Event viewer

[William B. Lurie]

If I am not looking into a problem, I will turn all that stuff off.
It is extra I/O I don't need and would rather my CPU time be spent
doing things I want. I find no use for the constant logging of
routine events. I don't look at my Event Log unless I am suspicious
of a problem which is almost never - or trying to help someone else
with their problem which is often. My event logs are no longer
intellectually stimulating.

If other folks want to log all that stuff, more power to 'em. I just
chose not to! It is also possible that with my tinkering over the
years my XP has been installed, I changed some of the Event Log
settings so they may not match yours. Maybe we are not even talking
about the same things anymore.

Okay - I don't to get bogged down with it and would rather move on.

The OP still does't seem to be able to hibernate reliably, his screen
saver doesn't work, he does not have SP3, has not said the hotfix to
fix hibernating for SP2 was installed, and has not described the SP3
anomalies.

I think I'll just watch that for a while!

Jose, I'm willing to stop logging except while we're trouble-shooting.
I imagine I can find out how, but that's a side issue. The screen-saver
works *most* of the time, except when these events prevent it.
SP3 forced things on me that I didn't like and don't recall what
they were, and couldn't undo except by going back to SP2. One of them
I think had to do with automatic live update for Windows, which
I most assuredly resented. The hotfix you mentioned seems to be a KB fix
that I'd welcome a link to........

 

[JD]

Yes, I have one anti-malware program installed but turned
it off two weeks ago when this ATI stuff started. msconfig has it not
loading on startup.

How about a couple of free programs that you run on demand? Take a look at:

Malwarebytes' Anti-Malware http://www.malwarebytes.org/mbam.php

SUPERAntiSpyware Free Edition http://www.superantispyware.com/

Download the free versions. That's all you need.

Read about them before you run them, make sure they won't conflict with
your current software (they shouldn't but you never know) and let's make
sure you machine is clean.

And if you've read along here, the logging of these errors default is
ON. Sometimes people reply here with great authority when they don't
really know what they're talking about.

I don't know what is causing your problem(s) but I'm trying to help you
to figure it out on your own. You know, teach a man to fish, don't just
give him a fish.

Maybe I missed your reply so I'll ask again. What changed on your
computer about the time you noticed these problems?

 

[Jose]

Jose, I'm willing to stop logging except while we're trouble-shooting.
I imagine I can find out how, but that's a side issue. The screen-saver
works *most* of the time, except when these events prevent it.
SP3 forced things on me that I didn't like and don't recall what
they were, and couldn't undo except by going back to SP2. One of them
I think had to do with automatic live update for Windows, which
I most assuredly resented. The hotfix you mentioned seems to be a KB fix
that I'd welcome a link to........

I thought I sent all that aready - maybe to somebody else:

http://support.microsoft.com/kb/909095

 

[William B. Lurie]

I thought I sent all that aready - maybe to somebody else:

http://support.microsoft.com/kb/909095

Thanks, I installed that KB item. Had not seen it before.

 

[William B. Lurie]

How about a couple of free programs that you run on demand? Take a look at:

Malwarebytes' Anti-Malware http://www.malwarebytes.org/mbam.php

SUPERAntiSpyware Free Edition http://www.superantispyware.com/

Download the free versions. That's all you need.

Read about them before you run them, make sure they won't conflict with
your current software (they shouldn't but you never know) and let's make
sure you machine is clean.

And if you've read along here, the logging of these errors default is
ON. Sometimes people reply here with great authority when they don't
really know what they're talking about.

I don't know what is causing your problem(s) but I'm trying to help you
to figure it out on your own. You know, teach a man to fish, don't just
give him a fish.

Maybe I missed your reply so I'll ask again. What changed on your
computer about the time you noticed these problems?

I thought I mentioned that I *did* install MBAM, in this time
frame, but, suspecting it as the cause, I have removed it from ram
and from the start-up list, so it should not be the cause.
Ditto the other item previously recommended, installed, tried,
but disabled.

 

[Jose]

  Thanks, I installed that KB item. Had not seen it before.

Good.

Reboot, set your hibernate to something like 5 minutes and see how it
goes.

XP needs to think your system is idle before it will hibernate. If
you are running some scan (at least for me) the scan has to complete,
then the hibernate countdown starts.

Try not to troubleshoot too many things at once - just fix one thing
at a time.

 

[William B. Lurie]

I thought I mentioned that I *did* install MBAM, in this time
frame, but, suspecting it as the cause, I have removed it from ram
and from the start-up list, so it should not be the cause.
Ditto the other item previously recommended, installed, tried,
but disabled.

***********************************************
One more time:
This report:
Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 2/16/2010
Time: 7:14:12 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: COMPAQ-2006
Description:
IPSec Services: IPSec Services failed to get the complete
list of network interfaces on the machine. This can be a potential
security hazard to the machine since some of the network interfaces
may not get the protection as desired by the applied IPSec filters.
Please run IPSec monitor snap-in to further diagnose the problem.



