locked
W7 Pro many Search/Gatherer warnings cause HP to freeze up RRS feed

  • Question

  • Below decsriibes exactly the prblem I am having. The thread says "solved" but the only solution suggested was to try safe mode.

     

    I have the same problem on my Dell Optiplex 380. I lock my computer when I'm AFK. Randomly, after a period of inactivity, I will move the mouse or hit a key to wake the display, and am prompted to press ctrl+alt+del to login. However, when I press ctrl+alt+del, the actual login prompt never shows, and instead only shows the Win7 background. If I let the computer alone after that, the ctrl+alt+del prompt might appear again. Instead of hitting ctrl+alt+del, if I click "switch user," the display is then disabled and goes to power-saving mode, while the computer is seemingly still in the same state. I thought it was a hardware issue, but am now convinced this is a Windows 7 issue. Here's why:

    -Dell has replaced the motherboard and memory, thinking it is a hardware problem.

    -Each time the computer freezes up, which is usually after the computer is idle for some time, I have to forcibly restart the machine.

    -The event logs always show the eventID posted above (10023) before the lock-up. (The protocol host process 4892 did not respond and is being forcibly terminated {filter host process 5344}.)

    -I have rebuilt the search index to no avail.

    -I have disabled the windows search service to no avail.

    Wednesday, September 21, 2011 10:39 AM

Answers

  • OK, after COMPLETELY disabling Defender, I no longer see any Search/Gatherer warnings, and no more lockups. I am going to re-enable my ctrl-alt-del functionality, and then maybe slowly re-enable Defender, altough if I have Trend-Micro protecting my PC (client on network) do I need Defender? I am convinced that an update to Defender on 9/10 was behind these S/G errors, and again- am surprised other W7 Pro users have not seen the same.

     

    I consider this thread "answered", but unsure of protocol.

    • Marked as answer by Sumesh P Friday, October 7, 2011 8:35 AM
    Wednesday, October 5, 2011 10:27 AM

All replies

  • Click Start\Control Panel\Hardware and Sound\Power Options\Select a power plan and at the top left is an option in blue to require a password on wakeup.

    That's a sleep wake-up password controlled by the power plan.

    Select that and disable it. It may be interfering with the windows + L lock out and causing the problem.

     

    I am not sure if you can access group policy edit but try this:

    Click Start=>type gpedit.msc and select it from the programs results

    Under Local Computer Policy, Computer Configuration, expand Windows Settings, expand Local Policies, select Security Options.

    Now scan down the list and find Interactive Logon: Do not require CTRL + ALT + DELETE policy and double click it, select the disabled button and select ok.

    Close out of gpedit and test.

     

    Wednesday, September 21, 2011 1:20 PM
  • I dont think it is related to power settings as I set hibrenate to "Never", but have enable "Do not require CTRL + ALT + DELETE policy..." and will try that and see if the same thing occurs. However, if it does, what does that reveal about the issue? Do you think all the warnings I and others receive about Search/Gatherer errors is unrelated?
    Wednesday, September 21, 2011 5:24 PM
  • The search\gatherer issue is related to office, outlook and sharepaoint from what I have seen in forums. No one really posted a solution, so I figured it was a a bad installation or file corruption problem.

    So, I focused upon the logon issue first. Dell may have configured something differently in their version of the OS.

    Insert the office installation disk and try a repair install. Or remove office and reinstall it.

