WIA and hibernation again

[John John - MVP]

Yes, John. I have been doing *all* of this testing and recording on
the clone system, which I Clean Boot every time I make one of
these 3-hour attempts to hibernate.

So we went from 2 hours hibernate to 3 hours... or did I forget to move

... It may have logged on
to do a task, but it was no scheduled task that I can track down,
and I was away from the machine. It sits with a black screen, idle,
with the tower's power-on light flashing, and suddenly the screen
comes on, with my desktop, and the period of waiting for it to go
to hibernation has been interrupted.

Maybe it's a screen saver... make sure that none are selected to run.

What next?

Philosophy 101... Or disable more unneeded stuff... or look at loaded
modules. It's easier to disable unneeded stuff for now, but if you want
to look at loaded modules copy and paste this in the Start menu Run box
and press <Enter>:

msinfo32 /category SWEnvLoadedModules

If something looks out of whack there, investigate. Modules that are
loaded outside the \Windows path are not needed.

I'm not going to look at that clock matter, unless you tell me to.
One thing at a time......

You don't need to bother with the time service, set your clock manually
and keep the time service disabled until you fix the hibernate problem.
You can check the current time here: http://www.time.gov/

So, what's the thing with the 3 hour hibernate... does it hibernate at 2
hours? Or 1 hour?

There are six Windows NT critical services, you have more than thirty
running services. Hibernation (probably) can't run on the six services
but weeding the list probably won't hurt your troubleshooting efforts.

Candidates for outright removal (for troubleshooting set to manual start):

Automatic Updates
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Fast User Switching Compatibility
Network Location Awareness (NLA)
Print Spooler
Remote Access Connection Manager
Secondary Logon
Server
Task Scheduler
TCP/IP NetBIOS Helper
WebClient


Note: The Server service is the biggest hole on your computer. When
this service is running the drawbridge is down. If you don't want
anybody in, pull up the drawbridge. Remote services can't execute if
the Server service is disabled.

John

 

[William B. Lurie]

So we went from 2 hours hibernate to 3 hours... or did I forget to move


Maybe it's a screen saver... make sure that none are selected to run.


Philosophy 101... Or disable more unneeded stuff... or look at loaded
modules. It's easier to disable unneeded stuff for now, but if you want
to look at loaded modules copy and paste this in the Start menu Run box
and press <Enter>:

msinfo32 /category SWEnvLoadedModules

If something looks out of whack there, investigate. Modules that are
loaded outside the \Windows path are not needed.


You don't need to bother with the time service, set your clock manually
and keep the time service disabled until you fix the hibernate problem.
You can check the current time here: http://www.time.gov/

So, what's the thing with the 3 hour hibernate... does it hibernate at 2
hours? Or 1 hour?

There are six Windows NT critical services, you have more than thirty
running services. Hibernation (probably) can't run on the six services
but weeding the list probably won't hurt your troubleshooting efforts.

Candidates for outright removal (for troubleshooting set to manual start):

Automatic Updates
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Fast User Switching Compatibility
Network Location Awareness (NLA)
Print Spooler
Remote Access Connection Manager
Secondary Logon
Server
Task Scheduler
TCP/IP NetBIOS Helper
WebClient


Note: The Server service is the biggest hole on your computer. When
this service is running the drawbridge is down. If you don't want
anybody in, pull up the drawbridge. Remote services can't execute if
the Server service is disabled.

John

John, the 3 hours is just a typo. Don't sweat it.

I'll set all those to Manual and see if anything changes.

 

[William B. Lurie]

John, the 3 hours is just a typo. Don't sweat it.

I'll set all those to Manual and see if anything changes.

Okay, now 0930....Did as suggested. All above now Manual.
Started 6:45 A.M., at 0800 it reverted to Desktop, and at
8:05 monitor was dark and power light flashing. I stopped
it and got following Events, net start and tasklist.
Note one request, that chkdsk/r be run because of corrupt etc.
First time that came around. Note other events, especially at start of run.

