locked
System Clock Inexplicably Loses 8-12 Hours on Windows 7 x64 RRS feed

  • Question

  • Over the last few days, I've noticed some unusual behavior with one of my computers.  It came to light with failing backups on my Windows Home Server, when the offending computer would lose its network connection.  The connection loss was due to the system clock getting skewed, resulting in a loss of IP address.

    When I started reviewing the System event log, I noticed a bunch of event ID 1, posted by Kernel-General, indicating the clock was getting reset to a point about 8-12 hours earlier than the actual time.  In every case, it was always an exact number of hours, although the number of seconds or milliseconds varied.

    My time zone is set to Eastern Time (US & Canada) GMT-5.  The computer is an HP desktop, Intel Core2 Quad Q9650 3.0 GHz, 8 GB RAM.

    Here are some postings from the System event log, with those at the top being more recent (all event ID 1, source Kernel-General, type Information):

    The system time has changed to ‎2010‎-‎01‎-‎07T06:01:05.500000000Z from ‎2010‎-‎01‎-‎07T18:01:05.500908300Z.  (12 hour change)
    The system time has changed to ‎2010‎-‎01‎-‎05T17:51:44.500000000Z from ‎2010‎-‎01‎-‎06T01:51:44.316744100Z.  (8 hour change)
    The system time has changed to ‎2010‎-‎01‎-‎04T17:51:45.500000000Z from ‎2010‎-‎01‎-‎05T01:51:44.273824100Z.  (8 hour change)

    Troubleshooting Steps Taken:

    1.  Verified all Critical and Important updates were applied via Windows Update.
    2.  Ran a Full System Scan using Norton Internet Security 2010, after verifying signature files were current.  No malware or viruses detected.  Only "threats" found were tracking cookies, which NIS deleted.  The problem occurred again after those cookies were deleted.
    3.  Checked CMOS battery; battery is 6 months old.  Battery is okay.
    4.  This computer backs up nightly to Windows Home Server, which is running the trial McAfee software; this has not reported any malware or viruses.
    5.  This problem showed up in the last week.  I have not installed any software on this computer except for the Windows Home Server software.  However, my laptop and my wife's laptop are both also running Windows 7 x64, with the Windows Home Server components, and they are NOT exhibiting this odd behavior.
    6.  The computer is set to sync with time-a.nist.gov; I'd manually force a sync each time I noticed the unusual clock skew.  Whenever this sync occurs, whether manual or automatic, an event appears in the log indicating a sync occurred with that server.  When these unusual clock skews occur, there is no corresponding sync message.
    7.  Checked Task Scheduler for tasks that run, or may run, at or near the times when the clock skew occurs.  Nothing unusual.
    8.  Checked Application, System and Security event logs for clues.  Nothing looks out of the ordinary.

    Does anyone have any insight into what may be causing the system clock to reset itself without warning to a time exactly 8 or 12 hours earlier?  In every case I've found, it's always a very exact amount, either 8 or 12 hours, with a variance of only seconds or milliseconds, but never minutes.

    Best regards,
    Matt

    Friday, January 8, 2010 4:06 AM

Answers

  • Hi Matt,

    The troubleshooting steps you’ve listed were very clear. I’ve noticed the following key points from your description:

    1. There are two laptops in the same network with Windows Home Server components, but they do not have this type of issue.

    - Do you setup time sync up on those laptops? If so, do you use the same time server? I agree with you that time-a.nist.gov is a good time server, but here’s a list of a couple of time servers that you can try instead. Do you have the same issue with another time server?
    pool.ntp.org  NTP Pool Address
    time-a.nist.gov  NIST, Gaithersburg, Maryland
    time-b.nist.gov  NIST, Gaithersburg, Maryland
    time-a.timefreq.bldrdoc.gov  NIST, Boulder, Colorado
    time-b.timefreq.bldrdoc.gov  NIST, Boulder, Colorado

    - If the issue persists, I think you can try to change this computer to update/sync up more often.

    Open regedit.exe through the start menu search box, and then find this registry key:

        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\NtpClient

    Double-click on the key on the right-hand side for SpecialPollInterval

    The default time period is 7 days calculated in seconds. I think 12 hour (the value is 43200 = 60 seconds * 60 minutes * 12 hours) is worth a try, but I wouldn’t recommend setting this to anything less than 4 hours worth, or your computer might get banned by the time servers.

