Malicious Software Removal Tool Errors Reported

  • Thread starter Thread starter DavidB
  • Start date Start date
D

DavidB

Hello

Can anyone give me an idea of what the following log file reports mean after
running the MST today?

Microsoft Windows Malicious Software Removal Tool v1.36, December 2007
Started On Wed Dec 12 15:59:33 2007
->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:2400 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:2400 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12
15:59:53 2007

Many thanks in advance

DavidB
 
"DavidB" wrote:

> Hello
>
> Can anyone give me an idea of what the following log file reports mean after
> running the MST today?
>
> Microsoft Windows Malicious Software Removal Tool v1.36, December 2007
> Started On Wed Dec 12 15:59:33 2007
> ->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
> ->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
> ->Scan ERROR: resource process://pid:2400 (code 0x00000005 (5))
> ->Scan ERROR: resource process://pid:2400 (code 0x0000054F (1359))
> ->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
> ->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
>
> Results Summary:
> ----------------
> No infection found.
>
> Return code: 0
> Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12
> 15:59:53 2007
>
> Many thanks in advance
>
> DavidB

Hi DavidB,
This can happen if the MWMSRT didn't have access to a process that was in
use or termainated by the system.
Resolution: you don't have to worry about it, but if it did happen when you
reRun it then this can Indicate on a Viral infection on your system and you
need to Run these cleaning steps to make sure there is/are not any nasties on
your machine.

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
Spybot Search & Destroy
http://www.safer-networking.org/en/download/index.html
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx


Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html
Lots of tools to download and disinfect your machine (offline scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/

After the scan run disk cleanup on your drive.

HTH.
nass
----
http://www.nasstec.co.uk
 
Don't worry about it.

DavidB wrote:
> Hello
>
> Can anyone give me an idea of what the following log file reports mean
> after
> running the MST today?
>
> Microsoft Windows Malicious Software Removal Tool v1.36, December 2007
> Started On Wed Dec 12 15:59:33 2007
> ->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
> ->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
> ->Scan ERROR: resource process://pid:2400 (code 0x00000005 (5))
> ->Scan ERROR: resource process://pid:2400 (code 0x0000054F (1359))
> ->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
> ->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
>
> Results Summary:
> ----------------
> No infection found.
>
> Return code: 0
> Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12
> 15:59:53 2007
>
> Many thanks in advance
>
> DavidB
 
"nass" wrote:

>
<snip>
> HTH.
> nass
> ----
> http://www.nasstec.co.uk

Thanks Nass.

I have run most of these already but will try the ones I was unaware or
hadn't thought of - the MSR tool has reported in this way for the last 3
months of running and I was concerned that there might be a virus.

The only problem is that if there is a virus then it is not apparent when
Windows is loaded and running normally except when i have run a scheduled
chkdisk prior to startup. If I do this, once the check has completed and
Windows has loaded I cannot open any anti-virus utilities, the control panel
or the processes tab of Task Manager - so I can't see what's running. I can
however open any other applications (apart from Outlook). A reboot always
fixes this.

This led me to believe that there was a boot-time virus so I downloaded a
virus scanner that would operate in dos and also made a floppy to allow me to
access my NTFS disc from the A: drive on boot - however I cannot get further
than the computer booting and recognising the A: drive, it reports that there
is no C: drive (or any other drive for that matter) when I try to change
directory to run the dos virus scan.

I actually changed the boot hard drive last week, using a clean disc and
having neither of my other 2 HD's connected when I was installing windows.
The same behaviour in Windows after running a chkdsk is still apparent. Is
it possible for there to be a virus in the hardware other than the hard
drive? I don't use any memory keys or the like so the only possible place I
can think of is the RAM which has checked out clean every time I've scanned.

As you may be able to tell I am not particularly knowledgable about viri so
any help or suggestions you can give would be much appreciated.

DavidB
 
"DavidB" wrote:

