WIA and hibernation again [Windows XP Basics]

Prev: Pressing Change Password -button in WIN XP causes reboot
Next: Microsoft caught pirating somebody's patent again!!!

From: William B. Lurie on 9 Apr 2010 18:27

From: William B. Lurie on 9 Apr 2010 18:29

Unknown wrote:
> What is the status of "speed disk" when failing to hibernate?

Disabled......but let me add that my system, the one I test with,
has Speed Disk disabled.

> "William B. Lurie" <billurie(a)nospam.net> wrote in message
> news:u0EKbI%231KHA.3652(a)TK2MSFTNGP04.phx.gbl...
>> William B. Lurie wrote:
>> (snip)
>>>>>> COMPAQ-2006
>>>>>> Information 4/8/2010 2:20:52 PM Tcpip None 4201 N/A
>>>>>> COMPAQ-2006
>>>>>> Information 4/8/2010 2:21:11 PM eventlog None 6005
>>>>>> N/A COMPAQ-2006
>>>>>> Information 4/8/2010 2:21:11 PM eventlog None 6009
>>>>>> N/A COMPAQ-2006
>>>>>>
>>>>>> Event Type: Information
>>>>>> Event Source: Ci
>>>>>> Event Category: CI Service Event ID: 4137
>>>>>> Date: 4/8/2010
>>>>>> Time: 2:47:52 PM
>>>>>> User: N/A
>>>>>> Computer: COMPAQ-2006
>>>>>> Description:
>>>>>> CI has started for catalog c:\system volume information\catalog.wci.
>>>>>>
>>>>> John, what the above shows, time-wise, is that however I set it up,
>>>>> it was after I made that whole batch automatic. I walked away at 2:21,
>>>>> and at 2:28 and again at 2:40-ish something interfered, and of course
>>>>> it never ended up hibernating.
>>>> Is the machine still connected to the internet or to a LAN? Disconnect
>>>> from both while you troubleshoot the problem!
>>>>
>>>> John
>>> John, I thought I made that clear. On each and every test run,
>>> I restart the computer in order to reboot to the the test system,
>>> and while it is booting, I physically disconnect the phone line
>>> as it enters the modem from the wall outlet. As for LAN.......
>>> I am a poor single-line homeowner with only one line of access
>>> to the world of information, other than Comcast cable for TV.
>>>
>>> And as for Ci which we discussed earlier, I can't put my finger on it;
>>> please tell me again what to disable to stop it from cataloguing
>>> system volume information at what appears to be random odd times.
>>>
>>> I have another overnight run to report later, showing that
>>> same intervention.
>>> Bill
>> But continuing on, another few bits of news.
>> I Disabled Indexing Service at 5:55 A.M. this morning and rebooted.
>> At 0700 screen was still black, power light still flashing, and I
>> thought maybe it would go the full 2 hours......only had 55 minutes
>> to go. At 0745 on came the desktop, followed by the "Preparing to standby"
>> message, and I figured I wouldn't wait another 100 minutes
>> to see if it would hibernate. More important to report what the Events
>> were. I filed the following from the Log:
>>
>>> Type Date Time Source Category Event User Computer
>>> Warning 4/9/2010 5:56:51 AM EventSystem (54) 4353 N/A COMPAQ-2006
>>> Warning 4/9/2010 5:56:51 AM EventSystem (52) 4356 N/A COMPAQ-2006
>>> Warning 4/9/2010 5:56:51 AM EventSystem (54) 4353 N/A COMPAQ-2006
>>> Warning 4/9/2010 5:56:51 AM EventSystem (52) 4356 N/A COMPAQ-2006
>>> Information 4/9/2010 5:56:47 AM ASP.NET 2.0.50727.0 None 1076 N/A
>>> COMPAQ-2006
>>> Warning 4/9/2010 5:52:17 AM EventSystem (54) 4353 N/A COMPAQ-2006
>>> Warning 4/9/2010 5:52:17 AM EventSystem (52) 4356 N/A COMPAQ-2006
>>> Warning 4/9/2010 5:52:17 AM EventSystem (54) 4353 N/A COMPAQ-2006
>>> Warning 4/9/2010 5:52:17 AM EventSystem (52) 4356 N/A COMPAQ-2006
>>> Information 4/9/2010 5:52:11 AM ASP.NET 2.0.50727.0 None 1076 N/A
>>> COMPAQ-2006
>>> Information 4/9/2010 1:18:32 AM Ci CI Service 4103 N/A COMPAQ-2006
>>> Information 4/8/2010 9:55:34 PM Ci CI Service 4137 N/A COMPAQ-2006
>>>
>>> Event Type: Information
>>> Event Source: ASP.NET 2.0.50727.0
>>> Event Category: None
>>> Event ID: 1076
>>> Date: 4/9/2010
>>> Time: 5:56:47 AM
>>> User: N/A
>>> Computer: COMPAQ-2006
>>> Description:
>>> State server starts listening with 3 listeners
>>>
>>> Type Date Time Source Category Event User Computer
>>> Error 4/9/2010 5:56:07 AM ntfs Disk 55 N/A COMPAQ-2006
>>> Error 4/9/2010 5:56:04 AM ntfs Disk 55 N/A COMPAQ-2006
>>> Information 4/9/2010 5:56:04 AM Tcpip None 4201 N/A COMPAQ-2006
>>> Information 4/9/2010 5:56:24 AM eventlog None 6005 N/A COMPAQ-2006
>>> Information 4/9/2010 5:56:24 AM eventlog None 6009 N/A COMPAQ-2006
>>> Information 4/9/2010 5:55:11 AM eventlog None 6006 N/A COMPAQ-2006
>>> Error 4/9/2010 5:51:31 AM ntfs Disk 55 N/A COMPAQ-2006
>>> Error 4/9/2010 5:51:29 AM ntfs Disk 55 N/A COMPAQ-2006
>>> Information 4/9/2010 5:51:28 AM Tcpip None 4201 N/A COMPAQ-2006
>>> Information 4/9/2010 5:51:49 AM eventlog None 6005 N/A COMPAQ-2006
>>> Information 4/9/2010 5:51:49 AM eventlog None 6009 N/A COMPAQ-2006
>>> Information 4/9/2010 5:24:36 AM eventlog None 6006 N/A COMPAQ-2006
>>>
>>> Event Type: Information
>>> Event Source: Tcpip
>>> Event Category: None
>>> Event ID: 4201
>>> Date: 4/9/2010
>>> Time: 5:56:04 AM
>>> User: N/A
>>> Computer: COMPAQ-2006
>>> Description:
>>> The system detected that network adapter \DEVICE\TCPIP_
>> {D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to the network,
>>
>> and has initiated normal operation over the network adapter.
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 00 00 00 00 02 00 50 00 ......P.
>>> 0008: 00 00 00 00 69 10 00 40 ....i..@
>>> 0010: 02 00 00 00 00 00 00 00 ........
>>> 0018: 00 00 00 00 00 00 00 00 ........
>>> 0020: 00 00 00 00 00 00 00 00 ........
>> Maybe there's some new evidence here. Things happening that I
>> of course don't understand. Note initiating operation over the network
>> adapter, but I rechecked and my phone line was indeed unplugged.
>> I only reconnect when I boot back to this main system.
>
>