    2. There is no corresponding sync message in event log if this unusual clock skews occur.

    - The sync up may blocked by your Firewall Settings, third party firewalls will often block the time servers, causing the sync to not work properly. If you are using McAfee or another firewall, you’ll need to use the configuration utility to unlock NPT access on UDP port 123.

    3. This problem showed up in the last week, and the only program you’ve installed is Windows Home Server program.

    - If all suggestions above did not work, I think you can consider use Windows system restore to return the system back before install Home Server components, reinstall the components as a test.

    What do you think of it? Any progress?

    • Marked as answer by Arthur Xie Monday, January 18, 2010 9:51 AM
    Monday, January 11, 2010 7:07 AM
  • Hi Matt,

    The issue may be caused by the time server. I suggest you change the server to time.windows.com or other servers and check the result.

    If the issue persists, let’s disable all startup items and third party services when booting. This method will help us determine if this issue is caused by a loading program or service. Please perform the following steps:

    1. Click the Start Button type "msconfig" (without quotation marks) in the Start Search box, and then press Enter.

    Note: If prompted, please click Continue on the User Account Control (UAC) window.
     
    2. Click the "Services" tab, check the "Hide All Microsoft Services" box and click "Disable All" (if it is not gray).
    3. Click the "Startup" tab, click "Disable All" and click "OK".

    Then, restart the computer. When the "System Configuration Utility" window appears, please check the "Don't show this message or launch the System Configuration Utility when Windows starts" box and click OK.

    Please test this issue in the Clean Boot environment, if the issue disappears in the Clean Boot environment, we can use a 50/50 approach to quickly narrow down which entry is causing the issue.


    Arthur Xie - MSFT
    • Marked as answer by Arthur Xie Monday, January 18, 2010 9:51 AM
    Monday, January 11, 2010 7:17 AM
  • Thanks for the info about your network instruction. Here are my thoughts:
    1. Since there might still be consecutive sync failures with time.windows.com, I suggest change it to another public time server.
    2. How often did the issue appears?
    3. I agree with you thought between loss network connectivity and the rollback time. Since the network connection issue was caused by the time lost, you should focus on fix this issue first.

    Pls keep us noticed if the issue re-occurs, and the further result if you restored the system.

    • Marked as answer by Arthur Xie Monday, January 18, 2010 9:51 AM
    Tuesday, January 12, 2010 6:18 AM

All replies

  • Hi Matt,

    The troubleshooting steps you’ve listed were very clear. I’ve noticed the following key points from your description:

    1. There are two laptops in the same network with Windows Home Server components, but they do not have this type of issue.

    - Do you setup time sync up on those laptops? If so, do you use the same time server? I agree with you that time-a.nist.gov is a good time server, but here’s a list of a couple of time servers that you can try instead. Do you have the same issue with another time server?
    pool.ntp.org  NTP Pool Address
    time-a.nist.gov  NIST, Gaithersburg, Maryland
    time-b.nist.gov  NIST, Gaithersburg, Maryland
    time-a.timefreq.bldrdoc.gov  NIST, Boulder, Colorado
    time-b.timefreq.bldrdoc.gov  NIST, Boulder, Colorado

    - If the issue persists, I think you can try to change this computer to update/sync up more often.

    Open regedit.exe through the start menu search box, and then find this registry key:

        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\NtpClient

    Double-click on the key on the right-hand side for SpecialPollInterval

    The default time period is 7 days calculated in seconds. I think 12 hour (the value is 43200 = 60 seconds * 60 minutes * 12 hours) is worth a try, but I wouldn’t recommend setting this to anything less than 4 hours worth, or your computer might get banned by the time servers.

    2. There is no corresponding sync message in event log if this unusual clock skews occur.

    - The sync up may blocked by your Firewall Settings, third party firewalls will often block the time servers, causing the sync to not work properly. If you are using McAfee or another firewall, you’ll need to use the configuration utility to unlock NPT access on UDP port 123.

    3. This problem showed up in the last week, and the only program you’ve installed is Windows Home Server program.

    - If all suggestions above did not work, I think you can consider use Windows system restore to return the system back before install Home Server components, reinstall the components as a test.

