2-hour hibernate failure

[William B. Lurie]

Windows Image Acquisition (WIA) used by scanners, cameras and probably
your webcam, this is why I asked you to *completely* remove these
devices and all their associated software from your machine. In the
batch file the line:

sc config stisvc start= Disabled

will (should have) set the Windows Image Acquisition (WIA) to
*disabled*. A disabled service cannot start, trying to start it will
throw an error. Something in your startup applications is changing the
start status of the service an re-enabling it, these things don't change
by themselves alone. Run the batch file again to reset the start values
of the services then do a clean boot, don't reboot after you run the
batch file because the startup applications will just change it again!
Run the batch file then do the necessary steps to clean boot then reboot.



You mean Norton stuff? That will be the next one to get its head
chopped off! It shouldn't run if you do the clean boot properly.

John

John, Norton in service is too important to me, and removing
it completely and reinstalling could be a forever task. We
have to either clear it or chop its legs off, and I propose
a test that will meet you more than half way. As you know,
I can always make more clones, even though it takes some time.

Let's take my test clone and remove all of Norton's A-V right
from Add/Remove. I just have to remember never to go online on
that system.

I'll take the system as it is now, UNinstall NAV,do your
ServicesStart.vbc again, and autorunsc.exe, and let's see
what happens. I'll start that right now.
Bill

 

[William B. Lurie]

Windows Image Acquisition (WIA) used by scanners, cameras and probably
your webcam, this is why I asked you to *completely* remove these
devices and all their associated software from your machine. In the
batch file the line:

sc config stisvc start= Disabled

will (should have) set the Windows Image Acquisition (WIA) to
*disabled*. A disabled service cannot start, trying to start it will
throw an error. Something in your startup applications is changing the
start status of the service an re-enabling it, these things don't change
by themselves alone. Run the batch file again to reset the start values
of the services then do a clean boot, don't reboot after you run the
batch file because the startup applications will just change it again!
Run the batch file then do the necessary steps to clean boot then reboot.



You mean Norton stuff? That will be the next one to get its head
chopped off! It shouldn't run if you do the clean boot properly.

John

***********************************************************************
John, I completely removed, uninstalled, all Norton stuff and made the
run I said I would. I'll try to show the results below. Note that
every hour, *some*thing is doing Auto Live Update.......but it ain't
Norton. Gotta go, but I'll try to patch the stuff in here.

Service Name,Start Mode
Alerter,Disabled,
ALG,Manual,
AppMgmt,Manual,
aspnet_state,Manual,
Ati HotKey Poller,Disabled,
ATI Smart,Manual,
AudioSrv,Auto,
Automatic LiveUpdate Scheduler,Auto,
BITS,Manual,
Browser,Auto,
CiSvc,Manual,
ClipSrv,Disabled,
clr_optimization_v2.0.50727_32,Manual,
COMSysApp,Manual,
CryptSvc,Auto,
DcomLaunch,Auto,
Dhcp,Auto,
dmadmin,Manual,
dmserver,Manual,
Dnscache,Manual,
ERSvc,Manual,
Eventlog,Auto,
EventSystem,Manual,
FastUserSwitchingCompatibility,Manual,
Fax,Manual,
FontCache3.0.0.0,Manual,
GEARSecurity,Disabled,
helpsvc,Auto,
HidServ,Disabled,
HTTPFilter,Manual,
IDriverT,Manual,
idsvc,Manual,
Imapi Helper,Manual,
ImapiService,Manual,
lanmanserver,Disabled,
lanmanworkstation,Auto,
LexBceS,Disabled,
LiveUpdate,Manual,
LmHosts,Manual,
MBAMService,Disabled,
MDM,Manual,
Messenger,Disabled,
mnmsrvc,Manual,
MSIServer,Manual,
NetDDE,Disabled,
NetDDEdsdm,Disabled,
Netlogon,Manual,
Netman,Manual,
NetTcpPortSharing,Disabled,
Nla,Manual,
NtLmSsp,Manual,
NtmsSvc,Manual,
ose,Manual,
PlugPlay,Auto,
PolicyAgent,Manual,
ProtectedStorage,Auto,
psqlWGE,Disabled,
RasAuto,Disabled,
RasMan,Manual,
RDSessMgr,Manual,
RemoteAccess,Disabled,
RpcLocator,Manual,
RpcSs,Auto,
RSVP,Manual,
SamSs,Auto,
SCardSvr,Manual,
Schedule,Manual,
seclogon,Manual,
SENS,Auto,
SharedAccess,Auto,
ShellHWDetection,Auto,
Spooler,Manual,
srservice,Auto,
SSDPSRV,Manual,
stisvc,Disabled,
SwPrv,Manual,
Symantec RemoteAssist,Manual,
SysmonLog,Manual,
TapiSrv,Manual,
TermService,Auto,
Themes,Auto,
TrkWks,Manual,
upnphost,Manual,
UPS,Manual,
Viewpoint Manager Service,Disabled,
VSS,Manual,
W32Time,Auto,
WebClient,Manual,
winmgmt,Auto,
WmdmPmSN,Manual,
WmiApSrv,Disabled,
WMPNetworkSvc,Manual,
wscsvc,Manual,
wuauserv,Auto,
WudfSvc,Manual,
WZCSVC,Auto,
xmlprov,Manual,

