Tony

A complete copy of the Error Report from Event Viewer would help.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

You need to identify the Application. You could try Process Monitor.
http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx

Start logging and then shut down. Read the post by Molotov is this link:
http://forum.sysinternals.com/forum_posts.asp?TID=13460

This is the entire message as it appears in Event Viewer (thanks to
Gerry for this tip!)

Event Type:    Error
Event Source:    Application Error
Event Category:    (100)
Event ID:    1000
Date:        5/19/2008
Time:        1:01:14 AM
User:        N/A
Computer:    TONYS
Description:
Faulting application , version 0.0.0.0, faulting module uxtheme.dll,
version 6.0.2900.5512, fault address 0x000011f5.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 20 30 2e   ure   0.
0018: 30 2e 30 2e 30 20 69 6e   0.0.0 in
0020: 20 75 78 74 68 65 6d 65    uxtheme
0028: 2e 64 6c 6c 20 36 2e 30   .dll 6.0
0030: 2e 32 39 30 30 2e 35 35   .2900.55
0038: 31 32 20 61 74 20 6f 66   12 at of
0040: 66 73 65 74 20 30 30 30   fset 000
0048: 30 31 31 66 35            011f5