Forum - DLL-files.com

No, I have XP/Home Edition/SP2 .....
And, to my knowledge, I installed no
Workgroup Engine.

Unknown wrote:
> Your XP is Professional? Did you install Windows Workgroup Engine?
> "William B. Lurie" <billurie@nospam.net> wrote in message
> news:OH8lwry2KHA.1624@TK2MSFTNGP06.phx.gbl...
>> Yes, and maybe John can devise a way to tell us why
>> it is being reset.
>>
>> Unknown wrote:
>>> Not all 'events' are recorded but the hibernate time out clock is being
>>> reset..
>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>> news:uxoL1Ey2KHA.1452@TK2MSFTNGP06.phx.gbl...
>>>> John John - MVP wrote:
>>>>> Well, forgive me but I surely have to wonder what it is that is going
>>>>> on at your end...
>>>>>
>>>>> The last batch file that I asked you to run would have changed some of
>>>>> the start values of some of the services but I note some
>>>>> inconsistencies:
>>>>>
>>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it matters
>>>>> but who disabled this?
>>>>>
>>>>> Browser set to Manual now it's back on Auto. Who set this back to
>>>>> Auto? You told me that you have a stand alone desktop and that
>>>>> definitely you are not on a network. The Browser service maintains the
>>>>> browse list, a list of of all available servers on domains or a list of
>>>>> available computers on workgroups. The Browser service does broadcast
>>>>> announcements over the network at specific time intervals (like every
>>>>> 12 minutes, until the Master Browser tells it to shut up) and plays a
>>>>> role in the assignment of browser tasks to specific computers on the
>>>>> network. You have no network... why is the Browser service on Auto?
>>>>> Maybe someone wants this thing barking every 12 minutes....
>>>>>
>>>>> lanmanserver set to Disabled now it's Manual. No network, no file and
>>>>> printer sharing so as far as I'm concerned this should be set to
>>>>> disabled, Manual might also be fine but the point is, who changed it
>>>>> from Disabled to Manual?
>>>>>
>>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>>> software, if the printer and all its software was removed I have to
>>>>> wonder why is this service still present...
>>>>>
>>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing? What
>>>>> software are you running that needs this thing to be set to Auto? A
>>>>> quick search had revealed that it might belong to an accounting
>>>>> package, I can't say for sure but anything with "sql" in it usually
>>>>> suggests that it is part of some kind of database. And I have to
>>>>> wonder if this database is in anyway associated to the Indexing service
>>>>> that seemed to be doing cataloging work at any or all hours of the day.
>>>>>
>>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>>> Information on this is a bit scant or vague but it seems that it might
>>>>> be junk installed by AOL and that it might be needed for some AOL
>>>>> features... or that it might be unwanted junk related to adware.
>>>>> Without knowing if you are on AOL I had decided to leave it on Auto for
>>>>> the time being. But as far as I'm concerned if you can live without it
>>>>> maybe you should have it disabled.
>>>>>
>>>>> W32Time set to Manual now back to Auto. You said in earlier posts that
>>>>> the Time service was improperly configured and that it couldn't
>>>>> synchronize with a time server, so all it's doing is trying (and
>>>>> failing) to contact a time server, network traffic for naught and for
>>>>> that specific reason I wanted to remove this from the picture, but I
>>>>> see that it is back... like the cat with nine lives...
>>>>>
>>>>> WZCSVC was set to Manual now it's back to Auto. This is is the service
>>>>> that automatically configures 802.11 wireless network devices. Are you
>>>>> on a wireless network? You said that you are a standalone machine that
>>>>> is not part of a network and that you plug to the internet with a
>>>>> telephone cable (I assume DSL, not dial-up, right?). Is your printer
>>>>> running on wireless? Is the webcam a wireless device? Do you have a
>>>>> wireless router? If you do have a wireless router, why are its
>>>>> wireless functions running if you use a telephone cable to plug to the
>>>>> internet? Why is this service back to Auto? For all I know maybe you
>>>>> have 'unwanted guests' accessing your wireless router...
>>>>>
>>>>> Maybe you inadvertently changed some of these settings while you were
>>>>> 'playing' with CodeStuff Starter. I'm still quite busy with other
>>>>> commitments, I will try to be back later with a new batch file for you
>>>>> to run, we'll give it another try.
>>>>>
>>>>> John
>>>> Well,John, the only approach I can see that makes sense, is for you
>>>> to give me a script file that will set all my services to what you
>>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>>> and run autoruns.exe again and report autostart.txt and we can see
>>>> what was changed when I do nothing in between. Meanwhile, I'm
>>>> waiting for your advice.
>>>>
>>>> I can't understand how the Events Log shows absolutely nothing
>>>> happening in the two-hour period, so no reason for it not to
>>>> obey the hibernate command......yet it jest doesn't do it.
>

PSQLWGE (your services) is Window Workgroup Engine. That and
'lanmanworkstation' indicate to me that other computers have access to your
computer.

"William B. Lurie" <billurie@nospam.net> wrote in message
news:uwDxpEz2KHA.1016@TK2MSFTNGP02.phx.gbl...
> No, I have XP/Home Edition/SP2 .....
> And, to my knowledge, I installed no
> Workgroup Engine.
>
> Unknown wrote:
>> Your XP is Professional? Did you install Windows Workgroup Engine?
>> "William B. Lurie" <billurie@nospam.net> wrote in message
>> news:OH8lwry2KHA.1624@TK2MSFTNGP06.phx.gbl...
>>> Yes, and maybe John can devise a way to tell us why
>>> it is being reset.
>>>
>>> Unknown wrote:
>>>> Not all 'events' are recorded but the hibernate time out clock is being
>>>> reset..
>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>> news:uxoL1Ey2KHA.1452@TK2MSFTNGP06.phx.gbl...
>>>>> John John - MVP wrote:
>>>>>> Well, forgive me but I surely have to wonder what it is that is going
>>>>>> on at your end...
>>>>>>
>>>>>> The last batch file that I asked you to run would have changed some
>>>>>> of the start values of some of the services but I note some
>>>>>> inconsistencies:
>>>>>>
>>>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>>>>> matters but who disabled this?
>>>>>>
>>>>>> Browser set to Manual now it's back on Auto. Who set this back to
>>>>>> Auto? You told me that you have a stand alone desktop and that
>>>>>> definitely you are not on a network. The Browser service maintains
>>>>>> the browse list, a list of of all available servers on domains or a
>>>>>> list of available computers on workgroups. The Browser service does
>>>>>> broadcast announcements over the network at specific time intervals
>>>>>> (like every 12 minutes, until the Master Browser tells it to shut up)
>>>>>> and plays a role in the assignment of browser tasks to specific
>>>>>> computers on the network. You have no network... why is the Browser
>>>>>> service on Auto? Maybe someone wants this thing barking every 12
>>>>>> minutes....
>>>>>>
>>>>>> lanmanserver set to Disabled now it's Manual. No network, no file
>>>>>> and printer sharing so as far as I'm concerned this should be set to
>>>>>> disabled, Manual might also be fine but the point is, who changed it
>>>>>> from Disabled to Manual?
>>>>>>
>>>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>>>> software, if the printer and all its software was removed I have to
>>>>>> wonder why is this service still present...
>>>>>>
>>>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>>>>> What software are you running that needs this thing to be set to
>>>>>> Auto? A quick search had revealed that it might belong to an
>>>>>> accounting package, I can't say for sure but anything with "sql" in
>>>>>> it usually suggests that it is part of some kind of database. And I
>>>>>> have to wonder if this database is in anyway associated to the
>>>>>> Indexing service that seemed to be doing cataloging work at any or
>>>>>> all hours of the day.
>>>>>>
>>>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>>>> Information on this is a bit scant or vague but it seems that it
>>>>>> might be junk installed by AOL and that it might be needed for some
>>>>>> AOL features... or that it might be unwanted junk related to adware.
>>>>>> Without knowing if you are on AOL I had decided to leave it on Auto
>>>>>> for the time being. But as far as I'm concerned if you can live
>>>>>> without it maybe you should have it disabled.
>>>>>>
>>>>>> W32Time set to Manual now back to Auto. You said in earlier posts
>>>>>> that the Time service was improperly configured and that it couldn't
>>>>>> synchronize with a time server, so all it's doing is trying (and
>>>>>> failing) to contact a time server, network traffic for naught and for
>>>>>> that specific reason I wanted to remove this from the picture, but I
>>>>>> see that it is back... like the cat with nine lives...
>>>>>>
>>>>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>>>>> service that automatically configures 802.11 wireless network
>>>>>> devices. Are you on a wireless network? You said that you are a
>>>>>> standalone machine that is not part of a network and that you plug to
>>>>>> the internet with a telephone cable (I assume DSL, not dial-up,
>>>>>> right?). Is your printer running on wireless? Is the webcam a
>>>>>> wireless device? Do you have a wireless router? If you do have a
>>>>>> wireless router, why are its wireless functions running if you use a
>>>>>> telephone cable to plug to the internet? Why is this service back to
>>>>>> Auto? For all I know maybe you have 'unwanted guests' accessing your
>>>>>> wireless router...
>>>>>>
>>>>>> Maybe you inadvertently changed some of these settings while you were
>>>>>> 'playing' with CodeStuff Starter. I'm still quite busy with other
>>>>>> commitments, I will try to be back later with a new batch file for
>>>>>> you to run, we'll give it another try.
>>>>>>
>>>>>> John
>>>>> Well,John, the only approach I can see that makes sense, is for you
>>>>> to give me a script file that will set all my services to what you
>>>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>>>> and run autoruns.exe again and report autostart.txt and we can see
>>>>> what was changed when I do nothing in between. Meanwhile, I'm
>>>>> waiting for your advice.
>>>>>
>>>>> I can't understand how the Events Log shows absolutely nothing
>>>>> happening in the two-hour period, so no reason for it not to
>>>>> obey the hibernate command......yet it jest doesn't do it.
>>

Well, certainly not on any kind of dial-up basis.
In the past, on specific occasion, I have granted
remote access to Symantec on-line-chat-technical
help to allow them to fix software problems. But
do you really think they are in any way accessing my
machine and causing it not to hibernate? Remember, I
am doing all these tests with my machine isolated
from the outside world. Specifically, I guess
those 'services' can be Disabled, to remove any such
worries.

