WIA and hibernation again

  • Thread starter Thread starter William B. Lurie
  • Start date Start date
William said:
John wrote:
(snip)
----------------------------------------------------
I did the following immediately after reboot, by going
to cmd DOS prompt, the C:\ and
net start > c:\test326a.txt
enter
tasklist /svc > c:\test326b.txt
enter

And now I will copy and paste the two .txt files here.


Image Name PID Services
========================= ======
=============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 1200 N/A
csrss.exe 1280 N/A
winlogon.exe 1312 N/A
services.exe 1356 Eventlog, PlugPlay
lsass.exe 1368 ProtectedStorage, SamSs
svchost.exe 1532 DcomLaunch, TermService
svchost.exe 1628 RpcSs
svchost.exe 1796 AudioSrv, CryptSvc, Dhcp, ERSvc,
EventSystem,
FastUserSwitchingCompatibility,
helpsvc, lanmanserver, lanmanworkstation,
Netman, Nla, RasMan, seclogon, SENS,
SharedAccess, ShellHWDetection, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, WZCSVC
svchost.exe 1868 Dnscache
svchost.exe 244 LmHosts, SSDPSRV
LEXBCES.EXE 392 LexBceS
spoolsv.exe 552 Spooler
LEXPPS.EXE 584 N/A
explorer.exe 832 N/A
svchost.exe 944 WebClient
lxctcoms.exe 996 lxct_device
ccSvcHst.exe 1044 Norton AntiVirus
w3dbsmgr.exe 1520 psqlWGE
NOPDB.exe 1824 Speed Disk service
ViewpointService.exe 2028 Viewpoint Manager Service
ccSvcHst.exe 2540 N/A
alg.exe 4080 ALG
cmd.exe 2256 N/A
hpsysdrv.exe 2348 N/A
tasklist.exe 2644 N/A
wmiprvse.exe 2676 N/A

Over to you, John.
Click to expand...

If I understand correctly, you have the machine set to hibernate after 2
hours of inactivity but it can't enter the hibernation state because
something keeps it awake...

This is what I would try:

Reboot the machine and don't do anything whatsoever after it boots,
leave it alone for the time set for hibernation and see if it does
hibernate.

If it doesn't hibernate I would then try a clean boot and once again not
touch the machine for the set time and see if it does hibernate.

http://support.microsoft.com/kb/310353
How to configure Windows XP to start in a "clean boot" state

John
 
John said:
If I understand correctly, you have the machine set to hibernate after 2
hours of inactivity but it can't enter the hibernation state because
something keeps it awake...

This is what I would try:

Reboot the machine and don't do anything whatsoever after it boots,
leave it alone for the time set for hibernation and see if it does
hibernate.

If it doesn't hibernate I would then try a clean boot and once again not
touch the machine for the set time and see if it does hibernate.

http://support.microsoft.com/kb/310353
How to configure Windows XP to start in a "clean boot" state
Click to expand...
Okay, John....you have stated the problem concisely. with
the following additional clarification:

If hibernate is set for 2 hours.....it will not.
If set for 1 hour.......it does.

Later today I'll do as you say above, for the 2 hour test.
 
John said:
If I understand correctly, you have the machine set to hibernate after 2
hours of inactivity but it can't enter the hibernation state because
something keeps it awake...

This is what I would try:

Reboot the machine and don't do anything whatsoever after it boots,
leave it alone for the time set for hibernation and see if it does
hibernate.

If it doesn't hibernate I would then try a clean boot and once again not
touch the machine for the set time and see if it does hibernate.

http://support.microsoft.com/kb/310353
How to configure Windows XP to start in a "clean boot" state

John
Click to expand...
Just one more point: I am at the stage of using SP2 (not SP3)
but I believe I have installed one of the SP3 'fixes' which
were supposed to fix hibernate problems......
 
John said:
If I understand correctly, you have the machine set to hibernate after 2
hours of inactivity but it can't enter the hibernation state because
something keeps it awake...

This is what I would try:

Reboot the machine and don't do anything whatsoever after it boots,
leave it alone for the time set for hibernation and see if it does
hibernate.

