MonitorWare Knowledge Base

I get a random winlogon error atleast once a day. I am running XP professional. I am not running alaire homesite or the other program that can cause problems. I get this message in event viewer:

Details
Product: Windows Operating System
ID: 1002
Source: Winlogon
Version: 5.0
Component: Application Event Log
Symbolic Name: EVENT_SHELL_RESTARTED
Message: The shell stopped unexpectedly and %1 was restarted.

Explanation
The shell was stopped and then restarted. By default, the shell is explorer.exe; however, you might have a customized shell.


User Action
No user action is required.



Version: 5.2
Symbolic Name: EVENT_SHELL_RESTARTED
Message: The shell stopped unexpectedly and %1 was restarted.

Explanation
The shell was stopped and then restarted. By default, the shell is explorer.exe; however, you might have a customized shell.


User Action
No user action is required.

This issue can be caused by shell extensions that are installed when you install Allaire Homesite , Cold Fusion or Novell Distributed Print Services.

To work around this behavior, remove Novell Distributed Print Services, Homesite or Cold Fusion, restart the computer, and then verify that the following files have been removed from the computer:

Cfshellftprds.dll
Cfssvradmin.dll

This same thing is happening to me more often. There is no particular action being performed that causes it more than another. I am not running any product from Allaire, Novell or Cold fusion. What are other causes of this?

I don't have these product installed and get this event 1002 on a number of servers.

I've started getting this too on Windows 2000. In my case it happens whenever I click on a desktop item or run Internet Explorer or File Manager. Like others here I don't think it is due to software I've added. I feel its some sort of registry csetting corruption.

I have the same error. This just started to happen and I've had Coldfusin on this machine for months. Can I remove Coldfusion and the DLL file's then reinstall coldfusion, without having the same problem?

O.S. W2K Pro

I have a laptop with Windows 2000 I have this problem of Winlogon, event number 1002, since:

* I gained access to the NT network a created a number of network connections

or

* I installed OnNet Host Suite 4.0

I have no idea of what is causing the trouble, but I can barely use Windows Explorer: it closes several seconds after I start it.

I even made the latest Windows Update but this is still failing.

I also get the error when opening up the "my computer" folder. And I just installed Windows 2000 service pak 4 fresh and did all the updates.

I have Win Xp home with sp2
with sp1 i getted this error more times a day
when i installed sp2, the problem was resolved....but....
but today the problem returned!
help

You probably have a trojan. As you know, services can be installed, and they are kind of like TSR's and are invisible. To make sure you don't have a trojan,
1. Get a good scanner, and scan. TrendMicro is free on-line, but it's not perfect. You can research what's best for you.
2. Look at TaskManager (Ctl-Alt_Del, select TaskManager, select Processes). Look at every service listed and make sure you understand them. If you don't, then Google "service_name trojan" and see what hits you get. If you find one that's listed as a trojan, you have to take steps to remove that one.
3. Run Regedit. Open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\notify
There you will see all the services that Windows starts for you as a user. Make sure you understand each of these services, because you're starting them.

A reinstall won't fix a trojan. It will simply reinstall Windows, and leave all your apps and registered services in place, it will only correct the Microsoft software.

Rock

I have this problem in xp pro and 2000 pro. It centers around one of my cd or dvd burning programs. If I try to right click in windows explorer it restarts I have to do a song and dance to get around it. Its not a trojan or spyware I'm certain of that.

Custom computers

I am gettng the same error but only since I recently added my new harddrive. I dont have cold fusion, a trojan or any spyware that could be causing the issue. I have tried a lot of things ranging from scanning disk for errors, using the western digital utility disk and defraging. It is getting very annoying.

I have also updated all my drivers and am running winxp sp2

If anyone has Ideas plz say so
I am running a
pent 3 800 = an old cpu but still good for surfing
768 megs ram
a 20 gig master and 160 slave

Hey guys, I'm having this same exact problem. Found this thread on a google search. It occurs for me about once a day.

Looking through my event viewer I was able to see that this problem started occuring regularly on September 25th for me (also occurced once in June and once in Feburary though probably unrelated). So I checked my system restore logs and found the only two things I had installed around the 25th was Windows Media Player 10 and Spybot Search & Destroy. The problem actually first popped up about 2-3 hours after Installing Windows Media Player 10. I also installed some of the hotfixes/urgent updates for Windows XP excatly 9 days before this started happening (I'm still running SP1 and not SP2). I really believe it's one of the newer SP2 updates for XP causing this for me.

I was wondering if some of you could check your restore point and event viewer logs for Event: 1002. Lets try to see if we can narrow this down to a program/update we installed around the time it started happening.

I should also note that I'm running Norton Internet Security 2003.

I was having the same problem. Turns out that the last two hot fixes that I installed updated winlogon (Win2K) I uninstalled, and the errors (and restart of explorer.exe) ceased.

I had haved the same problem with win2k.
Uninstall SP 840987 resolved the Problem