From: William B. Lurie on 9 Apr 2010 20:23

John John - MVP wrote:
> William B. Lurie wrote:
>
>>> Is the machine still connected to the internet or to a LAN?
>>> Disconnect from both while you troubleshoot the problem!
>>>
>>> John
>> John, I thought I made that clear. On each and every test run,
>> I restart the computer in order to reboot to the the test system,
>> and while it is booting, I physically disconnect the phone line
>> as it enters the modem from the wall outlet. As for LAN.......
>> I am a poor single-line homeowner with only one line of access
>> to the world of information, other than Comcast cable for TV.
>
> OK, being that your firewall and AV applications are not running while
> you run these trials I just wanted to make sure that you weren't opening
> your unprotected machine to the outside world.
>
>
>
>> And as for Ci which we discussed earlier, I can't put my finger on it;
>> please tell me again what to disable to stop it from cataloguing
>> system volume information at what appears to be random odd times.
>
> Let's try one last effort and see if we can get to the bottom of this.
> I'm going to try another approach, I will try to configure your services
> via scripts or batch files that you can run on your machine. We are
> going to start from scratch again, I need you to do the following 2 tasks:
>
> Task 1:
>
> Copy the stuff between the ====== lines and save it as ServiceStat.vbs:
>
>
> ================================================================
> Const ForWriting = 2
> Set objFSO = CreateObject("Scripting.FileSystemObject")
> Set objLogFile = objFSO.OpenTextFile("c:\services.txt", _
> ForWriting, True)
> objLogFile.Write _
> ("Service Name,Start Mode")
> objLogFile.Writeline
> strComputer = "."
> Set objWMIService = GetObject("winmgmts:" _
> & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
> Set colListOfServices = objWMIService.ExecQuery _
> ("Select * from Win32_Service")
> For Each objService in colListOfServices
> objLogFile.Write(objService.Name) & ","
> objLogFile.Write(objService.StartMode) & ","
> objLogFile.writeline
> Next
> objLogFile.Close
> ================================================================
>
> Run ServiceState.vbs (double click on it) and after it runs look for the
> file C:\services.txt, copy and paste the contents of the file to your
> next post.
>
>
> Task 2:
>
> This one involves running a Sysinternals utility (Autorunsc) at the
> command prompt.
>
> Go here: http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
>
> and download the Autoruns and Autorunsc package (581 KB). Unzip the
> package, there will be two executable in the package:
>
> The GUI version: autoruns.exe
>
> and the Command version: autorunsc.exe
>
> Copy the command version (autorunsc.exe) to an easy to find location,
> for example C:\, then at a Command Prompt run this command:
>
> c:\autorunsc >c:\autostart.txt
>
> Copy and paste the contents of the c:\autostart.txt to your next post.
>
>
> Be patient after you post the files. I have a busy next few days ahead,
> I might not be able to get back to you until much later, maybe not
> before Sunday.
>
> John
Okay, John, I did it pretty well, but with limitations.
File autorunsc.exe said it unzipped but I couldn't find it.
I did the unzipping all in one directory and I found the
autorun.exe but not its command version. So I executed the
one I found and maybe what I'll send below is what you were
after.