HKLM\System\CurrentControlSet\Control\Terminal
Server\Wds\rdpwd\StartupPrograms
rdpclip
rdpclip
RDP Clip Monitor
Microsoft Corporation
5.1.2600.2180
c:\windows\system32\rdpclip.exe
ab978e64b3cb5b78842bc2bdae19d0cd (MD5)
db49bb6158d12ea7dc9b28ef2ee857edb6015138 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
Userinit Logon Application
Microsoft Corporation
5.1.2600.2180
c:\windows\system32\userinit.exe
39b1ffb03c2296323832acbae50d2aff (MD5)
e5aedcbe25a97c89101f1f3860ff846e94d70445 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exe
Explorer.exe
Windows Explorer
Microsoft Corporation
6.0.2900.3156
c:\windows\explorer.exe
97bd6515465659ff8f3b7be375b2ea87 (MD5)
972307a3ef93680afdd03603df20f2241047a934 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPBootOp
"C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Boot Optimizer
Hewlett-Packard Company
3.0.0.0
c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe
a789b145f17fa5c2326907f4872fe173 (MD5)
f04982c1c82b75b38e5da0ef838b6b2e753b3e6c (SHA-1)
MSConfig
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
System Configuration Utility
Microsoft Corporation
5.1.2600.2764
c:\windows\pchealth\helpctr\binaries\msconfig.exe
3c60aefa68efa2c4d13ab6b68fe82b81 (MD5)
abdb5d622a86473732671f5d5d2d7ba458af656e (SHA-1)

Type Date Time Source Category Event User Computer
Information 4/14/2010 5:29:20 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 5:29:20 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 4:43:17 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 4:28:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 4:28:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 3:41:59 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 3:26:44 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 3:26:44 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 2:40:41 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 2:25:26 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 2:25:26 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:49:45 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:44:30 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:39:15 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:24:00 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:24:00 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:24:00 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:11:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:11:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:11:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Warning 4/14/2010 1:10:13 PM Userenv None 1517 SYSTEM COMPAQ-2006
Information 4/14/2010 1:09:46 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:46 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:09:46 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:09:46 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 1:09:29 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:23 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:17 PM NProtectService None 6 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:13 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:11 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:02 PM MsiInstaller None 11728 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:02 PM MsiInstaller None 11728 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:09:02 PM MsiInstaller None 11728 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:08:36 PM MsiInstaller None 1005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:08:36 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:06:15 PM IDriverT None 0 N/A COMPAQ-2006
Warning 4/14/2010 1:03:23 PM Userenv None 1517 SYSTEM COMPAQ-2006
Information 4/14/2010 1:02:39 PM MsiInstaller None 11725 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:00:04 PM IDriverT None 0 N/A COMPAQ-2006
Information 4/14/2010 12:58:31 PM Norton AntiVirus None 37 SYSTEM COMPAQ-2006
Information 4/14/2010 12:58:30 PM Norton AntiVirus None 36 SYSTEM COMPAQ-2006
Information 4/14/2010 12:54:26 PM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
Information 4/14/2010 12:54:23 PM Norton AntiVirus None 34 SYSTEM COMPAQ-2006

