Event viewer

[William B. Lurie]

You nice folks led me to Event Viewer not too long ago, and
in studying it, I find under Applications that Automatic Live
Update is being run every 3 hours. It isn't my Norton Anti-
Virus Live Update, and I do not allow Windows Live Update to
run. Or at least I think I have it set so that I run Windows
Update when I choose to do so.

How can I track down what is running so often, and preventing
my system from hibernating as a result?

Thank you.

 

[Smiles]

can you give me the link to the viewer I need one

thanks

 

[William B. Lurie]

can you give me the link to the viewer I need one

thanks

 

[Gerry]

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Jose]

You nice folks led me to Event Viewer not too long ago, and
in studying it, I find under Applications that Automatic Live
Update is being run every 3 hours. It isn't my Norton Anti-
Virus Live Update, and I do not allow Windows Live Update to
run. Or at least I think I have it set so that I run Windows
Update when I choose to do so.

How can I track down what is running so often, and preventing
my system from hibernating as a result?

Thank you.

Provide more information:

Minimize back and forth Q&A and eliminate guesswork and assumptions:

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select
All, Copy and then paste
back here.

There will be some personal information (like System Name and User
Name), and whatever appears to
be private information to you, just delete from the pasted
information.

What are your system settings regarding Hibernation? Mine is set to
hibernate after 30 minutes of inactivity, but I can also hibernate
anytime. Which does not work for you?

Has hibernation ever worked?

If you click Start, Turn Off Computer and press the Shift key, does
the Stand By button turn into a Hibernate button and then if you click
Hibernate does your system enter hibernation?

Let's see this event you see:

Look in the Event Viewer for clues around the time of the incident

Here is a method to post the specific information about individual
events.

To see the Event Viewer logs, click Start, Settings, Control Panel,
Administrative Tools, Event Viewer.

A shortcut to Event Viewer is to click Start, Run and in the box
enter:

%SystemRoot%\system32\eventvwr.msc

Click OK to launch the Event Viewer.

The most interesting logs are usually the Application and System.
Some logs may be almost or completely empty.
Not every event is a problem, some are informational messages that
things are working okay and some are warnings.
No event should defy reasonable explanation.

Each event is sorted by Date and Time. Errors will have red Xs,
Warnings will have yellow !s.
Information messages have white is. Not every Error or Warning event
means there is a serious issue.
Some are excusable at startup time when Windows is booting. Try to
find just the events at the date
and time around your problem.

If you double click an event, it will open a Properties windows with
more information. On the right are
black up and down arrow buttons to scroll through the open events. The
third button that looks like
two pages on top of each other is used to copy the event details to
your Windows clipboard.

When you find an interesting event that occurred around the time of
your issue, click the third button
under the up and down arrows to copy the details and then you can
paste the details (right click, Paste
or CTRL-V) the detail text back here for analysis.

To get a fresh start on any Event Viewer log, you can choose to clear
the log (backing up the log is offered),
then reproduce your issue, then look at just the events around the
time of your issue.

 

[William B. Lurie]

Thank you, Gerry. I find that the biggest offender is
Automatic Live Update Scheduler, and the only ones I'm
aware of on my system are Norton Anti-Virus, whose Live
Updater I have off, and Windows Update, which I also do
only when I'm in the mood.

 

[Bruce Chambers]

You nice folks led me to Event Viewer not too long ago, and
in studying it, I find under Applications that Automatic Live
Update is being run every 3 hours. It isn't my Norton Anti-
Virus Live Update, and I do not allow Windows Live Update to
run. Or at least I think I have it set so that I run Windows
Update when I choose to do so.

How can I track down what is running so often, and preventing
my system from hibernating as a result?

Thank you.

Many applications now install automatic update "features," so it's a
bit hard to narrow it down. Do you have, for instance, Java or Acrobat
Reader installed? Both have automatic updates features that the
computer user is not warned about when installing them. Also, while I
don't think this is the cause in this particular case, do you have your
WinXP clock configured to automatically synchronize with an Internet
time server? (Haven't used WinXP for a couple of years, so I've
forgotten some of the details, such as the frequency of those checks.)

To try narrowing down which application is doing this, double-click on
the pertinent entry in the application log to see if it will identify a
specific executable file's name. You can also use MSConfig to see what
is starting with the computer. Also, just in case someone tried to be
clever, you can check for Scheduled Tasks that would show up in the
usual "Startup" locations.


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[glee]

Automatic Live Update Scheduler is from Symantec (Norton) Live Update.
You may have turned it off, but it doesn't agree.

Automatic live update Norton. how to schedule?
http://www.windowsbbs.com/other-software/68671-automatic-live-update-norton-how-schedule.html

Turning Off Norton's Automatic Liveupdate -
http://forums.techguy.org/all-other-software/628975-turning-off-nortons-automatic-liveupdate.html

 

[Gerry]

William

I suggest you post an exact copy of the actual report.

--


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[William B. Lurie]

Gerry, I found that Norton System Works Premier, which
has a separate menu for such things, has a place where
I can choose "Turn off all automatic updates". I
did that several hours ago, and now the events have
trickled down to a very few.

Let's wait a day and see if it resets itself.

 

[William B. Lurie]

Many applications now install automatic update "features," so it's a
bit hard to narrow it down. Do you have, for instance, Java or Acrobat
Reader installed? Both have automatic updates features that the
computer user is not warned about when installing them. Also, while I
don't think this is the cause in this particular case, do you have your
WinXP clock configured to automatically synchronize with an Internet
time server? (Haven't used WinXP for a couple of years, so I've
forgotten some of the details, such as the frequency of those checks.)

