Why is windows "reorganizing" my registry?

Recently, Windows appears to freeze up for several minutes. Everything
seems dead, but there's a ton of disk activity and eventually everything
thaws. In the System log, there will be a dozen or so entries, source is
"Kernel-General" and the messages look like this:

Hive \??\T:\Temp\tmp173a.tmp\SOFTWARE was reorganized with a starting size
of 63197184 bytes and ending size of 63352832 bytes.

So far, I can't find anything online that sheds any light on this.

?

On 17 Dec 2017, Jason wrote in
alt.comp.os.windows-10:

Recently, Windows appears to freeze up for several minutes.
Everything seems dead, but there's a ton of disk activity and
eventually everything thaws. In the System log, there will be a
dozen or so entries, source is "Kernel-General" and the messages
look like this:

Hive \??\T:\Temp\tmp173a.tmp\SOFTWARE was reorganized with a
starting size of 63197184 bytes and ending size of 63352832 bytes.

So far, I can't find anything online that sheds any light on this.

I Googled the string 'windows registry "reorganized with a starting
size"' and did find a number of references to similar errors. I didn't
see any definite answers, but it seems to indicate a serious hardware
failure.

On Sun, 17 Dec 2017 22:53:29 -0500 "Nil"
wrote in article
I Googled the string 'windows registry "reorganized with a starting
size"' and did find a number of references to similar errors. I didn't
see any definite answers, but it seems to indicate a serious hardware
failure.

Thanks. I'll check that out, but there are no such errors in the log.

On 17 Dec 2017, Jason wrote in
alt.comp.os.windows-10:

On Sun, 17 Dec 2017 22:53:29 -0500 "Nil"
wrote in article

I Googled the string 'windows registry "reorganized with a
starting size"' and did find a number of references to similar
errors. I didn't see any definite answers, but it seems to
indicate a serious hardware failure.

Thanks. I'll check that out, but there are no such errors in the
log.

You said in your original post that there ARE such errors in the log.

Which is it?

Jason wrote:
Recently, Windows appears to freeze up for several minutes. Everything
seems dead, but there's a ton of disk activity and eventually everything
thaws. In the System log, there will be a dozen or so entries, source is
"Kernel-General" and the messages look like this:

Hive \??\T:\Temp\tmp173a.tmp\SOFTWARE was reorganized with a starting size
of 63197184 bytes and ending size of 63352832 bytes.

So far, I can't find anything online that sheds any light on this.

?


In the example here, it was probably a dirty shutdown
that causes the Registry journal to be invoked, so
that the registry could be recovered.

https://answers.microsoft.com/en-us/...307529d?auth=1

A reason for the Registry file size to decrease, is
when deleted entries are "harvested" by compaction.
The OS has an opportunity to do that, while it is
house cleaning the (slightly) damaged file.

You would need to walk the Event Viewer log backwards
and spot some other root cause. An actual pre-mature
shutdown (OS shuts down without flushing disk cache),
would be sufficient to damage the registry and require
usage of the journal to recover it. The thing has some
level of resilience. If you got into a loop of some
sort, maybe the damage could eventually be severe enough
to ruin it, in which case a Restore Point might have
good copies of the file.

Even if the security service on the OS was killed, requiring
mandatory shutdown of the OS in 60 seconds, there is a
chance to put away the registry properly when that happens.
Abrupt failures (like killing the AC power), leave
less room for cleanups.

I would probably run memtest86+ for at least one pass,
to make sure my RAM was still good. I got a few symptoms
on the test machine the other day, that I knew to be
software problems, but being a belt and suspenders guy,
I ran memtest86+ from a USB floppy drive anyway. And
while I was out shopping, there was time for 1 pass
to complete when I got back. (Downloads are at the
50% position on the web page.) Of course there
was nothing wrong with the RAM, but I test at least
once a year, as I've had a fair number of bad DIMMs
here. And no brand is completely immune.

http://www.memtest.org/

And you can crash Windows 10. I managed to do that
the first time I ran Windows 10 in VirtualBox. I
changed the chipset declaration (because I didn't
know any better), and Windows 10 black-screened,
with no frown symbol on the screen and Stop Code.
It just crashed, completely black screen, with of
course, no "normal" BSOD to provide a hint as to
what was wrong.

About 30% of OS problems of that sort, have as their
root cause, a video driver issue.

And malware is a good source of stimuli, as the
OS couldn't possibly exhibit as many problems as it
does, without helpful poking from malware to bring
out the worst. Very occasionally, Microsoft
does that on purpose, such as when Microsoft issued
an "atapi.sys" patch that happened to conflict with
TDSS rootkits using the same file. The TDSS developer
pushed out a patch two days later, to prevent the
"update" from tipping over "his" computers :-) If
you happened to wait a couple days without booting
that machine, then the TDSS patch would come in and
the machine would still be "owned". Beating out the
attempt to fiddle with atapi.sys.

Paul

Nil wrote:

wrote:

there are no such errors in the log.

You said in your original post that there ARE such errors in the log.

Not all event log entries are errors.

On Mon, 18 Dec 2017 00:02:57 -0500 "Nil"
wrote in article

On 17 Dec 2017, Jason wrote in
alt.comp.os.windows-10:

On Sun, 17 Dec 2017 22:53:29 -0500 "Nil"
wrote in article

I Googled the string 'windows registry "reorganized with a
starting size"' and did find a number of references to similar
errors. I didn't see any definite answers, but it seems to
indicate a serious hardware failure.

Thanks. I'll check that out, but there are no such errors in the
log.

You said in your original post that there ARE such errors in the log.

Which is it?

There are no reported hardware errors in the log, just a dozen or so
messages about reorganizing the registry.

On 18 Dec 2017, Jason wrote in
alt.comp.os.windows-10:

On Mon, 18 Dec 2017 00:02:57 -0500 "Nil"
wrote in article


You said in your original post that there ARE such errors in the
log.

Which is it?

There are no reported hardware errors in the log, just a dozen or
so messages about reorganizing the registry.

Ah, OK, I see what you're saying. However, hardware failures don't
necessarily show up in Windows logs as hardware errors - you're just a
likely to see the side effects of hardware problems. I've guessing that
the log entries you're seeing are such. You might have a failing hard
disk or bad RAM.

On Mon, 18 Dec 2017 12:38:09 -0500 "Nil"
wrote in article
I've guessing that
the log entries you're seeing are such. You might have a failing hard
disk or bad RAM.

Could be! I periodically run chkdsk at boot time to scan for errors and
fix them. I did that just a few days ago, before the freeze-ups, and all
seven partitions, on 4 physical drives (two ssd's, two spinners), checked
out ok. I'll run memtest, per Paul's suggestion, tonight when I'm not
using the machine.