Event Type: Information
Event Source: Automatic LiveUpdate Scheduler
Event Category: Devices
Event ID: 101
Date: 4/14/2010
Time: 4:43:17 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPAQ-2006
Description:
Information Level: success

Rolling back the schedule; execution will occur at approximately 4:48 PM.

Type Date Time Source Category Event User Computer
Error 4/14/2010 5:33:13 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/14/2010 5:31:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 5:29:23 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 4:28:07 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 3:26:47 PM Tcpip None 4201 N/A COMPAQ-2006
Error 4/14/2010 3:26:44 PM Service Control Manager None 7011 N/A COMPAQ-2006
Information 4/14/2010 2:25:29 PM Tcpip None 4201 N/A COMPAQ-2006
Error 4/14/2010 1:28:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/14/2010 1:27:25 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Error 4/14/2010 1:25:29 PM Service Control Manager None 7001 N/A COMPAQ-2006
Information 4/14/2010 1:23:40 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6009 N/A COMPAQ-2006>
Type Date Time Source Category Event User Computer

Error 4/14/2010 5:33:13 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/14/2010 5:31:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 5:29:23 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 4:28:07 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 3:26:47 PM Tcpip None 4201 N/A COMPAQ-2006
Error 4/14/2010 3:26:44 PM Service Control Manager None 7011 N/A COMPAQ-2006
Information 4/14/2010 2:25:29 PM Tcpip None 4201 N/A COMPAQ-2006
Error 4/14/2010 1:28:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/14/2010 1:27:25 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
Error 4/14/2010 1:25:29 PM Service Control Manager None 7001 N/A COMPAQ-2006
Information 4/14/2010 1:23:40 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6009 N/A COMPAQ-2006

I think the last one was a duplicate, pasted differently.
Some of these are a lot longer but I didn't copy what was
still earlier. If you need fuller Event Logs, I have them

But I think it's telling a story, that Auto Live Update
is asking every hour........I don't know if you Disabled it and it
came back somehow, or what, but I hope you do.
Bill

 

[William B. Lurie]

***********************************************************************
John, I completely removed, uninstalled, all Norton stuff and made the
run I said I would. I'll try to show the results below. Note that
every hour, *some*thing is doing Auto Live Update.......but it ain't
Norton. Gotta go, but I'll try to patch the stuff in here.



HKLM\System\CurrentControlSet\Control\Terminal
Server\Wds\rdpwd\StartupPrograms
rdpclip
rdpclip
RDP Clip Monitor
Microsoft Corporation
5.1.2600.2180
c:\windows\system32\rdpclip.exe
ab978e64b3cb5b78842bc2bdae19d0cd (MD5)
db49bb6158d12ea7dc9b28ef2ee857edb6015138 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
Userinit Logon Application
Microsoft Corporation
5.1.2600.2180
c:\windows\system32\userinit.exe
39b1ffb03c2296323832acbae50d2aff (MD5)
e5aedcbe25a97c89101f1f3860ff846e94d70445 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exe
Explorer.exe
Windows Explorer
Microsoft Corporation
6.0.2900.3156
c:\windows\explorer.exe
97bd6515465659ff8f3b7be375b2ea87 (MD5)
972307a3ef93680afdd03603df20f2241047a934 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPBootOp
"C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Boot Optimizer
Hewlett-Packard Company
3.0.0.0
c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe
a789b145f17fa5c2326907f4872fe173 (MD5)
f04982c1c82b75b38e5da0ef838b6b2e753b3e6c (SHA-1)
MSConfig
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
System Configuration Utility
Microsoft Corporation
5.1.2600.2764
c:\windows\pchealth\helpctr\binaries\msconfig.exe
3c60aefa68efa2c4d13ab6b68fe82b81 (MD5)
abdb5d622a86473732671f5d5d2d7ba458af656e (SHA-1)



