DWM 0x40010004 Winlogon 6000 and User Profile errors at every startup

[tryfos79]

I have Win 7 64bit Ultimate.
At every startup I get the following errors in that sequence:

First comes the notorious "winlogon notification subscriber SessionEnv was unavailable to handle a notification event" (ID 6000)"
- <System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />

<EventID Qualifiers="32768">6000</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.000000000Z" />

<EventRecordID>31623</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>.....</Computer>

<Security />

</System>


- <EventData>
<Data>SessionEnv</Data>

<Binary>D9060000</Binary>

</EventData>


</Event>



Then always "the DWM has exited with code 0x40010004" - <System>
<Provider Name="Desktop Window Manager" />

<EventID Qualifiers="16384">9009</EventID>

<Level>4</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.000000000Z" />

<EventRecordID>31622</EventRecordID>

<Channel>Application</Channel>

<Computer>......</Computer>

<Security />

</System>


- <EventData>
<Data>0x40010004</Data>

</EventData>


</Event>


Then the again"the winlogon notification subscriber SessionEnv was unavailable to handle a notification event" (ID 6000):

<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />

<EventID Qualifiers="32768">6000</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.000000000Z" />

<EventRecordID>31623</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>......</Computer>

<Security />

</System>


- <EventData>
<Data>SessionEnv</Data>

<Binary>D9060000</Binary>

</EventData>


</Event>

Then always something about user profile (not always the same), for example:
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />

<EventID>1530</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:26:58.586516100Z" />

<EventRecordID>31624</EventRecordID>

<Correlation ActivityID="{036B2A48-F800-0001-A2D4-9E108FB4CD01}" />

<Execution ProcessID="1028" ThreadID="4768" />

<Channel>Application</Channel>

<Computer>......</Computer>

<Security UserID="S-1-5-18" />

</System>


- <EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">7 user registry handles leaked from \Registry\User\S-1-5-21-2087956268-840787211-4146391690-1000: Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\Internet Explorer\Main Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Policies Process 1200 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software Process 1028 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2087956268-840787211-4146391690-1000\Software\Microsoft\RAS AutoDial</Data>





Then comes User Profile has stopped (event 1532)
- <Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />

<EventID>1532</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:27:02.268122500Z" />

<EventRecordID>31625</EventRecordID>

<Correlation />

<Execution ProcessID="1028" ThreadID="1192" />

<Channel>Application</Channel>

<Computer>......</Computer>

<Security UserID="S-1-5-18" />





Then the "suppress duplicate events" 4625:
- <Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />

<EventID Qualifiers="16384">4625</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2012-10-27T22:27:55.000000000Z" />

<EventRecordID>31626</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>.....</Computer>

<Security />

</System>


- <EventData>
<Data Name="param1">86400</Data>

<Data Name="param2">SuppressDuplicateDuration</Data>

<Data Name="param3">Software\Microsoft\EventSystem\EventLog</Data>

</EventData>


</Event>

And all of a sudden the "user profile service has started successfully".

Then comes again "the winlogon notification subscriber SessionEnv was unavailable to handle a notification event" (ID 6000)" and, finally, winlogon id 4101 "windows license validated".From then on all is normal.

The PC has no actual symptoms at all. The AERO works great and the dwm.exe always runs at task manager. Also aero themes working.

The only symptom is at restart, when the welcome screen disappears for a split second, then comes back (probably at the time when dwm exits and restarts?). Then I have a black screen with the mouse for 2-3 or 3-4 secs (as if the pc struggles to log on to the account) and then normally to desktop. That of course delays the startup but from then on all is normal.

From googling around I interpret those errors something like AERO exits at the beginning but comes back, then problems with logging into the user account but finally logging in is normal. I only have one administrative account and nothing else.
I suspect some kind of user profile corruption but cannot pinpoint it, since I get no errors apart from the log.
I have only managed to reproduce the following: I get into safe mode and aero is (normally) auto-disabled. When I restart in normal mode, aero is not activated automatically but the computer starts in basic display mode and I activate aero manually.
I ran aero troubleshooting and of course sfc/scannow without results.
I don't even know if the two problems are somehow connected.

Any help/suggestions would be greatly appreciated!

 

[Arc]

First you try http://www.sevenforums.com/tutorials/139810-sfc-scannow-run-command-prompt-boot.html

If the issue persists, do a http://www.sevenforums.com/tutorials/681-startup-repair.html.