thought helping one. May be it is a generation thing (at 74, I belong to the past)? Perhaps the norms have changed? On Sunday, April 5, 2009 at 10:28 pm, normanw wrote: >Thank you for your reply posting the results and also >for your detailed replies to all the other suggestions >given. This sort of feedback is all too rare, yet it is a >common courtesy to those people trying to help and >may also act as a useful case-history for others >experiencing similar problems. > >Worst of all, of course are those posters who simply >leave a message along the lines of "All fixed, not to >worry," ignoring the fact that their fix may be >valuable information for other users. Very egoistical! > > > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Monday, April 6, 2009 at 7:03 am Posted by normanw (1284 messages posted) Yes, it all goes with the expectation of everything in computing being free of charge. I'm 71 and certainly notice the drastic change in manners and common courtesy, even on this normally friendly and helpful forum. On Monday, April 6, 2009 at 6:52 am, raminder singh wrote: >I totally agree with you about the need to display courtesy, at least, apart from >providing feedback, to people who spend their time and thought helping one. May be >it is a generation thing (at 74, I belong to the past)? Perhaps the norms have changed? > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, April 8, 2009 at 12:25 am Posted by raminder singh (92 messages posted) Final report: The Lenovo system toolbox had required me to download and install .NET Framework 2.0. Doing so cleared all System Restore points, it appears. I was able to use the toolbox (as I reported) but found later that the computer froze (with a STOP error) when it tried to run a screen saver. Guessing that .NET was responsible, I uninstalled it and installed Framework 2.0 sp1 instead. No problems with the version sp1 so far. Anyway, the System Restore entries, which you had suggested clearing, have got thoroughly cleared! I tried the screen experiments you advised. No error appeared. Today I obtained and replaced the SATA cable. Unfortunately, occasional Event 11 errors continue to turn up. So far there are two observations that have a bearing on the appearance of these errors. On one occasion I noticed that HDD light activity ceased quickly after the welcome screen came up. And when I clicked on the user icon, the light again quietened down quickly after the desktop and its icons appeared. I started a program immediately. Event viewer showed no error. So I switched users and again found that the HDD light went off quickly. And I used a program on this profile also. Again no errors showed. However, usually the HDD light continues to show activity, and if one clicks on a user icon without waiting for the light to go still, one or more errors show up. Also, no matter how long I wait, one error does show up when the first user profile icon is clicked, except on the rare occasions like the one described earlier in this paragraph. However no further errors appear, no matter how the session of use, unless I switch users (which I seldom do). Finally, the computer is working as well as it ever did. It occurs to me that these errors may always have been present in this machine! I never used to look at the activity of the HDD light, or at the Event viewer logs (except Winlogon after a chkdsk). I started looking at the System log only after the UPS crashed, a user profile got corrupted and I started getting STOP errors. Unless I run into more trouble of some kind, I will pretend that the machine, at this point, is as good as new! Thank you for your help. Raminder Singh On Sunday, April 5, 2009 at 12:02 pm, Jacob6601 wrote: >Final thoughts: > >While thinking on the mysterious DriveImage fix, it seems that if you had errors >in the "system backup" data, that could have been causing the Volume Shadow Services >(VSS) to tie up. Removing/re-installing that app caused it to write new (and thus >erase older) backup points. You might try turning "system backup" off, rebooting, >etc. to completely clear the data out. > >The event 11 and event 5 errors, and their timing, may be hard to pinpoint. I would >do as you are -- simply monitor the situation as best you can. You could Use Notepad >to Create a Log File, in "all users\desktop", and open it at power on/user switch >for a time stamp compare as you check the event viewer less frequently. > >Those events could also be caused by EMI noise. Again, I would try the cable (bad >shielding) first. This is a cheap try at the most likely suspect. And most stores >should accept the cable for return if it does not work. It is, after all, just wire. > >When replacing the cable, I should have noted that there is no need to remove the >old one, simply unplug at both ends. Do not try to neatly route a replacement unless >the problem is fixed. > >You want to keep this episode in mind if you ever have network problems. That NIC >causing noise on the bus would be my second suspect to the event 11 and event 5 errors. > >The only other thing I can think of that might change at user switch (causing noise) >would be the screen. Open a command prompt and use ALT-ENTER to switch between full >screen/window a few times. Open the display properties and switch to a few higher >and lower resolutions. Just cancel this out at the "do you want to keep this ..." >box. Now check the event viewer. > >Use Notepad to Create a Log File = http://support.microsoft.com/kb/260563 [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Monday, May 11, 2009 at 2:52 am Posted by raminder singh (92 messages posted) As stated in my final report, I had decided to live with the Event 11 disk errors I was getting in the Event viewer. But their number slowly increased and I also started