Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1002 Source: Winlogon

The shell stopped unexpectedly and explorer.exe was restarted.
This problem occurs if Windows Explorer cannot retrieve correct image properties from the TIFF files. See ME898051 for a hotfix applicable to Microsoft Windows Server 2003.
In my case, I was having this issue on two Windows 2000 servers. Rolling back the RAGE XL video drivers to 5.0.2195.5012 resolved the issue.
In my case, the problem was caused by the ACE Mega codec. I removed it from the system and installed K-Lite codec instead. The problem is now gone.
In our case, the problem was caused by McAfee VirusScan 8.0i. Disabling the buffer overflow protection solved it immediately.
See ME872764 for a hotfix applicable to Microsoft Windows 2000.

As per Microsoft: "The shell was stopped and then restarted. By default, the shell is explorer.exe; however, you might have a customized shell". See MSW2KDB for more details.

If you recently installed ME841356, then see ME891608 to resolve this problem.

From a newsgroup post: "In my case after a little investigation I found out that Internet Explorer stored its temporary files in C:\TEMP (it applied the System flag to the directory so that it became read only for other applications). I changed this and the error disappeared".

From a newsgroup post: "I too have this problem and the solution as of now is to run my folder windows in a separate process. In “Windows Explorer” go to “Tools-->Folder Options”, go to the tab “View” and check "Launch folder windows in a separate process" ".

From a newsgroup post: "This problem can be caused by a shell extension. Isolate the problem by temporarily disabling third-party shell extensions using ShellExView from NirSoft".

Some users reported that removing WS_FTP helped them to get rid of this problem.

In my case, I had an icon for Kodak DC265 to access the camera and that was the problem. I had to uninstall Kodak DC265.
Thumbnail viewing of XML files in Windows 2000 was the problem for me. See ME821164 for information on fixing this problem.
We had the same problem with Windows Server 2003 Terminal Servers. Our problem also turned out to be caused by McAfee7.
I finally found my solution to this problem after much searching. If you are running Windows XP too, then see ME329692 for a hotfix.
My video cards were set at 32 bit color (high). I changed one card to 16 bit high color. When I clicked "applied" my monitor reacted out of range and was frozen and I had to reboot. SiS 6326 video driver caused this problem.
This event may occur in various conditions. See the links below.
This may occur when Explorer tries to read a damaged CD and apparently hungs. If the user kills the "explorer.exe" process, this event will be recorded. Basically, anytime the "explorer.exe" process is killed or somehow terminated, this event will show up in the event log.
I have found that explorer.exe may close unexpectedly after installing Service Pack 3 and/or installation of IE 6. Uninstalling IE 6 appears to resolve this issue. See ME326612.
In my case, I had a Adobe Photoshop 7 file on my desktop (25 MB) which caused explorer to crash each time I tried to log on - so no taskbar, etc.

I have Windows XP Pro and I installed McAfee7. Outlook XP hangs after 10 min (also no connection with XWin). I disabled McAfee services: everything ok. So I downgraded McAfee to version6: problem solved.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.