Event ID 1073 - USER32

[Tom Hall]

XP Pro SP2 here, running an Intel 3.0g with 1 gig onboard RAM and 200gig
SATA HD.

Starting about 2-3 days ago, the system hangs on virtually every restart or
shutdown command. The following error appears in the system event log:

Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1073
Date: 10/29/2006
Time: 12:09:57 PM
User: NT AUTHORITY\SYSTEM
Computer: V-C889AAF937B64
Description:
The attempt to reboot V-C889AAF937B64 failed

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....

In checking back through older logs, I found the first instance of this
event error on Oct. 13, but it wasn't until about 2-3 days ago that I
noticed that shutdown or restart commands appeared to stop midway through
the process. After doing some research on the problem, I found quite an
array of different suggestions and procedures people used to solve the
problem, but so far haven't been able to find any commonality among the
various approaches that have been tried.

Short of hitting the reset button, the only way I've been able to complete
a restart or shutdown operation is by selectively shutting down svchost.exe
processes from Task Manager until one of them triggers a system broadcast
message that counts down from one minute. At zero, the system restarts or
shuts down, as requested. I don't like doing that because it's ugly and
puts a lot of additional errors into the event log.

I have seen nothing else untoward in system operations. Everything appears
to work as well as it always has.

Interestingly enough, this problem does not appear if a restart command is
issued within the first ~5 minutes of uptime. After that time, the problem
reappears.

I tried one tip I found on researching this problem, namely sorting the
process list by CPU time to see what if anything might be using an
unusually high amount of CPU, but nothing presented itself. System Idle
task almost never went below 96-98%.

My antivirus software (AVG) is constantly updated, and I keep both Spybot
and Ad-Aware updated and run each at least once a week.

Windows OneCare gave me a clean bill of health after cleaning the registry.

I defrag the HD twice weekly as a Scheduled Task.

Any suggestions on where to start looking for the cause would be greatly
appreciated.


Tom

 

[Trevor]

Hello Tom,

Have your tried ...

Go to Control Panel, Power Options, and then change some settings --

System Standby / Never -- turn Off Hard Disk / Never -- then uncheck
Hybernation under the Hybernation tab.

Regardless of what they say, XP does not handle hybernation very well.
To many things running in the background and constantly filling up
memory.

XP Pro SP2 here, running an Intel 3.0g with 1 gig onboard RAM and 200gig
SATA HD.

Starting about 2-3 days ago, the system hangs on virtually every restart or
shutdown command. The following error appears in the system event log:

Event Type: Warning
Event Source: USER32
Event Category: None
Event ID: 1073
Date: 10/29/2006
Time: 12:09:57 PM
User: NT AUTHORITY\SYSTEM
Computer: V-C889AAF937B64
Description:
The attempt to reboot V-C889AAF937B64 failed

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....

In checking back through older logs, I found the first instance of this
event error on Oct. 13, but it wasn't until about 2-3 days ago that I
noticed that shutdown or restart commands appeared to stop midway through
the process. After doing some research on the problem, I found quite an
array of different suggestions and procedures people used to solve the
problem, but so far haven't been able to find any commonality among the
various approaches that have been tried.

Short of hitting the reset button, the only way I've been able to complete
a restart or shutdown operation is by selectively shutting down svchost.exe
processes from Task Manager until one of them triggers a system broadcast
message that counts down from one minute. At zero, the system restarts or
shuts down, as requested. I don't like doing that because it's ugly and
puts a lot of additional errors into the event log.

I have seen nothing else untoward in system operations. Everything appears
to work as well as it always has.

Interestingly enough, this problem does not appear if a restart command is
issued within the first ~5 minutes of uptime. After that time, the problem
reappears.

I tried one tip I found on researching this problem, namely sorting the
process list by CPU time to see what if anything might be using an
unusually high amount of CPU, but nothing presented itself. System Idle
task almost never went below 96-98%.

My antivirus software (AVG) is constantly updated, and I keep both Spybot
and Ad-Aware updated and run each at least once a week.

Windows OneCare gave me a clean bill of health after cleaning the registry.

I defrag the HD twice weekly as a Scheduled Task.

Any suggestions on where to start looking for the cause would be greatly
appreciated.


Tom

Good Luck,

Trev

 

[Tom Hall]

Hello Tom,

Have your tried ...