The file services.txt saved but is EMPTY except for a header line.
I'll go back and do that again.

Service Name,Start Mode <<<<<<<That's all that the run collected.

Meanwhile, here's the other one:

> HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
> rdpclip
> rdpclip
> RDP Clip Monitor
> Microsoft Corporation
> 5.1.2600.2180
> c:\windows\system32\rdpclip.exe
> ab978e64b3cb5b78842bc2bdae19d0cd (MD5)
> db49bb6158d12ea7dc9b28ef2ee857edb6015138 (SHA-1)
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
> C:\WINDOWS\system32\userinit.exe
> C:\WINDOWS\system32\userinit.exe
> Userinit Logon Application
> Microsoft Corporation
> 5.1.2600.2180
> c:\windows\system32\userinit.exe
> 39b1ffb03c2296323832acbae50d2aff (MD5)
> e5aedcbe25a97c89101f1f3860ff846e94d70445 (SHA-1)
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
> Explorer.exe
> Explorer.exe
> Windows Explorer
> Microsoft Corporation
> 6.0.2900.3156
> c:\windows\explorer.exe
> 97bd6515465659ff8f3b7be375b2ea87 (MD5)
> 972307a3ef93680afdd03603df20f2241047a934 (SHA-1)
>
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> LXCTCATS
> rundll32 C:\windows\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry(a)16
> Lexmark Connect Timer DLL
> Lexmark International Inc.
> 1.20.0.0
> c:\windows\system32\spool\drivers\w32x86\3\lxcttime.dll
> e9b2e1938b478881a0ce79b6bb9ac31c (MD5)
> 56d5749513073983c7bfb2fe1cabc88fc73a6726 (SHA-1)
>
> HKCU\Software\Microsoft\Windows\CurrentVersion\Run
> ctfmon.exe
> C:\windows\system32\ctfmon.exe
> CTF Loader
> Microsoft Corporation
> 5.1.2600.2180
> c:\windows\system32\ctfmon.exe
> 24232996a38c0b0cf151c2140ae29fc8 (MD5)
> b36d03b56a30187ffc6257459d632a4faac48af2 (SHA-1)