Unknown wrote:
> PSQLWGE (your services) is Window Workgroup Engine. That and
> 'lanmanworkstation' indicate to me that other computers have access to your
> computer.
>
> "William B. Lurie" <billurie@nospam.net> wrote in message
> news:uwDxpEz2KHA.1016@TK2MSFTNGP02.phx.gbl...
>> No, I have XP/Home Edition/SP2 .....
>> And, to my knowledge, I installed no
>> Workgroup Engine.
>>
>> Unknown wrote:
>>> Your XP is Professional? Did you install Windows Workgroup Engine?
>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>> news:OH8lwry2KHA.1624@TK2MSFTNGP06.phx.gbl...
>>>> Yes, and maybe John can devise a way to tell us why
>>>> it is being reset.
>>>>
>>>> Unknown wrote:
>>>>> Not all 'events' are recorded but the hibernate time out clock is being
>>>>> reset..
>>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>>> news:uxoL1Ey2KHA.1452@TK2MSFTNGP06.phx.gbl...
>>>>>> John John - MVP wrote:
>>>>>>> Well, forgive me but I surely have to wonder what it is that is going
>>>>>>> on at your end...
>>>>>>>
>>>>>>> The last batch file that I asked you to run would have changed some
>>>>>>> of the start values of some of the services but I note some
>>>>>>> inconsistencies:
>>>>>>>
>>>>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>>>>>> matters but who disabled this?
>>>>>>>
>>>>>>> Browser set to Manual now it's back on Auto. Who set this back to
>>>>>>> Auto? You told me that you have a stand alone desktop and that
>>>>>>> definitely you are not on a network. The Browser service maintains
>>>>>>> the browse list, a list of of all available servers on domains or a
>>>>>>> list of available computers on workgroups. The Browser service does
>>>>>>> broadcast announcements over the network at specific time intervals
>>>>>>> (like every 12 minutes, until the Master Browser tells it to shut up)
>>>>>>> and plays a role in the assignment of browser tasks to specific
>>>>>>> computers on the network. You have no network... why is the Browser
>>>>>>> service on Auto? Maybe someone wants this thing barking every 12
>>>>>>> minutes....
>>>>>>>
>>>>>>> lanmanserver set to Disabled now it's Manual. No network, no file
>>>>>>> and printer sharing so as far as I'm concerned this should be set to
>>>>>>> disabled, Manual might also be fine but the point is, who changed it
>>>>>>> from Disabled to Manual?
>>>>>>>
>>>>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>>>>> software, if the printer and all its software was removed I have to
>>>>>>> wonder why is this service still present...
>>>>>>>
>>>>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>>>>>> What software are you running that needs this thing to be set to
>>>>>>> Auto? A quick search had revealed that it might belong to an
>>>>>>> accounting package, I can't say for sure but anything with "sql" in
>>>>>>> it usually suggests that it is part of some kind of database. And I
>>>>>>> have to wonder if this database is in anyway associated to the
>>>>>>> Indexing service that seemed to be doing cataloging work at any or
>>>>>>> all hours of the day.
>>>>>>>
>>>>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>>>>> Information on this is a bit scant or vague but it seems that it
>>>>>>> might be junk installed by AOL and that it might be needed for some
>>>>>>> AOL features... or that it might be unwanted junk related to adware.
>>>>>>> Without knowing if you are on AOL I had decided to leave it on Auto
>>>>>>> for the time being. But as far as I'm concerned if you can live
>>>>>>> without it maybe you should have it disabled.
>>>>>>>
>>>>>>> W32Time set to Manual now back to Auto. You said in earlier posts
>>>>>>> that the Time service was improperly configured and that it couldn't
>>>>>>> synchronize with a time server, so all it's doing is trying (and
>>>>>>> failing) to contact a time server, network traffic for naught and for
>>>>>>> that specific reason I wanted to remove this from the picture, but I
>>>>>>> see that it is back... like the cat with nine lives...
>>>>>>>
>>>>>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>>>>>> service that automatically configures 802.11 wireless network
>>>>>>> devices. Are you on a wireless network? You said that you are a
>>>>>>> standalone machine that is not part of a network and that you plug to
>>>>>>> the internet with a telephone cable (I assume DSL, not dial-up,
>>>>>>> right?). Is your printer running on wireless? Is the webcam a
>>>>>>> wireless device? Do you have a wireless router? If you do have a
>>>>>>> wireless router, why are its wireless functions running if you use a
>>>>>>> telephone cable to plug to the internet? Why is this service back to
>>>>>>> Auto? For all I know maybe you have 'unwanted guests' accessing your
>>>>>>> wireless router...
>>>>>>>
>>>>>>> Maybe you inadvertently changed some of these settings while you were
>>>>>>> 'playing' with CodeStuff Starter. I'm still quite busy with other
>>>>>>> commitments, I will try to be back later with a new batch file for
>>>>>>> you to run, we'll give it another try.
>>>>>>>
>>>>>>> John
>>>>>> Well,John, the only approach I can see that makes sense, is for you
>>>>>> to give me a script file that will set all my services to what you
>>>>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>>>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>>>>> and run autoruns.exe again and report autostart.txt and we can see
>>>>>> what was changed when I do nothing in between. Meanwhile, I'm
>>>>>> waiting for your advice.
>>>>>>
>>>>>> I can't understand how the Events Log shows absolutely nothing
>>>>>> happening in the two-hour period, so no reason for it not to
>>>>>> obey the hibernate command......yet it jest doesn't do it.
>
>

Are you strictly dialup? Does Windows Workgroup Engine appear in add/remove
programs?
William B. Lurie" <billurie@nospam.net> wrote in message
news:O7c5giz2KHA.2284@TK2MSFTNGP06.phx.gbl...
> Well, certainly not on any kind of dial-up basis.
> In the past, on specific occasion, I have granted
> remote access to Symantec on-line-chat-technical
> help to allow them to fix software problems. But
> do you really think they are in any way accessing my
> machine and causing it not to hibernate? Remember, I
> am doing all these tests with my machine isolated
> from the outside world. Specifically, I guess
> those 'services' can be Disabled, to remove any such
> worries.
>
> Unknown wrote:
>> PSQLWGE (your services) is Window Workgroup Engine. That and
>> 'lanmanworkstation' indicate to me that other computers have access to
>> your computer.
>>
>> "William B. Lurie" <billurie@nospam.net> wrote in message
>> news:uwDxpEz2KHA.1016@TK2MSFTNGP02.phx.gbl...
>>> No, I have XP/Home Edition/SP2 .....
>>> And, to my knowledge, I installed no
>>> Workgroup Engine.
>>>
>>> Unknown wrote:
>>>> Your XP is Professional? Did you install Windows Workgroup Engine?
>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>> news:OH8lwry2KHA.1624@TK2MSFTNGP06.phx.gbl...
>>>>> Yes, and maybe John can devise a way to tell us why
>>>>> it is being reset.
>>>>>
>>>>> Unknown wrote:
>>>>>> Not all 'events' are recorded but the hibernate time out clock is
>>>>>> being reset..
>>>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>>>> news:uxoL1Ey2KHA.1452@TK2MSFTNGP06.phx.gbl...
>>>>>>> John John - MVP wrote:
>>>>>>>> Well, forgive me but I surely have to wonder what it is that is
>>>>>>>> going on at your end...
>>>>>>>>
>>>>>>>> The last batch file that I asked you to run would have changed some
>>>>>>>> of the start values of some of the services but I note some
>>>>>>>> inconsistencies:
>>>>>>>>
>>>>>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>>>>>>> matters but who disabled this?
>>>>>>>>
>>>>>>>> Browser set to Manual now it's back on Auto. Who set this back to
>>>>>>>> Auto? You told me that you have a stand alone desktop and that
>>>>>>>> definitely you are not on a network. The Browser service maintains
>>>>>>>> the browse list, a list of of all available servers on domains or a
>>>>>>>> list of available computers on workgroups. The Browser service
>>>>>>>> does broadcast announcements over the network at specific time
>>>>>>>> intervals (like every 12 minutes, until the Master Browser tells it
>>>>>>>> to shut up) and plays a role in the assignment of browser tasks to
>>>>>>>> specific computers on the network. You have no network... why is
>>>>>>>> the Browser service on Auto? Maybe someone wants this thing barking
>>>>>>>> every 12 minutes....
>>>>>>>>
>>>>>>>> lanmanserver set to Disabled now it's Manual. No network, no file
>>>>>>>> and printer sharing so as far as I'm concerned this should be set
>>>>>>>> to disabled, Manual might also be fine but the point is, who
>>>>>>>> changed it from Disabled to Manual?
>>>>>>>>
>>>>>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>>>>>> software, if the printer and all its software was removed I have to
>>>>>>>> wonder why is this service still present...
>>>>>>>>
>>>>>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>>>>>>> What software are you running that needs this thing to be set to
>>>>>>>> Auto? A quick search had revealed that it might belong to an
>>>>>>>> accounting package, I can't say for sure but anything with "sql" in
>>>>>>>> it usually suggests that it is part of some kind of database. And
>>>>>>>> I have to wonder if this database is in anyway associated to the
>>>>>>>> Indexing service that seemed to be doing cataloging work at any or
>>>>>>>> all hours of the day.
>>>>>>>>
>>>>>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>>>>>> Information on this is a bit scant or vague but it seems that it
>>>>>>>> might be junk installed by AOL and that it might be needed for some
>>>>>>>> AOL features... or that it might be unwanted junk related to
>>>>>>>> adware. Without knowing if you are on AOL I had decided to leave it
>>>>>>>> on Auto for the time being. But as far as I'm concerned if you can
>>>>>>>> live without it maybe you should have it disabled.
>>>>>>>>
>>>>>>>> W32Time set to Manual now back to Auto. You said in earlier posts
>>>>>>>> that the Time service was improperly configured and that it
>>>>>>>> couldn't synchronize with a time server, so all it's doing is
>>>>>>>> trying (and failing) to contact a time server, network traffic for
>>>>>>>> naught and for that specific reason I wanted to remove this from
>>>>>>>> the picture, but I see that it is back... like the cat with nine
>>>>>>>> lives...
>>>>>>>>
>>>>>>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>>>>>>> service that automatically configures 802.11 wireless network
>>>>>>>> devices. Are you on a wireless network? You said that you are a
>>>>>>>> standalone machine that is not part of a network and that you plug
>>>>>>>> to the internet with a telephone cable (I assume DSL, not dial-up,
>>>>>>>> right?). Is your printer running on wireless? Is the webcam a
>>>>>>>> wireless device? Do you have a wireless router? If you do have a
>>>>>>>> wireless router, why are its wireless functions running if you use
>>>>>>>> a telephone cable to plug to the internet? Why is this service back
>>>>>>>> to Auto? For all I know maybe you have 'unwanted guests' accessing
>>>>>>>> your wireless router...
>>>>>>>>
>>>>>>>> Maybe you inadvertently changed some of these settings while you
>>>>>>>> were 'playing' with CodeStuff Starter. I'm still quite busy with
>>>>>>>> other commitments, I will try to be back later with a new batch
>>>>>>>> file for you to run, we'll give it another try.
>>>>>>>>
>>>>>>>> John
>>>>>>> Well,John, the only approach I can see that makes sense, is for you
>>>>>>> to give me a script file that will set all my services to what you
>>>>>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>>>>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>>>>>> and run autoruns.exe again and report autostart.txt and we can see
>>>>>>> what was changed when I do nothing in between. Meanwhile, I'm
>>>>>>> waiting for your advice.
>>>>>>>
>>>>>>> I can't understand how the Events Log shows absolutely nothing
>>>>>>> happening in the two-hour period, so no reason for it not to
>>>>>>> obey the hibernate command......yet it jest doesn't do it.
>>

Unknown wrote:
> Are you strictly dialup?