Go to Control Panel, Power Options, and then change some settings --

System Standby / Never -- turn Off Hard Disk / Never -- then uncheck
Hybernation under the Hybernation tab.

Both are already off, and hibernation is disabled.

Regardless of what they say, XP does not handle hybernation very well.
To many things running in the background and constantly filling up
memory.

It's very interesting that you should mention power management. This system
is a little more than a year old, and about 3-4 months ago the option to
shut off the monitor (BENQ T905) stopped working. Again, nothing else out
of the ordinary happened around that time, so I just let it go. I now use a
idle timer through a program called PowerPro that after 45 minutes invokes
a little Steve Gibson utility called Wizmo to shut off the monitor.

However, while attempting to troubleshoot the issue further, I turned off a
program called TClockex, a taskbar clock enhancer that I've used for years,
and so far the problem has not returned, and so far there have been no more
Event ID 1073's.

Crossing fingers,

Tom

 

[Trevor]

Glad you figured it out Tom. It sounded like a power management issue.
But I've also experienced legacy apps that get nuked eventually by MS
updates. Especially those that install as services.....Funny term that
is sometimes....services aren't always so serving eh?

Both are already off, and hibernation is disabled.


It's very interesting that you should mention power management. This system
is a little more than a year old, and about 3-4 months ago the option to
shut off the monitor (BENQ T905) stopped working. Again, nothing else out
of the ordinary happened around that time, so I just let it go. I now use a
idle timer through a program called PowerPro that after 45 minutes invokes
a little Steve Gibson utility called Wizmo to shut off the monitor.

However, while attempting to troubleshoot the issue further, I turned off a
program called TClockex, a taskbar clock enhancer that I've used for years,
and so far the problem has not returned, and so far there have been no more
Event ID 1073's.

Crossing fingers,

Tom

Good Luck,

Trev

 

[Tom Hall]

Glad you figured it out Tom. It sounded like a power management issue.
But I've also experienced legacy apps that get nuked eventually by MS
updates. Especially those that install as services.....Funny term that
is sometimes....services aren't always so serving eh?

Indeed.

My first hint that TClockex may have been the culprit was when it kept
coming back at startup after I had specifically de-selected that option
from the program's own GUI. The first time I tried to turn it off, I
noticed that Spybot's Teatimer didn't say anything about the registry
change. Only when I uninstalled the program through Add and Remove Programs
did Teatimer tell me about the registry change.

TClockex also does not appear as a process and there are no menu entries,
other than an icon in Control Panel which itself is a configurable option.

I guess XP figured something was stealthed that shouldn't be but couldn't
figure out how to deal with the suspected miscreant...

I've used TClockex since 2000, when it was released, and I think that may
even have been before the first release of Windows XP.

As a humorous anecdote, many years ago I worked as a temp for a local
bank's head office, and on a Windows NT workstation so locked down I
couldn't even access hotmail, I was able to install TClockex - again with
no menu entries and no way to configure it other than by right-clicking the
Tclockex-modified taskbar clock.

I guess this machine is reaching an age where all manner of odd behaviors
may creep in. My current issue is figuring out how to make Autoplay options
for the DVD burner "stick". I can go to My Computer and configure Autoplay
options there, but the next time I go back to review them, the option I
chose is gone and instead the radio button to ask each time is active, just
as it was when I first tried to set the individual options.

An interesting variant of this problem occurs when the desired action is
actually performed when a disc is inserted into the drive - but the window
to select which operation to perform pops up as well.

Perhaps the combination of Halloween and a Friday the 13th in the same
month are taking their toll...


Tom

 

[Tom Hall]

In checking back through older logs, I found the first instance of this
event error on Oct. 13

As it so happens, on Oct. 13th I bought a new Logitech G7 cordless mouse
and a new Microsoft natural keyboard.

The Setpoint 3.10 installer apparently disregarded the existence of other
Logitech software, as the Mouseman installation was not touched. The only
visible change was the registry replacement of em_exec.exe with
khalmnpr.exe.

I uninstalled the Setpoint software and re-installed the Mouseman software,
and ran with the old mouse for a few hours. I decided to test out my theory
that the Event ID 1073 may be caused by something gone amok in the mouse
driver. There was no Event ID 1073 or any derangement of the restart
process, so I shut down the computer and swapped back in the G7 mouse.