>
>
> "nass" wrote:
>
> >
> <snip>
> > HTH.
> > nass
> > ----
> > http://www.nasstec.co.uk
>
> Thanks Nass.
>
> I have run most of these already but will try the ones I was unaware or
> hadn't thought of - the MSR tool has reported in this way for the last 3
> months of running and I was concerned that there might be a virus.
>
> The only problem is that if there is a virus then it is not apparent when
> Windows is loaded and running normally except when i have run a scheduled
> chkdisk prior to startup. If I do this, once the check has completed and
> Windows has loaded I cannot open any anti-virus utilities, the control panel
> or the processes tab of Task Manager - so I can't see what's running. I can
> however open any other applications (apart from Outlook). A reboot always
> fixes this.
>
> This led me to believe that there was a boot-time virus so I downloaded a
> virus scanner that would operate in dos and also made a floppy to allow me to
> access my NTFS disc from the A: drive on boot - however I cannot get further
> than the computer booting and recognising the A: drive, it reports that there
> is no C: drive (or any other drive for that matter) when I try to change
> directory to run the dos virus scan.
>
> I actually changed the boot hard drive last week, using a clean disc and
> having neither of my other 2 HD's connected when I was installing windows.
> The same behaviour in Windows after running a chkdsk is still apparent. Is
> it possible for there to be a virus in the hardware other than the hard
> drive? I don't use any memory keys or the like so the only possible place I
> can think of is the RAM which has checked out clean every time I've scanned.
>
> As you may be able to tell I am not particularly knowledgable about viri so
> any help or suggestions you can give would be much appreciated.
>
> DavidB


Hi David,
Either you can use the Avast Anti-virus as it has the Capability's to run An
On Boot Virus scan which is very good to determine if you have a Boot sector
Virus like WXY for example.
http://www.avast.com try the home user free version.
Also try to check the Event Viewer log for error as this not good new if you
run the chkdsk to enhance your system you get the opposite which slowing down
or unresponsive system for a while.

Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

Extra Info it doesn't mean it apply to your issue, just in case:
System Has Recovered from a Serious Error:
http://support.microsoft.com/kb/316424
You receive a "System Has Recovered from a Serious Error"
http://support.microsoft.com/kb/317277
HTH.
nass
---
http://www.nasstec.co.uk
 
"nass" <nass@discussions.microsoft.com> wrote in message
news:1AABB6C2-870C-42E9-B73F-00C3397AC673@microsoft.com...
>
<snip>
> http://www.nasstec.co.uk

Hi Nass

Thanks again for your continued help. I have downloaded Avast as you
suggest and will install it tomorrow evening and give it a try.

I have pasted the Event viewer logs showing the errors when I replicated the
fault by running chkdsk on a reboot. The error in applications occured 4
times within a few seconds - always the same error. The other 2 occured
once each.

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 20 30 2e ure 0.
0018: 30 2e 30 2e 30 20 69 6e 0.0.0 in
0020: 20 75 6e 6b 6e 6f 77 6e unknown
0028: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0030: 20 61 74 20 6f 66 66 73 at offs
0038: 65 74 20 30 30 30 30 30 et 00000
0040: 30 30 30 000

From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

DavidB
 
"DavidB" wrote:

Please if you wish to "SNIP" snip all or leave all as we are here for links?.
That been said, I hope you performed a scan on your machine and made sure
all okay.
There is another option but we will come to it if these steps didn't help or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine, please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass
----
http://www.nasstec.co.uk
 
The machine is not networked other than through a router to the Internet.
As I've stated previously, rebooting the machine without running a further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
scan was aborted when it tried to run. On a subsequent reboot the scan ran
but of course i had not run chkdsk so the problem had disappeared again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
told you that before.

I cannot access services.msc while the computer is faulting - therefore I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