I thought I made that clear. I am DSL on a regular phone
line, hardwired and on all the time. And I can't find
Windows Workgroup Engine in Add/Remove.

Does Windows Workgroup Engine appear in add/remove
> programs?

> William B. Lurie" <billurie@nospam.net> wrote in message
> news:O7c5giz2KHA.2284@TK2MSFTNGP06.phx.gbl...
>> Well, certainly not on any kind of dial-up basis.
>> In the past, on specific occasion, I have granted
>> remote access to Symantec on-line-chat-technical
>> help to allow them to fix software problems. But
>> do you really think they are in any way accessing my
>> machine and causing it not to hibernate? Remember, I
>> am doing all these tests with my machine isolated
>> from the outside world. Specifically, I guess
>> those 'services' can be Disabled, to remove any such
>> worries.
>>
>> Unknown wrote:
>>> PSQLWGE (your services) is Window Workgroup Engine. That and
>>> 'lanmanworkstation' indicate to me that other computers have access to
>>> your computer.
>>>
>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>> news:uwDxpEz2KHA.1016@TK2MSFTNGP02.phx.gbl...
>>>> No, I have XP/Home Edition/SP2 .....
>>>> And, to my knowledge, I installed no
>>>> Workgroup Engine.
>>>>
>>>> Unknown wrote:
>>>>> Your XP is Professional? Did you install Windows Workgroup Engine?
>>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>>> news:OH8lwry2KHA.1624@TK2MSFTNGP06.phx.gbl...
>>>>>> Yes, and maybe John can devise a way to tell us why
>>>>>> it is being reset.
>>>>>>
>>>>>> Unknown wrote:
>>>>>>> Not all 'events' are recorded but the hibernate time out clock is
>>>>>>> being reset..
>>>>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>>>>> news:uxoL1Ey2KHA.1452@TK2MSFTNGP06.phx.gbl...
>>>>>>>> John John - MVP wrote:
>>>>>>>>> Well, forgive me but I surely have to wonder what it is that is
>>>>>>>>> going on at your end...
>>>>>>>>>
>>>>>>>>> The last batch file that I asked you to run would have changed some
>>>>>>>>> of the start values of some of the services but I note some
>>>>>>>>> inconsistencies:
>>>>>>>>>
>>>>>>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>>>>>>>> matters but who disabled this?
>>>>>>>>>
>>>>>>>>> Browser set to Manual now it's back on Auto. Who set this back to
>>>>>>>>> Auto? You told me that you have a stand alone desktop and that
>>>>>>>>> definitely you are not on a network. The Browser service maintains
>>>>>>>>> the browse list, a list of of all available servers on domains or a
>>>>>>>>> list of available computers on workgroups. The Browser service
>>>>>>>>> does broadcast announcements over the network at specific time
>>>>>>>>> intervals (like every 12 minutes, until the Master Browser tells it
>>>>>>>>> to shut up) and plays a role in the assignment of browser tasks to
>>>>>>>>> specific computers on the network. You have no network... why is
>>>>>>>>> the Browser service on Auto? Maybe someone wants this thing barking
>>>>>>>>> every 12 minutes....
>>>>>>>>>
>>>>>>>>> lanmanserver set to Disabled now it's Manual. No network, no file
>>>>>>>>> and printer sharing so as far as I'm concerned this should be set
>>>>>>>>> to disabled, Manual might also be fine but the point is, who
>>>>>>>>> changed it from Disabled to Manual?
>>>>>>>>>
>>>>>>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>>>>>>> software, if the printer and all its software was removed I have to
>>>>>>>>> wonder why is this service still present...
>>>>>>>>>
>>>>>>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>>>>>>>> What software are you running that needs this thing to be set to
>>>>>>>>> Auto? A quick search had revealed that it might belong to an
>>>>>>>>> accounting package, I can't say for sure but anything with "sql" in
>>>>>>>>> it usually suggests that it is part of some kind of database. And
>>>>>>>>> I have to wonder if this database is in anyway associated to the
>>>>>>>>> Indexing service that seemed to be doing cataloging work at any or
>>>>>>>>> all hours of the day.
>>>>>>>>>
>>>>>>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>>>>>>> Information on this is a bit scant or vague but it seems that it
>>>>>>>>> might be junk installed by AOL and that it might be needed for some
>>>>>>>>> AOL features... or that it might be unwanted junk related to
>>>>>>>>> adware. Without knowing if you are on AOL I had decided to leave it
>>>>>>>>> on Auto for the time being. But as far as I'm concerned if you can
>>>>>>>>> live without it maybe you should have it disabled.
>>>>>>>>>
>>>>>>>>> W32Time set to Manual now back to Auto. You said in earlier posts
>>>>>>>>> that the Time service was improperly configured and that it
>>>>>>>>> couldn't synchronize with a time server, so all it's doing is
>>>>>>>>> trying (and failing) to contact a time server, network traffic for
>>>>>>>>> naught and for that specific reason I wanted to remove this from
>>>>>>>>> the picture, but I see that it is back... like the cat with nine
>>>>>>>>> lives...
>>>>>>>>>
>>>>>>>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>>>>>>>> service that automatically configures 802.11 wireless network
>>>>>>>>> devices. Are you on a wireless network? You said that you are a
>>>>>>>>> standalone machine that is not part of a network and that you plug
>>>>>>>>> to the internet with a telephone cable (I assume DSL, not dial-up,
>>>>>>>>> right?). Is your printer running on wireless? Is the webcam a
>>>>>>>>> wireless device? Do you have a wireless router? If you do have a
>>>>>>>>> wireless router, why are its wireless functions running if you use
>>>>>>>>> a telephone cable to plug to the internet? Why is this service back
>>>>>>>>> to Auto? For all I know maybe you have 'unwanted guests' accessing
>>>>>>>>> your wireless router...
>>>>>>>>>
>>>>>>>>> Maybe you inadvertently changed some of these settings while you
>>>>>>>>> were 'playing' with CodeStuff Starter. I'm still quite busy with
>>>>>>>>> other commitments, I will try to be back later with a new batch
>>>>>>>>> file for you to run, we'll give it another try.
>>>>>>>>>
>>>>>>>>> John
>>>>>>>> Well,John, the only approach I can see that makes sense, is for you
>>>>>>>> to give me a script file that will set all my services to what you
>>>>>>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>>>>>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>>>>>>> and run autoruns.exe again and report autostart.txt and we can see
>>>>>>>> what was changed when I do nothing in between. Meanwhile, I'm
>>>>>>>> waiting for your advice.
>>>>>>>>
>>>>>>>> I can't understand how the Events Log shows absolutely nothing
>>>>>>>> happening in the two-hour period, so no reason for it not to
>>>>>>>> obey the hibernate command......yet it jest doesn't do it.
>