    What do you think of it? Any progress?

    • Marked as answer by Arthur Xie Monday, January 18, 2010 9:51 AM
    Monday, January 11, 2010 7:07 AM
  • Hi Matt,

    The issue may be caused by the time server. I suggest you change the server to time.windows.com or other servers and check the result.

    If the issue persists, let’s disable all startup items and third party services when booting. This method will help us determine if this issue is caused by a loading program or service. Please perform the following steps:

    1. Click the Start Button type "msconfig" (without quotation marks) in the Start Search box, and then press Enter.

    Note: If prompted, please click Continue on the User Account Control (UAC) window.
     
    2. Click the "Services" tab, check the "Hide All Microsoft Services" box and click "Disable All" (if it is not gray).
    3. Click the "Startup" tab, click "Disable All" and click "OK".

    Then, restart the computer. When the "System Configuration Utility" window appears, please check the "Don't show this message or launch the System Configuration Utility when Windows starts" box and click OK.

    Please test this issue in the Clean Boot environment, if the issue disappears in the Clean Boot environment, we can use a 50/50 approach to quickly narrow down which entry is causing the issue.


    Arthur Xie - MSFT
    • Marked as answer by Arthur Xie Monday, January 18, 2010 9:51 AM
    Monday, January 11, 2010 7:17 AM
  • Hi Gordon and Arthur,

    Thank you for the replies and additional troubleshooting steps.  I'll go through Gordon's steps first, and then Arthur's, with details of what was found, actions taken, etc.  First, I wanted to give some additional background on the networking setup.  I thought perhaps that could be the guilty party, but I've been running this setup for months without fuss or trouble so I doubt it's the cause.  Anyhow, here it is:

    Network Setup

    Primary Network - Direct Internet connection via AT&T U-verse (router is a 2WIRE "residential gateway")
    IP Address Space:  192.168.1.1 - 192.168.1.255
    Subnet:  255.255.255.0
    Current IP (DHCP):  192.168.1.82
    Default Gateway:  192.168.1.254

    Secondary Network - Linksys wireless router connects to Internet via DHCP on Primary network; the Linksys is a client of the 2WIRE residential gateway
    IP Address Space:  192.168.2.1 - 192.168.2.255
    Subnet:  255.255.255.0
    Current IP (DHCP):  192.168.2.106
    Default Gateway:  192.168.2.1

    2WIRE Router Static IP:  192.168.1.254
    Linksys Router Static IP (that clients on Secondary network see):  192.168.2.1

    The purpose of the Secondary network is because I have another desktop that runs Hyper-V, and the desktop giving me trouble is configured as a dual-boot machine with Windows Server 2008 R2 (MSDN) that I use for Hyper-V testing.  Microsoft best practices recommend having 2 network connections when using Hyper-V, hence the secondary network, which I use exclusively for Hyper-V.

    Gordon's Items:

    1. Two laptops on same network with WHS components (specifically they're from WHS with Power Pack 3 with HP MediaSmart Software version 3.0, Update 1).  The affected desktop is running the same.

    - Desktop was already set to time-a.nist.gov when I first noticed the problem. I changed it to that in the past when I had a few consecutive sync failures with time.windows.com. I changed this back to time.windows.com, but the problem remained.

    - Checked registry key; it was set to 604800 (7 days). I changed it to 43200 and will see what happens.

    2. No corresponding sync message when clock skew occurs.

    - I have Norton Internet Security 2010, but it doesn't block the sync.  There are plenty of successful syncs in the logs, both automatic and manually-initiated, so it's definitely not blocking.

    - I would think that if a sync failure occurred, the clock would simply not get updated. I've never seen a clock sync failure cause a system clock to "jump" 8-12 hours into the past. I would think that if sync succeeds, the clock updates; if the sync fails, the clock does nothing.

    - I guess what really bothers me is that the clock isn't "drifting" or losing random chunks of time.  When it "jumps" back into the past, it's always an exact number of hours. When I manually resync it, I've found that the minute doesn't get changed, just the hour.  So something is causing it to jump back into the past a very exact number of hours.