"nass" <nass@discussions.microsoft.com> wrote in message
news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
>
>
> "DavidB" wrote:
>
> Please if you wish to "SNIP" snip all or leave all as we are here for
> links?.
> That been said, I hope you performed a scan on your machine and made sure
> all okay.
> There is another option but we will come to it if these steps didn't help
> or
> not completely eliminate the Issue.
>
> My reply is under each error message:
>
> From application :
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date: 13/12/2007
> Time: 16:43:24
> User: N/A
> Computer: PHANTOM
> Description:
> Faulting application , version 0.0.0.0, faulting module unknown, version
> 0.0.0.0, fault address 0x00000000.
>
> This can indicate a memory is Bad so check your RAM sticks by downloading
> this tool to check it with:
> You may have a bad RAM try to test your RAM by running Memtest by
> downloading this tool and unzip it and make a floppy or CD/DVD and run it
> on
> Reboot.
> http://www.memtest86.com/
> You may need to reposition/reset the RAM sticks in their slots.
>
>
> From security:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Policy Change
> Event ID: 615
> Date: 13/12/2007
> Time: 16:45:41
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: PHANTOM
> Description:
> IPSec Services: IPSec Services failed to get the complete list of network
> interfaces on the machine. This can be a potential security hazard to the
> machine since some of the network interfaces may not get the protection as
> desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> further diagnose the problem.
>
> Make sure this service "IPSec Service" is started Automatically or
> manullay
> in Services control panel.
> When this error occur?.
>
> <MS::>
> Event Message:
>
> IPSec policy agent changed: parameter PolicySource: parameter parameter
> Source Event Log Event ID Event Type
> Security Security 615 Success Audit
> Explanation:
>
> This event record indicates that a local group account has been created.
> </MS::>
> Troubleshooting VPN over IPsec
> http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
> Step-by-Step Guide to Internet Protocol Security (IPSec)
> http://technet.microsoft.com/en-us/library/bb742429.aspx
>
> IPsec Policy Agent Service Runtime
> http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
>
>
>
> From System:
>
> Event Type: Error
> Event Source: Dhcp
> Event Category: None
> Event ID: 1002
> Date: 13/12/2007
> Time: 16:46:15
> User: N/A
> Computer: PHANTOM
> Description:
> The IP address lease 192.168.1.2 for the Network Card with network address
> 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
> Server
> sent a DHCPNACK message).
>
> Log into the Router or the server that assign the IP and click on the DHCP
> there and see the MAC address for the machine having trouble.
> You will find a log of bad IP addresses obtained by this machine, please
> delete this log and make sure the machine is get the IP address Auto.
> On the machine having trouble obtaining IP address Open a run command and
> type in:
> ipconfig /flushdns click [OK]
> ipconfig /renew click [OK]
> netsh winsock reset click [OK]
> Reboot the machine and see if the error will be lgged after a while.
>
>
> DHCP Across IP Routers
> http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
>
> HTH.
> nass
> ----
> http://www.nasstec.co.uk
 

> "nass" <nass@discussions.microsoft.com> wrote in message
> news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
> >
> >
> > "DavidB" wrote:
> >
> > Please if you wish to "SNIP" snip all or leave all as we are"" NOT"" here for
> > links?.
> > That been said, I hope you performed a scan on your machine and made sure
> > all okay.
> > There is another option but we will come to it if these steps didn't help
> > or
> > not completely eliminate the Issue.
> >
> > My reply is under each error message:
> >
> > From application :
> >
> > Event Type: Error
> > Event Source: Application Error
> > Event Category: (100)
> > Event ID: 1000
> > Date: 13/12/2007
> > Time: 16:43:24
> > User: N/A
> > Computer: PHANTOM
> > Description:
> > Faulting application , version 0.0.0.0, faulting module unknown, version
> > 0.0.0.0, fault address 0x00000000.
> >
> > This can indicate a memory is Bad so check your RAM sticks by downloading
> > this tool to check it with:
> > You may have a bad RAM try to test your RAM by running Memtest by
> > downloading this tool and unzip it and make a floppy or CD/DVD and run it
> > on
> > Reboot.
> > http://www.memtest86.com/
> > You may need to reposition/reset the RAM sticks in their slots.
> >
> >
> > From security:
> >
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Policy Change
> > Event ID: 615
> > Date: 13/12/2007
> > Time: 16:45:41
> > User: NT AUTHORITY\NETWORK SERVICE
> > Computer: PHANTOM
> > Description:
> > IPSec Services: IPSec Services failed to get the complete list of network
> > interfaces on the machine. This can be a potential security hazard to the
> > machine since some of the network interfaces may not get the protection as
> > desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> > further diagnose the problem.
> >
> > Make sure this service "IPSec Service" is started Automatically or
> > manullay
> > in Services control panel.
> > When this error occur?.
> >
> > <MS::>
> > Event Message:
> >
> > IPSec policy agent changed: parameter PolicySource: parameter parameter
> > Source Event Log Event ID Event Type
> > Security Security 615 Success Audit
> > Explanation:
> >
> > This event record indicates that a local group account has been created.
> > </MS::>
> > Troubleshooting VPN over IPsec
> > http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
> > Step-by-Step Guide to Internet Protocol Security (IPSec)
> > http://technet.microsoft.com/en-us/library/bb742429.aspx
> >
> > IPsec Policy Agent Service Runtime
> > http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
> >
> >
> >
> > From System:
> >
> > Event Type: Error
> > Event Source: Dhcp
> > Event Category: None
> > Event ID: 1002
> > Date: 13/12/2007
> > Time: 16:46:15
> > User: N/A
> > Computer: PHANTOM
> > Description:
> > The IP address lease 192.168.1.2 for the Network Card with network address
> > 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
> > Server
> > sent a DHCPNACK message).
> >
> > Log into the Router or the server that assign the IP and click on the DHCP
> > there and see the MAC address for the machine having trouble.
> > You will find a log of bad IP addresses obtained by this machine, please
> > delete this log and make sure the machine is get the IP address Auto.
> > On the machine having trouble obtaining IP address Open a run command and
> > type in:
> > ipconfig /flushdns click [OK]
> > ipconfig /renew click [OK]
> > netsh winsock reset click [OK]
> > Reboot the machine and see if the error will be lgged after a while.
> >
> >
> > DHCP Across IP Routers
> > http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
> >
> > HTH.
> > nass
> > ----
> > http://www.nasstec.co.uk