Type Date Time Source Category Event User Computer
Error 4/14/2010 5:33:13 PM DCOM None 10005
Compaq_Owner COMPAQ-2006
Error 4/14/2010 5:31:51 PM DCOM None 10005
Compaq_Owner COMPAQ-2006
Information 4/14/2010 5:29:23 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 4:28:07 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 3:26:47 PM Tcpip None 4201
N/A COMPAQ-2006
Error 4/14/2010 3:26:44 PM Service Control Manager None
7011 N/A COMPAQ-2006
Information 4/14/2010 2:25:29 PM Tcpip None 4201
N/A COMPAQ-2006
Error 4/14/2010 1:28:51 PM DCOM None 10005
Compaq_Owner COMPAQ-2006
Error 4/14/2010 1:27:25 PM DCOM None 10005
Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Error 4/14/2010 1:25:29 PM Service Control Manager None
7001 N/A COMPAQ-2006
Information 4/14/2010 1:23:40 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6005
N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6009
N/A COMPAQ-2006> Type Date Time Source Category
Event User Computer

I think the last one was a duplicate, pasted differently.
Some of these are a lot longer but I didn't copy what was
still earlier. If you need fuller Event Logs, I have them

But I think it's telling a story, that Auto Live Update
is asking every hour........I don't know if you Disabled it and it
came back somehow, or what, but I hope you do.
Bill

****************************************************
I should snip the above but that can wait.

I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill

 

[William B. Lurie]

William B. Lurie wrote:

I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill

See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System Event 513 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security Logon/Logoff 551
Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to the network, and has initiated normal operation over the network adapter.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....
Bill

 

[John John - MVP]

William B. Lurie wrote:

See these:


Type Date
Success Audit 4/14/2010 11:34:34 PM Security System
Event 513 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security
Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff
528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff
528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event
515 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006


I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....

Please do the clean boot.

John

 

[William B. Lurie]

Please do the clean boot.

John

That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.
Bill

 

[John John - MVP]

That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.

Typically you should only be seeing one (if ever) Event 4201 from TCPIP
when the computer is booted, or when the adapter is disabled or enabled.
Have you always been getting multiple Events 4201? If yes this might
be indicative of faulty or failing network hardware, bad cable, bad
switch, bad router, bad NIC... Try disabling the network adapter and
see what happens, to disable the adapter go in "Network Connections" and
right click on the connection. On your previous effort with a different
clone, did you ever at any time successfully hibernate at 2 hours?

John

 

[William B. Lurie]

Typically you should only be seeing one (if ever) Event 4201 from TCPIP
when the computer is booted, or when the adapter is disabled or enabled.
Have you always been getting multiple Events 4201? If yes this might
be indicative of faulty or failing network hardware, bad cable, bad
switch, bad router, bad NIC... Try disabling the network adapter and
see what happens, to disable the adapter go in "Network Connections" and
right click on the connection. On your previous effort with a different
clone, did you ever at any time successfully hibernate at 2 hours?