These Windows services are started:

COM+ Event System
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Event Log
Fast User Switching Compatibility
Help and Support
IPSEC Services
Network Connections
Network Location Awareness (NLA)
Plug and Play
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Security Accounts Manager
Server
Shell Hardware Detection
System Event Notification
Telephony
Terminal Services
Themes
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Windows Management Instrumentation
Wireless Zero Configuration
Workstation

The command completed successfully.

Image Name PID Services

========================= ======
=============================================
System Idle Process 0 N/A

System 4 N/A

smss.exe 1200 N/A

csrss.exe 1280 N/A

winlogon.exe 1312 N/A

services.exe 1356 Eventlog, PlugPlay

lsass.exe 1368 PolicyAgent, ProtectedStorage, SamSs

svchost.exe 1536 DcomLaunch, TermService

svchost.exe 1636 RpcSs

svchost.exe 1792 AudioSrv, CryptSvc, Dhcp, EventSystem,

FastUserSwitchingCompatibility,
helpsvc,
lanmanserver, lanmanworkstation,
Netman,
Nla, RasMan, SENS, SharedAccess,

ShellHWDetection, TapiSrv, Themes,
winmgmt,
WZCSVC

explorer.exe 632 N/A

ctfmon.exe 1548 N/A

EditPadLite.exe 1720 N/A

cmd.exe 1808 N/A

tasklist.exe 356 N/A

wmiprvse.exe 228 N/A


Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 6:40:36 AM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 6:35:10 AM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 4/1/2010
Time: 6:42:47 AM
User: N/A
Computer: COMPAQ-2006
Description:
The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume R:.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0d 00 00 00 02 00 4e 00 ......N.
0008: 02 00 00 00 37 00 04 c0 ....7..À
0010: 00 00 00 00 32 00 00 c0 ....2..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 4/1/2010
Time: 6:44:25 AM
User: N/A
Computer: COMPAQ-2006
Description:
The following boot-start or system-start driver(s) failed to load:
ftsata2
KLIF

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Especially note this last one, which has been seen on almost
every run.

 

[John John - MVP]

Okay, now 0930....Did as suggested. All above now Manual.
Started 6:45 A.M., at 0800 it reverted to Desktop, and at
8:05 monitor was dark and power light flashing. I stopped
it and got following Events, net start and tasklist.
Note one request, that chkdsk/r be run because of corrupt etc.
First time that came around. Note other events, especially at start of run.


Image Name PID Services
========================= ======
=============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 1200 N/A
csrss.exe 1280 N/A
winlogon.exe 1312 N/A
services.exe 1356 Eventlog, PlugPlay
lsass.exe 1368 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 1536 DcomLaunch, TermService
svchost.exe 1636 RpcSs
svchost.exe 1792 AudioSrv, CryptSvc, Dhcp, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
lanmanserver, lanmanworkstation, Netman,
Nla, RasMan, SENS, SharedAccess,
ShellHWDetection, TapiSrv, Themes,
winmgmt,
WZCSVC
explorer.exe 632 N/A
ctfmon.exe 1548 N/A
EditPadLite.exe 1720 N/A
cmd.exe 1808 N/A
tasklist.exe 356 N/A
wmiprvse.exe 228 N/A

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 6:40:36 AM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 4/1/2010
Time: 6:35:10 AM
User: COMPAQ-2006\Compaq_Owner
Computer: COMPAQ-2006
Description:
DCOM got error "The service cannot be started, either because it is
disabled or because it has no enabled devices associated with it. "
attempting to start the service MDM with arguments "" in order to run
the server:
{0C0A3666-30C9-11D0-8F20-00805F2CD064}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 4/1/2010
Time: 6:42:47 AM
User: N/A
Computer: COMPAQ-2006
Description:
The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume R:.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0d 00 00 00 02 00 4e 00 ......N.
0008: 02 00 00 00 37 00 04 c0 ....7..À
0010: 00 00 00 00 32 00 00 c0 ....2..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 4/1/2010
Time: 6:44:25 AM
User: N/A
Computer: COMPAQ-2006
Description:
The following boot-start or system-start driver(s) failed to load:
ftsata2
KLIF

Is that an updated and current list of started Windows services?