To try narrowing down which application is doing this, double-click
on the pertinent entry in the application log to see if it will identify
a specific executable file's name. You can also use MSConfig to see
what is starting with the computer. Also, just in case someone tried to
be clever, you can check for Scheduled Tasks that would show up in the
usual "Startup" locations.

Thanks for the added clues, Bruce. I do get notices about
downloading updates for Adobe Reader, but never Java. The
only clock reset that I have pings an atomic clock site,
but only on my request.

As I messaged, I found in Norton System Works a place
that ostensibly turns off auto updates, and I'll look
again tomorrow to see what happened overnight.

And it's back to hibernating after an hour so maybe
the intrusions have ceased.

 

[VanguardLH]

Gerry, I found that Norton System Works Premier, which
has a separate menu for such things, has a place where
I can choose "Turn off all automatic updates". I
did that several hours ago, and now the events have
trickled down to a very few.

But doesn't that also mean that you won't get signature and/or program
updates for your Norton security program? You would end up with an out-of-
date Norton product.

 

[William B. Lurie]

But doesn't that also mean that you won't get signature and/or program
updates for your Norton security program? You would end up with an out-of-
date Norton product.

I turned off all *automatic* updates. I can still do
Live Update when I choose to do so.

 

[William B. Lurie]

I turned off all *automatic* updates. I can still do
Live Update when I choose to do so.

*************************************************
And now, some evidence and a question.
Overnight it did something every hour that
prevented it from going to hibernate. Or even screen saver!

Here's the event log:

http://bellsouthpwp.net/b/i/billurie/events.evt

Can someone please tell me how to interpret what it shows?
(By the way, I uploaded the file but my notepad can't read
it; I hope somebody can!)

 

[William B. Lurie]

*************************************************
And now, some evidence and a question.
Overnight it did something every hour that
prevented it from going to hibernate. Or even screen saver!

Here's the event log:

http://bellsouthpwp.net/b/i/billurie/events.evt

Can someone please tell me how to interpret what it shows?
(By the way, I uploaded the file but my notepad can't read
it; I hope somebody can!)

Here is a screen shot of the events log.......maybe more
decipherable.......

http://bellsouthpwp.net/b/i/billurie/events.jpg

 

[JD]

Here is a screen shot of the events log.......maybe more
decipherable.......

http://bellsouthpwp.net/b/i/billurie/events.jpg

Go back to the events log and double left mouse click on one of the
errors. That will bring up the Event Properties. On the upper right side
of that window will be an up and down arrow and two little pages. Left
mouse click on the two pages. Then open Notepad and either hit Ctrl V or
click on Edit and select Paste. Now you have a copy of the error
properties and maybe you or someone here can tell you what is causing
the error.

 

[William B. Lurie]

Go back to the events log and double left mouse click on one of the
errors. That will bring up the Event Properties. On the upper right side
of that window will be an up and down arrow and two little pages. Left
mouse click on the two pages. Then open Notepad and either hit Ctrl V or
click on Edit and select Paste. Now you have a copy of the error
properties and maybe you or someone here can tell you what is causing
the error.

Great instructions, JD, and here's one typical 'event'.

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 2/13/2010
Time: 6:38:44 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: COMPAQ-2006
Description:
IPSec Services: IPSec Services failed to get the complete
list of network interfaces on the machine. This can be a potential
security hazard to the machine since some of the network interfaces
may not get the protection as desired by the applied IPSec filters.
Please run IPSec monitor snap-in to further diagnose the problem.


That, of course, leads me to another place I've never been before...
IPSec monitor snap-in. And now.......??

 

[Unknown]

Why don't you simply shut down NORTON?

Great instructions, JD, and here's one typical 'event'.

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 2/13/2010
Time: 6:38:44 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: COMPAQ-2006
Description:
IPSec Services: IPSec Services failed to get the complete
list of network interfaces on the machine. This can be a potential
security hazard to the machine since some of the network interfaces
may not get the protection as desired by the applied IPSec filters.
Please run IPSec monitor snap-in to further diagnose the problem.


That, of course, leads me to another place I've never been before...
IPSec monitor snap-in. And now.......??

 

[William B. Lurie]

All of the old complaints about Norton and Symantec
taken into consideration, they have cleaned up their act
tremendously over the years, and are extremely helpful and
have kept my machines free of (most) intruders very well.
They do try to do too many things for me automatically,
but I have it tuned so that I am in control. This
automatic live update thing, I changed back to manual,
so I'm not going to shut them down.

 

[JD]

Great instructions, JD, and here's one typical 'event'.

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 2/13/2010
Time: 6:38:44 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: COMPAQ-2006
Description:
IPSec Services: IPSec Services failed to get the complete
list of network interfaces on the machine. This can be a potential
security hazard to the machine since some of the network interfaces
may not get the protection as desired by the applied IPSec filters.
Please run IPSec monitor snap-in to further diagnose the problem.


That, of course, leads me to another place I've never been before...
IPSec monitor snap-in. And now.......??

Hopefully somebody will come along and tell you what this all means. I
know how to generate the .txt file but I'm not sure what the problem is.

I use http://www.ask.com so you can see what you can find there.
Search for: IPSec monitor snap-in

A good question for this type of problem is; when did the problem start
and what changes were made to your computer around the time you first
noticed the problem?