After restarting the system, I first uninstalled the Mouseman software
(which forced a system restart) and then re-installed the Setpoint package.
I'll muck around for a few hours and then see what happens when I restart
the system.

Interesting footnote: the new Microsoft keyboard apparently does not
support DOS mode, as I discovered when I tried to boot from a DVD I knew to
be bootable. As soon as I put back the older keyboard (also Microsoft, but
with PS2 connection), voila! the DVD booted.

I'll think twice before I go shopping again for computer accessories on
Friday the 13th...

 

[Tom Hall]

Interesting footnote: the new Microsoft keyboard apparently does not
support DOS mode, as I discovered when I tried to boot from a DVD I knew to
be bootable. As soon as I put back the older keyboard (also Microsoft, but
with PS2 connection), voila! the DVD booted.

I should add for the sake of clarification that I now know that the DVD was
always booting successfully; it's just that my keyboard didn't work once I
got to the DOS prompt.

Commercial CDs were never affected - only the bootable ones I made.

I'm fairly confident at this writing that the basic cause of the problem
was having two completely separate driver sets installed for a single
mouse. Uninstalling the older Mouseman software before installing the
Setpoint software seems to have done the trick.

Crossing fingers,


Tom

 

[Chris]

Im not sure if I'm doing this right, so my apologies, and to Tom Hall
<[email protected]>. I have your post saved so you don't have to do
any writing.

I got a new in June and I want to take care of it, You know anti virus,
firewall, the whole nine yards. Recently I haven't been able to optimize it.
Defrag it. I start the defrag, but it doesn't respond. I figured I would
restore it from the beginning, it says it is unable to restore that point.
Now I believe the minimum disk space required is 15%. Mine is to the max and
only shows 12%, so maybe that is the reason for that one. Which leaves me
with my defrag.

Is it a common occurence.

BTW: I turned off restore, and reboot my computer. Turned restore back on,
hoping to delete those restore points. Thinking they were taking up the
space, hence 12%, nothing doing though.

Chris

 

[Crispy Critter]

Im not sure if I'm doing this right, so my apologies, and to Tom Hall
<[email protected]>. I have your post saved so you don't have to do
any writing.

I got a new in June and I want to take care of it, You know anti virus,
firewall, the whole nine yards. Recently I haven't been able to optimize it.
Defrag it. I start the defrag, but it doesn't respond. I figured I would
restore it from the beginning, it says it is unable to restore that point.
Now I believe the minimum disk space required is 15%. Mine is to the max and
only shows 12%, so maybe that is the reason for that one. Which leaves me
with my defrag.

Is it a common occurence.

BTW: I turned off restore, and reboot my computer. Turned restore back on,
hoping to delete those restore points. Thinking they were taking up the
space, hence 12%, nothing doing though.

Chris

Press F8 when you boot up and select safe mode, will it defrag now? I've
seen some software that auto loads with Windows stop defrag from completing
because when it tries to move those files in use it can't. You have to find
out what software is causing it and stop it from auto loading by typing
msconfig in the run box and unchecking the offending program. Not saying
that is your issue for sure but it could be.

 

[Tom Hall]

I'm fairly confident at this writing that the basic cause of the problem
was having two completely separate driver sets installed for a single
mouse. Uninstalling the older Mouseman software before installing the
Setpoint software seems to have done the trick.

Crossing fingers,

I'm all out of fingers - the problem returned again last night, with a new
wrinkle. A split-second after I issued the restart command, a dialog box
popped up titled dwwin.exe saying the application can't initialize because
system is shutting down. I've now seen this error happen both with and
without the Event ID 1073 entry in the system event log.

Other than an annoying sound, this popup message doesn't seem to affect the
restart process (which will fail or succeed depending on some condition as
yet unidentified).

Oh yes - there is an event log entry for this occurrence:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 11/4/2006
Time: 10:28:35 AM
User: N/A
Computer: V-C889AAF937B64
Description:
Application popup: dwwin.exe - DLL Initialization Failed : The application
failed to initialize because the window station is shutting down.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Sometimes this is accompanied by the 1073 error, and sometimes not. The
only consistent event is the appearance of the 1073 error at those times
when the shutdown or restart command fails.


Tom

 

[Guest]

I have the same problem. Not able to shutdown & only reset button works.
Would love to have a solution. Problem goes away for a hile but always comes
back. It doesn't matter which user is logged on.