If it doesn't hibernate I would then try a clean boot and once again not
touch the machine for the set time and see if it does hibernate.

http://support.microsoft.com/kb/310353
How to configure Windows XP to start in a "clean boot" state

John
Click to expand...

John, I followed instructions. Touched NOTHING for 4 hours
(hibernate set at 2). Power-on light on tower was flashing
and it never went to hibernate. I'll read the Clean Boot instructions
again. Last time I thought it was quite an effort, but this is
this time. Maybe this evening.
 
William; I compared my services with yours since my system does not fail to
hibernate.
I'll post the differences. Do a Google search for 'viewpoint manager
services'. Looks suspicious.
I would also suspect Norton AntiVirus.
Differences (not on my system) are:
LexBce Server
lxct device
Norton AntiVirus-------I would definately get rid of this.
Pervasive PSQL Workgroup Engine
Speed Disk Service------Part of Norton
Viewpoint Manager Service
 
Dear Unk:
Thanks for working with me. I'll let John comment more on
your list, but Norton Anti-Virus is my main protection and
I don't leave home without it. I could, of course, disconnect from
the phone line and disable it to see if somehow that's the cause.
One thing at a time.....
 
William said:
John, I followed instructions. Touched NOTHING for 4 hours
(hibernate set at 2). Power-on light on tower was flashing
and it never went to hibernate. I'll read the Clean Boot instructions
again. Last time I thought it was quite an effort, but this is
this time. Maybe this evening.
Click to expand...

I took another small step, John. I like to try new things on my Clone
system before I take a chance with my Main Drive......so I printed
out KB310353 and followed its Method 2 on my clone system. It was very
easy, and I did it and immediately went away for 2-3/4 hours ......and
when I returned, the power light on my tower was blinking, the screen
was on, and was not even in Screen Saver mode, which to me means that
some Event occurred. It goes to Screen Saver at 10 minutes. I undid the
msconfig changes and returned here, to my Master Drive.

So I would judge that Clean Boot didn't show any difference. What's
your next advice?
 
William said:
I took another small step, John. I like to try new things on my Clone
system before I take a chance with my Main Drive......so I printed
out KB310353 and followed its Method 2 on my clone system. It was very
easy, and I did it and immediately went away for 2-3/4 hours ......and
when I returned, the power light on my tower was blinking, the screen
was on, and was not even in Screen Saver mode, which to me means that
some Event occurred. It goes to Screen Saver at 10 minutes. I undid the
msconfig changes and returned here, to my Master Drive.

So I would judge that Clean Boot didn't show any difference. What's
your next advice?
Click to expand...

Take a look in the Event Viewer and see if anything relevant is logged.
Check the log on the clone too.

John
 
John said:
Take a look in the Event Viewer and see if anything relevant is logged.
Check the log on the clone too.

John
Click to expand...
I'll have to do the clean boot again to be sure, but I don't think
it told a noteworthy story. But, because I, too, am suspicious that
the Norton AV software is a likely suspect, I made a different test
overnight, on this Master system.

I disabled all Norton/Symantec entries in the services.msc list,
disconnected from the phone line, and let it try to go to sleep
at 10 P.M...... and when I checked nine hours later, the power
light on the tower was flashing. So I immediately copied and
saved the 3 pages in the Events Log, and will paste them in below.
I was disappointed in a way, at not seeing the every-hour intervention,
and I don't know if it's good news or not. What's your take on it?
(I'm sorry for the length of the post; I haven't worked out the
free uploading thing yet).

But the overnight Events Log is surprisingly bare; maybe that does point
the accusing finger at the Norton software. I can repeat that test
overnight with just that one difference.
Note the usual 7026 error when booting at 6:50 this morning,
that I've mentioned before, and nothing else.