John

Can't say if I ever saw multiple 4201 from Tcpip, John. All I can do is
watch for it as we make more runs. I can repeat last run exactly, in the
clone, with Network Connections Disabled. As for ever seeing successful
hibernate at 2 hours, 'ever' is getting to be a long time, and I
really can't say if I ever saw it. I think yes, but really couldn't
swear to it. I'll look at and disable now in the clone, but, remember,
that system has no AV at all and I run it disconnected from the line.
Back at 12:30....
Bill

 

[William B. Lurie]

Typically you should only be seeing one (if ever) Event 4201 from TCPIP
when the computer is booted, or when the adapter is disabled or enabled.
Have you always been getting multiple Events 4201? If yes this might
be indicative of faulty or failing network hardware, bad cable, bad
switch, bad router, bad NIC... Try disabling the network adapter and
see what happens, to disable the adapter go in "Network Connections" and
right click on the connection. On your previous effort with a different
clone, did you ever at any time successfully hibernate at 2 hours?

John

Now 1 PM, John, and a strange thing happened. After almost 2 hours,
power-on light was flashing as usual, and 20 minutes later it had
shut down. Symptomatic of having hibernated! I jiggled mouse, it did
not come alive, as it should not, if it truly was in hibernation. So
I pressed the power-on button, and my desktop came on, without first
giving me a notice that it was coming out of hibernation. At least I
think that's the way it was, but now, dammit, I have to repeat that
run. But I did look at the log, and it showed nothing in the 2-hour
period, just the DCOM implying (I think) that it recorder my bringing
it to life. Only difference between this run and previous was that I
disabled Network Connections. Your comments will be welcome, but I'm
sorry to have to say that I have to confirm my story.
Bill

 

[William B. Lurie]

Now 1 PM, John, and a strange thing happened. After almost 2 hours,
power-on light was flashing as usual, and 20 minutes later it had
shut down. Symptomatic of having hibernated! I jiggled mouse, it did
not come alive, as it should not, if it truly was in hibernation. So
I pressed the power-on button, and my desktop came on, without first
giving me a notice that it was coming out of hibernation. At least I
think that's the way it was, but now, dammit, I have to repeat that
run. But I did look at the log, and it showed nothing in the 2-hour
period, just the DCOM implying (I think) that it recorder my bringing
it to life. Only difference between this run and previous was that I
disabled Network Connections. Your comments will be welcome, but I'm
sorry to have to say that I have to confirm my story.
Bill

Continuing on at 3:25, I confirmed that it really did hibernate, in
perfectly normal, proper manner, after 2 hours. Posting below a piece of
the event logs.

Type Date Time Source Category Event User Computer
Error 4/15/2010 3:10:47 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/15/2010 3:10:47 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/15/2010 1:08:57 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 1:08:57 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 1:08:57 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/15/2010 1:08:57 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 1:08:57 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Error 4/15/2010 1:08:57 PM Service Control Manager None 7001 N/A COMPAQ-2006
Error 4/15/2010 1:08:57 PM Service Control Manager None 7001 N/A COMPAQ-2006
Error 4/15/2010 1:07:39 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/15/2010 1:07:39 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/15/2010 1:07:37 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/15/2010 1:07:19 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/15/2010 1:07:19 PM eventlog None 6009 N/A COMPAQ-2006
Information 4/15/2010 12:44:58 PM eventlog None 6006 N/A COMPAQ-2006

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/15/2010
Time: 3:10:47 PM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The noteworthy events are the *two* identical 10005s after the system
came out of hibernation, and the fact that nothing happened during the
2 hour hibernation to inhibit it. I think the DCOMs are just part of
coming alive. The significant thing is that I can't put my finger on
anything defective in my system. Network Connections is what made it
work. It certainly isn't any kind of an intermittent, because it happens
the same every time. And I haven't changed anything, ever, since the
modem and cabling were installed 3+ years ago. It isn't a portable of
any kind, it's a big, klutzy, solid desktop lying peacefully on its
side in its own drawer, with all cabling tucked away behind. And I think
you asked if it ever did hibernate at 2 hours, and I can't honestly answer.

What to do next? Start putting back into the clone what it needs to
operate? No, I really can't do that, because I don't think there's any
way to put the Norton AV back. Start with a new clone, and disable just
Network Connections, as a test? Simple to do.......

Now I'm ready to listen, John.