You discussed about those two drivers with another poster not too long ago.

ftsata2: Do you now, or did you at any time have a Promise controller
installed?

KLIF: Do you now or did you at any time have Kaspersky AV software
installed on the machine?

The chkdsk message... What do you have stored on volume R?

John

 

[William B. Lurie]

Is that an updated and current list of started Windows services?

Yes, John, I generate it anew every time I make one
of these hibernation runs, so that you can see it right
with the Events.

You discussed about those two drivers with another poster not too long ago.

Yes, and now I'll answer your queries:

ftsata2: Do you now, or did you at any time have a Promise controller
installed?

No, I do not now, and never did. This basic HP machine came with
one hard drive, and cabling and slots for two more, which I
added. I select which drive to run by interrupting boot process
and telling it.

KLIF: Do you now or did you at any time have Kaspersky AV software
installed on the machine?

No, I have used Norton AV steadily for at least 15 years. From
the days when Norton was impossible to work with, to the present,
where they fix boo-boos by Chat and remote control of their software.

The chkdsk message... What do you have stored on volume R?

Oh, I missed that it was referring to volume R. I have numerous
'restore points' of which that volume is one. I generate these
every month or so, using the Save & Restore feature of Norton
System Works, which used to be PowerQuest Partition Magic. I
keep these in case I have to recreate a system as it was as of
an earlier date). I'll chkdsk it routinely but I think we can
ignore that Event.

 

[Unknown]

Thanks. Without sitting at your machine and observing various items I can
only go through the process of elimination.
It seems something is calling for the internet about every hour. May I ask
what you mean when you say Norton fixes their Boo-boos by remote control?

 

[John John - MVP]

Yes, John, I generate it anew every time I make one
of these hibernation runs, so that you can see it right
with the Events.

Yes, and now I'll answer your queries:

No, I do not now, and never did. This basic HP machine came with
one hard drive, and cabling and slots for two more, which I
added. I select which drive to run by interrupting boot process
and telling it.

No, I have used Norton AV steadily for at least 15 years. From
the days when Norton was impossible to work with, to the present,
where they fix boo-boos by Chat and remote control of their software.

Oh, I missed that it was referring to volume R. I have numerous
'restore points' of which that volume is one. I generate these
every month or so, using the Save & Restore feature of Norton
System Works, which used to be PowerQuest Partition Magic. I
keep these in case I have to recreate a system as it was as of
an earlier date). I'll chkdsk it routinely but I think we can
ignore that Event.

These system-start driver errors shouldn't affect the ability to
hibernate but you can change their startup type and get rid of the
errors if you want. You will have to change them in the registry at
their respective subkeys in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key , set their
Start Value to 0x3 or 0x4. 0x3 is manual start, 0x4 is disabled.

Or, we can change them at the command prompt if you wish, I need the
results of the following command before I can give you the proper
commands to change the start type:

sc query state= all >c:\sc.txt

Copy and paste the contents of the generated sc.txt file to your next
post, there will be lots of verbiage in the file, post it all.

John

 

[William B. Lurie]

Thanks. Without sitting at your machine and observing various items I can
only go through the process of elimination.
It seems something is calling for the internet about every hour. May I ask
what you mean when you say Norton fixes their Boo-boos by remote control?

Sure. I go to their website and find tech support, for which one option
is one-on-one online chat with their 'analyst'. I describe the problem,
he (she) asks for permission to connect to my machine remotely, I give
it, then he takes control of my cursor as tho' he was sitting in my
chair, clicks and clacks, even downloads new upgrades software,
installs, he and I check that he has fixed the problem, and I terminate
the 'chat' session. The wait isn't usually long, typically 5 to 15
minutes. It's calling for *something* after one hour, which is why it
doesn't reach the 2-hour hibernate, but as for calling the Internet, I
don't know if we've proven that........

 

[Unknown]

You stated after the hibernation time (2 hours) your HD light is flashing?
At that point did you open task manager and check what processes is running
and whether or not
an application is running?
Also have you compared the services when starting to hibernate against the
services after one hour?