I really ought to do the clean boot thing again on the clone, and
record the Events Log.
Type Date Time Source Category Event User Computer
Information 3/27/2010 6:49:21 AM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
Information 3/27/2010 6:49:19 AM Norton AntiVirus None 34 SYSTEM COMPAQ-2006
Information 3/27/2010 6:45:45 AM SecurityCenter None 1800 N/A COMPAQ-2006
Information 3/27/2010 6:44:02 AM Viewpoint Manager Service None 0 N/A COMPAQ-2006
Information 3/27/2010 6:43:11 AM Norton Save and Restore Medium Priority 100 N/A COMPAQ-2006
Information 3/27/2010 6:42:26 AM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
Information 3/27/2010 6:42:25 AM Norton AntiVirus None 34 SYSTEM COMPAQ-2006
Click to expand...
Type Date Time Source Category Event User Computer
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 849 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:04 AM Security Policy Change 848 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:50:02 AM Security Privilege Use 576 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:50:02 AM Security Logon/Logoff 528 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:53 AM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:53 AM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:46 AM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:46 AM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:44 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:39 AM Security Privilege Use 576 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:39 AM Security Logon/Logoff 528 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:21 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:15 AM Security Logon/Logoff 540
ANONYMOUS LOGON COMPAQ-2006
Success Audit 3/27/2010 6:49:12 AM Security Privilege Use 576 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:12 AM Security Logon/Logoff 528 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:06 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:06 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:06 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:05 AM Security Policy Change 806 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Privilege Use 576
Compaq_Owner COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Logon/Logoff 528
Compaq_Owner COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Account Logon 680 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Logon/Logoff 538
Compaq_Owner COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Privilege Use 576
Compaq_Owner COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Logon/Logoff 528
Compaq_Owner COMPAQ-2006
Success Audit 3/27/2010 6:49:04 AM Security Account Logon 680 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:02 AM Security Privilege Use 576 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:02 AM Security Logon/Logoff 528 LOCAL
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:02 AM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:02 AM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 518 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:49:01 AM Security System Event 514 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:47:55 AM Security System Event 513 SYSTEM
COMPAQ-2006
Success Audit 3/27/2010 6:47:48 AM Security Logon/Logoff 551
Compaq_Owner COMPAQ-2006
Success Audit 3/26/2010 10:29:50 PM Security System Event 517 SYSTEM
COMPAQ-2006

Type Date Time Source Category Event User Computer
Information 3/27/2010 7:02:21 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 7:02:20 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 7:00:55 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 7:00:55 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:50:35 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Error 3/27/2010 6:50:35 AM Service Control Manager None 7026 N/A COMPAQ-2006
Information 3/27/2010 6:50:02 AM SRTSP None 2003 N/A COMPAQ-2006
Information 3/27/2010 6:48:47 AM Tcpip None 4201 N/A COMPAQ-2006
Information 3/27/2010 6:49:01 AM eventlog None 6005 N/A COMPAQ-2006
Information 3/27/2010 6:49:01 AM eventlog None 6009 N/A COMPAQ-2006
Information 3/27/2010 6:47:55 AM eventlog None 6006 N/A COMPAQ-2006
Information 3/27/2010 6:45:45 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:45:45 AM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 3/27/2010 6:44:02 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:44:02 AM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 3/27/2010 6:42:56 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:42:56 AM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 3/27/2010 6:42:49 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 3/27/2010 6:42:26 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:42:26 AM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 3/27/2010 6:41:19 AM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 3/27/2010 6:41:19 AM Service Control Manager None 7035
SYSTEM COMPAQ-2006
 
John said:
Take a look in the Event Viewer and see if anything relevant is logged.
Check the log on the clone too.

John
Click to expand...
The scene changes again, John. I just heard from Symantec, that Norton
AntiVirus does do Idle Time Scan. I had it set for "Quarterly" so it
should not have interfered. But with their help, I reset it to *never*
and maybe that will be the answer. I can live with no idle time scans.
So put my other testing on hold while I find out if hibernate now
works right.
 
Have you looked into using MSE?
William B. Lurie said:
Dear Unk:
Thanks for working with me. I'll let John comment more on
your list, but Norton Anti-Virus is my main protection and
I don't leave home without it. I could, of course, disconnect from
the phone line and disable it to see if somehow that's the cause.
One thing at a time.....
Click to expand...
 
