WIA and hibernation again
in [Windows XP Basics]
|
Prev: Pressing Change Password -button in WIN XP causes reboot
Next: Microsoft caught pirating somebody's patent again!!!
From: William B. Lurie on 28 Mar 2010 02:27 William B. Lurie wrote: > William B. Lurie wrote: >> William B. Lurie wrote: >>> William B. Lurie wrote: >>>> John John - MVP wrote: >>>>> William B. Lurie wrote: >>>>>> William B. Lurie wrote: >>>>>>> John John - MVP wrote: >>>>>>>> >>>>>>>> If I understand correctly, you have the machine set to hibernate >>>>>>>> after 2 hours of inactivity but it can't enter the hibernation >>>>>>>> state because something keeps it awake... >>>>>>>> >>>>>>>> This is what I would try: >>>>>>>> >>>>>>>> Reboot the machine and don't do anything whatsoever after it >>>>>>>> boots, leave it alone for the time set for hibernation and see >>>>>>>> if it does hibernate. >>>>>>>> >>>>>>>> If it doesn't hibernate I would then try a clean boot and once >>>>>>>> again not touch the machine for the set time and see if it does >>>>>>>> hibernate. >>>>>>>> >>>>>>>> http://support.microsoft.com/kb/310353 >>>>>>>> How to configure Windows XP to start in a "clean boot" state >>>>>>>> >>>>>>>> John >>>>>>> >>>>>>> John, I followed instructions. Touched NOTHING for 4 hours >>>>>>> (hibernate set at 2). Power-on light on tower was flashing >>>>>>> and it never went to hibernate. I'll read the Clean Boot >>>>>>> instructions >>>>>>> again. Last time I thought it was quite an effort, but this is >>>>>>> this time. Maybe this evening. >>>>>> >>>>>> I took another small step, John. I like to try new things on my Clone >>>>>> system before I take a chance with my Main Drive......so I printed >>>>>> out KB310353 and followed its Method 2 on my clone system. It was >>>>>> very >>>>>> easy, and I did it and immediately went away for 2-3/4 hours >>>>>> ......and >>>>>> when I returned, the power light on my tower was blinking, the screen >>>>>> was on, and was not even in Screen Saver mode, which to me means that >>>>>> some Event occurred. It goes to Screen Saver at 10 minutes. I >>>>>> undid the >>>>>> msconfig changes and returned here, to my Master Drive. >>>>>> >>>>>> So I would judge that Clean Boot didn't show any difference. What's >>>>>> your next advice? >>>>> >>>>> Take a look in the Event Viewer and see if anything relevant is >>>>> logged. Check the log on the clone too. >>>>> >>>>> John >>>> The scene changes again, John. I just heard from Symantec, that >>>> Norton AntiVirus does do Idle Time Scan. I had it set for >>>> "Quarterly" so it >>>> should not have interfered. But with their help, I reset it to *never* >>>> and maybe that will be the answer. I can live with no idle time scans. >>>> So put my other testing on hold while I find out if hibernate now >>>> works right. >>> Three hours later. At 8:55 I set Idle Scan at Never, rebooted, >>> and went away. Three hours later, it had not gone into hibernation, >>> and Events Log showed *no* events in that period, but was >>> obviously alive and recording things. I am of the opinion that >>> Norton Anti-Virus is not the source of the problem. And I'm not about >>> to change horses and use MSE (as Unk just suggested). There has to >>> be a reason why it doesn't hibernate after 2 hours, and the events >>> log doesn't show it. >>> >>> I'm going back to Clone, Disable Norton, do a Clean Boot, and let 3 >>> hours go by, and look at Events Log as you suggested, John. I won't >>> be back on until 1600 EDT. >> >> I didn't do it right, and will do it again later this evening. Sorry. > > I think I did it right this time, John, and it still didn't go to > hibernate, and left events periodically in Events Log. I'll let > it run all night tonight, and have more data in the morning, and will > b extra keerful this time. Mwanwhile, perhaps these are of value: > >> These Windows services are started: >> >> Application Layer Gateway Service >> Automatic Updates >> COM+ Event