    - Additional Observation:  This problem can cause me to lose network connectivity.  My guess is because the DHCP leases expire.  If the clock "jumps" back into the past X number of hours, the leases will expire on the router side, but the computer will think it still has plenty of time.  I must manually perform ipconfig /release and ipconfig /renew to restore connectivity before I can manually resync the clock.

    3. Problem showed up in last week.  I'll wait and see if these steps resolve the issue.  Otherwise I'll definitely give the system restore a try.


    Arthur's Steps:

    I didn't want to start disabling services right away.  Rather, I decided to list what's running, like processes or what services msconfig shows.  Perhaps one of you may see a process that doesn't belong.  It's always possible there is malware running that's too new and/or too unknown that A/V signatures don't recognize it yet, although my guess is that this is exceedingly unlikely.

    Here's the process list, which I retrieved from PowerShell.  I ran Get-Process | Export-Csv, which reports a TON of data.  I removed most of the columns, which I thought were unnecessary.  Here is the list I thought was mot important.  Please note that I abbreviated the name "Program Files" to "PF" to make things fit better.  I thought it may be beneficial for you to see where each process executable resides, just in case one of them is residing in an unusual spot (i.e. malware):

    Name						Company				FileVersion						ProductVersion	Description							Product						Path
    ac.sharedstore					ActivIdentity			"8,2,0,13"						"8,2"		ActivIdentity Cache Server						Common - Authentication Clients			C:\PF\Common Files\ActivIdentity\ac.sharedstore.exe
    accrdsub						ActivIdentity			"6,2,1,52"						"6,2,1"		ActivIdentity card event handler					ActivClient					C:\PF\ActivIdentity\ActivClient\accrdsub.exe
    acevents						ActivIdentity			"4,4,0,25"						"4,4"		ActivIdentity Event Service						ActivClient Services				C:\PF\ActivIdentity\ActivClient\acevents.exe
    acevents						ActivIdentity			"4,4,0,25"						"4,4"		ActivIdentity Event Service						ActivClient Services				C:\PF\ActivIdentity\ActivClient\acevents.exe
    acsagent						ActivIdentity			"6,2,1,36"						"6,2,1"		ActivClient Agent							ActivClient					C:\PF\ActivIdentity\ActivClient\acsagent.exe
    AppleMobileDeviceService				Apple Inc.			2.50.39.0							2.50.39.0		Apple Mobile Device Service						Apple Mobile Device Service				C:\PF (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    audiodg							
    brs						cyberlink				"1, 0, 0, 1"						"1, 0, 0, 1"	brs								cyberlink brs					C:\PF (x86)\CyberLink\Shared Files\brs.exe
    ccSvcHst						Symantec Corporation		109.0.1.6							109.0.1.6		Symantec Service Framework						Symantec Security Technologies			C:\PF (x86)\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
    ccSvcHst						Symantec Corporation		109.0.1.6							109.0.1.6		Symantec Service Framework						Symantec Security Technologies			C:\PF (x86)\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
    CinemaNowSvc					"CinemaNow, Inc."			"1, 9, 0, 2"						"1, 9, 0, 2"	CinemaNow Service Application					CinemaNow Service Application			C:\PF (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
    conhost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Console Window Host						Microsoft? Windows? Operating System			C:\Windows\system32\conhost.exe
    CPMonitor										"1,0,0,1"							"1,0,0,1"		CPMonitor Application						CPMonitor Application				C:\PF (x86)\Roxio 2010\5.0\CPMonitor.exe
    csrss						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Client Server Runtime Process					Microsoft? Windows? Operating System			C:\Windows\system32\csrss.exe
    csrss						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Client Server Runtime Process					Microsoft? Windows? Operating System			C:\Windows\system32\csrss.exe