William said:
The scene changes again, John. I just heard from Symantec, that Norton
AntiVirus does do Idle Time Scan. I had it set for "Quarterly" so it
should not have interfered. But with their help, I reset it to *never*
and maybe that will be the answer. I can live with no idle time scans.
So put my other testing on hold while I find out if hibernate now
works right.
Click to expand...
Three hours later. At 8:55 I set Idle Scan at Never, rebooted,
and went away. Three hours later, it had not gone into hibernation,
and Events Log showed *no* events in that period, but was
obviously alive and recording things. I am of the opinion that
Norton Anti-Virus is not the source of the problem. And I'm not about
to change horses and use MSE (as Unk just suggested). There has to
be a reason why it doesn't hibernate after 2 hours, and the events
log doesn't show it.

I'm going back to Clone, Disable Norton, do a Clean Boot, and let 3
hours go by, and look at Events Log as you suggested, John. I won't
be back on until 1600 EDT.
 
William said:
Three hours later. At 8:55 I set Idle Scan at Never, rebooted,
and went away. Three hours later, it had not gone into hibernation,
and Events Log showed *no* events in that period, but was
obviously alive and recording things. I am of the opinion that
Norton Anti-Virus is not the source of the problem. And I'm not about
to change horses and use MSE (as Unk just suggested). There has to
be a reason why it doesn't hibernate after 2 hours, and the events
log doesn't show it.

I'm going back to Clone, Disable Norton, do a Clean Boot, and let 3
hours go by, and look at Events Log as you suggested, John. I won't
be back on until 1600 EDT.
Click to expand...

I didn't do it right, and will do it again later this evening. Sorry.
 
William said:
I didn't do it right, and will do it again later this evening. Sorry.
Click to expand...

I think I did it right this time, John, and it still didn't go to
hibernate, and left events periodically in Events Log. I'll let
it run all night tonight, and have more data in the morning, and will
b extra keerful this time. Mwanwhile, perhaps these are of value:
These Windows services are started:

Application Layer Gateway Service
Automatic Updates
COM+ Event System
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Event Log
Fast User Switching Compatibility
Help and Support
IPSEC Services
Network Connections
Network Location Awareness (NLA)
Plug and Play
Print Spooler
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Secondary Logon
Security Accounts Manager
Server
Shell Hardware Detection
SSDP Discovery Service
System Event Notification
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Terminal Services
Themes
WebClient
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Windows Image Acquisition (WIA)
Windows Management Instrumentation
Windows Time
Wireless Zero Configuration
Workstation

The command completed successfully.
Click to expand...

Image Name PID Services

========================= ======
=============================================
System Idle Process 0 N/A

System 4 N/A

smss.exe 1200 N/A

csrss.exe 1284 N/A

winlogon.exe 1316 N/A

services.exe 1360 Eventlog, PlugPlay

lsass.exe 1372 PolicyAgent, ProtectedStorage, SamSs

svchost.exe 1532 DcomLaunch, TermService

svchost.exe 1632 RpcSs

svchost.exe 1784 AudioSrv, CryptSvc, Dhcp, ERSvc,

EventSystem,
FastUserSwitchingCompatibility,
helpsvc, lanmanserver,
lanmanworkstation,
Netman, Nla, RasMan, Schedule,
seclogon,
SENS, SharedAccess, ShellHWDetection,

TapiSrv, Themes, TrkWks, W32Time,
winmgmt,
wuauserv, WZCSVC

svchost.exe 1872 Dnscache

svchost.exe 232 LmHosts, SSDPSRV

spoolsv.exe 556 Spooler

explorer.exe 816 N/A

svchost.exe 904 WebClient

svchost.exe 976 stisvc

PrintScreen.exe 1864 N/A

alg.exe 1712 ALG

cmd.exe 1728 N/A

tasklist.exe 652 N/A

wmiprvse.exe 1136 N/A

I am able to send some more before I shut down.
Note the Events Log.....I left it at around 7:48
and came back and saw that it was not going to
hibernate, at 10:36 .... meanwhile please note the
events in betweem which I guess are what caused it not
to hibernate. The 7036's. Maybe you can make something
of this, John. I do think I did it right this time.
 