From: William B. Lurie on 9 Apr 2010 20:42

William B. Lurie wrote:
> John John - MVP wrote:
>> William B. Lurie wrote:
>>
>>>> Is the machine still connected to the internet or to a LAN?
>>>> Disconnect from both while you troubleshoot the problem!
>>>>
>>>> John
>>> John, I thought I made that clear. On each and every test run,
>>> I restart the computer in order to reboot to the the test system,
>>> and while it is booting, I physically disconnect the phone line
>>> as it enters the modem from the wall outlet. As for LAN.......
>>> I am a poor single-line homeowner with only one line of access
>>> to the world of information, other than Comcast cable for TV.
>>
>> OK, being that your firewall and AV applications are not running while
>> you run these trials I just wanted to make sure that you weren't
>> opening your unprotected machine to the outside world.
>>
>>
>>
>>> And as for Ci which we discussed earlier, I can't put my finger on it;
>>> please tell me again what to disable to stop it from cataloguing
>>> system volume information at what appears to be random odd times.
>>
>> Let's try one last effort and see if we can get to the bottom of this.
>> I'm going to try another approach, I will try to configure your
>> services via scripts or batch files that you can run on your machine.
>> We are going to start from scratch again, I need you to do the
>> following 2 tasks:
>>
>> Task 1:
>>
>> Copy the stuff between the ====== lines and save it as ServiceStat.vbs:
>>
>>
>> ================================================================
>> Const ForWriting = 2
>> Set objFSO = CreateObject("Scripting.FileSystemObject")
>> Set objLogFile = objFSO.OpenTextFile("c:\services.txt", _
>> ForWriting, True)
>> objLogFile.Write _
>> ("Service Name,Start Mode")
>> objLogFile.Writeline
>> strComputer = "."
>> Set objWMIService = GetObject("winmgmts:" _
>> & "{impersonationLevel=impersonate}!\\" & strComputer &
>> "\root\cimv2")
>> Set colListOfServices = objWMIService.ExecQuery _
>> ("Select * from Win32_Service")
>> For Each objService in colListOfServices
>> objLogFile.Write(objService.Name) & ","
>> objLogFile.Write(objService.StartMode) & ","
>> objLogFile.writeline
>> Next
>> objLogFile.Close
>> ================================================================
>>
>> Run ServiceState.vbs (double click on it) and after it runs look for
>> the file C:\services.txt, copy and paste the contents of the file to
>> your next post.
>>
>>
>> Task 2:
>>
>> This one involves running a Sysinternals utility (Autorunsc) at the
>> command prompt.
>>
>> Go here: http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
>>
>> and download the Autoruns and Autorunsc package (581 KB). Unzip the
>> package, there will be two executable in the package:
>>
>> The GUI version: autoruns.exe
>>
>> and the Command version: autorunsc.exe
>>
>> Copy the command version (autorunsc.exe) to an easy to find location,
>> for example C:\, then at a Command Prompt run this command:
>>
>> c:\autorunsc >c:\autostart.txt
>>
>> Copy and paste the contents of the c:\autostart.txt to your next post.
>>
>>
>> Be patient after you post the files. I have a busy next few days
>> ahead, I might not be able to get back to you until much later, maybe
>> not before Sunday.
>>
>> John
> Okay, John, I did it pretty well, but with limitations.
> File autorunsc.exe said it unzipped but I couldn't find it.
> I did the unzipping all in one directory and I found the
> autorun.exe but not its command version. So I executed the
> one I found and maybe what I'll send below is what you were
> after.
>
> The file services.txt saved but is EMPTY except for a header line.
> I'll go back and do that again.
>
> Service Name,Start Mode <<<<<<<That's all that the run collected.
>
>
> Meanwhile, here's the other one:
>
>> HKLM\System\CurrentControlSet\Control\Terminal
>> Server\Wds\rdpwd\StartupPrograms
>> rdpclip
>> rdpclip
>> RDP Clip Monitor
>> Microsoft Corporation
>> 5.1.2600.2180
>> c:\windows\system32\rdpclip.exe
>> ab978e64b3cb5b78842bc2bdae19d0cd (MD5)
>> db49bb6158d12ea7dc9b28ef2ee857edb6015138 (SHA-1)
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
>> C:\WINDOWS\system32\userinit.exe
>> C:\WINDOWS\system32\userinit.exe
>> Userinit Logon Application
>> Microsoft Corporation
>> 5.1.2600.2180
>> c:\windows\system32\userinit.exe
>> 39b1ffb03c2296323832acbae50d2aff (MD5)
>> e5aedcbe25a97c89101f1f3860ff846e94d70445 (SHA-1)
>>
>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
>> Explorer.exe
>> Explorer.exe
>> Windows Explorer
>> Microsoft Corporation
>> 6.0.2900.3156
>> c:\windows\explorer.exe
>> 97bd6515465659ff8f3b7be375b2ea87 (MD5)
>> 972307a3ef93680afdd03603df20f2241047a934 (SHA-1)
>>
>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>> LXCTCATS
>> rundll32
>> C:\windows\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry(a)16
>> Lexmark Connect Timer DLL
>> Lexmark International Inc.
>> 1.20.0.0
>> c:\windows\system32\spool\drivers\w32x86\3\lxcttime.dll
>> e9b2e1938b478881a0ce79b6bb9ac31c (MD5)
>> 56d5749513073983c7bfb2fe1cabc88fc73a6726 (SHA-1)
>>
>> HKCU\Software\Microsoft\Windows\CurrentVersion\Run
>> ctfmon.exe
>> C:\windows\system32\ctfmon.exe
>> CTF Loader
>> Microsoft Corporation
>> 5.1.2600.2180
>> c:\windows\system32\ctfmon.exe
>> 24232996a38c0b0cf151c2140ae29fc8 (MD5)
>> b36d03b56a30187ffc6257459d632a4faac48af2 (SHA-1)
>
But let me expand about services.txt ....