For more information, see Help and Support Center
at http://go.microsoft.com/fwlink/events.asp.
*******************************************************
This '615' under Security seems to happen
every hour or two. It asks me to run IPSec (presumably SECurity)
monitor snap-in to further diagnose the problem.

R=Those terms are all brand new to me. I'd like
to run it if I knew what it was and where it is.
Thanks.

 

[William B. Lurie]

Provide more information:

Minimize back and forth Q&A and eliminate guesswork and assumptions:

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select
All, Copy and then paste
back here.

There will be some personal information (like System Name and User
Name), and whatever appears to
be private information to you, just delete from the pasted
information.

What are your system settings regarding Hibernation? Mine is set to
hibernate after 30 minutes of inactivity, but I can also hibernate
anytime. Which does not work for you?

Has hibernation ever worked?

If you click Start, Turn Off Computer and press the Shift key, does
the Stand By button turn into a Hibernate button and then if you click
Hibernate does your system enter hibernation?

Let's see this event you see:

Look in the Event Viewer for clues around the time of the incident

Here is a method to post the specific information about individual
events.

To see the Event Viewer logs, click Start, Settings, Control Panel,
Administrative Tools, Event Viewer.

A shortcut to Event Viewer is to click Start, Run and in the box
enter:

%SystemRoot%\system32\eventvwr.msc

Click OK to launch the Event Viewer.

The most interesting logs are usually the Application and System.
Some logs may be almost or completely empty.
Not every event is a problem, some are informational messages that
things are working okay and some are warnings.
No event should defy reasonable explanation.

Each event is sorted by Date and Time. Errors will have red Xs,
Warnings will have yellow !s.
Information messages have white is. Not every Error or Warning event
means there is a serious issue.
Some are excusable at startup time when Windows is booting. Try to
find just the events at the date
and time around your problem.

If you double click an event, it will open a Properties windows with
more information. On the right are
black up and down arrow buttons to scroll through the open events. The
third button that looks like
two pages on top of each other is used to copy the event details to
your Windows clipboard.

When you find an interesting event that occurred around the time of
your issue, click the third button
under the up and down arrows to copy the details and then you can
paste the details (right click, Paste
or CTRL-V) the detail text back here for analysis.

To get a fresh start on any Event Viewer log, you can choose to clear
the log (backing up the log is offered),
then reproduce your issue, then look at just the events around the
time of your issue.

Okay, Jose, one mo' time:

Event Type: Error
Event Source: ati2mtag
Event Category: CRT
Event ID: 45062
Date: 2/16/2010
Time: 1:03:13 PM
User: N/A
Computer: COMPAQ-2006
Description:
CRT invalid display type
Data:
0000: 00 00 00 00 01 00 5a 00 ......Z.
0008: 2c 00 00 00 06 b0 00 c0 ,....°.À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

The above is the Event that occurs every time the
Power Options is invoked (I think). How do I
find out what it doesn't like about my CRT?

 

[William B. Lurie]

Okay, Jose, one mo' time:

Event Type: Error
Event Source: ati2mtag
Event Category: CRT
Event ID: 45062
Date: 2/16/2010
Time: 1:03:13 PM
User: N/A
Computer: COMPAQ-2006
Description:
CRT invalid display type
Data:
0000: 00 00 00 00 01 00 5a 00 ......Z.
0008: 2c 00 00 00 06 b0 00 c0 ,....°.À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

The above is the Event that occurs every time the
Power Options is invoked (I think). How do I
find out what it doesn't like about my CRT?

It is now worse than ever, and I suspect why.

I decided to do some Windows Update. Hadn't been there in about
a month. (I prefer Manual....I don't want all the updates, and
for good reason).

I let it install 27 updates, including Windows Search and IE8.

I did a reboot (of course), and some work, and went away,
figuring it would go to hibernate. Instead, 8 hours later,
it had not even gone to Screen Saver!

Looking at Event Viewer, it has 200 events recorded, in the top
two categories.

I'd like to back off and uninstall Windows Search and try again,
if somebody will tell me how to uninstall it. As for IE8, I can
probably download and IE7, uninstall IE8 and reinstall IE7. I
use Firefox as my main browser anyway.

Meanwhile, here is one of the messages in the Event Viewer. Note
that Windows Search was involved.

Event Type: Error
Event Source: Windows Search Service
Event Category: Gatherer
Event ID: 3024
Date: 2/16/2010
Time: 3:29:08 PM
User: N/A
Computer: COMPAQ-2006
Description:
The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again.

Context: Windows Application, SystemIndex Catalog


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[William B. Lurie]

It is now worse than ever, and I suspect why.

I decided to do some Windows Update. Hadn't been there in about
a month. (I prefer Manual....I don't want all the updates, and
for good reason).

I let it install 27 updates, including Windows Search and IE8.

I did a reboot (of course), and some work, and went away,
figuring it would go to hibernate. Instead, 8 hours later,
it had not even gone to Screen Saver!

Looking at Event Viewer, it has 200 events recorded, in the top
two categories.