getting STOP errors, regularly. At that point I invoked the warranty and called the IBM service engineer. The service engineer was initially not convinced that Event 11 disk errors meant a damaged hard disk. He wanted to clean install XP with a genuine CD first. I let him do this since I had images of the whole drive stored in an external drive. Event 11 errors appeared in the fresh installation right away, but he wanted me also to check for STOP errors. These also appeared the next day! I was then provided with a temporary replacement HDD on which a clean install of XP was done. No event 11 or STOP errors appeared on this installation, at which point he accepted that the original disk was indeed damaged in some subtle way. It will be replaced in a few days. Interestingly, a couple of days ago the BIOS failed, and it turns out that the mother board also needs to be replaced! A swollen capacitor was found on the mother board. This too will be replaced. I have been a bit unlucky with this machine. Raminder Singh On Wednesday, April 8, 2009 at 12:25 am, raminder singh wrote: >Final report: > >The Lenovo system toolbox had required me to download and install .NET Framework >2.0. Doing so cleared all System Restore points, it appears. I was able to use the >toolbox (as I reported) but found later that the computer froze (with a STOP error) > when it tried to run a screen saver. Guessing that .NET was responsible, I uninstalled >it and installed Framework 2.0 sp1 instead. No problems with the version sp1 so far. >Anyway, the System Restore entries, which you had suggested clearing, have got thoroughly >cleared! > >I tried the screen experiments you advised. No error appeared. > >Today I obtained and replaced the SATA cable. Unfortunately, occasional Event 11 >errors continue to turn up. > >So far there are two observations that have a bearing on the appearance of these >errors. On one occasion I noticed that HDD light activity ceased quickly after the >welcome screen came up. And when I clicked on the user icon, the light again quietened >down quickly after the desktop and its icons appeared. I started a program immediately. >Event viewer showed no error. So I switched users and again found that the HDD light >went off quickly. And I used a program on this profile also. Again no errors showed. >However, usually the HDD light continues to show activity, and if one clicks on a >user icon without waiting for the light to go still, one or more errors show up. >Also, no matter how long I wait, one error does show up when the first user profile >icon is clicked, except on the rare occasions like the one described earlier in this >paragraph. However no further errors appear, no matter how the session of use, unless >I switch users (which I seldom do). > >Finally, the computer is working as well as it ever did. It occurs to me that these >errors may always have been present in this machine! I never used to look at the >activity of the HDD light, or at the Event viewer logs (except Winlogon after a chkdsk). >I started looking at the System log only after the UPS crashed, a user profile got >corrupted and I started getting STOP errors. Unless I run into more trouble of some >kind, I will pretend that the machine, at this point, is as good as new! > >Thank you for your help. > >Raminder Singh > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Monday, May 11, 2009 at 7:24 am Posted by MartinM (7551 messages posted) Thanks for posting the answer - makes perfect sense :-) Event Log is always a good source of information. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Monday, May 11, 2009 at 6:00 pm Posted by normanw (1284 messages posted) Than you for the feedback. I could well be of help toother posters in future. On Monday, May 11, 2009 at 2:52 am, raminder singh wrote: >As stated in my final report, I had decided to live with the Event 11 disk errors >I was getting in the Event viewer. But their number slowly increased and I also started >getting STOP errors, regularly. At that point I invoked the warranty and called the >IBM service engineer. > >The service engineer was initially not convinced that Event 11 disk errors meant >a damaged hard disk. He wanted to clean install XP with a genuine CD first. I let >him do this since I had images of the whole drive stored in an external drive. Event >11 errors appeared in the fresh installation right away, but he wanted me also to >check for STOP errors. These also appeared the next day! I was then provided with >a temporary replacement HDD on which a clean install of XP was done. No event 11 >or STOP errors appeared on this installation, at which point he accepted that the >original disk was indeed damaged in some subtle way. It will be replaced in a few >days. > >Interestingly, a couple of days ago the BIOS failed, and it turns out that the mother >board also needs to be replaced! A swollen capacitor was found on the mother board. >This too will be replaced. > >I have been a bit unlucky with this machine. > >Raminder Singh > > > > [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Wednesday, May 13, 2009 at 8:57 pm Posted by Jacob6601 (2174 messages posted) Be thankful that there was a visual indication of a bad board. I suspect your new drive would have been damaged sooner or later otherwise. Two things: Search (inet) for hardware failures using the Lenovo model number or mother board number. If that problem is widespread (design flaw) you may only get another year of service out of that pc. However, I imagine IBM would be aware of such a flaw by now and give you a revised or comparable (but different) board. Continue looking at the event log as well as doing a visual inspection of the board every 60 days or so. Event Viewer Shortcut (bottom of