Solved Memory Diagnostic Tool (MDRes) keeps launching on boot up

[DrDOS]

I know this question has been asked in the past but I never found answers, just more questions. I hope this will provide someone enough info so they can shed some light on this.

I ran the MdSched.exe file just to test my laptop's RAM (for grins really) and now that I have, MdRes shows up in the system tray. It doesn't consume much memory. I can stop it. But it bugs me that it is there and nowhere can I find out why it appears or how to prevent it from doing so. Startup, HKLM_Run, HKU_Run are where one would normally check for startup processes. It doesn't seem to be a service either. It's not in MSCONFIG and can't run Defender (Vista issue?). I rebooted, shut down and removed my hibernation file and created it anew. I searched in the System Event Log and the only reference was when I initiated MdSched. I am including that.

The process C:\Windows\System32\MdSched.exe (DRDOS-PC) has initiated the 
restart of computer DRDOS-PC on behalf of user DrDOS-PC\DrDOS for the following 
reason: Hardware: Maintenance (Planned)

 
Here is a more detailed version:

 
Log Name:      System

 
Source:        USER32

 
Date:          7/11/2011 5:21:57 PM

 
Event ID:      1074

 
Task Category: None

 
Level:         Information

 
Keywords:      Classic

 
User:          DrDOS-PC\DrDOS

 
Computer:      DrDOS-PC

 
Description:

 
The process C:\Windows\System32\MdSched.exe (DRDOS-PC) has initiated the 
restart of computer DRDOS-PC on behalf of user DrDOS-PC\DrDOS for the following 
reason: Hardware: Maintenance (Planned)

 
 Reason Code: 0x80010001

 
 Shutdown Type: restart

 
 Comment: 

 
Event Xml:

 
<Event xmlns="[URL="http://schemas.microsoft.com/win/2004/08/events/event"]Error[/URL]">

 
  <System>

 
    <Provider Name="USER32" />

 
    <EventID Qualifiers="32768">1074</EventID>

 
    <Level>4</Level>

 
    <Task>0</Task>

 
    <Keywords>0x80000000000000</Keywords>

 
    <TimeCreated SystemTime="2011-07-11T21:21:57.000Z" />

 
    <EventRecordID>706662</EventRecordID>

 
    <Channel>System</Channel>

 
    <Computer>DrDOS-PC</Computer>

 
    <Security UserID="S-1-5-21-3134208594-130458281-3635107679-1000" 
/>

 
  </System>

 
  <EventData>

 
    <Data>C:\Windows\System32\MdSched.exe (DRDOS-PC)</Data>

 
    <Data>DRDOS-PC</Data>

 
    <Data>Hardware: Maintenance (Planned)</Data>

 
    <Data>0x80010001</Data>

 
    <Data>restart</Data>

 
    <Data>

 
    </Data>

 
    <Data>DrDOS-PC\DrDOS</Data>

 
    <Binary>01000180</Binary>

 
  </EventData>

 
</Event>

I've also found/experienced what everyone in the prior posts mentioned. I don't own a copy of Vista and only have some DVDs I created to restore my system when I first purchased it. I really don't want to start over again or use a restore point as I purge them periodically using Disk Cleanup.

Any direction would be appreciated. Thanks for your time.

 

[richc46]

I gave an aswer which was simple and easy, but then read your post again and saw that your deleted your restore points. This is never suggested. The small space saved does not warrant their removal due to situations, just like this.
Did you try to go to search, notification area, and then untick the service if listed.
In lieu of using a method that would have worked, try this and SFC command.
http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html
Just a wild guess, but if you go to search and type "turn windows features on", if it is there you can untick it.
You could try downloading Winpatrol, the startup items seem to be in more detail than msconfig and you may be able to turn it off from there if it shows.
You can try Process Explorer ( not necessary to download, you can just run it from the site) and see if the process can be killed with that software.
http://technet.microsoft.com/en-us/sysinternals/bb896653

Defender cant be run if you have Microsoft Security Essentials as your AV.

.

 

[niemiro]

Hello, and welcome to the Vista Forums!

There are actually a great number of registry entries a process can start from. Track it down with autoruns: Autoruns for Windows

Also, if you can't find it: User drop down > NT AUTHORITY\{SYSTEM/LOCAL SERVICE}

Good luck!

Richard

 

[DrDOS]

Richc46 - I got it to disappear as I had a Restore Point from dated two days prior.

Niemiro - I'll take a look at the program you offered. Thanks for sharing. And not clear what this means yet User drop down > NT AUTHORITY\{SYSTEM/LOCAL SERVICE} but I do like research

I marked this as solved. Hope it worked.

Thanks everyone!

 

[richc46]

Sounds like you got it sorted, good luck