In the process of doing that on the clone, it gave an error pane:
"Remote Server machine does not exist or is unavailable.
'GetObject' code 800A01CE Microsoft VBScript Runtime Error"

But I did run it on my Master machine and got the following:

> Service Name,Start Mode
> Alerter,Disabled,
> ALG,Manual,
> AppMgmt,Manual,
> aspnet_state,Manual,
> Ati HotKey Poller,Disabled,
> ATI Smart,Manual,
> AudioSrv,Auto,
> Automatic LiveUpdate Scheduler,Disabled,
> BITS,Manual,
> Browser,Auto,
> CiSvc,Manual,
> ClipSrv,Disabled,
> clr_optimization_v2.0.50727_32,Manual,
> COMSysApp,Manual,
> CryptSvc,Auto,
> DcomLaunch,Auto,
> Dhcp,Auto,
> dmadmin,Manual,
> dmserver,Manual,
> Dnscache,Auto,
> ERSvc,Auto,
> Eventlog,Auto,
> EventSystem,Manual,
> FastUserSwitchingCompatibility,Manual,
> Fax,Manual,
> FontCache3.0.0.0,Manual,
> GEARSecurity,Disabled,
> helpsvc,Auto,
> HidServ,Disabled,
> HTTPFilter,Manual,
> IDriverT,Manual,
> idsvc,Manual,
> Imapi Helper,Manual,
> ImapiService,Manual,
> lanmanserver,Auto,
> lanmanworkstation,Auto,
> LexBceS,Auto,
> LiveUpdate,Manual,
> LmHosts,Auto,
> lxct_device,Auto,
> MBAMService,Disabled,
> MDM,Manual,
> Messenger,Disabled,
> mnmsrvc,Manual,
> MSIServer,Manual,
> NetDDE,Disabled,
> NetDDEdsdm,Disabled,
> Netlogon,Manual,
> Netman,Manual,
> NetTcpPortSharing,Disabled,
> Nla,Manual,
> Norton AntiVirus,Auto,
> Norton Save and Restore,Manual,
> NProtectService,Manual,
> NtLmSsp,Manual,
> NtmsSvc,Manual,
> ose,Manual,
> PlugPlay,Auto,
> PolicyAgent,Manual,
> ProtectedStorage,Auto,
> psqlWGE,Auto,
> RasAuto,Disabled,
> RasMan,Manual,
> RDSessMgr,Manual,
> RemoteAccess,Disabled,
> RpcLocator,Manual,
> RpcSs,Auto,
> RSVP,Manual,
> SamSs,Auto,
> SCardSvr,Manual,
> Schedule,Manual,
> seclogon,Auto,
> SENS,Auto,
> SharedAccess,Auto,
> ShellHWDetection,Auto,
> Speed Disk service,Disabled,
> Spooler,Auto,
> srservice,Auto,
> SSDPSRV,Manual,
> stisvc,Manual,
> SwPrv,Manual,
> Symantec RemoteAssist,Manual,
> SysmonLog,Manual,
> TapiSrv,Manual,
> TermService,Auto,
> Themes,Auto,
> TrkWks,Auto,
> upnphost,Manual,
> UPS,Manual,
> Viewpoint Manager Service,Disabled,
> VSS,Manual,
> W32Time,Auto,
> WebClient,Auto,
> winmgmt,Auto,
> WmdmPmSN,Manual,
> WmiApSrv,Disabled,
> WMPNetworkSvc,Manual,
> wscsvc,Manual,
> wuauserv,Manual,
> WudfSvc,Manual,
> WZCSVC,Auto,
> xmlprov,Manual,

I'd sure like to run that on the clone, but you'll
have to modify the .vbs file so that the error goes away.

From: John John - MVP on 9 Apr 2010 20:54

First | Prev | Next | Last
Pages: 26 27 28 29 30 31 32 33 34 35 36 37 38
Prev: Pressing Change Password -button in WIN XP causes reboot
Next: Microsoft caught pirating somebody's patent again!!!