System >> Cryptographic Services >> DCOM Server Process Launcher >> DHCP Client >> Distributed Link Tracking Client >> DNS Client >> Error Reporting Service >> Event Log >> Fast User Switching Compatibility >> Help and Support >> IPSEC Services >> Network Connections >> Network Location Awareness (NLA) >> Plug and Play >> Print Spooler >> Protected Storage >> Remote Access Connection Manager >> Remote Procedure Call (RPC) >> Secondary Logon >> Security Accounts Manager >> Server >> Shell Hardware Detection >> SSDP Discovery Service >> System Event Notification >> Task Scheduler >> TCP/IP NetBIOS Helper >> Telephony >> Terminal Services >> Themes >> WebClient >> Windows Audio >> Windows Firewall/Internet Connection Sharing (ICS) >> Windows Image Acquisition (WIA) >> Windows Management Instrumentation >> Windows Time >> Wireless Zero Configuration >> Workstation >> >> The command completed successfully. >> > > Image Name PID Services > > ========================= ====== > ============================================= > System Idle Process 0 N/A > > System 4 N/A > > smss.exe 1200 N/A > > csrss.exe 1284 N/A > > winlogon.exe 1316 N/A > > services.exe 1360 Eventlog, PlugPlay > > lsass.exe 1372 PolicyAgent, ProtectedStorage, SamSs > > svchost.exe 1532 DcomLaunch, TermService > > svchost.exe 1632 RpcSs > > svchost.exe 1784 AudioSrv, CryptSvc, Dhcp, ERSvc, > > EventSystem, > FastUserSwitchingCompatibility, > helpsvc, lanmanserver, > lanmanworkstation, > Netman, Nla, RasMan, Schedule, > seclogon, > SENS, SharedAccess, ShellHWDetection, > > TapiSrv, Themes, TrkWks, W32Time, > winmgmt, > wuauserv, WZCSVC > > svchost.exe 1872 Dnscache > > svchost.exe 232 LmHosts, SSDPSRV > > spoolsv.exe 556 Spooler > > explorer.exe 816 N/A > > svchost.exe 904 WebClient > > svchost.exe 976 stisvc > > PrintScreen.exe 1864 N/A > > alg.exe 1712 ALG > > cmd.exe 1728 N/A > > tasklist.exe 652 N/A > > wmiprvse.exe 1136 N/A > > I am able to send some more before I shut down. > Note the Events Log.....I left it at around 7:48 > and came back and saw that it was not going to > hibernate, at 10:36 .... meanwhile please note the > events in betweem which I guess are what caused it not > to hibernate. The 7036's. Maybe you can make something > of this, John. I do think I did it right this time. > > >> Type Date Time Source Category Event User Computer >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7035 Compaq_Owner COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 3/27/2010 10:56:32 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Error 3/27/2010 10:56:32 PM Service Control Manager >> None 7026 N/A COMPAQ-2006 >> Information 3/27/2010 10:54:44 PM Tcpip None 4201 >> N/A COMPAQ-2006 >> Information 3/27/2010 10:55:03 PM eventlog None 6005 >> N/A COMPAQ-2006 >> Information 3/27/2010 10:55:03 PM eventlog None 6009 >> N/A COMPAQ-2006 >> Information 3/27/2010 10:36:00 PM eventlog None 6006 >> N/A COMPAQ-2006 >> Information 3/27/2010 10:19:27 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 9:18:02 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 7:48:35 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 7:48:35 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 7:48:35 PM Service Control Manager >> None 7035 SYSTEM COMPAQ-2006 >> Information 3/27/2010 7:48:35 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> Information 3/27/2010 7:48:35 PM Service Control Manager >> None 7036 N/A COMPAQ-2006 >> And expanding that one Event out, we see: > Event Type: Information > Event Source: Service Control Manager > Event Category: None > Event ID: 7036 > Date: 3/27/2010 > Time: 9:18:02 PM > User: N/A > Computer: COMPAQ-2006 > Description: > The Windows Image Acquisition (WIA) service entered the running state. > > So, are we back to continuing to try to find out what caused WIA to enter the running state? It was listed as a System event....and I believe it says the Service Control Manager was the Source of the event.