 

[John John - MVP]

Continuing on at 3:25, I confirmed that it really did hibernate, in
perfectly normal, proper manner, after 2 hours. Posting below a piece of
the event logs.



The noteworthy events are the *two* identical 10005s after the system
came out of hibernation, and the fact that nothing happened during the
2 hour hibernation to inhibit it. I think the DCOMs are just part of
coming alive. The significant thing is that I can't put my finger on
anything defective in my system. Network Connections is what made it
work. It certainly isn't any kind of an intermittent, because it happens
the same every time. And I haven't changed anything, ever, since the
modem and cabling were installed 3+ years ago. It isn't a portable of
any kind, it's a big, klutzy, solid desktop lying peacefully on its
side in its own drawer, with all cabling tucked away behind. And I think
you asked if it ever did hibernate at 2 hours, and I can't honestly answer.

What to do next? Start putting back into the clone what it needs to
operate? No, I really can't do that, because I don't think there's any
way to put the Norton AV back. Start with a new clone, and disable just
Network Connections, as a test? Simple to do.......

Now I'm ready to listen, John.

You can start with a new clone and give it a try with the network
adapter disabled and see what happens.

John

 

[William B. Lurie]

You can start with a new clone and give it a try with the network
adapter disabled and see what happens.

John

Yes, I thought that would be logical as a starting point. It
will take a while, but 'can do'./Bill

 

[Shenan Stanley]

This is a new thread. See old stuff for history.

Does everyone realize that at this point in the troubleshooting procedure -
if time is money (and for many people it is) and even if it is not a *lot*
of money (let's go with $1.00 / hour - U.S.) that this problem has gone on
long enough now to afford a replacement computer with likely more CPU power,
more hard drive space and a better video device without all the current
trouble by now, eh? ;-)

I mean - really - this computer could be defective.

Just throwing that out there... *grin*

 

[William B. Lurie]

Yes, I thought that would be logical as a starting point. It
will take a while, but 'can do'./Bill

Okay, it's close to 9 PM and I made a clean new clone and Disabled
Network connections, unplugged the line, forgot to kill screen
saver (but that didn't hurt anything). Unplugged printer and camera.

It failed to hibernate but a valid reason popped up. When I
re-energized the system after 2 hours, it said "Norton is
performing background task", so I'll have to prevent that on next
run.
See attached fairly clean Event Logs, and comment, please.

Type Date Time Source Category Event User Computer
Success Audit 4/15/2010 7:17:44 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/15/2010 7:17:44 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:27:40 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:27:40 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:27:40 PM Security Privilege Use 576 LOCAL SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:27:40 PM Security Logon/Logoff 528 LOCAL SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:26:09 PM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:26:09 PM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006
Success Audit 4/15/2010 6:26:09 PM Security Policy Change 850 SYSTEM COMPAQ-2006

Note the events clocked at 50 minutes into the run.......

Type Date Time Source Category Event User Computer
Information 4/15/2010 8:41:05 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 8:41:03 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/15/2010 6:33:22 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 6:33:22 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/15/2010 6:27:41 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 6:27:37 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/15/2010 6:27:37 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/15/2010 6:27:30 PM SRTSP None 2003 N/A COMPAQ-2006
Information 4/15/2010 6:26:27 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/15/2010 6:26:27 PM Service Control Manager None 7036 N/A COMPAQ-2006

Notice, no events until I restarted.
I'll just start another test, trying to disable Norton this time, since
it specifically did something.......I should look at the 7:17 events, too.

 

[William B. Lurie]

Does everyone realize that at this point in the troubleshooting procedure -
if time is money (and for many people it is) and even if it is not a *lot*
of money (let's go with $1.00 / hour - U.S.) that this problem has gone on
long enough now to afford a replacement computer with likely more CPU power,
more hard drive space and a better video device without all the current
trouble by now, eh? ;-)

I mean - really - this computer could be defective.