    DkService						Diskeeper Corporation		13.0.844.0						13.0.844.0	Diskeeper Service							Diskeeper (TM) Disk Defragmenter			C:\PF\Diskeeper Corporation\Diskeeper\DkService.exe
    dwm						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Desktop Window Manager						Microsoft? Windows? Operating System			C:\Windows\system32\Dwm.exe
    ehmsas						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Media Center Media Status Aggregator Service				Microsoft? Windows? Operating System			C:\Windows\ehome\ehmsas.exe
    esClient						Microsoft Corporation		6.0.2423.0 (whs_pp3.091007-1235)				6.0.2423.0	Windows Media Center Client Service					Microsoft? Windows? Operating System			C:\PF\Windows Home Server\esClient.exe
    explorer						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows Explorer							Microsoft? Windows? Operating System			C:\Windows\Explorer.EXE
    felix						Dojo North Software		"3, 0, 0, 0"						"3, 0, 0, 0"	Enhanced Felix							Enhanced Felix					C:\PF\ScreenMates\felix.exe
    HDSentinel					H.D.S. Hungary			3.0.0.0							3		Hard Disk Sentinel Engine						Hard Disk Sentinel					C:\PF (x86)\Hard Disk Sentinel\HDSentinel.exe
    hpwuSchd2						Hewlett-Packard			"80, 1, 0, 0"						"80, 1, 0, 0"	hpwuSchd Application	 					hpwuSchd Application				C:\PF (x86)\Hp\HP Software Update\hpwuSchd2.exe
    IBurn						CyberLink Corporation	.	5.0.3004  						5.0.3004  	InstantBurn UDF Tool						InstantBurn					C:\PF (x86)\CyberLink\InstantBurn\Win2K\IBurn.exe
    Idle						
    ielowutil						Microsoft Corporation		8.00.7600.16385 (win7_rtm.090713-1255)			8.00.7600.16385	Internet Low-Mic Utility Tool					Windows? Internet Explorer				C:\PF (x86)\Internet Explorer\IELowutil.exe
    iPodService					Apple Inc.			9.0.2.25							9.0.2.25		iPodService Module (64-bit)						iTunes						C:\PF\iPod\bin\iPodService.exe
    iTunesHelper					Apple Inc.			9.0.2.25							9.0.2.25		iTunesHelper							iTunes						C:\PF (x86)\iTunes\iTunesHelper.exe
    LightScribeControlPanel				Hewlett-Packard Company		1.18.9.1									LightScribe													C:\PF (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
    lsass						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Local Security Authority Process					Microsoft? Windows? Operating System			C:\Windows\system32\lsass.exe
    lsm						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Local Session Manager Service					Microsoft? Windows? Operating System			C:\Windows\system32\lsm.exe
    LSSrvc						Hewlett-Packard Company		1.18.9.1									LightScribe Service						LightScribe					C:\PF (x86)\Common Files\LightScribe\LSSrvc.exe
    MagicDisc						"MagicISO, Inc."			2.7.0.106							2.7.0.106		MagicISO Virtual CD/DVD Manager					MagicDisc						C:\PF (x86)\MagicDisc\MagicDisc.exe
    mDNSResponder					Apple Inc.			"1,0,6,2"							"1,0,6,2"		Bonjour Service							Bonjour						C:\PF (x86)\Bonjour\mDNSResponder.exe
    MediaCollectorClient				Hewlett-Packard Company		3.0.13.33055						3.0.13.33055	MCClient								MCClient						C:\PF\Hewlett-Packard\HP MediaSmart Server\MediaCollectorClient.exe
    Microsoft.HomeServer.Archive.TransferService		Microsoft Corporation		6.0.2423.0						6.0.2423.0	TV Archive Transfer Service						Microsoft (R) Windows (R) Operating System		C:\PF\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe
    Moe						Microsoft Corporation		0.9.4014.7						0.9.4014.7	Mesh Operating Environment						Live Mesh						C:\Users\Matt\AppData\Local\Microsoft\Live Mesh\GacBase\Moe.exe
    MoeMonitor					Microsoft Corporation		0.9.4014.7						0.9.4014.7	MOE Monitor							Live Mesh						C:\Users\Matt\AppData\Local\Microsoft\Live Mesh\Bin\Servicing\0.9.4014.7\MoeMonitor.exe
    MSSConnectorService				HP				3.0.10.32891						3.0.10.32891	MSSConnectorService						MSSConnectorService				C:\PF\Hewlett-Packard\HP MediaSmart Server\MSSConnectorService.exe
    notepad						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Notepad								Microsoft? Windows? Operating System			C:\Windows\system32\NOTEPAD.EXE