Your first comment on your previous post left some confusion. "Well
certainly not on any kind of dialup basis"
My system then, is very similar to yours. I.E. I have XP Home, I'm on a DSL
line. But, you have many more 'services' than I. Some I can easily explain,
(such as LexBeeS), I have a Hewlett Packard. But, psqlWGE,
lanmanworkstation, and the fact that Norton Antivirus pops up in auto after
you shut it down makes no sense.
I'll not offer any suggestions but await John John's next post.
"William B. Lurie" <billurie@nospam.net> wrote in message
news:uy1fO6z2KHA.4336@TK2MSFTNGP04.phx.gbl...
> Unknown wrote:
>> Are you strictly dialup?
>
> I thought I made that clear. I am DSL on a regular phone
> line, hardwired and on all the time. And I can't find
> Windows Workgroup Engine in Add/Remove.
>
> Does Windows Workgroup Engine appear in add/remove
>> programs?
>
>> William B. Lurie" <billurie@nospam.net> wrote in message
>> news:O7c5giz2KHA.2284@TK2MSFTNGP06.phx.gbl...
>>> Well, certainly not on any kind of dial-up basis.
>>> In the past, on specific occasion, I have granted
>>> remote access to Symantec on-line-chat-technical
>>> help to allow them to fix software problems. But
>>> do you really think they are in any way accessing my
>>> machine and causing it not to hibernate? Remember, I
>>> am doing all these tests with my machine isolated
>>> from the outside world. Specifically, I guess
>>> those 'services' can be Disabled, to remove any such
>>> worries.
>>>
>>> Unknown wrote:
>>>> PSQLWGE (your services) is Window Workgroup Engine. That and
>>>> 'lanmanworkstation' indicate to me that other computers have access to
>>>> your computer.
>>>>
>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>> news:uwDxpEz2KHA.1016@TK2MSFTNGP02.phx.gbl...
>>>>> No, I have XP/Home Edition/SP2 .....
>>>>> And, to my knowledge, I installed no
>>>>> Workgroup Engine.
>>>>>
>>>>> Unknown wrote:
>>>>>> Your XP is Professional? Did you install Windows Workgroup Engine?
>>>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>>>> news:OH8lwry2KHA.1624@TK2MSFTNGP06.phx.gbl...
>>>>>>> Yes, and maybe John can devise a way to tell us why
>>>>>>> it is being reset.
>>>>>>>
>>>>>>> Unknown wrote:
>>>>>>>> Not all 'events' are recorded but the hibernate time out clock is
>>>>>>>> being reset..
>>>>>>>> "William B. Lurie" <billurie@nospam.net> wrote in message
>>>>>>>> news:uxoL1Ey2KHA.1452@TK2MSFTNGP06.phx.gbl...
>>>>>>>>> John John - MVP wrote:
>>>>>>>>>> Well, forgive me but I surely have to wonder what it is that is
>>>>>>>>>> going on at your end...
>>>>>>>>>>
>>>>>>>>>> The last batch file that I asked you to run would have changed
>>>>>>>>>> some of the start values of some of the services but I note some
>>>>>>>>>> inconsistencies:
>>>>>>>>>>
>>>>>>>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>>>>>>>>> matters but who disabled this?
>>>>>>>>>>
>>>>>>>>>> Browser set to Manual now it's back on Auto. Who set this back
>>>>>>>>>> to Auto? You told me that you have a stand alone desktop and that
>>>>>>>>>> definitely you are not on a network. The Browser service
>>>>>>>>>> maintains the browse list, a list of of all available servers on
>>>>>>>>>> domains or a list of available computers on workgroups. The
>>>>>>>>>> Browser service does broadcast announcements over the network at
>>>>>>>>>> specific time intervals (like every 12 minutes, until the Master
>>>>>>>>>> Browser tells it to shut up) and plays a role in the assignment
>>>>>>>>>> of browser tasks to specific computers on the network. You have
>>>>>>>>>> no network... why is the Browser service on Auto? Maybe someone
>>>>>>>>>> wants this thing barking every 12 minutes....
>>>>>>>>>>
>>>>>>>>>> lanmanserver set to Disabled now it's Manual. No network, no
>>>>>>>>>> file and printer sharing so as far as I'm concerned this should
>>>>>>>>>> be set to disabled, Manual might also be fine but the point is,
>>>>>>>>>> who changed it from Disabled to Manual?
>>>>>>>>>>
>>>>>>>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>>>>>>>> software, if the printer and all its software was removed I have
>>>>>>>>>> to wonder why is this service still present...
>>>>>>>>>>
>>>>>>>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>>>>>>>>> What software are you running that needs this thing to be set to
>>>>>>>>>> Auto? A quick search had revealed that it might belong to an
>>>>>>>>>> accounting package, I can't say for sure but anything with "sql"
>>>>>>>>>> in it usually suggests that it is part of some kind of database.
>>>>>>>>>> And I have to wonder if this database is in anyway associated to
>>>>>>>>>> the Indexing service that seemed to be doing cataloging work at
>>>>>>>>>> any or all hours of the day.
>>>>>>>>>>
>>>>>>>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>>>>>>>> Information on this is a bit scant or vague but it seems that it
>>>>>>>>>> might be junk installed by AOL and that it might be needed for
>>>>>>>>>> some AOL features... or that it might be unwanted junk related to
>>>>>>>>>> adware. Without knowing if you are on AOL I had decided to leave
>>>>>>>>>> it on Auto for the time being. But as far as I'm concerned if
>>>>>>>>>> you can live without it maybe you should have it disabled.
>>>>>>>>>>
>>>>>>>>>> W32Time set to Manual now back to Auto. You said in earlier
>>>>>>>>>> posts that the Time service was improperly configured and that it
>>>>>>>>>> couldn't synchronize with a time server, so all it's doing is
>>>>>>>>>> trying (and failing) to contact a time server, network traffic
>>>>>>>>>> for naught and for that specific reason I wanted to remove this
>>>>>>>>>> from the picture, but I see that it is back... like the cat with
>>>>>>>>>> nine lives...
>>>>>>>>>>
>>>>>>>>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>>>>>>>>> service that automatically configures 802.11 wireless network
>>>>>>>>>> devices. Are you on a wireless network? You said that you are a
>>>>>>>>>> standalone machine that is not part of a network and that you
>>>>>>>>>> plug to the internet with a telephone cable (I assume DSL, not
>>>>>>>>>> dial-up, right?). Is your printer running on wireless? Is the
>>>>>>>>>> webcam a wireless device? Do you have a wireless router? If you
>>>>>>>>>> do have a wireless router, why are its wireless functions running
>>>>>>>>>> if you use a telephone cable to plug to the internet? Why is this
>>>>>>>>>> service back to Auto? For all I know maybe you have 'unwanted
>>>>>>>>>> guests' accessing your wireless router...
>>>>>>>>>>
>>>>>>>>>> Maybe you inadvertently changed some of these settings while you
>>>>>>>>>> were 'playing' with CodeStuff Starter. I'm still quite busy with
>>>>>>>>>> other commitments, I will try to be back later with a new batch
>>>>>>>>>> file for you to run, we'll give it another try.
>>>>>>>>>>
>>>>>>>>>> John
>>>>>>>>> Well,John, the only approach I can see that makes sense, is for
>>>>>>>>> you
>>>>>>>>> to give me a script file that will set all my services to what you
>>>>>>>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>>>>>>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>>>>>>>> and run autoruns.exe again and report autostart.txt and we can see
>>>>>>>>> what was changed when I do nothing in between. Meanwhile, I'm
>>>>>>>>> waiting for your advice.
>>>>>>>>>
>>>>>>>>> I can't understand how the Events Log shows absolutely nothing
>>>>>>>>> happening in the two-hour period, so no reason for it not to
>>>>>>>>> obey the hibernate command......yet it jest doesn't do it.
>>

John John - MVP wrote:
> William B. Lurie wrote:
>> John John - MVP wrote:
>>>
>>> Well, forgive me but I surely have to wonder what it is that is going
>>> on at your end...
>>>
>>> The last batch file that I asked you to run would have changed some
>>> of the start values of some of the services but I note some
>>> inconsistencies:
>>>
>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>> matters but who disabled this?
>>>
>>> Browser set to Manual now it's back on Auto. Who set this back to
>>> Auto? You told me that you have a stand alone desktop and that
>>> definitely you are not on a network. The Browser service maintains
>>> the browse list, a list of of all available servers on domains or a
>>> list of available computers on workgroups. The Browser service does
>>> broadcast announcements over the network at specific time intervals
>>> (like every 12 minutes, until the Master Browser tells it to shut up)
>>> and plays a role in the assignment of browser tasks to specific
>>> computers on the network. You have no network... why is the Browser
>>> service on Auto? Maybe someone wants this thing barking every 12
>>> minutes....
>>>
>>> lanmanserver set to Disabled now it's Manual. No network, no file
>>> and printer sharing so as far as I'm concerned this should be set to
>>> disabled, Manual might also be fine but the point is, who changed it
>>> from Disabled to Manual?
>>>
>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>> software, if the printer and all its software was removed I have to
>>> wonder why is this service still present...
>>>
>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>> What software are you running that needs this thing to be set to
>>> Auto? A quick search had revealed that it might belong to an
>>> accounting package, I can't say for sure but anything with "sql" in
>>> it usually suggests that it is part of some kind of database. And I
>>> have to wonder if this database is in anyway associated to the
>>> Indexing service that seemed to be doing cataloging work at any or
>>> all hours of the day.
>>>
>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>> Information on this is a bit scant or vague but it seems that it
>>> might be junk installed by AOL and that it might be needed for some
>>> AOL features... or that it might be unwanted junk related to adware.
>>> Without knowing if you are on AOL I had decided to leave it on Auto
>>> for the time being. But as far as I'm concerned if you can live
>>> without it maybe you should have it disabled.
>>>
>>> W32Time set to Manual now back to Auto. You said in earlier posts
>>> that the Time service was improperly configured and that it couldn't
>>> synchronize with a time server, so all it's doing is trying (and
>>> failing) to contact a time server, network traffic for naught and for
>>> that specific reason I wanted to remove this from the picture, but I
>>> see that it is back... like the cat with nine lives...
>>>
>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>> service that automatically configures 802.11 wireless network
>>> devices. Are you on a wireless network? You said that you are a
>>> standalone machine that is not part of a network and that you plug to
>>> the internet with a telephone cable (I assume DSL, not dial-up,
>>> right?). Is your printer running on wireless? Is the webcam a
>>> wireless device? Do you have a wireless router? If you do have a
>>> wireless router, why are its wireless functions running if you use a
>>> telephone cable to plug to the internet? Why is this service back
>>> to Auto? For all I know maybe you have 'unwanted guests' accessing
>>> your wireless router...
>>>
>>> Maybe you inadvertently changed some of these settings while you were
>>> 'playing' with CodeStuff Starter. I'm still quite busy with other
>>> commitments, I will try to be back later with a new batch file for
>>> you to run, we'll give it another try.
>>>
>>> John
>>
>> Well,John, the only approach I can see that makes sense, is for you
>> to give me a script file that will set all my services to what you
>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>> establish a baseline, and then I'll simply let it sit for 2 hours
>> and run autoruns.exe again and report autostart.txt and we can see
>> what was changed when I do nothing in between. Meanwhile, I'm
>> waiting for your advice.
>>
>> I can't understand how the Events Log shows absolutely nothing
>> happening in the two-hour period, so no reason for it not to
>> obey the hibernate command......yet it jest doesn't do it.
>
> I posted the wrong batch file earlier, it was a work file, not the
> finished file. Sorry about that, try this instead:
>
> Copy the stuff between the === lines and save it as a .bat file then run
> the batch file (double click on it). After you run the batch file
> reboot and see if the machine will hibernate.
>
> ====================================================================
> rem Second set of changes
>
> sc config Alerter start= Disabled
> sc config ALG start= Manual
> sc config AppMgmt start= Manual
> sc config aspnet_state start= Manual
> sc config Ati HotKey Poller start= Disabled
> sc config ATI Smart start= Manual
> sc config AudioSrv start= Auto
> sc config Automatic LiveUpdate Scheduler start= Disabled
> sc config BITS start= Manual
> sc config Browser start= Manual
> sc config CiSvc start= Manual
> sc config ClipSrv start= Disabled
> sc config clr_optimization_v2.0.50727_32 start= Manual
> sc config COMSysApp start= Manual
> sc config CryptSvc start= Auto
> sc config DcomLaunch start= Auto
> sc config Dhcp start= Auto
> sc config dmadmin start= Manual
> sc config dmserver start= Manual
> sc config Dnscache start= Manual
> sc config ERSvc start= Manual
> sc config Eventlog start= Auto
> sc config EventSystem start= Manual
> sc config FastUserSwitchingCompatibility start= Manual
> sc config Fax start= Manual
> sc config FontCache3.0.0.0 start= Manual
> sc config GEARSecurity start= Disabled
> sc config helpsvc start= Auto
> sc config HidServ start= Disabled
> sc config HTTPFilter start= Manual
> sc config IDriverT start= Manual
> sc config idsvc start= Manual
> sc config Imapi Helper start= Manual
> sc config ImapiService start= Manual
> sc config lanmanserver start= Disabled
> sc config lanmanworkstation start= Auto
> sc config LexBceS start= Disabled
> sc config LiveUpdate start= Manual
> sc config LmHosts start= Manual
> sc config MBAMService start= Disabled
> sc config MDM start= Manual
> sc config Messenger start= Disabled
> sc config mnmsrvc start= Manual
> sc config MSIServer start= Manual
> sc config NetDDE start= Disabled
> sc config NetDDEdsdm start= Disabled
> sc config Netlogon start= Manual
> sc config Netman start= Manual
> sc config NetTcpPortSharing start= Disabled
> sc config Nla start= Manual
> sc config Norton AntiVirus start= Manual
> sc config Norton Save and Restore start= Manual
> sc config NProtectService start= Manual
> sc config NtLmSsp start= Manual
> sc config NtmsSvc start= Manual
> sc config ose start= Manual
> sc config PlugPlay start= Auto
> sc config PolicyAgent start= Manual
> sc config ProtectedStorage start= Auto
> sc config psqlWGE start= Disabled
> sc config RasAuto start= Disabled
> sc config RasMan start= Manual
> sc config RDSessMgr start= Manual
> sc config RemoteAccess start= Disabled
> sc config RpcLocator start= Manual
> sc config RpcSs start= Auto
> sc config RSVP start= Manual
> sc config SamSs start= Auto
> sc config SCardSvr start= Manual
> sc config Schedule start= Manual
> sc config seclogon start= Manual
> sc config SENS start= Auto
> sc config SharedAccess start= Auto
> sc config ShellHWDetection start= Auto
> sc config Speed Disk service start= Disabled
> sc config Spooler start= Manual
> sc config srservice start= Auto
> sc config SSDPSRV start= Manual
> sc config stisvc start= Disabled
> sc config SwPrv start= Manual
> sc config Symantec RemoteAssist start= Manual
> sc config SysmonLog start= Manual
> sc config TapiSrv start= Manual
> sc config TermService start= Manual
> sc config Themes start= Auto
> sc config TrkWks start= Manual
> sc config upnphost start= Manual
> sc config UPS start= Manual
> sc config Viewpoint Manager Service start= Disabled
> sc config VSS start= Manual
> sc config W32Time start= Manual
> sc config WebClient start= Manual
> sc config winmgmt start= Auto
> sc config WmdmPmSN start= Manual
> sc config WmiApSrv start= Disabled
> sc config WMPNetworkSvc start= Manual
> sc config wscsvc start= Manual
> sc config wuauserv start= Auto
> sc config WudfSvc start= Manual
> sc config WZCSVC start= Manual
> sc config xmlprov start= Manual
> sc config spooler depend= RPCSS
> =========================================================
>
> If it still doesn't hibernate after doing the above do a clean boot and
> try again:
>
> http://support.microsoft.com/kb/310353
> How to configure Windows XP to start in a "clean boot" state
>
> John
WILL DO IT TOMORROW MORNING.
btw.... I don't see the 'earlier' file posted, but
you don't want me to use it anyway.
Bill...

