Re: Would Like LOG file to Record Shutdown

Hi Gerry! I have Nero 6.6.0.18 installed that came with my Asus P5WD2
Premium MB installed Dec05. I've never used it. I was using Roxio but after
reading comments on Roxio causing hangs, which I was experiencing, I removed
it thoroughly, every reg entry. I was planning, within hours, to buy the new
Nero.

Something possibly relevant I noticed the other night: I bought Acronis V10
the True Image program, I have to wait 40 mins for it to get through a hang
before it starts. I've completed a Report for the Acronis Techs but haven't
heard of their finds yet.

I'm suspicious, the IMAPI Warnings and Acronis Hangs are related. Maybe not
but I recently noticed I got an IMAPI Warning at the very same time I started
Acronis. More work required as I couldn't immediately repeat it.

Now, to answer your question: Yes! LOL ...


"Gerry Cornell" wrote:

Edna

Are you using Nero software?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


"Edna" <Edna@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F070D8B9-367F-4E8D-A680-2AFF26403B88@xxxxxxxxxxxxxxxx
Wes I'm so sorry time didn't permit me to respond as I should have and
wanted
very much to do. I came here so often to continue and something else
would
prevent me from concentrating on this.
I did switch my AV from NAV to Zone Alarm Security Suite and find now
that
the only Warning I'm getting with any regularity is the IMAPI Warning but
it's prolific. I'm talking 15 - 20 entries at once. Once I counted 60.

Event Type: Warning
Event Source: Imapi
Event Category: None
Event ID: 54
Date: 04/12/2006
Time: 12:37:30 PM
User: N/A
Computer: SHARK
Description:
The description for Event ID ( 54 ) in Source ( Imapi ) cannot be found.
The
local computer may not have the necessary registry information or message
DLL
files to display messages from a remote computer. You may be able to use
the
/AUXSOURCE= flag to retrieve this description; see Help and Support for
details. The following information is part of the event: .
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 36 00 04 80 ....6..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Presently I have it on Automatic but whether it's on Automatic or Manual
doesn't make any difference. Obviously I don't need it as it doesn't start
itself.
But if it isn't being used why do the Warnings appear?

I've Started IMAPI on occasion but that doesn't make any difference.
I think I'll put it back on Manual and leave it in the Stopped mode.

Sometimes I get multiple entries in a row. Sometimes one. I've tried but
can't pin down what I'm doing that causes it to go into a multiple spin.

Oh BTW since abandoning Norton, my shut downs are now lickety split.
Maybe
it was Norton, maybe not, but it's so nice not to have to wait when
shutting
down.
I've used Norton for years but recently I got hit with some Pest thingie.
I
was dissappointed NAV didn't protect me so I switched.
Again, Wes, Thank You for the time u spent helping me and pls accept my
apology. My failure to reply wasn't by choice. ...

"Wesley Vogel" wrote:

Edna,

Your original post said 2 - 3 minute shutdowns. How long did shutdown
take
before you installed UPHClean?

I get the Event Source: HHCTRL Event ID: 1904 all the time. Due to a
Windows Critical Update.

Event Type: Information
Event Source: HHCTRL
Event Category: None
Event ID: 1904
Date: 02/23/2006
Time: 1:32:25 PM
User: N/A
Computer: MYPENTIUM450
Description:
The description for Event ID ( 1904 ) in Source ( HHCTRL ) cannot be
found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help
and
Support for details. The following information is part of the event:
res://C:\WINDOWS\System32\shdoclc.dll/dnserror.htm,
http://go.microsoft.com/fwlink?LinkID=45840.

http://go.microsoft.com/fwlink?LinkID=45840
resolves to...
MS05-026: A vulnerability in HTML Help could allow remote code execution
http://support.microsoft.com/kb/896358
------

UPHClean 1412: I have no idea what that is. SWAG: handle remapping did
not
work, so it tried closing handle the handle.

