Winlogon error 1002: Still looking for a solution. Anyone?

Hi,

I have a Windows 2000 laptop which keeps giving me a Winlogon error and shuts down Explorer - sometimes several times an hour.

In the Event Viewer Application log, this is what I get:

SourceL: Winlogon
Event ID: 1002

The shell stopped unexpectedly and Explorer.exe was restarted.

I have even reimaged the PC several times. No luck.

Here are the hotfixes I had, in addition to SP4. Maybe, that might ring a bell with someone?

KB-823182, 823559, 823980, 824105, 825119, 826232, 828035, 828741, 828749, 835732, 837001, 839643, 839645, 840315, 841872, 841873, and 842526.

I have removed them all.

And I have neither Novell Distributed Print Services, Homesite or Cold Fusion on my laptop, which some say could be the cause. Some have also said it could be SP 4.0

Anyway, I have decided to remove SP 4.0 completely to rid me of this idiotic annoyance. Is this the best course of action? What are the consequences of NOT having SP 4.0? Can I go to SP2.0? I am ready to go back to Win98 (not XP, which I just don't like!) I want to weigh the pros and cons.

Thanks.
Harry

 

Harry - to the best of my knowledge, SP4 is solid and not likely to be causing you problems. Removing it removes quite a few stability and security enhancements and I really don't recommend it. Yup - I can see that it isn't real stable now but ....

Does the shell just restart or do you get a crash and reboot? I'd love to hear you get a crash.

Have you tried getting to a start=>run line and keying in sfc /scannow (note the space after sfc) and OK? The system file checker might be able to locate and replace damaged or missing system files that are causing you grief.

 

Hello Newt,

Thanks for the quick response. Hmmm...I am in a real dilemma. I learnt from various sources on the Net that SP4 is the culprit. I thought of a compromise by going to SP3. But, I don't want to compromise security just for the sake of rectifying this problem!

No, only any open Windows Explorer windows shut down. Nothing else - application windows are unaffected. It does not shut the PC down, either.

Well, that's the rub! I formatted and reinstalled Win2000 followed by SP4, and within the first hour, before I even started installing any of the applications, the darned problem lifted its ugly head So, I doubt there are any corrupted files there.

This is exactly what happens:

I have reformatted and reinstalled Win2000 ver 5.00.2195 (Service Pack 4), but constantly get the error: "Explorer has generated errors and will be closed by Windows... ".

In Event Viewer, it alternately gives the Dr. Watson error, "The application, explorer.exe, generated an application error The error occurred on 09/01/2004 @ 18:38:03.245 The exception generated was c0000005 at address 77C72A84 (Ordinal169) ". Event: 4097.
....Appl
0008: 69 63 61 74 69 6f 6e 20 ication
0010: 65 78 63 65 70 74 69 6f exceptio
0018: 6e 20 6f 63 63 75 72 72 n occurr
0020: 65 64 3a 0d 0a 20 20 20 ed:..
0028: 20 20 20 20 20 41 70 70 App
0030: 3a 20 65 78 70 6c 6f 72 : explor
0038: 65 72 2e 65 78 65 20 28 er.exe (
0040: 70 69 64 3d 39 33 32 29 pid=932)

then the Winlogon error: "The shell stopped unexpectedly and Explorer.exe was restarted ". Event 1002.

This happens about 2 or 3 times an hour, on an average.

Now, I heard somewhere that this could be a problem with a non-Microsoft context menu item. I have to start keeping tabs.

I LOVE 2000 and don't want to go to XP. I would rather go down to Win98 than go to XP. I detest certain things about XP.

I just learnt that ShellExView can be used to isolate the oproblem. But, I simply don't have the time and patience for this.

Weren't computers designed to make our life easier and to reduce stress??!

Thanks again.

 

Thanks, Arie. I am now on the lookout for that Hotfix.

Regards,

 

I think the above quote answers your question.

I've installed win 2000 on numerous systems and have never had a problem with SP4. However, that does not mean that there will never be a problem on a system with it. Every system has it's quirks.

Since you've already wiped the drive do it again and re-install 2000 WITHOUT SP4 just to see if the problem comes back. Don't install anything else!

If it proves stable with the install start installing drivers for the mainboard and other hardware. If you have the time install drivers one at a time. What I do is to have a system I'm working on right next to my desk. While I'm doing stuff on my system I'll reach over every now and then and do something with the system I'm working on that relates to the problem. This way I'm getting stuff done while the working on system is doing it's thing.