From: Unknown on 29 Mar 2010 11:52 Since you have Viewpoint Manager Service started in services, have you opened it and disabled auto update? Could be this service is looking for updates for viewpoint products and thusly not allowing hibernation. "William B. Lurie" <billurie(a)nospam.net> wrote in message news:%23djV5%23jzKHA.4328(a)TK2MSFTNGP04.phx.gbl... > William B. Lurie wrote: >> William B. Lurie wrote: >>> William B. Lurie wrote: >>>> William B. Lurie wrote: >>>>> John John - MVP wrote: >>>>>> William B. Lurie wrote: >>>>>>> William B. Lurie wrote: >>>>>>>> John John - MVP wrote: >>>>>>>>> >>>>>>>>> If I understand correctly, you have the machine set to hibernate >>>>>>>>> after 2 hours of inactivity but it can't enter the hibernation >>>>>>>>> state because something keeps it awake... >>>>>>>>> >>>>>>>>> This is what I would try: >>>>>>>>> >>>>>>>>> Reboot the machine and don't do anything whatsoever after it >>>>>>>>> boots, leave it alone for the time set for hibernation and see if >>>>>>>>> it does hibernate. >>>>>>>>> >>>>>>>>> If it doesn't hibernate I would then try a clean boot and once >>>>>>>>> again not touch the machine for the set time and see if it does >>>>>>>>> hibernate. >>>>>>>>> >>>>>>>>> http://support.microsoft.com/kb/310353 >>>>>>>>> How to configure Windows XP to start in a "clean boot" state >>>>>>>>> >>>>>>>>> John >>>>>>>> >>>>>>>> John, I followed instructions. Touched NOTHING for 4 hours >>>>>>>> (hibernate set at 2). Power-on light on tower was flashing >>>>>>>> and it never went to hibernate. I'll read the Clean Boot >>>>>>>> instructions >>>>>>>> again. Last time I thought it was quite an effort, but this is >>>>>>>> this time. Maybe this evening. >>>>>>> >>>>>>> I took another small step, John. I like to try new things on my >>>>>>> Clone >>>>>>> system before I take a chance with my Main Drive......so I printed >>>>>>> out KB310353 and followed its Method 2 on my clone system. It was >>>>>>> very >>>>>>> easy, and I did it and immediately went away for 2-3/4 hours >>>>>>> ......and >>>>>>> when I returned, the power light on my tower was blinking, the >>>>>>> screen >>>>>>> was on, and was not even in Screen Saver mode, which to me means >>>>>>> that >>>>>>> some Event occurred. It goes to Screen Saver at 10 minutes. I undid >>>>>>> the >>>>>>> msconfig changes and returned here, to my Master Drive. >>>>>>> >>>>>>> So I would judge that Clean Boot didn't show any difference. What's >>>>>>> your next advice? >>>>>> >>>>>> Take a look in the Event Viewer and see if anything relevant is >>>>>> logged. Check the log on the clone too. >>>>>> >>>>>> John >>>>> The scene changes again, John. I just heard from Symantec, that Norton >>>>> AntiVirus does do Idle Time Scan. I had it set for "Quarterly" so it >>>>> should not have interfered. But with their help, I reset it to *never* >>>>> and maybe that will be the answer. I can live with no idle time scans. >>>>> So put my other testing on hold while I find out if hibernate now >>>>> works right. >>>> Three hours later. At 8:55 I set Idle Scan at Never, rebooted, >>>> and went away. Three hours later, it had not gone into hibernation, >>>> and Events Log showed *no* events in that period, but was >>>> obviously alive and recording things. I am of the opinion that >>>> Norton Anti-Virus is not the source of the problem. And I'm not about >>>> to change horses and use MSE (as Unk just suggested). There has to >>>> be a reason why it doesn't hibernate after 2 hours, and the events >>>> log doesn't show it. >>>> >>>> I'm going back to Clone, Disable Norton, do a Clean Boot, and let 3 >>>> hours go by, and look at Events Log as you suggested, John. I won't >>>> be back on until 1600 EDT. >>> >>> I didn't do it right, and will do it again later this evening. Sorry. >> >> I think I did it right this time, John, and it still didn't go to >> hibernate, and left events periodically in Events Log. I'll let >> it run all night tonight, and have more data in the morning, and will >> b extra keerful this time. Mwanwhile, perhaps these are of value: >> >>> These Windows services are started: >>> >>> Application Layer