The following are from:
http://download.microsoft.com/download/a/8/7/a87b3d05-cd04-4743-a23b-b16645e075ac/readme.txt

-------
3) Here the service is telling you that it closed handles that were
preventing
the profile from unloading:

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 11/14/2003
Time: 10:26:29 PM
User: RCARONDOM\u1
Computer: RCARONDOM-DC1
Description:
The following handles in user profile hive RCARONDOM\u1
(S-1-5-21-3230802392-3390281410-1560515013-1307) have been closed because
they
were preventing the profile from unloading successfully:

profleak.exe (1444)
HKCU (0x144)
-------

1201 is just information that UPHClean is doing its job.
-------

8) If you use handle remapping instead of getting event id 1201 logged
you
will
get event 1401:

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1401
Date: 10/26/2004
Time: 9:56:52 PM
User: RCARON2-NC\u1
Computer: RCARON2-NC
Description:
The following handles in user profile hive RCARON2-NC\u1
(S-1-5-21-796845957-1275210071-1801674531-1024) have been remapped
because
they
were preventing the profile from unloading successfully:

regopenkeyex.exe (368)
HKCU\Software\Classes\Software (0x4)
-------

UPHClean assists the operating system to unload user profile hive by
remapping the handles to the user profile hive to the default user hive.

UPHClean doing its job.
-------

Event Source: UPHClean
Event Category: None
Event ID: 1010

This will occur eveer time that UPHClean stops and is normal.
-------

I saw HKCU\Software\NVIDIA Corporation\Global\nView\Tweak under Event
Source: UPHClean
Event ID: 1201.

NVIDIA software can mess up a bunch of things. NVIDIA is a graphic card.

I have all of this NVIDIA crap disabled and suggest that you do the same.

Disable the NVIDIA Display Driver Service...
Start | Run | Type: services.msc | OK |
Scroll down to and double click: NVIDIA Display Driver Service |
Under Startup type set to Disabled | Apply | Click the Stop button |
When it stops click OK | You may have to reboot

First: NvCplDaemon, NvMediaCenter and nwiz what are they?

NvCplDaemon
[System Tray icon used to change display settings, change the clock rate
and
memory speed for nVidia based graphics cards. This is unnecessary since
you
can easily configure these settings the way you want them in the Display
Properties and not have to mess with them again. Also disable the "NVIDIA
Driver Helper Service" if enabled as it can cause this entry to be
re-enabled on re-boot (note that this service can also cause extreme
shutdown delays if enabled ]
http://www.sysinfo.org/startuplist.php?letter=R&filter=&count=50&offset=150

NvMediaCenter
[[RunDLL32.exe NvMCTray.dll, NvTaskbarInit System Tray icon used to
manage
settings for nVidia based graphics cards. May be required for some 3D
applications to recognize your card correctly - such as the game
"Everquest". Otherwise, settings can be changed manually via Display
Properties]]

nwiz.exe = NVIDIA nView Wizard
[[Application enables user to having 32 virtual desktops, get a desktop
larger than the viewable area of the monitor, being able to divide the
display across more than one monitor, managing applications and many more
functionality.]]
-----

Manually delete these three entries:
NvCplDaemon, NvMediaCenter and nwiz.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: NvCplDaemon
Value Type: REG_SZ
Value Data: RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: NvMediaCenter
Value Type: REG_SZ
Value Data: RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: nwiz
Value Type: REG_SZ
Value Data: nwiz.exe /install
-----

Download and install ShellExView (shexview.exe)...

ShellExView download
http://www.snapfiles.com/get/shellexview.html

Open ShellExView and disable the Nvidia right click Menu entries.
These five entries...
Extension Name: Desktop Explorer
Extension Name: Desktop Explorer Menu
Extension Name: DesktopContext Class
Extension Name: NVIDIA CPL Extension
Extension Name: nView Desktop Context Menu

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:0803AD03-1726-4EED-98C3-792963095203@xxxxxxxxxxxxx,
Edna <Edna@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
Hi Wes, I was just checking to see if you had commented on my Reply and
I
don't see my Reply. I wonder what I did or what happened to it. It
was
so
lengthy too and now I don't recall all I told u. Nevertheless, I did
enact
all these great suggestions and I do think it knocked off maybe 10 secs
max
from the delayed shutdown but it still takes 1-1/2 mins to complete.
Meaning
Wes, ya gotta keep thinking! Please!!
Under Event Viewer\Application I don't see any Warnings nor Errors.
Something strange today though, I got 300 yes 300 entries for HHCTRL
All
Event 1904 User N/A.

Also there's a regular pattern of the FIRST 4 entries being UPHClean
having
to perform in leiu of the actual program closing itself. I'll copy
them
as
they appear, first to last.

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1412
Date: 7/8/2006
Time: 5:31:05 PM
User: SHARK\Owner
Computer: SHARK
Description:
Setup for handle remapping for process explorer.exe (644) failed.
Reverting
to closing handle.
.