page) = http://www.pctoday.com/... [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Thursday, May 14, 2009 at 9:16 pm Posted by raminder singh (92 messages posted) Thank you for your suggestions. I will keep them in mind. As I reported some weeks ago, I downloaded the "Lenovo system toolbox" after my problems began and tested everything, including the mother board. All components passed all the tests. Clearly, software cannot spot some kinds of hardware damage. Twenty four hours ago the motherboard was changed. I noticed that some of the capacitors looked quite different from those on the old board. The hard disk was not replaced (80 GB disk not in stock perhaps?), so I continued with my "damaged" hard disk. Imagine my surprise to find no disk errors or any other errors showing up in the Event viewer system log!! I performed, repeatedly, all the operations which invariably resulted in errors with the old board, but no error has showed up in the past 24 hours. I first ran with the fresh install of XP already on the disk, and later after restoring the stored images of all my partitions, including the C: drive. (DriveImage worked really well and reliably). While pleased about having a healthy system, several questions puzzle me. I would be grateful for some expert comments about them, if someone can spare the time. In view of the systematic investigation done by the IBM engineer on his visit a few days ago, which I reported, and which seemed, decisively, to have identified a damaged hard disk, is it possible to choose between the following alternatives? 1. That the UPS crash late in March probably did not hurt either the hard disk or the board. Certainly it did not cause the board capacitor to swell. A user profile did get corrupted, which resulted in STOP errors and, in turn, caused me to start looking at Event viewer logs (which I never did earlier). The board was probably already dying anyway, even before the UPS crash, and disk errors were probably showing up in the system log, but I never looked. Finally, total board failure (error message, no boot) pinpointed the faulty component. Its replacement has cleared all the problems. 2. That the UPS crash did some small damage to the SATA controller on the board (the swollen capacitor was a mere red herring), or to the disk controller on the HDD, or both. Replacing *either* of these with a fully healthy unit eliminated all errors. This would mean that I am living with a somewhat damaged hard disk. 3. That Western Digital hard disks are more sensitive to board defects than the Hitachi disk given to me as a temporary replacement? This does seem a bit far out; is it possible at all? raminder singh On Wednesday, May 13, 2009 at 8:57 pm, Jacob6601 wrote: >Be thankful that there was a visual indication of a bad board. I suspect your new >drive would have been damaged sooner or later otherwise. > >Two things: > >Search (inet) for hardware failures using the Lenovo model number or mother board >number. If that problem is widespread (design flaw) you may only get another year >of service out of that pc. However, I imagine IBM would be aware of such a flaw by >now and give you a revised or comparable (but different) board. > >Continue looking at the event log as well as doing a visual inspection of the board >every 60 days or so. >Event Viewer Shortcut (bottom of page) = http://www.pctoday.com/... [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, May 15, 2009 at 6:06 am Posted by Jacob6601 (2174 messages posted) The different capacitors are a result of the board revision I spoke of. The original components did not match up with other components reliably. More likely, the vendor supplied unreliable components. On boards where the component tolerances vary too much, you get slight damage, then more damage ... then failure. Unless you have a VERY cheap UPS, it did no damage (except, of course, the system corruption); Most are designed to kill themselves before overpowering (spiking) your pc. The brownout may have caused a spike through the phone/cable/ethernet, but you usually "see smoke" in that situation. The disk controller on the HDD may have been slightly damaged or it may be more sensitive. We will probably never know for sure. But I think it is okay. If you do not get an RMA with the new disc, keep that one for data. [Reply or follow-up to this message] re: Erunt and DriveImage backups suddenly taking 10 times longer! Friday, May 15, 2009 at 9:26 am Posted by raminder singh (92 messages posted) Thank you. The UPS is a locally made one of unknown quality. But I saw no smoke and it has functioned well since the crash, including coping with a few power failures. I will not be getting a replacement hard disk since I told them that my system was working fine with the old disk. Fortunately, enough months of the warranty remain to protect me if the disk does fail eventually. On Friday, May 15, 2009 at 6:06 am, Jacob6601 wrote: >The different capacitors are a result of the board revision I spoke of. The original >components did not match up with other components reliably. More likely, the vendor >supplied unreliable components. On boards where the component tolerances vary too >much, you get slight damage, then more damage ... then failure. > >Unless you have a VERY cheap UPS, it did no damage (except, of course, the system >corruption); Most are designed to kill themselves before overpowering (spiking) your >pc. The brownout may have caused a spike through the phone/cable/ethernet, but you >usually "see smoke" in that situation. > >The disk controller on the HDD may have been slightly damaged or it may be more sensitive. >We will probably never know for sure. But I think it is okay. If you do not get an >RMA with the new disc, keep that one for data. [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows XP Discussion Forum