Gateway Service >>> Automatic Updates >>> COM+ Event System >>> Cryptographic Services >>> DCOM Server Process Launcher >>> DHCP Client >>> Distributed Link Tracking Client >>> DNS Client >>> Error Reporting Service >>> Event Log >>> Fast User Switching Compatibility >>> Help and Support >>> IPSEC Services >>> Network Connections >>> Network Location Awareness (NLA) >>> Plug and Play >>> Print Spooler >>> Protected Storage >>> Remote Access Connection Manager >>> Remote Procedure Call (RPC) >>> Secondary Logon >>> Security Accounts Manager >>> Server >>> Shell Hardware Detection >>> SSDP Discovery Service >>> System Event Notification >>> Task Scheduler >>> TCP/IP NetBIOS Helper >>> Telephony >>> Terminal Services >>> Themes >>> WebClient >>> Windows Audio >>> Windows Firewall/Internet Connection Sharing (ICS) >>> Windows Image Acquisition (WIA) >>> Windows Management Instrumentation >>> Windows Time >>> Wireless Zero Configuration >>> Workstation >>> >>> The command completed successfully. >>> >> >> Image Name PID Services >> >> ========================= ====== >> ============================================= >> System Idle Process 0 N/A >> >> System 4 N/A >> >> smss.exe 1200 N/A >> >> csrss.exe 1284 N/A >> >> winlogon.exe 1316 N/A >> >> services.exe 1360 Eventlog, PlugPlay >> >> lsass.exe 1372 PolicyAgent, ProtectedStorage, SamSs >> >> svchost.exe 1532 DcomLaunch, TermService >> >> svchost.exe 1632 RpcSs >> >> svchost.exe 1784 AudioSrv, CryptSvc, Dhcp, ERSvc, >> >> EventSystem, >> FastUserSwitchingCompatibility, >> helpsvc, lanmanserver, >> lanmanworkstation, >> Netman, Nla, RasMan, Schedule, >> seclogon, >> SENS, SharedAccess, ShellHWDetection, >> >> TapiSrv, Themes, TrkWks, W32Time, >> winmgmt, >> wuauserv, WZCSVC >> >> svchost.exe 1872 Dnscache >> >> svchost.exe 232 LmHosts, SSDPSRV >> >> spoolsv.exe 556 Spooler >> >> explorer.exe 816 N/A >> >> svchost.exe 904 WebClient >> >> svchost.exe 976 stisvc >> >> PrintScreen.exe 1864 N/A >> >> alg.exe 1712 ALG >> >> cmd.exe 1728 N/A >> >> tasklist.exe 652 N/A >> >> wmiprvse.exe 1136 N/A >> >> I am able to send some more before I shut down. >> Note the Events Log.....I left it at around 7:48 >> and came back and saw that it was not going to >> hibernate, at 10:36 .... meanwhile please note the >> events in betweem which I guess are what caused it not >> to hibernate. The 7036's. Maybe you can make something >> of this, John. I do think I did it right this time. >> >> >>> Type Date Time Source Category Event User Computer >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7035 Compaq_Owner COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 3/27/2010 10:56:32 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Error 3/27/2010 10:56:32 PM Service Control Manager None >>> 7026 N/A COMPAQ-2006 >>> Information 3/27/2010 10:54:44 PM Tcpip None 4201 N/A >>> COMPAQ-2006 >>> Information 3/27/2010 10:55:03 PM eventlog None 6005 >>> N/A COMPAQ-2006 >>> Information 3/27/2010 10:55:03 PM eventlog None 6009 >>> N/A COMPAQ-2006 >>> Information 3/27/2010 10:36:00 PM eventlog None 6006 >>> N/A COMPAQ-2006 >>> Information 3/27/2010 10:19:27 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 9:18:02 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 7:48:35 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 7:48:35 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 7:48:35 PM Service Control Manager >>> None 7035 SYSTEM COMPAQ-2006 >>> Information 3/27/2010 7:48:35 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> Information 3/27/2010 7:48:35 PM Service Control Manager >>> None 7036 N/A COMPAQ-2006 >>> > And expanding that one Event out, we see: > >> Event Type: Information >> Event Source: Service Control Manager >> Event Category: None >> Event ID: 7036 >> Date: 3/27/2010 >> Time: 9:18:02 PM >> User: N/A >> Computer: COMPAQ-2006 >> Description: >> The Windows Image Acquisition (WIA) service entered the running state. >> >> So, are we back to continuing to try to find out what caused > WIA to enter the running state? It was listed as a System > event....and I believe it says the Service Control Manager was > the Source of the event.