 

[William B. Lurie]

These system-start driver errors shouldn't affect the ability to
hibernate but you can change their startup type and get rid of the
errors if you want. You will have to change them in the registry at
their respective subkeys in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key , set their
Start Value to 0x3 or 0x4. 0x3 is manual start, 0x4 is disabled.

Or, we can change them at the command prompt if you wish, I need the
results of the following command before I can give you the proper
commands to change the start type:

sc query state= all >c:\sc.txt

Copy and paste the contents of the generated sc.txt file to your next
post, there will be lots of verbiage in the file, post it all.

John

I don't mess with registry unless it has to be messed with.
And if those commands and errors are innocuous, I see no need to
mess with them via command prompt. And the chkdsk request was
a blind alley, and to be sure, I deleted that 2+ year old backup
anyway.

But what to do next? With all this time spent on the hibernate
problem, I hate to give up. Who knows, the answer may be just around
the next bend in the road.

 

[William B. Lurie]

You stated after the hibernation time (2 hours) your HD light is flashing?
At that point did you open task manager and check what processes is running
and whether or not
an application is running?

No, but I will next time around. What I see there most often, during
these test runs, is nothing related to the user except HpBootOpt, but
plenty of System and Local Service with many many 'svchost.exe',
none of which are under my control.

The sequence is, first desktop; then Screen Saver: then Monitor shutoff
(never), then HD shutoff (20 minutes), then System Standby (25 min.)
and finally hibernate (2 hours). After 2 hours or more have elapsed,
the mintor is in reduced power, the power-on light is flashing, and
that's all. It never goes to hibernate, which would be indicated by
the power-on light turning off.

 

[Unknown]

Do a Google search for 'power on light flashing' Lots of info there.

 

[John John - MVP]

I don't mess with registry unless it has to be messed with.
And if those commands and errors are innocuous, I see no need to
mess with them via command prompt. And the chkdsk request was
a blind alley, and to be sure, I deleted that 2+ year old backup
anyway.

But what to do next? With all this time spent on the hibernate
problem, I hate to give up. Who knows, the answer may be just around
the next bend in the road.

I don't see the KLIF or ftsata2 driver on the sc query list that you
supplied... could be that they are on the clone but not on the
production machine, or that the sc command doesn't see these as
services. You can try these and see what it returns:

sc query klif
sc query ftsata2


We could also get the list of drivers with a different command:

driverquery >c:\drivers.txt

If you want to solve the problem you need to keep on investigating until
you find what it is that is running or starting and that prevents
hibernation, I don't know of an easy way to figure this out. Sometimes
you need dogged determination to get to the bottom of some of these
problems.

John

 

[William B. Lurie]

I don't see the KLIF or ftsata2 driver on the sc query list that you
supplied... could be that they are on the clone but not on the
production machine, or that the sc command doesn't see these as
services. You can try these and see what it returns:

sc query klif
sc query ftsata2

They're both there, John. One of them is:


SERVICE_NAME: ftsata2
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
The other one reads the same but I misplaced it.....the
same except it said klif and one other change
(I think TYPE -------CONTROL).

We could also get the list of drivers with a different command:

driverquery >c:\drivers.txt

It didn't recognize that command.

If you want to solve the problem you need to keep on investigating until
you find what it is that is running or starting and that prevents
hibernation, I don't know of an easy way to figure this out. Sometimes
you need dogged determination to get to the bottom of some of these
problems.

Oh, you're right, John. We've both invested too much
time and intellect in it, and I'd hate to drop it,
either. But, as I said, what next?

 

[William B. Lurie]

They're both there, John. One of them is:


SERVICE_NAME: ftsata2
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
The other one reads the same but I misplaced it.....the
same except it said klif and one other change
(I think TYPE -------CONTROL).xxxxxx SEE BELOW!!!!
xxxxxxxx

It didn't recognize that command.

Oh, you're right, John. We've both invested too much
time and intellect in it, and I'd hate to drop it,
either. But, as I said, what next?

Here's the other one.....from the Clone; both are

 

[John John - MVP]

They're both there, John. One of them is:


SERVICE_NAME: ftsata2
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED

(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 31 (0x1f)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
The other one reads the same but I misplaced it.....the
same except it said klif and one other change
(I think TYPE -------CONTROL).