     


    • Edited by Nano Warp Wednesday, September 21, 2011 6:14 PM
    Wednesday, September 21, 2011 6:13 PM
  • I dont think it is related to power settings as I set hibrenate to "Never",

    Did you click on the option and confirm that it is off, or did you assume?
    Wednesday, September 21, 2011 6:22 PM
  • Thank you Nana Warp, Well, anyway I disable requirement for CTRL+ALT+DEL and came in this morning to find desktop normal, and icons active, but the first thing i double clicked just started the curson spinning and the application never came up, nor would Event viewer. I was forced to do a cold boot again. Logs showed the same series of search gatherer warnings that preceded my forced shutdown. Looking back I see the first forced shutdown was 9/10/2011, and that prior to that there were very few (but not none) search gatherer warnings. The computer warked fine before that for 11 months- never an issue.  That I can think of, no new hardware or siftware was installed in that period. Do you still feel this is an issue related to Office?
    Thursday, September 22, 2011 12:17 PM
  • No, I don't think it specifically related to office. Searching the error produced problems from 07-'09 related to office and sharepoint. Nothing new on the error.

    For example, indexing mailboxes http://www.eventid.net/display.asp?eventid=10023&eventno=10810&source=Microsoft-Windows-Search&phase=1

    Since the group policy didn't fix it, you may want to return it to the default.

    Thursday, September 22, 2011 7:46 PM
  • OK, so the first that that i need to know is if it happens in the safe mode or safe mode with networking?

    This is important because many such issues are caused by 3rd party software that doesnt load in safe mode, hence it helps us to quickly narrow things down.

    Do report back the results.

     


    Sumesh P - Microsoft Online Community Support
    Friday, September 23, 2011 10:09 AM
  • I solved the problem by identifying the date (September 10th) as the start of the most frequent search/Gatherer warnings and linked it to a "Defender" upgrade. I uninstalled the upgrade and Viola! no more warnings, no more lockups. I am quite surprised that no one else has had the same issue and same resolution.
    • Marked as answer by FisherDave Saturday, September 24, 2011 1:28 PM
    • Unmarked as answer by Sumesh P Tuesday, October 4, 2011 4:35 PM
    Saturday, September 24, 2011 1:28 PM
  • I have to update this, as I had problem locking up again. Looked at error logs, same multiple Search/Gatherer warnings preceding lockup. Checked Defender- it had enabled itself again! No question this is causeing the out of control searching, but is the solution really to disable or uninstall Defender? Is there a Windows tech out there who is familiar with this issue, stemming from Sept 10 Defender update? I can't be the only one...
    Thursday, September 29, 2011 11:52 AM
  • Windows defender is automatically turned off if you have another antivirus software.

    Is the Windows Defender Service in disabled state? how did you disable it earlier?

    Have you confirmed that turning off defender resolves the issue every time?

    Does the error occur in safe mode or in a clean boot state?

    Try excluding your PST files from Defender and AV and see if the problem continues.

    I have seen only one other report of this problem so far.

     


    Sumesh P - Microsoft Online Community Support
    • Edited by Sumesh P Thursday, September 29, 2011 12:08 PM add
    Thursday, September 29, 2011 12:06 PM
  • We do have Trend Micro on all our client PC's; but Defender does seem to be working. I had disabled recommended settings and set do not scan programs. seemed to work for a dazy or two but when I tried to connect remotely this weekend, could not do so. Coming in this morning was only able to get to startup screen before PC froze. Rebooted and found long string of search/gatherer warnings that began on friday. Safe mode does not seem practical as it appears to be a cumulative problem and does not cause lockup until Search/Gatherer warnings reach a critical mass. I have now disabled Defender completely and will try that even though if what you say is correct it should have nothing to do with this problem. Very frustrating to know the problem but not have to cause. Of course I could disable Search (what our local IT guy suggested) but I use it a a lot.
    Monday, October 3, 2011 11:33 AM
  • You can also check if there are any 3rd party DLLs loading inside the searchprotocolhost that might be causing it to crash.

    You can use process explorer for this.

     


    Sumesh P - Microsoft Online Community Support
    Tuesday, October 4, 2011 4:38 PM
  • OK, after COMPLETELY disabling Defender, I no longer see any Search/Gatherer warnings, and no more lockups. I am going to re-enable my ctrl-alt-del functionality, and then maybe slowly re-enable Defender, altough if I have Trend-Micro protecting my PC (client on network) do I need Defender? I am convinced that an update to Defender on 9/10 was behind these S/G errors, and again- am surprised other W7 Pro users have not seen the same.