From: William B. Lurie on 29 Mar 2010 12:58 Unknown wrote: > Since you have Viewpoint Manager Service started in services, have you > opened it and disabled auto update? > Could be this service is looking for updates for viewpoint products and > thusly not allowing hibernation. (snip) Well, I didn't consciously install it, have never intentionally used it and don't know what it's for, I'll certainly disable it and see what that does for me, good or bad. Thanks.
From: William B. Lurie on 30 Mar 2010 07:25 William B. Lurie wrote: > Unknown wrote: >> Since you have Viewpoint Manager Service started in services, have you >> opened it and disabled auto update? >> Could be this service is looking for updates for viewpoint products >> and thusly not allowing hibernation. > > (snip) > Well, I didn't consciously install it, have never intentionally used > it and don't know what it's for, I'll certainly disable it and see > what > that does for me, good or bad. Thanks. And now, John, some new evidence elicited from Clean Booth overnight run on Clone system, with phone line disconnected: Note that the first of the questionable Events on System was a newbie.... Application Layer Gateway Service started.....From then on, it was every hour, another intrusion calol to WIA..... Does that tell anything? > Type Date Time Source Category Event User Computer > Information 3/30/2010 6:30:57 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/30/2010 5:29:47 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/30/2010 4:28:29 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/30/2010 3:27:11 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/30/2010 2:25:53 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/30/2010 1:24:35 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/30/2010 12:23:17 AM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 11:21:52 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006 > > Event Type: Information > Event Source: Service Control Manager > Event Category: None > Event ID: 7035 > Date: 3/29/2010 > Time: 10:20:12 PM > User: NT AUTHORITY\SYSTEM > Computer: COMPAQ-2006 > Description: > The Application Layer Gateway Service service was successfully sent a start control. > > For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
From: John John - MVP on 30 Mar 2010 08:32
William B. Lurie wrote: > William B. Lurie wrote: >> Unknown wrote: >>> Since you have Viewpoint Manager Service started in services, have >>> you opened it and disabled auto update? >>> Could be this service is looking for updates for viewpoint products >>> and thusly not allowing hibernation. >> >> (snip) >> Well, I didn't consciously install it, have never intentionally used >> it and don't know what it's for, I'll certainly disable it and see >> what >> that does for me, good or bad. Thanks. > > And now, John, some new evidence elicited from Clean Booth overnight > run on Clone system, with phone line disconnected: > > Note that the first of the questionable Events on System was a > newbie.... Application Layer Gateway Service started.....From > then on, it was every hour, another intrusion calol to WIA..... > Does that tell anything? I'm not so sure that your "Clean Boot" is all that clean... I suspect that Norton plays a role in the ALG request to the Service Control Manager. The WIA... I suspect your web cam or your Lexmark printer. From the clone after you boot do the Net Start and the Tasklist /svc commands and see what is running when you clean boot. Also run the AT command, it should return "There are no entries in the list". John |