William B. Lurie wrote:
> John John - MVP wrote:
>> William B. Lurie wrote:
>>> John John - MVP wrote:
>>>>
>>>> Well, forgive me but I surely have to wonder what it is that is
>>>> going on at your end...
>>>>
>>>> The last batch file that I asked you to run would have changed some
>>>> of the start values of some of the services but I note some
>>>> inconsistencies:
>>>>
>>>> Ati HotKey Poller set to Manual now it' Disabled. Not that it
>>>> matters but who disabled this?
>>>>
>>>> Browser set to Manual now it's back on Auto. Who set this back to
>>>> Auto? You told me that you have a stand alone desktop and that
>>>> definitely you are not on a network. The Browser service maintains
>>>> the browse list, a list of of all available servers on domains or a
>>>> list of available computers on workgroups. The Browser service does
>>>> broadcast announcements over the network at specific time intervals
>>>> (like every 12 minutes, until the Master Browser tells it to shut
>>>> up) and plays a role in the assignment of browser tasks to specific
>>>> computers on the network. You have no network... why is the Browser
>>>> service on Auto? Maybe someone wants this thing barking every 12
>>>> minutes....
>>>>
>>>> lanmanserver set to Disabled now it's Manual. No network, no file
>>>> and printer sharing so as far as I'm concerned this should be set to
>>>> disabled, Manual might also be fine but the point is, who changed it
>>>> from Disabled to Manual?
>>>>
>>>> LexBceS still set to Auto. This is part of your Lexmark printer
>>>> software, if the printer and all its software was removed I have to
>>>> wonder why is this service still present...
>>>>
>>>> psqlWGE set to Manual now it's bact to Auto. What is this thing?
>>>> What software are you running that needs this thing to be set to
>>>> Auto? A quick search had revealed that it might belong to an
>>>> accounting package, I can't say for sure but anything with "sql" in
>>>> it usually suggests that it is part of some kind of database. And I
>>>> have to wonder if this database is in anyway associated to the
>>>> Indexing service that seemed to be doing cataloging work at any or
>>>> all hours of the day.
>>>>
>>>> Viewpoint Manager Service was set to Auto, now it's Disabled.
>>>> Information on this is a bit scant or vague but it seems that it
>>>> might be junk installed by AOL and that it might be needed for some
>>>> AOL features... or that it might be unwanted junk related to adware.
>>>> Without knowing if you are on AOL I had decided to leave it on Auto
>>>> for the time being. But as far as I'm concerned if you can live
>>>> without it maybe you should have it disabled.
>>>>
>>>> W32Time set to Manual now back to Auto. You said in earlier posts
>>>> that the Time service was improperly configured and that it couldn't
>>>> synchronize with a time server, so all it's doing is trying (and
>>>> failing) to contact a time server, network traffic for naught and
>>>> for that specific reason I wanted to remove this from the picture,
>>>> but I see that it is back... like the cat with nine lives...
>>>>
>>>> WZCSVC was set to Manual now it's back to Auto. This is is the
>>>> service that automatically configures 802.11 wireless network
>>>> devices. Are you on a wireless network? You said that you are a
>>>> standalone machine that is not part of a network and that you plug
>>>> to the internet with a telephone cable (I assume DSL, not dial-up,
>>>> right?). Is your printer running on wireless? Is the webcam a
>>>> wireless device? Do you have a wireless router? If you do have a
>>>> wireless router, why are its wireless functions running if you use a
>>>> telephone cable to plug to the internet? Why is this service back
>>>> to Auto? For all I know maybe you have 'unwanted guests' accessing
>>>> your wireless router...
>>>>
>>>> Maybe you inadvertently changed some of these settings while you
>>>> were 'playing' with CodeStuff Starter. I'm still quite busy with
>>>> other commitments, I will try to be back later with a new batch file
>>>> for you to run, we'll give it another try.
>>>>
>>>> John
>>>
>>> Well,John, the only approach I can see that makes sense, is for you
>>> to give me a script file that will set all my services to what you
>>> want, and then I'll run ServiceStat.vbc and autoruns.exe and
>>> establish a baseline, and then I'll simply let it sit for 2 hours
>>> and run autoruns.exe again and report autostart.txt and we can see
>>> what was changed when I do nothing in between. Meanwhile, I'm
>>> waiting for your advice.
>>>
>>> I can't understand how the Events Log shows absolutely nothing
>>> happening in the two-hour period, so no reason for it not to
>>> obey the hibernate command......yet it jest doesn't do it.
>>
>> I posted the wrong batch file earlier, it was a work file, not the
>> finished file. Sorry about that, try this instead:
>>
>> Copy the stuff between the === lines and save it as a .bat file then
>> run the batch file (double click on it). After you run the batch file
>> reboot and see if the machine will hibernate.
>>
>> ====================================================================
>> rem Second set of changes
>>
>> sc config Alerter start= Disabled
>> sc config ALG start= Manual
>> sc config AppMgmt start= Manual
>> sc config aspnet_state start= Manual
>> sc config Ati HotKey Poller start= Disabled
>> sc config ATI Smart start= Manual
>> sc config AudioSrv start= Auto
>> sc config Automatic LiveUpdate Scheduler start= Disabled
>> sc config BITS start= Manual
>> sc config Browser start= Manual
>> sc config CiSvc start= Manual
>> sc config ClipSrv start= Disabled
>> sc config clr_optimization_v2.0.50727_32 start= Manual
>> sc config COMSysApp start= Manual
>> sc config CryptSvc start= Auto
>> sc config DcomLaunch start= Auto
>> sc config Dhcp start= Auto
>> sc config dmadmin start= Manual
>> sc config dmserver start= Manual
>> sc config Dnscache start= Manual
>> sc config ERSvc start= Manual
>> sc config Eventlog start= Auto
>> sc config EventSystem start= Manual
>> sc config FastUserSwitchingCompatibility start= Manual
>> sc config Fax start= Manual
>> sc config FontCache3.0.0.0 start= Manual
>> sc config GEARSecurity start= Disabled
>> sc config helpsvc start= Auto
>> sc config HidServ start= Disabled
>> sc config HTTPFilter start= Manual
>> sc config IDriverT start= Manual
>> sc config idsvc start= Manual
>> sc config Imapi Helper start= Manual
>> sc config ImapiService start= Manual
>> sc config lanmanserver start= Disabled
>> sc config lanmanworkstation start= Auto
>> sc config LexBceS start= Disabled
>> sc config LiveUpdate start= Manual
>> sc config LmHosts start= Manual
>> sc config MBAMService start= Disabled
>> sc config MDM start= Manual
>> sc config Messenger start= Disabled
>> sc config mnmsrvc start= Manual
>> sc config MSIServer start= Manual
>> sc config NetDDE start= Disabled
>> sc config NetDDEdsdm start= Disabled
>> sc config Netlogon start= Manual
>> sc config Netman start= Manual
>> sc config NetTcpPortSharing start= Disabled
>> sc config Nla start= Manual
>> sc config Norton AntiVirus start= Manual
>> sc config Norton Save and Restore start= Manual
>> sc config NProtectService start= Manual
>> sc config NtLmSsp start= Manual
>> sc config NtmsSvc start= Manual
>> sc config ose start= Manual
>> sc config PlugPlay start= Auto
>> sc config PolicyAgent start= Manual
>> sc config ProtectedStorage start= Auto
>> sc config psqlWGE start= Disabled
>> sc config RasAuto start= Disabled
>> sc config RasMan start= Manual
>> sc config RDSessMgr start= Manual
>> sc config RemoteAccess start= Disabled
>> sc config RpcLocator start= Manual
>> sc config RpcSs start= Auto
>> sc config RSVP start= Manual
>> sc config SamSs start= Auto
>> sc config SCardSvr start= Manual
>> sc config Schedule start= Manual
>> sc config seclogon start= Manual
>> sc config SENS start= Auto
>> sc config SharedAccess start= Auto
>> sc config ShellHWDetection start= Auto
>> sc config Speed Disk service start= Disabled
>> sc config Spooler start= Manual
>> sc config srservice start= Auto
>> sc config SSDPSRV start= Manual
>> sc config stisvc start= Disabled
>> sc config SwPrv start= Manual
>> sc config Symantec RemoteAssist start= Manual
>> sc config SysmonLog start= Manual
>> sc config TapiSrv start= Manual
>> sc config TermService start= Manual
>> sc config Themes start= Auto
>> sc config TrkWks start= Manual
>> sc config upnphost start= Manual
>> sc config UPS start= Manual
>> sc config Viewpoint Manager Service start= Disabled
>> sc config VSS start= Manual
>> sc config W32Time start= Manual
>> sc config WebClient start= Manual
>> sc config winmgmt start= Auto
>> sc config WmdmPmSN start= Manual
>> sc config WmiApSrv start= Disabled
>> sc config WMPNetworkSvc start= Manual
>> sc config wscsvc start= Manual
>> sc config wuauserv start= Auto
>> sc config WudfSvc start= Manual
>> sc config WZCSVC start= Manual
>> sc config xmlprov start= Manual
>> sc config spooler depend= RPCSS
>> =========================================================
>>
>> If it still doesn't hibernate after doing the above do a clean boot
>> and try again:
>>
>> http://support.microsoft.com/kb/310353
>> How to configure Windows XP to start in a "clean boot" state
>>
>> John
> WILL DO IT TOMORROW MORNING.
> btw.... I don't see the 'earlier' file posted, but
> you don't want me to use it anyway.
> Bill...
***********************************************************
Latest news, overnight runs (I was up with a bad cold anyway):
Did first half of what was requested. Ran the .bat file and
am posting interesting results below. Will do it again from
Clean Boot later. See SCM/WIA involvement, plus specifically
the every-hour-events.