At the command prompt do:

sc config klif start= demand
sc config ftsata2 start= demand

You should get a ChangeServiceConfig message indicating success or failure.

It didn't recognize that command.

Another utility that is included in XP Pro but not in XP Home...

Oh, you're right, John. We've both invested too much
time and intellect in it, and I'd hate to drop it,
either. But, as I said, what next?

Make sure that you don't have a 3D screen saver running.

Disconnect the network cable and see if things change, maybe something
from 'outside' is keeping the machine alive.

See what shows up in the Event Log, if there is nothing to be found in
the Event Log start investigating the Loaded Modules.

John

 

[William B. Lurie]

At the command prompt do:

sc config klif start= demand
sc config ftsata2 start= demand

You should get a ChangeServiceConfig message indicating success or failure.

Okay, I'll try those.

Another utility that is included in XP Pro but not in XP Home...



Make sure that you don't have a 3D screen saver running.

Only screen saver is garden variety generic via Start>>Display>>Screen
Saver that came with XP.

Disconnect the network cable and see if things change, maybe something
from 'outside' is keeping the machine alive.

I was testing that way for a while, didn't show any improvement (then).

See what shows up in the Event Log, if there is nothing to be found in
the Event Log start investigating the Loaded Modules.

By Loaded Modules, I assume you mean everything that shows
in the Task Manager list, including about 15 executables
that are not user-generated...... SvcHosts, for example.
I don't think I'm up to doing that, but I have the other
items above to look into.

May I digress with an adaptation of a prayer?
Lord, give me the strength to change what I can change.
And the grace to accept what I cannot change.
And the wisdom to know the difference between the two.
Bill

 

[William B. Lurie]

(snip)

At the command prompt do:

sc config klif start= demand
sc config ftsata2 start= demand

You should get a ChangeServiceConfig message indicating success or failure.

Right. They both worked fine, and both showed 'Success'.
I hope that's good.

Another utility that is included in XP Pro but not in XP Home...



Make sure that you don't have a 3D screen saver running.

Disconnect the network cable and see if things change, maybe something
from 'outside' is keeping the machine alive.

I'll make another run with phone line disconnected,
but I've done that before. Meanwhile, you have a record of
what my Loaded Modules look like.....can you tell me which
ones I must absolutely not delete because the System won't function
without them? There aren't that many (I assume you're referring
to what the Task Manager shows me).

 

[John John - MVP]

Only screen saver is garden variety generic via Start>>Display>>Screen
Saver that came with XP.

Even if they are the "garden variety" that came with XP they could still
be at fault. You have to positively eliminate possible causes, disable
screen savers(set to None) and see if things change.

I was testing that way for a while, didn't show any improvement (then).

By Loaded Modules, I assume you mean everything that shows
in the Task Manager list, including about 15 executables
that are not user-generated...... SvcHosts, for example.
I don't think I'm up to doing that, but I have the other
items above to look into.

May I digress with an adaptation of a prayer?
Lord, give me the strength to change what I can change.
And the grace to accept what I cannot change.
And the wisdom to know the difference between the two.

Amen.

John

 

[John John - MVP]

(snip)

Right. They both worked fine, and both showed 'Success'.
I hope that's good.

Yes, thats good. The Event Viewer errors relating to these two drivers
should now disappear.

I'll make another run with phone line disconnected,
but I've done that before. Meanwhile, you have a record of
what my Loaded Modules look like.....can you tell me which
ones I must absolutely not delete because the System won't function
without them? There aren't that many (I assume you're referring
to what the Task Manager shows me).

Reboot the machine and give us a fresh list for the Net Start and
Tasklist /svc commands.

Keep checking the Event Log to see if new errors are being recorded, if
you are lucky an event in the log might provide a clue that will lead to
the cause of the problem. If there are no clues in the Event Log then
you will have to look at the loaded modules for more clues. Weeding
through the list of modules is significantly more arduous than disabling
unneeded services. To see the loaded modules enter the following in the
Start Menu Run box:

msinfo32 /category SWEnvLoadedModules

John