Just throwing that out there... *grin*

You are 99-44/100 percent right, but the other 0.56% is the
spirit of the scientist who wants to know *why*. I would be
willing to drop the issue any time John wants to throw in
the towel, and I will thank him a thousand-fold for his
invaluable assistance, perseverance, and resourcefulness.

Meanwhile, we are quite close to the solution, as my posting later
this morning will indicate. Getting the Network thing and also
the ever-intrusive Norton background scans out of the way has
given me, overnight, two runs which ran two hours before going
into hibernation.

 

[William B. Lurie]

You are 99-44/100 percent right, but the other 0.56% is the
spirit of the scientist who wants to know *why*. I would be
willing to drop the issue any time John wants to throw in
the towel, and I will thank him a thousand-fold for his
invaluable assistance, perseverance, and resourcefulness.

Meanwhile, we are quite close to the solution, as my posting later
this morning will indicate. Getting the Network thing and also
the ever-intrusive Norton background scans out of the way has
given me, overnight, two runs which ran two hours before going
into hibernation.

To make the successful runs on my Clone system, John, I did
not do Clean Boot, but I Disabled the Networks Connection from Control
Panel, and turned off all Norton Anti Virus (disconnecting from
the line, of course). Oh, I unplugged printer and camera but I
don't expect that is pertinent. I'll see to the Norton part, but
what's your take on the 'Networks Connection' thing? Isn't that
vital to communicating with he web?

 

[John John - MVP]

To make the successful runs on my Clone system, John, I did
not do Clean Boot, but I Disabled the Networks Connection from Control
Panel, and turned off all Norton Anti Virus (disconnecting from
the line, of course). Oh, I unplugged printer and camera but I
don't expect that is pertinent. I'll see to the Norton part, but
what's your take on the 'Networks Connection' thing? Isn't that
vital to communicating with he web?

Yes, the web is a network and all your network traffic flows through
your network adapter, without it you will not be able to get on the web.

So what happens if you keep all your Norton stuff turned off and enable
the adapter?

Also make sure that power saving is not enabled on the adapter. Right
click on the network adapter and select "Properties" then click on the
"Configure" button for the adapter then click on the "Power Management"
tab and make sure that the "Allow the computer to turn off this device
to save power" is *not* selected.

John

 

[William B. Lurie]

Yes, the web is a network and all your network traffic flows through
your network adapter, without it you will not be able to get on the web.

So what happens if you keep all your Norton stuff turned off and enable
the adapter?

Also make sure that power saving is not enabled on the adapter. Right
click on the network adapter and select "Properties" then click on the
"Configure" button for the adapter then click on the "Power Management"
tab and make sure that the "Allow the computer to turn off this device
to save power" is *not* selected.

John

That will be my next step, this morning, and thank you, John.

 

[Unknown]

You give up too easily.

Does everyone realize that at this point in the troubleshooting
procedure - if time is money (and for many people it is) and even if it is
not a *lot* of money (let's go with $1.00 / hour - U.S.) that this problem
has gone on long enough now to afford a replacement computer with likely
more CPU power, more hard drive space and a better video device without
all the current trouble by now, eh? ;-)

I mean - really - this computer could be defective.

Just throwing that out there... *grin*

 

[William B. Lurie]

This last set of comments comes at a funny time, namely, I believe
we have just solved the problem. First on my clone, and now on my
Master drive, I got the system to hibernate at two hours by making
what I believe are *only* two changes.

First, Network Connections.....>>Power Options....
Do *not* allow it to turnoff device.........

Second, in Norton Anti-Virus, set it for 'Silent Mode'
(whatever that means) and set its 'Idle Time Scan' for the
maximum it allows, namely six hours.

It has hibernated at 2 hours twice so far, and I intend to give it
more opportunities........

But that Norton 'feature' to me is something I'm going to complain
to them about. If I don't want it to scan except when I want it to,
I should have that privilege! They really do too many things that
way...you know, the 'Big Brother knows best' syndrome.

You give up too easily.