    nvvsvc						NVIDIA Corporation			8.16.11.9107						8.16.11.9107	"NVIDIA Driver Helper Service, Version 191.07"			"NVIDIA Driver Helper Service, Version 191.07"	C:\Windows\system32\nvvsvc.exe
    nvvsvc						NVIDIA Corporation			8.16.11.9107						8.16.11.9107	"NVIDIA Driver Helper Service, Version 191.07"			"NVIDIA Driver Helper Service, Version 191.07"	C:\Windows\system32\nvvsvc.exe
    OfficeSAS						Microsoft Corporation		14.0.4514.1004						14.0.4514.1004	Microsoft Office Send-a-Smile main application			Microsoft Office Send-a-Smile			C:\PF\Microsoft Office\Office14\OfficeSAS\OfficeSAS.exe
    OfficeSASScheduler					Microsoft Corporation		14.0.4514.1004						14.0.4514.1004	Microsoft Office Send-a-Smile scheduler application			Office Send-a-Smile scheduler			C:\PF\Microsoft Office\Office14\OfficeSAS\officeSASscheduler.exe
    OSPPSVC						Microsoft Corporation		14.0.0370.400 (longhorn(wmbla).090811-1826)			14.0.0370.400	Microsoft Office Software Protection Platform Service			Microsoft? Office					C:\PF\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    PDVDServ						Cyberlink Corp.			7.00.4321							7.00.4321		PowerDVD RC Service						PowerDVD						C:\PF (x86)\CyberLink\PowerDVD\PDVDServ.exe
    powershell					Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows PowerShell							Microsoft? Windows? Operating System			C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
    Roxio Burn									1.00.93a							1. 0. 0. 0	Roxio Burn							Roxio Burn					C:\PF (x86)\Roxio 2010\Roxio Burn\Roxio Burn.exe
    Roxio Burn									1.00.93a							1. 0. 0. 0	Roxio Burn							Roxio Burn					C:\PF (x86)\Roxio 2010\Roxio Burn\Roxio Burn.exe
    RoxioBurnLauncher									1. 0. 0. 4						1. 0. 0. 4	Roxio Burn Launcher						Roxio Burn					C:\PF (x86)\Roxio 2010\Roxio Burn\RoxioBurnLauncher.exe
    RTSHookInterop					Realtime Soft Ltd			1.1.2.0							1.1.2		RTSHookInterop							RTSHookInterop					C:\PF (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
    SaibSVC										1.00.35a							"1, 0, 0, 1"	SaibSVC Application	 					SaibSVC Application				C:\PF (x86)\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
    SearchIndexer					Microsoft Corporation		7.00.7600.16385 (win7_rtm.090713-1255)			7.00.7600.16385	Microsoft Windows Search Indexer					Windows? Search					C:\Windows\system32\SearchIndexer.exe
    services						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Services and Controller app						Microsoft? Windows? Operating System			C:\Windows\system32\services.exe
    sidebar						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			1.0.7600.16385	Windows Desktop Gadgets						Microsoft? Windows? Operating System			C:\PF\Windows Sidebar\sidebar.exe
    smss						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows Session Manager						Microsoft? Windows? Operating System			C:\Windows\system32\smss.exe
    spoolsv						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Spooler SubSystem App						Microsoft? Windows? Operating System			C:\Windows\System32\spoolsv.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\System32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\System32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\system32\svchost.exe
    svchost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Services					Microsoft? Windows? Operating System			C:\Windows\System32\svchost.exe
    System						
    taskeng						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Task Scheduler Engine						Microsoft? Windows? Operating System			C:\Windows\system32\taskeng.exe
    taskhost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Host Process for Windows Tasks					Microsoft? Windows? Operating System			C:\Windows\system32\taskhost.exe
    taskmgr						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows Task Manager						Microsoft? Windows? Operating System			C:\Windows\system32\taskmgr.exe