     

    I consider this thread "answered", but unsure of protocol.

    • Marked as answer by Sumesh P Friday, October 7, 2011 8:35 AM
    Wednesday, October 5, 2011 10:27 AM
  • Defender is supposed to be disabled when you install and AV, not sure why it is different in your case.

    During a web search i came across some similar issue where defender is not correctly disabled. Please try removing Trend and reinstalling.

     


    Sumesh P - Microsoft Online Community Support
    Friday, October 7, 2011 8:40 AM
  • Nope. No S/G warnings for about 40 hours, then suddenly a string of about 6 spaced 3 minutes then a new S/G (this time Error not Warning) "Unable to initialize the filter host process. Terminating."   I checked and Defender is still disabled.  I will try removing and reinstalling Trend but as it has worked fine for 12-16 months and the only chan ge I have seen are Defender Mods and updates. We'll see
    Friday, October 7, 2011 9:44 AM
  • Problem continues- extremely frustrating. Disabling Defender did not fix problem. Reinstalling Trend did not fix problem. It seems to be about 36 hours before the search/gather warning start, then they repeat every 1-2 minutes. The only option now is to disable Search, which I use quite often. I am disappointed that no MS tech can come up with an answer.  Also, I had set up Events to send me an email when the messages occur, and I did not get any.
    Thursday, October 13, 2011 10:23 AM
  • I have started to see this problem on my box. This is a windows 10 pro box, upgraded from a windows 8.1 updated install. It started when Office 365 wanted to upgrade. I would RD into the box and it would lockup after a few minutes. I had to force it to power cycle to make it recover.

    The search/gather errors are abundant. I've seen Cortana DLL load errors.

    I did the tasklist discovery of loaded DLLs in the search process: https://ghostbin.com/paste/xoko8

    That's from this command:

    tasklist /m /FI "imagename eq search*"

    Event viewer has this warning every 8 minutes:

    The protocol host process xxxxx did not respond and is being forcibly terminated {filter host process 0}.

    Just before those warnings started I saw this error:

    Failed to create restore point (Process = C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.168_none_76587b40265ca57e\TiWorker.exe -Embedding; Description = Windows Modules Installer; Error = 0x80070422).

    Failed to create restore point (Process = C:\WINDOWS\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x80070422).

    and before that:

    Product: Skype Click to Call -- Error 1606. Could not access network location advapi32::CloseServiceHandle(i R7) n\browser\extensions.

    Product: Skype Click to Call -- Error 1606. Could not access network location advapi32::CloseServiceHandle(i R7) n\browser\extensions.

    The curious part is how this all correlates with a memory pre-leak:

    Fault bucket 128950514132, type 5
    Event Name: RADAR_PRE_LEAK_64
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: java.exe
    P2: 7.0.170.2
    P3: 10.0.10586.2.0.0

    The host process always changes. Sometimes it's Cortana's search DLLs, sometimes java, sometimes some other process.

    Monday, May 16, 2016 3:47 PM
  • Here's what happens when Cortana stops working:

    Faulting application name: SearchUI.exe, version: 10.0.10586.306, time stamp: 0x571af796
    Faulting module name: Windows.UI.Xaml.dll, version: 10.0.10586.306, time stamp: 0x571af9f6
    Exception code: 0xc000027b
    Fault offset: 0x0000000000281f52
    Faulting process id: 0x2550
    Faulting application start time: 0x01d1af8b8a1e0950
    Faulting application path: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll
    Report Id: 21232069-fb74-4d2b-8c53-c27e228a1773
    Faulting package full name: Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy
    Faulting package-relative application ID: CortanaUI

    I noticed that system restore was not working because I had cloned from a spindle drive to an ssd. Maybe that was causing this problem.

    Tuesday, May 17, 2016 3:07 PM