William said:
I think I did it right this time, John, and it still didn't go to
hibernate, and left events periodically in Events Log. I'll let
it run all night tonight, and have more data in the morning, and will
b extra keerful this time. Mwanwhile, perhaps these are of value:


Image Name PID Services

========================= ======
=============================================
System Idle Process 0 N/A

System 4 N/A

smss.exe 1200 N/A

csrss.exe 1284 N/A

winlogon.exe 1316 N/A

services.exe 1360 Eventlog, PlugPlay

lsass.exe 1372 PolicyAgent, ProtectedStorage, SamSs

svchost.exe 1532 DcomLaunch, TermService

svchost.exe 1632 RpcSs

svchost.exe 1784 AudioSrv, CryptSvc, Dhcp, ERSvc,

EventSystem,
FastUserSwitchingCompatibility,
helpsvc, lanmanserver,
lanmanworkstation,
Netman, Nla, RasMan, Schedule,
seclogon,
SENS, SharedAccess, ShellHWDetection,

TapiSrv, Themes, TrkWks, W32Time,
winmgmt,
wuauserv, WZCSVC

svchost.exe 1872 Dnscache

svchost.exe 232 LmHosts, SSDPSRV

spoolsv.exe 556 Spooler

explorer.exe 816 N/A

svchost.exe 904 WebClient

svchost.exe 976 stisvc

PrintScreen.exe 1864 N/A

alg.exe 1712 ALG

cmd.exe 1728 N/A

tasklist.exe 652 N/A

wmiprvse.exe 1136 N/A

I am able to send some more before I shut down.
Note the Events Log.....I left it at around 7:48
and came back and saw that it was not going to
hibernate, at 10:36 .... meanwhile please note the
events in betweem which I guess are what caused it not
to hibernate. The 7036's. Maybe you can make something
of this, John. I do think I did it right this time.
Click to expand...
And expanding that one Event out, we see:
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 3/27/2010
Time: 9:18:02 PM
User: N/A
Computer: COMPAQ-2006
Description:
The Windows Image Acquisition (WIA) service entered the running state.

So, are we back to continuing to try to find out what caused
Click to expand...
WIA to enter the running state? It was listed as a System
event....and I believe it says the Service Control Manager was
the Source of the event.
 
Since you have Viewpoint Manager Service started in services, have you
opened it and disabled auto update?
Could be this service is looking for updates for viewpoint products and
thusly not allowing hibernation.
 
Unknown said:
Since you have Viewpoint Manager Service started in services, have you
opened it and disabled auto update?
Could be this service is looking for updates for viewpoint products and
thusly not allowing hibernation.
Click to expand...

(snip)
Well, I didn't consciously install it, have never intentionally used
it and don't know what it's for, I'll certainly disable it and see
what
that does for me, good or bad. Thanks.
 
William said:
(snip)
Well, I didn't consciously install it, have never intentionally used
it and don't know what it's for, I'll certainly disable it and see
what
that does for me, good or bad. Thanks.
Click to expand...

And now, John, some new evidence elicited from Clean Booth overnight
run on Clone system, with phone line disconnected:

Note that the first of the questionable Events on System was a
newbie.... Application Layer Gateway Service started.....From
then on, it was every hour, another intrusion calol to WIA.....
Does that tell anything?
Type Date Time Source Category Event User Computer
Information 3/30/2010 6:30:57 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/30/2010 5:29:47 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/30/2010 4:28:29 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/30/2010 3:27:11 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/30/2010 2:25:53 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/30/2010 1:24:35 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/30/2010 12:23:17 AM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 11:21:52 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 3/29/2010 10:20:12 PM Service Control Manager None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 3/29/2010
Time: 10:20:12 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPAQ-2006
Description:
The Application Layer Gateway Service service was
Click to expand...

successfully sent a start control.
For more information, see Help and Support Center at
Click to expand...

http://go.microsoft.com/fwlink/events.asp.
 
Back
Top