> Type Date Time Source Category Event User Computer
> Information 4/14/2010 12:42:32 AM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:42:29 AM Norton AntiVirus None 34 SYSTEM COMPAQ-2006
> Information 4/13/2010 10:04:32 AM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
> Information 4/13/2010 10:04:28 AM Norton AntiVirus None 34 SYSTEM COMPAQ-2006
> Information 4/12/2010 8:29:13 PM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
> Information 4/12/2010 8:29:11 PM Norton AntiVirus None 34 SYSTEM COMPAQ-2006
> Information 4/12/2010 5:22:53 PM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
>
> Type Date Time Source Category Event User Computer
> Success Audit 4/14/2010 12:43:31 AM Security Privilege Use 576 NETWORK SERVICE COMPAQ-2006
> Success Audit 4/14/2010 12:43:31 AM Security Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
> Success Audit 4/14/2010 12:42:56 AM Security System Event 515 SYSTEM COMPAQ-2006
> Success Audit 4/14/2010 12:42:54 AM Security Policy Change 850 SYSTEM COMPAQ-2006
> Success Audit 4/14/2010 12:42:54 AM Security Policy Change 850 SYSTEM COMPAQ-2006
>
> Type Date Time Source Category Event User Computer
> Information 4/14/2010 7:16:16 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 7:16:13 AM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 6:14:57 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 6:14:54 AM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 5:13:39 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 5:13:36 AM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 4:12:21 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 4:12:18 AM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 3:11:04 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 3:11:00 AM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 2:09:37 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:45:44 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:45:42 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:43 AM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 12:43:42 AM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:43:22 AM SRTSP None 2003 N/A COMPAQ-2006
> Information 4/14/2010 12:41:53 AM Tcpip None 4201 N/A COMPAQ-2006
> Warning 4/14/2010 12:42:15 AM Dhcp None 1003 N/A COMPAQ-2006
> Information 4/14/2010 12:42:13 AM eventlog None 6005 N/A COMPAQ-2006
> Information 4/14/2010 12:42:13 AM eventlog None 6009 N/A COMPAQ-2006
> Information 4/13/2010 10:09:19 AM eventlog None 6006 N/A COMPAQ-2006
> Information 4/13/2010 10:06:24 AM Service Control Manager None 7036 N/A COMPAQ-2006
>
> Event Type: Information
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7036
> Date: 4/14/2010
> Time: 7:16:16 AM
> User: N/A
> Computer: COMPAQ-2006
> Description:
> The Windows Image Acquisition (WIA) service entered the running state.
>
> For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
> Event Type: Information
> Event Source: Tcpip
> Event Category: None
> Event ID: 4201
> Date: 4/14/2010
> Time: 7:16:13 AM
> User: N/A
> Computer: COMPAQ-2006
> Description:
> The system detected that network adapter \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to the network, and has initiated normal operation over the network adapter.
>
> For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 02 00 50 00 ......P.
> 0008: 00 00 00 00 69 10 00 40 ....i..@
> 0010: 02 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
>
There's a lot of info there, John, too much for me to even help
interpret just now. I have the Event Logs, full, to pass
along if you want them. More later.

And I have some notes from Norton to digest.

Bill

John John - MVP wrote:
> William B. Lurie wrote:
>
>> Latest news, overnight runs (I was up with a bad cold anyway):
>> Did first half of what was requested. Ran the .bat file and
>> am posting interesting results below. Will do it again from
>> Clean Boot later. See SCM/WIA involvement,
>
> Windows Image Acquisition (WIA) used by scanners, cameras and probably
> your webcam, this is why I asked you to *completely* remove these
> devices and all their associated software from your machine. In the
> batch file the line:
>
> sc config stisvc start= Disabled
>
> will (should have) set the Windows Image Acquisition (WIA) to
> *disabled*. A disabled service cannot start, trying to start it will
> throw an error. Something in your startup applications is changing the
> start status of the service an re-enabling it, these things don't change
> by themselves alone. Run the batch file again to reset the start values
> of the services then do a clean boot, don't reboot after you run the
> batch file because the startup applications will just change it again!
> Run the batch file then do the necessary steps to clean boot then reboot.
>
>
>> plus specifically the every-hour-events.
>
> You mean Norton stuff? That will be the next one to get its head
> chopped off! It shouldn't run if you do the clean boot properly.
>
> John
John, Norton in service is too important to me, and removing
it completely and reinstalling could be a forever task. We
have to either clear it or chop its legs off, and I propose
a test that will meet you more than half way. As you know,
I can always make more clones, even though it takes some time.

Let's take my test clone and remove all of Norton's A-V right
from Add/Remove. I just have to remember never to go online on
that system.

I'll take the system as it is now, UNinstall NAV,do your
ServicesStart.vbc again, and autorunsc.exe, and let's see
what happens. I'll start that right now.
Bill

John John - MVP wrote:
> William B. Lurie wrote:
>
>> Latest news, overnight runs (I was up with a bad cold anyway):
>> Did first half of what was requested. Ran the .bat file and
>> am posting interesting results below. Will do it again from
>> Clean Boot later. See SCM/WIA involvement,
>
> Windows Image Acquisition (WIA) used by scanners, cameras and probably
> your webcam, this is why I asked you to *completely* remove these
> devices and all their associated software from your machine. In the
> batch file the line:
>
> sc config stisvc start= Disabled
>
> will (should have) set the Windows Image Acquisition (WIA) to
> *disabled*. A disabled service cannot start, trying to start it will
> throw an error. Something in your startup applications is changing the
> start status of the service an re-enabling it, these things don't change
> by themselves alone. Run the batch file again to reset the start values
> of the services then do a clean boot, don't reboot after you run the
> batch file because the startup applications will just change it again!
> Run the batch file then do the necessary steps to clean boot then reboot.
>
>
>> plus specifically the every-hour-events.
>
> You mean Norton stuff? That will be the next one to get its head
> chopped off! It shouldn't run if you do the clean boot properly.
>
> John
***********************************************************************
John, I completely removed, uninstalled, all Norton stuff and made the
run I said I would. I'll try to show the results below. Note that
every hour, *some*thing is doing Auto Live Update.......but it ain't
Norton. Gotta go, but I'll try to patch the stuff in here.

> Service Name,Start Mode
> Alerter,Disabled,
> ALG,Manual,
> AppMgmt,Manual,
> aspnet_state,Manual,
> Ati HotKey Poller,Disabled,
> ATI Smart,Manual,
> AudioSrv,Auto,
> Automatic LiveUpdate Scheduler,Auto,
> BITS,Manual,
> Browser,Auto,
> CiSvc,Manual,
> ClipSrv,Disabled,
> clr_optimization_v2.0.50727_32,Manual,
> COMSysApp,Manual,
> CryptSvc,Auto,
> DcomLaunch,Auto,
> Dhcp,Auto,
> dmadmin,Manual,
> dmserver,Manual,
> Dnscache,Manual,
> ERSvc,Manual,
> Eventlog,Auto,
> EventSystem,Manual,
> FastUserSwitchingCompatibility,Manual,
> Fax,Manual,
> FontCache3.0.0.0,Manual,
> GEARSecurity,Disabled,
> helpsvc,Auto,
> HidServ,Disabled,
> HTTPFilter,Manual,
> IDriverT,Manual,
> idsvc,Manual,
> Imapi Helper,Manual,
> ImapiService,Manual,
> lanmanserver,Disabled,
> lanmanworkstation,Auto,
> LexBceS,Disabled,
> LiveUpdate,Manual,
> LmHosts,Manual,
> MBAMService,Disabled,
> MDM,Manual,
> Messenger,Disabled,
> mnmsrvc,Manual,
> MSIServer,Manual,
> NetDDE,Disabled,
> NetDDEdsdm,Disabled,
> Netlogon,Manual,
> Netman,Manual,
> NetTcpPortSharing,Disabled,
> Nla,Manual,
> NtLmSsp,Manual,
> NtmsSvc,Manual,
> ose,Manual,
> PlugPlay,Auto,
> PolicyAgent,Manual,
> ProtectedStorage,Auto,
> psqlWGE,Disabled,
> RasAuto,Disabled,
> RasMan,Manual,
> RDSessMgr,Manual,
> RemoteAccess,Disabled,
> RpcLocator,Manual,
> RpcSs,Auto,
> RSVP,Manual,
> SamSs,Auto,
> SCardSvr,Manual,
> Schedule,Manual,
> seclogon,Manual,
> SENS,Auto,
> SharedAccess,Auto,
> ShellHWDetection,Auto,
> Spooler,Manual,
> srservice,Auto,
> SSDPSRV,Manual,
> stisvc,Disabled,
> SwPrv,Manual,
> Symantec RemoteAssist,Manual,
> SysmonLog,Manual,
> TapiSrv,Manual,
> TermService,Auto,
> Themes,Auto,
> TrkWks,Manual,
> upnphost,Manual,
> UPS,Manual,
> Viewpoint Manager Service,Disabled,
> VSS,Manual,
> W32Time,Auto,
> WebClient,Manual,
> winmgmt,Auto,
> WmdmPmSN,Manual,
> WmiApSrv,Disabled,
> WMPNetworkSvc,Manual,
> wscsvc,Manual,
> wuauserv,Auto,
> WudfSvc,Manual,
> WZCSVC,Auto,
> xmlprov,Manual,


HKLM\System\CurrentControlSet\Control\Terminal
Server\Wds\rdpwd\StartupPrograms
rdpclip
rdpclip
RDP Clip Monitor
Microsoft Corporation
5.1.2600.2180
c:\windows\system32\rdpclip.exe
ab978e64b3cb5b78842bc2bdae19d0cd (MD5)
db49bb6158d12ea7dc9b28ef2ee857edb6015138 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
Userinit Logon Application
Microsoft Corporation
5.1.2600.2180
c:\windows\system32\userinit.exe
39b1ffb03c2296323832acbae50d2aff (MD5)
e5aedcbe25a97c89101f1f3860ff846e94d70445 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exe
Explorer.exe
Windows Explorer
Microsoft Corporation
6.0.2900.3156
c:\windows\explorer.exe
97bd6515465659ff8f3b7be375b2ea87 (MD5)
972307a3ef93680afdd03603df20f2241047a934 (SHA-1)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HPBootOp
"C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Boot Optimizer
Hewlett-Packard Company
3.0.0.0
c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe
a789b145f17fa5c2326907f4872fe173 (MD5)
f04982c1c82b75b38e5da0ef838b6b2e753b3e6c (SHA-1)
MSConfig
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
System Configuration Utility
Microsoft Corporation
5.1.2600.2764
c:\windows\pchealth\helpctr\binaries\msconfig.exe
3c60aefa68efa2c4d13ab6b68fe82b81 (MD5)
abdb5d622a86473732671f5d5d2d7ba458af656e (SHA-1)

