Re: Malicious Software Removal Tool Errors Reported

The machine is not networked other than through a router to the Internet.
As I've stated previously, rebooting the machine without running a further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
scan was aborted when it tried to run. On a subsequent reboot the scan ran
but of course i had not run chkdsk so the problem had disappeared again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
told you that before.

I cannot access services.msc while the computer is faulting - therefore I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

"nass" <nass@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@xxxxxxxxxxxxxxxx


"DavidB" wrote:

Please if you wish to "SNIP" snip all or leave all as we are here for
links?.
That been said, I hope you performed a scan on your machine and made sure
all okay.
There is another option but we will come to it if these steps didn't help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windowsserver2008/en/library/458fbffb-1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine, please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass
----
http://www.nasstec.co.uk


.

Relevant Pages

  • Re: Lock-Ups ERROR - IPSec Service
    ... using an ipsec VPN connection you do not need ipsec. ... Normally the ipsec service should not cause ... IPSec Services failed to get the complete list of Network ... machine since some of the network interfaces may not get the protection as ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Green Admin - Brute Force Attack - Pls Help
    ... Ipsec configuration is very similar [if ... specifics on how to use ipsec "filtering" policy to protect computers. ... is managing a network - particularly one in a hostile environment. ...
    (microsoft.public.security)
  • Re: asp.net
    ... Snap-in selection in the drop menu, ... pop-up messages from network sense telling you that the ... >>One normally sees the IPsec message that you mention ... >>when one network capable interface has not finished its ...
    (microsoft.public.windowsxp.security_admin)
  • Re: IPSec / domain isolation: confusing MS documents
    ... workstation, he is able to attach to server ressources again, but for our ... The user right for access this computer from the network ... will not work for computer accounts unless ipsec is being used. ... securing a domain controller. ...
    (microsoft.public.windows.server.security)
  • RE: IPSEC
    ... IPSec security is applied to these clients. ... Generally speaking, IPSec can improve security on a network, but changing ... Microsoft CSS Online Newsgroup Support ... newsgroups so that they can be resolved in an efficient and timely manner. ...
    (microsoft.public.windows.server.sbs)