Since I believe that you said that the problem was present before you added the 256meg ram I would pretty much rule out a memory problem. Although I can't remember if you said that you tried it with just the 256 stick, leaving out the 64meg stick. If you haven't, it couldn't hurt to try it.

Anyway, If you are stable with a generic 2000 install without SP4 and memory is ruled totally out... well, I've just never known SP4 to be a problem but that dosen't mean that it can't be on that system.

 

The strange thing is I bought this laptop in 2002, and it has been working fine all along. Problem is I cannot remember if this issue started after I installed SP4. I have reinstalled SP4. I will wait and see if the problem reappears.

Actually, it's like this. I purchased the system, with 512 MB memory, ie., I have never had anything else in terms of memory on the laptop. I have two 256 MB sticks. No 64 MB in there at all. And, it has been working fine all these years. But a few days ago, it said "the memory has changed ", or something to that effect. Sure enough, as it was loading, it told me there was only 256 MB of memory, though both 256 MB sticks were intact. And, as quick as the problem appeared, it has disappeared! Bizarre! Then, as if to add insult to injury, a new problem appeared - the BIOS version is wrong I recall the memory problem happened once last year, and mysteriously, it disappeared. Same thing happened this time. The laptop is functioning fine now! But, I had to power cycle it several times.

Am I safe without SP4? I mean, shouldn't my virus software and router protect my PC? What exactly does SP4 do? What about going back to SP2 or SP3?

Thanks.

 

Someone correct me if I'm wrong but I believe that it would boil down to this in simple terms...

A critical Update involves a fix for a glitch or vulnerability relateing to a specific situation.

A recommended update deals with enhancements that aren't really necessary.

A Service Pack more or less 'rewrites' the OS to cover many enhancements and vulnerabilities spread out through the entire OS.

Are you safe without SP4?? Ask the thousands out there that have never even heard of it...

Running without SP4 wouldn't be nearly as risky on a home system as in a business as it's very unlikely that someone is gonna specifically seek you out to mess with. That is NOT to say that you are not more at risk!!! It's just not as likely that you will be attacked. Again, this dosen't mean that you won't be attacked, just that the chances are less.

I would cover every base to try to run SP4. Try any advice that is offered here to try to resolve the problem. If absolutely nothing works and you are running a good firewall and Anti-virus along with spyware software I wouldn't get parinoid or anything but DO make every effort to resolve the issue.

Actually what you said about the system saying memory has changed and now only showing 256meg tends to tell me that the problem all along has been memory. I would try to isolate the stick that's not showing, clean and re-seat it and if still a problem with it, get rid of it. Run Microsoft Memory Diafnostics on one stick at a time. I have a feeling that one of them is going to fail.

On my ststement about the 64meg, I must have gotten your thread mixed up with someone elses.

 

Thanks for the response, Jay.

Well, I decided to try it outafter reimaging withOUT SP4. I installed Sygate Personal Firewall and depended on my router for safety. However, after using it like that for a few hours, it did the same thing - winlogon error and Explorer shut down So, it is not a SP4 issue. So, I have just reinstalled SP4.

It is also not a memory issue as I no longer get that error after reseating the memory stick and rebooting. Also, it no longer reads only 256 MB memory. It does correctly show the full memory of 512 MB now.

So, I am at a loss...it's not SP4 or the memory. So, what else can it be?

TIA.

 

I would still run Memory Diagnostics.

Also agree that your attempts to re-do windows should be from format and install from CD, not using an image.

 

Sorry about that. I use the words "reimaging" and "reimage/install" interchangeably. No, I never create a restore disk. I always do a clean format and install 2000 from the CD, in case of serious problems.

And, Jaylach, I ran the memory tool - came out squeaky clean. Not single error.

In fact, I am using the laptop in question to compose this message.

To give you an idea, here is what has happened today:

I have had the same error three times in the past 3 hours.

Winlogon error 1002. "The shell stopped unexpectedly and Explorer.exe was restarted. " All Explorer windows close and all my desktop icons are rearranged...sheeesh...

Absolutely nuts! Makes me wanna go back to Win98...

 

Well, as much as I hate to admit it, I'm pretty much at a loss...

I doubt that it will make a difference but if you have active desktop enabled, disable it. If it's not enabled, do so. It still sounds like a hardware/driver problem but I don't know what to tell you to try.

 

Thanks, Jay. Never thought of that. However, though enabling the active desktop did not do the trick, locking the icons within that function now keeps my icons fom being scattered about. Now, they retain their rightful place, which is one less headache after each crash. One small step for Windows...a giant leap for me!

Thanks.