> Type Date Time Source Category Event User Computer
> Information 4/14/2010 5:29:20 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 5:29:20 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 4:43:17 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 4:28:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 4:28:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 3:41:59 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 3:26:44 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 3:26:44 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 2:40:41 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 2:25:26 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 2:25:26 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:49:45 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:44:30 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:39:15 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:24:00 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:24:00 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:24:00 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:11:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:11:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:11:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Warning 4/14/2010 1:10:13 PM Userenv None 1517 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:09:46 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:46 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:09:46 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:09:46 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:09:29 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:23 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:17 PM NProtectService None 6 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:13 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:11 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:02 PM MsiInstaller None 11728 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:02 PM MsiInstaller None 11728 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:09:02 PM MsiInstaller None 11728 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:08:36 PM MsiInstaller None 1005 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:08:36 PM MsiInstaller None 11724 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:06:15 PM IDriverT None 0 N/A COMPAQ-2006
> Warning 4/14/2010 1:03:23 PM Userenv None 1517 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:02:39 PM MsiInstaller None 11725 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:00:04 PM IDriverT None 0 N/A COMPAQ-2006
> Information 4/14/2010 12:58:31 PM Norton AntiVirus None 37 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:58:30 PM Norton AntiVirus None 36 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:54:26 PM Norton AntiVirus None 35 SYSTEM COMPAQ-2006
> Information 4/14/2010 12:54:23 PM Norton AntiVirus None 34 SYSTEM COMPAQ-2006

> Event Type: Information
> Event Source: Automatic LiveUpdate Scheduler
> Event Category: Devices
> Event ID: 101
> Date: 4/14/2010
> Time: 4:43:17 PM
> User: NT AUTHORITY\SYSTEM
> Computer: COMPAQ-2006
> Description:
> Information Level: success
>
> Rolling back the schedule; execution will occur at approximately 4:48 PM.

Type Date Time Source Category Event User Computer
Error 4/14/2010 5:33:13 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/14/2010 5:31:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 5:29:23 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 4:28:07 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 3:26:47 PM Tcpip None 4201 N/A COMPAQ-2006
Error 4/14/2010 3:26:44 PM Service Control Manager None 7011 N/A COMPAQ-2006
Information 4/14/2010 2:25:29 PM Tcpip None 4201 N/A COMPAQ-2006
Error 4/14/2010 1:28:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Error 4/14/2010 1:27:25 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
Compaq_Owner COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7035
SYSTEM COMPAQ-2006
Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A
COMPAQ-2006
Error 4/14/2010 1:25:29 PM Service Control Manager None 7001 N/A COMPAQ-2006
Information 4/14/2010 1:23:40 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6005 N/A COMPAQ-2006
Information 4/14/2010 1:23:47 PM eventlog None 6009 N/A COMPAQ-2006>
Type Date Time Source Category Event User Computer
> Error 4/14/2010 5:33:13 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
> Error 4/14/2010 5:31:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 5:29:23 PM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 4:28:07 PM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 3:26:47 PM Tcpip None 4201 N/A COMPAQ-2006
> Error 4/14/2010 3:26:44 PM Service Control Manager None 7011 N/A COMPAQ-2006
> Information 4/14/2010 2:25:29 PM Tcpip None 4201 N/A COMPAQ-2006
> Error 4/14/2010 1:28:51 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
> Error 4/14/2010 1:27:25 PM DCOM None 10005 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Error 4/14/2010 1:25:29 PM Service Control Manager None 7001 N/A COMPAQ-2006
> Information 4/14/2010 1:23:40 PM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 1:23:47 PM eventlog None 6005 N/A COMPAQ-2006
> Information 4/14/2010 1:23:47 PM eventlog None 6009 N/A COMPAQ-2006

I think the last one was a duplicate, pasted differently.
Some of these are a lot longer but I didn't copy what was
still earlier. If you need fuller Event Logs, I have them

But I think it's telling a story, that Auto Live Update
is asking every hour........I don't know if you Disabled it and it
came back somehow, or what, but I hope you do.
Bill

William B. Lurie wrote:
> John John - MVP wrote:
>> William B. Lurie wrote:
>>
>>> Latest news, overnight runs (I was up with a bad cold anyway):
>>> Did first half of what was requested. Ran the .bat file and
>>> am posting interesting results below. Will do it again from
>>> Clean Boot later. See SCM/WIA involvement,
>>
>> Windows Image Acquisition (WIA) used by scanners, cameras and probably
>> your webcam, this is why I asked you to *completely* remove these
>> devices and all their associated software from your machine. In the
>> batch file the line:
>>
>> sc config stisvc start= Disabled
>>
>> will (should have) set the Windows Image Acquisition (WIA) to
>> *disabled*. A disabled service cannot start, trying to start it will
>> throw an error. Something in your startup applications is changing
>> the start status of the service an re-enabling it, these things don't
>> change by themselves alone. Run the batch file again to reset the
>> start values of the services then do a clean boot, don't reboot after
>> you run the batch file because the startup applications will just
>> change it again! Run the batch file then do the necessary steps to
>> clean boot then reboot.
>>
>>
>>> plus specifically the every-hour-events.
>>
>> You mean Norton stuff? That will be the next one to get its head
>> chopped off! It shouldn't run if you do the clean boot properly.
>>
>> John
> ***********************************************************************
> John, I completely removed, uninstalled, all Norton stuff and made the
> run I said I would. I'll try to show the results below. Note that
> every hour, *some*thing is doing Auto Live Update.......but it ain't
> Norton. Gotta go, but I'll try to patch the stuff in here.
>
>> Service Name,Start Mode
>> Alerter,Disabled,
>> ALG,Manual,
>> AppMgmt,Manual,
>> aspnet_state,Manual,
>> Ati HotKey Poller,Disabled,
>> ATI Smart,Manual,
>> AudioSrv,Auto,
>> Automatic LiveUpdate Scheduler,Auto,
>> BITS,Manual,
>> Browser,Auto,
>> CiSvc,Manual,
>> ClipSrv,Disabled,
>> clr_optimization_v2.0.50727_32,Manual,
>> COMSysApp,Manual,
>> CryptSvc,Auto,
>> DcomLaunch,Auto,
>> Dhcp,Auto,
>> dmadmin,Manual,
>> dmserver,Manual,
>> Dnscache,Manual,
>> ERSvc,Manual,
>> Eventlog,Auto,
>> EventSystem,Manual,
>> FastUserSwitchingCompatibility,Manual,
>> Fax,Manual,
>> FontCache3.0.0.0,Manual,
>> GEARSecurity,Disabled,
>> helpsvc,Auto,
>> HidServ,Disabled,
>> HTTPFilter,Manual,
>> IDriverT,Manual,
>> idsvc,Manual,
>> Imapi Helper,Manual,
>> ImapiService,Manual,
>> lanmanserver,Disabled,
>> lanmanworkstation,Auto,
>> LexBceS,Disabled,
>> LiveUpdate,Manual,
>> LmHosts,Manual,
>> MBAMService,Disabled,
>> MDM,Manual,
>> Messenger,Disabled,
>> mnmsrvc,Manual,
>> MSIServer,Manual,
>> NetDDE,Disabled,
>> NetDDEdsdm,Disabled,
>> Netlogon,Manual,
>> Netman,Manual,
>> NetTcpPortSharing,Disabled,
>> Nla,Manual,
>> NtLmSsp,Manual,
>> NtmsSvc,Manual,
>> ose,Manual,
>> PlugPlay,Auto,
>> PolicyAgent,Manual,
>> ProtectedStorage,Auto,
>> psqlWGE,Disabled,
>> RasAuto,Disabled,
>> RasMan,Manual,
>> RDSessMgr,Manual,
>> RemoteAccess,Disabled,
>> RpcLocator,Manual,
>> RpcSs,Auto,
>> RSVP,Manual,
>> SamSs,Auto,
>> SCardSvr,Manual,
>> Schedule,Manual,
>> seclogon,Manual,
>> SENS,Auto,
>> SharedAccess,Auto,
>> ShellHWDetection,Auto,
>> Spooler,Manual,
>> srservice,Auto,
>> SSDPSRV,Manual,
>> stisvc,Disabled,
>> SwPrv,Manual,
>> Symantec RemoteAssist,Manual,
>> SysmonLog,Manual,
>> TapiSrv,Manual,
>> TermService,Auto,
>> Themes,Auto,
>> TrkWks,Manual,
>> upnphost,Manual,
>> UPS,Manual,
>> Viewpoint Manager Service,Disabled,
>> VSS,Manual,
>> W32Time,Auto,
>> WebClient,Manual,
>> winmgmt,Auto,
>> WmdmPmSN,Manual,
>> WmiApSrv,Disabled,
>> WMPNetworkSvc,Manual,
>> wscsvc,Manual,
>> wuauserv,Auto,
>> WudfSvc,Manual,
>> WZCSVC,Auto,
>> xmlprov,Manual,
>
>
> HKLM\System\CurrentControlSet\Control\Terminal
> Server\Wds\rdpwd\StartupPrograms
> rdpclip
> rdpclip
> RDP Clip Monitor
> Microsoft Corporation
> 5.1.2600.2180
> c:\windows\system32\rdpclip.exe
> ab978e64b3cb5b78842bc2bdae19d0cd (MD5)
> db49bb6158d12ea7dc9b28ef2ee857edb6015138 (SHA-1)
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
> C:\WINDOWS\system32\userinit.exe
> C:\WINDOWS\system32\userinit.exe
> Userinit Logon Application
> Microsoft Corporation
> 5.1.2600.2180
> c:\windows\system32\userinit.exe
> 39b1ffb03c2296323832acbae50d2aff (MD5)
> e5aedcbe25a97c89101f1f3860ff846e94d70445 (SHA-1)
>
> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
> Explorer.exe
> Explorer.exe
> Windows Explorer
> Microsoft Corporation
> 6.0.2900.3156
> c:\windows\explorer.exe
> 97bd6515465659ff8f3b7be375b2ea87 (MD5)
> 972307a3ef93680afdd03603df20f2241047a934 (SHA-1)
>
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> HPBootOp
> "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
> HP Boot Optimizer
> Hewlett-Packard Company
> 3.0.0.0
> c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe
> a789b145f17fa5c2326907f4872fe173 (MD5)
> f04982c1c82b75b38e5da0ef838b6b2e753b3e6c (SHA-1)
> MSConfig
> C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
> System Configuration Utility
> Microsoft Corporation
> 5.1.2600.2764
> c:\windows\pchealth\helpctr\binaries\msconfig.exe
> 3c60aefa68efa2c4d13ab6b68fe82b81 (MD5)
> abdb5d622a86473732671f5d5d2d7ba458af656e (SHA-1)
>
>> Type Date Time Source Category Event User Computer
>> Information 4/14/2010 5:29:20 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 5:29:20 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 4:43:17 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 4:28:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 4:28:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 3:41:59 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 3:26:44 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 3:26:44 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 2:40:41 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 2:25:26 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 2:25:26 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:49:45 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:44:30 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:39:15 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:24:00 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:24:00 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:24:00 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:11:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:11:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:11:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Warning 4/14/2010 1:10:13 PM Userenv None 1517
>> SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:09:46 PM MsiInstaller None
>> 11724 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:46 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:09:46 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:09:46 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:09:29 PM MsiInstaller None
>> 11724 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:23 PM MsiInstaller None
>> 11724 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:17 PM NProtectService None
>> 6 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:13 PM MsiInstaller None
>> 11724 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:11 PM MsiInstaller None
>> 11724 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:02 PM MsiInstaller None
>> 11728 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:02 PM MsiInstaller None
>> 11728 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:09:02 PM MsiInstaller None
>> 11728 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:08:36 PM MsiInstaller None
>> 1005 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:08:36 PM MsiInstaller None
>> 11724 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:06:15 PM IDriverT None 0
>> N/A COMPAQ-2006
>> Warning 4/14/2010 1:03:23 PM Userenv None 1517
>> SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:02:39 PM MsiInstaller None
>> 11725 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:00:04 PM IDriverT None 0
>> N/A COMPAQ-2006
>> Information 4/14/2010 12:58:31 PM Norton AntiVirus None
>> 37 SYSTEM COMPAQ-2006
>> Information 4/14/2010 12:58:30 PM Norton AntiVirus None
>> 36 SYSTEM COMPAQ-2006
>> Information 4/14/2010 12:54:26 PM Norton AntiVirus None
>> 35 SYSTEM COMPAQ-2006
>> Information 4/14/2010 12:54:23 PM Norton AntiVirus None
>> 34 SYSTEM COMPAQ-2006
>
>> Event Type: Information
>> Event Source: Automatic LiveUpdate Scheduler
>> Event Category: Devices Event ID: 101
>> Date: 4/14/2010
>> Time: 4:43:17 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: COMPAQ-2006
>> Description:
>> Information Level: success
>>
>> Rolling back the schedule; execution will occur at approximately 4:48 PM.
>
> Type Date Time Source Category Event User Computer
> Error 4/14/2010 5:33:13 PM DCOM None 10005
> Compaq_Owner COMPAQ-2006
> Error 4/14/2010 5:31:51 PM DCOM None 10005
> Compaq_Owner COMPAQ-2006
> Information 4/14/2010 5:29:23 PM Tcpip None 4201
> N/A COMPAQ-2006
> Information 4/14/2010 4:28:07 PM Tcpip None 4201
> N/A COMPAQ-2006
> Information 4/14/2010 3:26:47 PM Tcpip None 4201
> N/A COMPAQ-2006
> Error 4/14/2010 3:26:44 PM Service Control Manager None
> 7011 N/A COMPAQ-2006
> Information 4/14/2010 2:25:29 PM Tcpip None 4201
> N/A COMPAQ-2006
> Error 4/14/2010 1:28:51 PM DCOM None 10005
> Compaq_Owner COMPAQ-2006
> Error 4/14/2010 1:27:25 PM DCOM None 10005
> Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7035 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 1:25:29 PM Service Control Manager
> None 7036 N/A COMPAQ-2006
> Error 4/14/2010 1:25:29 PM Service Control Manager None
> 7001 N/A COMPAQ-2006
> Information 4/14/2010 1:23:40 PM Tcpip None 4201
> N/A COMPAQ-2006
> Information 4/14/2010 1:23:47 PM eventlog None 6005
> N/A COMPAQ-2006
> Information 4/14/2010 1:23:47 PM eventlog None 6009
> N/A COMPAQ-2006> Type Date Time Source Category
> Event User Computer
>> Error 4/14/2010 5:33:13 PM DCOM None 10005
>> Compaq_Owner COMPAQ-2006
>> Error 4/14/2010 5:31:51 PM DCOM None 10005
>> Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 5:29:23 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Information 4/14/2010 4:28:07 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Information 4/14/2010 3:26:47 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Error 4/14/2010 3:26:44 PM Service Control Manager None
>> 7011 N/A COMPAQ-2006
>> Information 4/14/2010 2:25:29 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Error 4/14/2010 1:28:51 PM DCOM None 10005
>> Compaq_Owner COMPAQ-2006
>> Error 4/14/2010 1:27:25 PM DCOM None 10005
>> Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7035 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 1:25:29 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Error 4/14/2010 1:25:29 PM Service Control Manager None
>> 7001 N/A COMPAQ-2006
>> Information 4/14/2010 1:23:40 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Information 4/14/2010 1:23:47 PM eventlog None 6005
>> N/A COMPAQ-2006
>> Information 4/14/2010 1:23:47 PM eventlog None 6009
>> N/A COMPAQ-2006
>
> I think the last one was a duplicate, pasted differently.
> Some of these are a lot longer but I didn't copy what was
> still earlier. If you need fuller Event Logs, I have them
>
> But I think it's telling a story, that Auto Live Update
> is asking every hour........I don't know if you Disabled it and it
> came back somehow, or what, but I hope you do.
> Bill
****************************************************
I should snip the above but that can wait.

