RE: System Information: Error Control

http://i598.photobucket.com/albums/tt65/Ken_039/REDO.jpg

"Ken" wrote:

Nas, in process of upgrading driver,ATI Radeon x1050and Catalyst Control
Center.Driver package version 8.476,Catalyst version 8.4.
This version is not equiped with ATI uninstall utility, can however be
removed from Add/Remove Programs.Is suggested by ATI
installation guide to manually remove.Instuctions clear, can follow until
<Clear> C:/Windows/Temp/ Is this referring to the C:/ATI
Folder and its contents.

http://i598.photobucket.com/albums/tt65/Ken_039/ATISUPPORTFOLDER.jpg

Will removing by Add/Remove Programs or deleting every sub-folder produce
same result? Presumming of course Im not totally
off the mark.

"nass" wrote:


Hi Ken,
Do you have Small Business Server installed and running on this machine? or
did you Install/Uninstall ASP/SBS or any software/hardware recently?
What version of service pack this machine up to? Is it SP1,SP2 or SP3?

I would like to make sure the machine clean from malware/viruses by running
a thorough scan.
Go through these Cleaning steps:
1... Click start >> Control Panel >> Double Click Network and Internet
Connections >> Double click Internet Options, on the IE Properties window
you will see these Options:
General | Security | Privacy | Content | Connections | Programs
| Advanced .

Click on General Tab (1st Tab on the left) and you will see a Button called
[ Clear History ..] click on it to clear your History caches, then click on
[Delete Files..] to delete Internet Files created over the time, click on [
Delete Cookies...] to delete your cookies left by visiting websites.

Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
= Then try to Disable the Add-Ons on your Browser somehow installed on your
browser, On how to disable the Add-ons follow this:
Click on Programs Tab and then click the Manage Add-Ons Button there Disable
the Non/Not Verified Plug-ins/Add-ons ( you need to Renable them one-by-one
later and see which is the culprit .
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (off-line scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

If you need further help and your machine infected download the Hijackthis
and send the report to one of many forums for analysis and troubleshooting or
you can send it to me on my email provided at the bottom:
When all else fails, download HijackThis v2.0.2
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)

Can you please send me a copy at to_you_rossREMOVETHISCAPS@xxxxxxxxxxx ,
remove the obvious to email me.

Please read the info below and apply when apropriate.

Application
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 4/1/2009
Time: 12:58:08 AM
User: YOUR-58AA870609\Geraldine
Computer: YOUR-58AA870609
Description:
Windows cannot unload your classes registry file - it is still in use by
other applications or services. The file will be unloaded when it is no
longer in use.

Solution::
User Profile Hive Cleanup Service
http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en

The system may not unload your user profile correctly when you log off from
a Windows XP-based computer
http://support.microsoft.com/kb/842827
========================================================================
Event Type: Error
Event Source: Application on Demand - IEXPLORE
Event Category: None
Event ID: 0
Date: 3/31/2009
Time: 11:28:54 PM
User: N/A
Computer: YOUR-58AA870609
Description:
The description for Event ID ( 0 ) in Source ( Application on Demand -
IEXPLORE ) cannot be found. The local computer may not have the necessary
registry information or message DLL files to display messages from a remote
computer. You may be able to use the /AUXSOURCE= flag to retrieve this
description; see Help and Support for details. The following information is
part of the event: ALoggerFileCyclic: Failed to delete an old log file Last
error code: 32

Type:ERROR
Location:::(0) : error 0:
Computer:
Id: 0, Name:Null

Solution::
Event ID 0 Source .NET Runtime
http://www.eventid.net/display.asp?eventid=0&eventno=2142&source=.NET%20Runtime&phase=1

Detailed Usage of the Event Viewer /AUXSOURCE Switch Option
http://support.microsoft.com/?kbid=312216

===============================================================
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 3/22/2009
Time: 7:17:22 PM
User: N/A
Computer: YOUR-58AA870609
Description:
Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

==================================================================================
Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1015
Date: 3/15/2009
Time: 5:14:04 PM
User: YOUR-58AA870609\Kenny
Computer: YOUR-58AA870609
Description:

Solution::
MSI Installer and Failed to connect to server Event
http://blogs.msdn.com/mpoulson/archive/2005/11/30/498586.aspx

Event ID 1015 is logged in the Application log when you use the OHotFix
program to install Office updates
http://support.microsoft.com/kb/907341

