5

A few days ago, something happened to my laptop (running Windows 10); it took long minutes for common applications (Browser, VLC, etc.) to load. As much as I investigated, I couldn't find the cause. After several reboots, checks and scans, the problem seemed to simply disappear.

However, along the way I noticed that dozens, if not hundreds of processes per second, mostly registry operations, had non-success return values, as shown in ProcMon. For instance:

| Process Name | Operation  | Path                                     | Result         |
|--------------|------------|------------------------------------------|----------------|
| svhost.exe   | RegOpenKey | HKLM\System\CurrentControlSet\[...]\Keys | REPARSE        |
| svhost.exe   | RegOpenKey | HKLM\System\CurrentControlSet\[...]\Keys | NAME NOT FOUND |

Although svhost.exe was frequently involved, it happened for many other processes as well.

I understand that it is to be expected that some processes show these results. However, their frequency seemed highly suspicious. I ran several virus / malware scans, ran checks on my SSD, and couldn't find anything. So I decided to format my system partition and reinstall Windows. To my surprise, I still find a lot of the same.

Here is a frequency table for the Results column, using default ProcMon filters, after around 30 seconds of idle monitoring:

enter image description here

Since there are thousands of cases, investigating any one in particular does not make much sense. Yet doing nothing leaves me uneasy.

My Question : is such a high frequency of non-successful results something I should worry about? And if so, what steps could I try next?

Note that I did not format my entire drive before reinstalling Windows; before doing so, I'd like to hear some of your POV's. The tools I have tried so far:

  • chkdsk (nothing to repair)
  • fsc /scannow (nothing to repair)
  • MalwareBytes full scan (no threat detected)
  • Avast Premium Full scan (no threat detected)
  • Windows Defender full scan (no threat detected)
Dominic Comtois
  • 191

2 Answers2

6

I have lots of NAME NOT FOUND as well and there is nothing wrong with my computer. It is not deemed to be a critical issue. Several answers below to that effect. No need to worry.

https://social.technet.microsoft.com/Forums/ie/en-US/a2c2fd4d-e653-4348-8e84-997994958dab/is-name-not-found-result-by-process-monitor-a-critical-issue?forum=smallbusinessserver

1

The "NAME NOT FOUND" count being high is completely normal.

Consider loading a single DLL or invoking a single executable b name. Windows will search each PATH entry and test for file existence until it's found. Each of the "wrong" PATH entries result in some operation returning "NAME NOT FOUND" but it's totally innocuous as long as the resource is found in a later place.

From the other answer, the same thing can happen with Registry lookups. This may be less about hunting for alternatives than about "if the key exists, I will behave differently".

covener
  • 164