I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill

William B. Lurie wrote:
<snip>
> I just finished what might be the most positive indicating
> run yet. Same conditions as last run, except this time I did
>
> Clean Boot
> Disabled Auto Live Update
> Disabled WIA and started at 9:12 P.M.
>
> 2.5 hours later, it had not hibernated, but I think
> there is just one reason clearly shown. I'll send you
> the files in the morning to look at, John.
>
> What I see is just *one* event, but it happened at 10:35 .....
> Tcpip... Type 4201 ......."SCM" I think.
>
> Bill
See these:

> Type Date Time Source Category Event User Computer
> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System Event 513 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security Logon/Logoff 551
Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006

> Type Date Time Source Cate
> Information 4/14/2010 11:34:34 PM eventlog None 6006 N/A COMPAQ-2006
> Information 4/14/2010 11:34:33 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 11:30:33 PM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 10:35:53 PM Tcpip None 4201 N/A COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
> Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
>
> Event Type: Information
> Event Source: Tcpip
> Event Category: None
> Event ID: 4201
> Date: 4/14/2010
> Time: 10:35:53 PM
> User: N/A
> Computer: COMPAQ-2006
> Description:
> The system detected that network adapter \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to the network, and has initiated normal operation over the network adapter.
>
> For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 02 00 50 00 ......P.
> 0008: 00 00 00 00 69 10 00 40 ....i..@
> 0010: 02 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....
Bill

William B. Lurie wrote:
> William B. Lurie wrote:
> <snip>
>> I just finished what might be the most positive indicating
>> run yet. Same conditions as last run, except this time I did
>>
>> Clean Boot
>> Disabled Auto Live Update
>> Disabled WIA and started at 9:12 P.M.
>>
>> 2.5 hours later, it had not hibernated, but I think
>> there is just one reason clearly shown. I'll send you
>> the files in the morning to look at, John.
>>
>> What I see is just *one* event, but it happened at 10:35 .....
>> Tcpip... Type 4201 ......."SCM" I think.
>>
>> Bill
> See these:
>
>> Type Date Time Source Category Event User Computer
>> Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>> Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
>> Scheduler Devices 101 SYSTEM COMPAQ-2006
>
> Type Date
> Success Audit 4/14/2010 11:34:34 PM Security System
> Event 513 SYSTEM COMPAQ-2006
> Success Audit 4/14/2010 11:34:28 PM Security
> Logon/Logoff 551 Compaq_Owner COMPAQ-2006
> Success Audit 4/14/2010 9:11:04 PM Security Privilege
> Use 576 NETWORK SERVICE COMPAQ-2006
> Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff
> 528 NETWORK SERVICE COMPAQ-2006
> Success Audit 4/14/2010 9:10:24 PM Security Privilege
> Use 576 NETWORK SERVICE COMPAQ-2006
> Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff
> 528 NETWORK SERVICE COMPAQ-2006
> Success Audit 4/14/2010 9:10:24 PM Security System Event
> 515 SYSTEM COMPAQ-2006
> Success Audit 4/14/2010 9:10:22 PM Security Policy
> Change 850 SYSTEM COMPAQ-2006
> Success Audit 4/14/2010 9:10:22 PM Security Policy
> Change 850 SYSTEM COMPAQ-2006
> Success Audit 4/14/2010 9:10:22 PM Security Policy
> Change 850 SYSTEM COMPAQ-2006
>
>> Type Date Time Source Cate
>> Information 4/14/2010 11:34:34 PM eventlog None 6006
>> N/A COMPAQ-2006
>> Information 4/14/2010 11:34:33 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 11:30:33 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Information 4/14/2010 10:35:53 PM Tcpip None 4201
>> N/A COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7035 Compaq_Owner COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7035 SYSTEM COMPAQ-2006
>> Information 4/14/2010 9:11:40 PM Service Control Manager
>> None 7036 N/A COMPAQ-2006
>>
>> Event Type: Information
>> Event Source: Tcpip
>> Event Category: None
>> Event ID: 4201
>> Date: 4/14/2010
>> Time: 10:35:53 PM
>> User: N/A
>> Computer: COMPAQ-2006
>> Description:
>> The system detected that network adapter
>> \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
>> the network, and has initiated normal operation over the network adapter.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 00 00 00 00 02 00 50 00 ......P.
>> 0008: 00 00 00 00 69 10 00 40 ....i..@
>> 0010: 02 00 00 00 00 00 00 00 ........
>> 0018: 00 00 00 00 00 00 00 00 ........
>> 0020: 00 00 00 00 00 00 00 00 ........
>
> I think that 10:35 PM event was the killer........
> Our old friend Tcpip again. I have the feeling that, if I let it
> run on past 11:30. it would repeat every hour or so.
>
> I'm ready to clean out the Event Logs on the Clone
> system, and Clean Boot, and do whatever you tell me to,
> John, to track it down. I don't know what Network Adapter they're
> referring to in the Event Description.....

Please do the clean boot.

John