    UltraMon						Realtime Soft Ltd			3.0.7.0							3.0.7 Beta	UltraMon								UltraMon						C:\PF\UltraMon\UltraMon.exe
    UltraMonTaskbar					Realtime Soft Ltd			3.0.7.0							3.0.7 Beta	UltraMon Taskbar							UltraMon						C:\PF\UltraMon\UltraMonTaskbar.exe
    UltraMonUiAcc					Realtime Soft Ltd			3.0.7.0							3.0.7 Beta	UltraMon UI Access							UltraMon						C:\PF\UltraMon\UltraMonUiAcc.exe
    VxBlockServer					Sonic Solutions			1.01.03a							1.01.03a		COM Server wrapper for VxBlockDLL					VxBlock COM Server					C:\PF (x86)\Common Files\PX Storage Engine\VxBlockServer.exe
    WHSConnector					Microsoft Corporation		6.0.2423.0 (whs_pp3.091007-1235)				6.0.2423.0	Windows Home Server Connector Service				Microsoft? Windows? Operating System			C:\PF\Windows Home Server\WHSConnector.exe
    WHSConsoleClient					Microsoft Corporation		6.0.2423.0 (whs_pp3.091007-1235)				6.0.2423.0	Windows Home Server Console						Microsoft? Windows? Operating System			C:\PF\Windows Home Server\WHSConsoleClient.exe
    WHSTrayApp					Microsoft Corporation		6.0.2423.0 (whs_pp3.091007-1235)				6.0.2423.0	Home Server Tray Application					Microsoft? Windows? Operating System			C:\PF\Windows Home Server\WHSTrayApp.exe
    WindowsLiveSync					Microsoft Corporation		14.0.8089.0726						14.0.8089.0726	Windows Live Sync							Windows Live Sync					C:\PF (x86)\Windows Live\Sync\WindowsLiveSync.exe
    wininit						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows Start-Up Application					Microsoft? Windows? Operating System			C:\Windows\system32\wininit.exe
    winlogon						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows Logon Application						Microsoft? Windows? Operating System			C:\Windows\system32\winlogon.exe
    wlcrasvc						Microsoft Corporation		0.9.4014.7						0.9.4014.7	Live Mesh Remote Desktop						Live Mesh						C:\PF\Live Mesh\Remote Desktop\wlcrasvc.exe
    WLIDSVC						Microsoft Corporation		6.500.3136.1						6.500.3136.1	Microsoft? Windows Live ID Service					Microsoft? Windows Live ID				C:\PF\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    WLIDSVCM						Microsoft Corporation		6.500.3136.1						6.500.3136.1	Microsoft? Windows Live ID Service Monitor				Microsoft? Windows Live ID				C:\PF\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    WmiPrvSE						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	WMI Provider Host							Microsoft? Windows? Operating System			C:\Windows\system32\wbem\wmiprvse.exe
    wmpnetwk						Microsoft Corporation		12.0.7600.16385 (win7_rtm.090713-1255)			12.0.7600.16385	Windows Media Player Network Sharing Service				Microsoft? Windows? Operating System			C:\PF\Windows Media Player\wmpnetwk.exe
    WUDFHost						Microsoft Corporation		6.1.7600.16385 (win7_rtm.090713-1255)			6.1.7600.16385	Windows Driver Foundation - User-mode Driver Framework Host Process	Microsoft? Windows? Operating System			C:\Windows\system32\WUDFHost.exe
    YahooMessenger					Yahoo! Inc.			"10,0,0,1102"						"10,0,0,1102"	Yahoo! Messenger							Yahoo! Messenger					C:\PF (x86)\Yahoo!\Messenger\YahooMessenger.exe
    ZuneLauncher					Microsoft Corporation		4.0.740.0 (ZUNE_DORADO_V4.0_RTM(pegblder).090902-0010)		4.0.740.0		Zune Auto-Launcher							Zune?						C:\PF\Zune\ZuneLauncher.exe
    
    Best regards,
    Matt
    Monday, January 11, 2010 5:21 PM
  • Thanks for the info about your network instruction. Here are my thoughts:
    1. Since there might still be consecutive sync failures with time.windows.com, I suggest change it to another public time server.
    2. How often did the issue appears?
    3. I agree with you thought between loss network connectivity and the rollback time. Since the network connection issue was caused by the time lost, you should focus on fix this issue first.

    Pls keep us noticed if the issue re-occurs, and the further result if you restored the system.

    • Marked as answer by Arthur Xie Monday, January 18, 2010 9:51 AM
    Tuesday, January 12, 2010 6:18 AM