Results 1 to 9 of 9
  1. #1
    New Lounger
    Join Date
    Mar 2017
    Posts
    11
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Question "Event Viewer" error: "The system cannot find the file specified." What file?

    After recovering from a nasty virus attack a few months ago that disabled about 100 Windows Services, nearly every morning after cold booting my computer, I'll get a long delay (about a minute) of staring at my mouse pointer against a black screen before the desktop finally appears (no such delay when rebooting).

    I checked the "Event Viewer" System logs, and there are several errors, one of which is: "The system cannot find the file specified." But is DOESN'T specify a file.

    How do I figure out what "file" the system was looking for but couldn't find (or ID the Service triggering the error)?

    TIA

  2. #2
    WS Lounge VIP mrjimphelps's Avatar
    Join Date
    Dec 2009
    Location
    USA
    Posts
    3,984
    Thanks
    518
    Thanked 472 Times in 441 Posts
    You could disable all non-Microsoft services, then reboot. If the message goes away, then re-enable them one service at a time, rebooting after each re-enable, till the message returns. You'll know then that the last service you re-enabled was the culprit. Disable that one again, and then continue re-enabling one at a time till either you find another culprit, or until all are re-enabled.

    You could then stop at that point, or you could dig around to find out which program the disabled service is for.

    To do this procedure, run MSCONFIG, go to the Services tab, and check the box which says "Hide all Microsoft Services". Disable all of the services still showing on the screen (i.e. the non-Microsoft services), then follow the above procedure.

  3. #3
    New Lounger
    Join Date
    Mar 2017
    Posts
    11
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by mrjimphelps View Post
    You could disable all non-Microsoft services, then reboot. If the message goes away, then re-enable them one service at a time, rebooting after each re-enable, till the message returns. You'll know then that the last service you re-enabled was the culprit. Disable that one again, and then continue re-enabling one at a time till either you find another culprit, or until all are re-enabled.

    You could then stop at that point, or you could dig around to find out which program the disabled service is for.

    To do this procedure, run MSCONFIG, go to the Services tab, and check the box which says "Hide all Microsoft Services". Disable all of the services still showing on the screen (i.e. the non-Microsoft services), then follow the above procedure.
    Thanks for the reply, my apologies for not including it, but the Service in question is "Superfetch", which is an MS Service. So I know the Service that is encountering an error, but not the name of the file it claims it "can't find".

    Many (many) other events use "Superfetch" without issue, so disabling it is not an option.

    Here is the full error message in total:

    Code:
    The Superfetch service terminated with the following error: 
    The system cannot find the file specified.
    This next event does not occur for another 7 seconds, so it is one of the bigger delays (I already identified and corrected another error responsible for at least another 20 seconds worth of boot delays.)

  4. #4
    Administrator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    5,058
    Thanks
    417
    Thanked 666 Times in 561 Posts
    I have Superfetch disabled

    Use CCleaner Slim to preview only the Windows Prefetch files. For those that are listed, you can edit any lines related to them out of the C:\Windows\Prefetch\Layout.ini file (use the find feature) and then Save it. Then run CCleaner to remove the old/unused Prefetch files.

    Reboot and test again.
    Last edited by satrow; 2017-11-14 at 10:30.

  5. #5
    5 Star Lounger
    Join Date
    Jan 2010
    Location
    Fort McMurray, Alberta, Canada
    Posts
    733
    Thanks
    75
    Thanked 92 Times in 87 Posts
    Ah, Windows message rot. Error messages seem to have gotten worse over time!

    However, are you sure you thoroughly checked Event Viewer for information? There is a Details tab when you open an error message, which does not open by default. You need to click every plus sign (+) in there to make sure that the file name you seek isn't hidden in there somewhere.

  6. #6
    New Lounger
    Join Date
    Mar 2017
    Posts
    11
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by BHarder View Post
    Ah, Windows message rot. Error messages seem to have gotten worse over time!

    However, are you sure you thoroughly checked Event Viewer for information? There is a Details tab when you open an error message, which does not open by default. You need to click every plus sign (+) in there to make sure that the file name you seek isn't hidden in there somewhere.
    Yes. Even checked the XML. No reference to any file.

    Examining some other Event errors, I discovered two other disabled Services and was able to switch them back to "Automatic". Hopefully that should resolve the bulk of (it not all) Startup delays.

    I'll follow-up if they return.

  7. #7
    5 Star Lounger
    Join Date
    Jan 2010
    Location
    Fort McMurray, Alberta, Canada
    Posts
    733
    Thanks
    75
    Thanked 92 Times in 87 Posts
    Yes. Even checked the XML. No reference to any file.
    Ah well, it was worth trying. Isn't this infuriating, it must know the name of the file in question, but it won't tell you what it is!

    Last edited by BHarder; 2017-11-15 at 11:00. Reason: Corrected quote

  8. #8
    Administrator Rick Corbett's Avatar
    Join Date
    Dec 2009
    Location
    South Glos., UK
    Posts
    3,587
    Thanks
    144
    Thanked 918 Times in 735 Posts
    Quote Originally Posted by Mugsy
    How do I figure out what "file" the system was looking for but couldn't find (or ID the Service triggering the error)?
    Unfortunately, even failing to create a file (usually a permissions issue) can generate a NAME NOT FOUND result.

    Try the Sysinternals/Technet tool Process Monitor.

    Play around with it and get used to starting/stopping captures and filtering. Perhaps most importantly, read the accompanying help file (especially the advice about Boot Logging).

    When you're ready, Enable Boot Logging from the Options menu:

    procmon-boot logging.png
    Click to enlarge

    You'll probably only need to monitor file activity so switch all but the Show File System Activity icon off from the toolbar:

    procmon-show file activity.png
    Click to enlarge

    ProcMon generates masses of data so, after rebooting (with Boot Logging enabled), re-run ProcMon, stop the Capture then, in the Result column, right-click on an instance of SUCCESS and choose Exclude 'SUCCESS'.

    procmon-exclude success.png
    Click to enlarge

    Keep filtering until you're left with what's probably going to be a lengthy repetitive sequence. The longer the period that the repetitive sequence lasts (you mentioned about a minute), the more likely it's the cause of your delay.

    Further info:

    Hope this helps...

  9. #9
    Administrator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    5,058
    Thanks
    417
    Thanked 666 Times in 561 Posts
    For info: Superfetch is related to Prefetch, ReadyBoot and ReadyBoost; the latter is opt-in, so the 'missing' file is most likely to be found by drilling into the Prefetch and ReadyBoot data, as described in #4.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •