Re: Logon and logoff

Information sent.

"nass" <nass@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message

"Ken" wrote:

Ok, maybe no attachments? Then here's the event log info (four entries)
"access denied" looks suspicious. That is part of the virus software, I

Event Type: Error
Event Source: WMPNetworkSvc
Event Category: None
Event ID: 14325
Date: 9/27/2008
Time: 1:13:17 PM
User: N/A
Computer: KGPLACE
Service 'WMPNetworkSvc' did not start correctly because QueryService
encountered error '0x80004002'. In Windows Media Player, turn off media
sharing, and then turn it back on.

When you try use Windows Media Player 11 to play a digital rights
(DRM)-protected media file, the media may not play
After enabling Media Sharing, if I open Media Player and select LIBRARY->
MEDIA SHARING, it displays a dialog box saying "Media sharing is currently
disabled, either because the sharing service is not running or your
settings have changed. To restart sharing, you must first confirm your
sharing settings."

I have enabled all WMP sharing-related firewall rules, and when
investigating the service, I found what I explained above.
Open a command run and type in
services.msc click [Ok] and see if the following services have been
on your XP machine:
SSPD Discovery Service
Universal Plug and Play Device Host
Windows Media Player Network Sharing Service

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 9/27/2008
Time: 1:13:34 PM
Computer: KGPLACE
DCOM got error "Access is denied. " attempting to start the service
with arguments "" in order to run the server:

Check PC-Cillin Spyware Control Service is Enabled or the application is
working okay.


Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 28
Date: 9/27/2008
Time: 1:13:16 PM
User: N/A
Computer: KGPLACE
WinMgmt could not initialize the core parts. This could be due to a badly
installed version of WinMgmt, WinMgmt repository upgrade failure,
insufficient disk space or insufficient memory.

Hello Bob,

Thank you for using newsgroup!

From your post, it appears that the WMI installation of this computer is
corrupt. Please try to reset the WMI installation using the following

1. Stop the WINMGMT (Windows Management Instrumentation) service.
2. Move all the files under the WBEM Repository directory (located in the
\%Windir%\System32\WBEM directory) to a temp folder. In fact we can delete
the files here as well. Moving the files is just a backup for the files
3. Restart the WINMGMT (Windows Management Instrumentation) service.
4. If the files in the WBEM Repository directory are not created by
restarting the WMI service, restart the computer and these files should be

Thanks & Regards,

Ken Zhao

Microsoft Online Support
Sorry Ken,

I deleted the wrong folder.
You clearly said \%Windir%\System32\WBEM, but I did \%Windir%\WBEM. I put
the files back and deleted the correct files this time.

To be clear, this is what I finally did.
1. net stop WINMGMT
2. Restored C:\WINDOWS\WBEM\msfeeds.mof
3. Restored C:\WINDOWS\WBEM\msfeedsbs.mof
4. Deleted C:\WINDOWS\system32\wbem\Repository\$WinMgmt.CFG
5. Deleted the five files in folder C:\WINDOWS\system32\wbem\Repository\FS
6. Register all DLLS in %SystemRoot%\System32\wbem by doing the following
from the cmd prompt:
a) cd C:\WINDOWS\system32\wbem
b) for /f %s in ('dir /b *.dll') do regsvr32 /s %s
7. Restarted system.

Result is I no longer get the WinMgmt Event ID: 28 error. THANKS!

Event ID 28 - WMI Service Availability

Event Type: Error
Event Source: SecurityCenter
Event Category: None
Event ID: 1802
Date: 9/27/2008
Time: 1:13:16 PM
User: N/A
Computer: KGPLACE
The Windows Security Center Service was unable to establish event queries
with WMI to monitor third party AntiVirus and Firewall.

The error about MS Security Center not being able to track or recognize
anti-virus, check that the Firewall service for TrendMicro
is Enabled Auto and working in the Services control panel.
Can you please run through these cleaning steps and if you wish send me
Hijackthis log. I will be interested to see if your Audit is messed up and
there is any kind of rootkit/Zlob infection!
Also can you tell us:
- How much Disk space on this machine
- How much RAM installed
- Do you have a Firewall and your AV subscription is current

How to Identify a Damaged User Profile and Create a New Profile:

1... Click start >> Control Panel >> Double Click Network and Internet
Connections >> Double click Internet Options, on the IE Properties window
you will see these Options:
General | Security | Privacy | Content | Connections | Programs
| Advanced .

Click on General Tab (1st Tab on the left) and you will see a Button
[ Clear History ..] click on it to clear your History caches, then click
[Delete Files..] to delete Internet Files created over the time, click on
Delete Cookies...] to delete your cookies left by visiting websites.

= Then try to Disable the Add-Ons on your Browser somehow installed on
browser, On how to disable the Add-ons follow this:
Click on Programs Tab and then click the Manage Add-Ons Button there
the None/Not Verified Plug-ins/Add-ons ( you need to Renable them
later and see which is the culprit or you can send them here in your next
post) and click [OK] to confirm your Changes.
How to manage Add-Ons:

Click on Advanced Tab and scroll down under the browsing option and
this box:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) and click Apply
then OK to close your IE Properties.
Scan for malware from here:
SuperAntispyware - Free
Run a scan from here on-line:
Download Avast Cleaner (offline scanner) from here:
Comodo BOClean : Anti-Malware Version 4.27
Download Hijackthis and send me the log.
my address is : to_you_ross(at remove this and repalce with the
( _ is underscore)

"nass" <nass@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message

"Ken" wrote:

Need some help, please.
After a windows update and reboot, I can log in but it quickly logs me
out -- no chance at all. I can start in SAFE mode and log in OK. Virus
software is up-to-date, and other scans do not help (but can only run
safe mode).
Any ideas?

It looks to me a hardware/software issue, try to start the machine with
basics device like Monitor, mouse, keyboard and disconnect any extra
devices and see if that will help.

Do you get any error message?
Please send us your Error messages by following the steps below:
Open a Notepad, customize or minimize to the taskbar as you will need
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the
you opened earlier and right click on the first line and select Paste
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP

Please we need just the error messages with Red (X) and don't repeat
error, just one of each kind and post them back in your next post.