I'd like to back off and uninstall Windows Search and try again,
if somebody will tell me how to uninstall it. As for IE8, I can
probably download and IE7, uninstall IE8 and reinstall IE7. I
use Firefox as my main browser anyway.

Meanwhile, here is one of the messages in the Event Viewer. Note
that Windows Search was involved.

Event Type: Error
Event Source: Windows Search Service
Event Category: Gatherer
Event ID: 3024
Date: 2/16/2010
Time: 3:29:08 PM
User: N/A
Computer: COMPAQ-2006
Description:
The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again.

Context: Windows Application, SystemIndex Catalog


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

and still one more to explain:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 2/17/2010
Time: 7:54:22 AM
User: N/A
Computer: COMPAQ-2006
Description:
The following boot-start or system-start driver(s) failed to load:
ftsata2
KLIF

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Jose]

It is now worse than ever, and I suspect why.

I decided to do some Windows Update. Hadn't been there in about
a month. (I prefer Manual....I don't want all the updates, and
for good reason).

I let it install 27 updates, including Windows Search and IE8.

I did a reboot (of course), and some work, and went away,
figuring it would go to hibernate. Instead, 8 hours later,
it had not even gone to Screen Saver!

Looking at Event Viewer, it has 200 events recorded, in the top
two categories.

I'd like to back off and uninstall Windows Search and try again,
if somebody will tell me how to uninstall it. As for IE8, I can
probably download and IE7, uninstall IE8 and reinstall IE7. I
use Firefox as my main browser anyway.

Meanwhile, here is one of the messages in the Event Viewer. Note
that Windows Search was involved.

Event Type:     Error
Event Source:   Windows Search Service
Event Category: Gatherer
Event ID:       3024
Date:           2/16/2010
Time:           3:29:08 PM
User:           N/A
Computer:       COMPAQ-2006
Description:
The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again.

Context: Windows Application, SystemIndex Catalog

For more information, see Help and Support Center athttp://go.microsoft.com/fwlink/events.asp.

Enough people want to uninstall Windows Search post install (I wonder
why?), so I have copy/paste directions:

After updates, Search Desktop may show up in the Taskbar because
Windows Search has been installed.

You can turn off the Windows Search Deskbar but Windows Search will
still be installed and running. Contrary to some beliefs,turning off
the toolbar is not the same as uninstalling.

Uninstalling Windows Search depends on the version.

Windows Search is Microsoft KB940157.

Windows Search 4.0 can be removed from Add or Remove Programs. If you
do not see it check the Show updates box and look again.

Version 3.0 did not show up in Add or Remove Programs, but the
uninstall process is the same for both behind the scenes.

KB940157 and every installed KB should have an uninstall folder and
uninstallation process to go with it.

Click Start, Run and in the box enter:

%systemroot%\$NtUninstallKB940157$\spuninst\spuninst.exe

Click OK and the uninstall will run for KB940157. Follow the prompts
and reboot.

You could also navigate to the KB940157 folder and double click the
spuninst.exe to launch it.

Reboot when the uninstall is complete.

 

[William B. Lurie]

Enough people want to uninstall Windows Search post install (I wonder
why?), so I have copy/paste directions:

After updates, Search Desktop may show up in the Taskbar because
Windows Search has been installed.

You can turn off the Windows Search Deskbar but Windows Search will
still be installed and running. Contrary to some beliefs,turning off
the toolbar is not the same as uninstalling.

Uninstalling Windows Search depends on the version.

Windows Search is Microsoft KB940157.

Windows Search 4.0 can be removed from Add or Remove Programs. If you
do not see it check the Show updates box and look again.

Version 3.0 did not show up in Add or Remove Programs, but the
uninstall process is the same for both behind the scenes.

KB940157 and every installed KB should have an uninstall folder and
uninstallation process to go with it.

Click Start, Run and in the box enter:

%systemroot%\$NtUninstallKB940157$\spuninst\spuninst.exe

Click OK and the uninstall will run for KB940157. Follow the prompts
and reboot.

You could also navigate to the KB940157 folder and double click the
spuninst.exe to launch it.

Reboot when the uninstall is complete.

*********************************************
Thank you, Jose......I had already managed to uninstall
Windows Search. But the ati error message and reference
to CRT still persists as an unanswered question. When
the Power Options selections don't get invoked, sometimes
it goes all the way back to where, after 3 hours, all my desktop
icons and wallpaper are still there. See Event ID 45062 above.
Any clues?

 

[William B. Lurie]

*********************************************
Thank you, Jose......I had already managed to uninstall
Windows Search. But the ati error message and reference
to CRT still persists as an unanswered question. When
the Power Options selections don't get invoked, sometimes
it goes all the way back to where, after 3 hours, all my desktop
icons and wallpaper are still there. See Event ID 45062 above.
Any clues?

I hate to be a pest, because it isn't a vital malfunction.
But it is annoyong to get error messages that might as
well be written in Sanskrit, for all the use they are!