==============================================================================
Event Type: Error
Event Source: Microsoft Management Console
Event Category: None
Event ID: 1001
Date: 3/15/2009
Time: 1:24:14 PM
User: N/A
Computer: YOUR-58AA870609
Description:
The description for Event ID ( 1001 ) in Source ( Microsoft Management
Console ) cannot be found. The local computer may not have the necessary
registry information or message DLL files to display messages from a remote
computer. You may be able to use the /AUXSOURCE= flag to retrieve this
description; see Help and Support for details. The following information is
part of the event: 598251248.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 35 39 38 32 35 31 32 34 59825124
0010: 38 0d 0a 8..

schedule

Solution::
Event ID 1000, 1001 is logged every five minutes in the Application event log
http://support.microsoft.com/kb/290647

Event ID 1001 — Performance Library Availability
http://technet.microsoft.com/en-us/library/cc775086.aspx

Event ID 1001 — Network Performance Counter Availability
http://technet.microsoft.com/en-us/library/cc774942.aspx

Step-by-Step Guide to the Microsoft Management Console
http://technet.microsoft.com/en-us/library/bb742442.aspx

Microsoft Management Console - Overview
http://technet.microsoft.com/en-us/library/bb742441.aspx


========================================================================================
Event Type: Warning
Event Source: System.ServiceModel.Install 3.0.0.0
Event Category: None
Event ID: 0
Date: 3/9/2009
Time: 8:33:05 PM
User: N/A
Computer: YOUR-58AA870609
Description:
Configuration section system.serviceModel.activation already exists in
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Config\machine.config.

Solution::
Cannot Find Server (404) or Get Plain Text for WCF .svc Files From IIS?
http://blogs.msdn.com/wenlong/archive/2006/09/10/748294.aspx
Hosting WCF service on IIS/XP - browsing to the .SVC gives a plain text view
of the contents
http://social.msdn.microsoft.com/Forums/en-US/wcf/thread/b109a13a-7258-49dd-a90d-66bf257ce63e/

Setup .NET 3.0 fails
http://social.msdn.microsoft.com/Forums/en-US/netfxsetup/thread/be94b523-e802-4f76-8494-450ea571da44/

===================================================================

Event Type: Warning
Event Source: ASP.NET 2.0.50727.0
Event Category: Setup
Event ID: 1020
Date: 3/9/2009
Time: 8:32:13 PM
User: N/A
Computer: YOUR-58AA870609
Description:
Updates to the IIS metabase were aborted because IIS is either not installed
or is disabled on this machine. To configure ASP.NET to run in IIS, please
install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Solution::
KB928365 bootstrapper package
http://social.msdn.microsoft.com/Forums/en-US/netfxsetup/thread/ba572097-7639-48cf-8d45-227f83e8ea97/

Error 1335 When trying to install VCS
http://social.msdn.microsoft.com/Forums/en-US/Vsexpressvcs/thread/255e6619-a2cc-488c-8f23-3a7b57a1cf7d/
===============================================================================
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 3/5/2009
Time: 6:20:51 PM
User: N/A
Computer: YOUR-58AA870609
Description:
Fault bucket 752609324.

Solution::
RAM test, you may have a bad RAM stick!

================================================================
Security

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 3/23/2009
Time: 8:23:42 PM
User: NT AUTHORITY\SYSTEM
Computer: YOUR-58AA870609
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Kevin
Source Workstation: YOUR-58AA870609
Error Code: 0xC000006A

Solution::
<Q::>Justin S. (Last update 5/3/2005):
- Error code: 0xC0000064 - I discovered one of our workstations had somehow
managed to add a stored password (under Control Panel -> Users -> Advanced ->
Manage Passwords) with the form username@xxxxxxxxxxx This created thousands
of failure events as the user browsed our intranet. Removing the offending
entries stopped the events.
</Q::>

<Q::>Adrian Florin Moisei (Last update 4/18/2003):
- Error code: 0xC000006A (Error code 0xC000006A) - According to Microsoft
Windows XP attempts a limited logon for each account that is displayed on the
Welcome screen to determine whether to prompt the user for a password. An
attempted logon is logged for each account displayed. To resolve this
problem, obtain the latest service pack for Windows XP. To prevent these
events from being logged, disable the Welcome screen and use the classic
logon screen or turn off auditing of logon events.
</Q::>

http://www.eventid.net/display.asp?eventid=680&eventno=2267&source=Security&phase=1

How to troubleshoot Kerberos-related issues in IIS
http://support.microsoft.com/default.aspx?scid=kb;en-us;326985

Account Lockout Tools
http://technet.microsoft.com/en-us/library/cc738772.aspx

========================================================================
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 4/1/2009
Time: 1:02:25 AM
.