"DavidB" wrote:

> The machine is not networked other than through a router to the Internet.
> As I've stated previously, rebooting the machine without running a further
> chkdsk while the errors are occuring resolves the problem.
>
> I installed Avast AV and did a boot time scan - no problem reported so I
> scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
> scan was aborted when it tried to run. On a subsequent reboot the scan ran
> but of course i had not run chkdsk so the problem had disappeared again.
>
> One thing that also happens each time the fault occurs is a message as
> Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
> told you that before.
>
> I cannot access services.msc while the computer is faulting - therefore I
> don't know if the IPsec service is running or not. It is running
> automatically when the fault is not apparent
>
> Memory checks out OK.
>
> I am becoming more concerned that the problem may be in the BIOS of the
> machine - is this possible?
>
> DavidB

Did you update the Motherboard Drivers since you install XP on this machine?.
Go to the Motherboard manufacturer website and download the latest drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.
HTH.
nass
-----
http://www.nasstec.co.uk
 
"nass" wrote:

>
>
>
> > "nass" <nass@discussions.microsoft.com> wrote in message
> > news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
> > >
> > >
> > > "DavidB" wrote:
> > >
> > > Please if you wish to "SNIP" snip all or leave all as we are"" NOT"" here for
> > > links?.
> > > That been said, I hope you performed a scan on your machine and made sure
> > > all okay.
> > > There is another option but we will come to it if these steps didn't help
> > > or
> > > not completely eliminate the Issue.
> > >
> > > My reply is under each error message:
> > >
> > > From application :
> > >
> > > Event Type: Error
> > > Event Source: Application Error
> > > Event Category: (100)
> > > Event ID: 1000
> > > Date: 13/12/2007
> > > Time: 16:43:24
> > > User: N/A
> > > Computer: PHANTOM
> > > Description:
> > > Faulting application , version 0.0.0.0, faulting module unknown, version
> > > 0.0.0.0, fault address 0x00000000.
> > >
> > > This can indicate a memory is Bad so check your RAM sticks by downloading
> > > this tool to check it with:
> > > You may have a bad RAM try to test your RAM by running Memtest by
> > > downloading this tool and unzip it and make a floppy or CD/DVD and run it
> > > on
> > > Reboot.
> > > http://www.memtest86.com/
> > > You may need to reposition/reset the RAM sticks in their slots.
> > >
> > >
> > > From security:
> > >
> > > Event Type: Failure Audit
> > > Event Source: Security
> > > Event Category: Policy Change
> > > Event ID: 615
> > > Date: 13/12/2007
> > > Time: 16:45:41
> > > User: NT AUTHORITY\NETWORK SERVICE
> > > Computer: PHANTOM
> > > Description:
> > > IPSec Services: IPSec Services failed to get the complete list of network
> > > interfaces on the machine. This can be a potential security hazard to the
> > > machine since some of the network interfaces may not get the protection as
> > > desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> > > further diagnose the problem.
> > >
> > > Make sure this service "IPSec Service" is started Automatically or
> > > manullay
> > > in Services control panel.
> > > When this error occur?.
> > >
> > > <MS::>
> > > Event Message:
> > >
> > > IPSec policy agent changed: parameter PolicySource: parameter parameter
> > > Source Event Log Event ID Event Type
> > > Security Security 615 Success Audit
> > > Explanation:
> > >
> > > This event record indicates that a local group account has been created.
> > > </MS::>
> > > Troubleshooting VPN over IPsec
> > > http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
> > > Step-by-Step Guide to Internet Protocol Security (IPSec)
> > > http://technet.microsoft.com/en-us/library/bb742429.aspx
> > >
> > > IPsec Policy Agent Service Runtime
> > > http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
> > >
> > >
> > >
> > > From System:
> > >
> > > Event Type: Error
> > > Event Source: Dhcp
> > > Event Category: None
> > > Event ID: 1002
> > > Date: 13/12/2007
> > > Time: 16:46:15
> > > User: N/A
> > > Computer: PHANTOM
> > > Description:
> > > The IP address lease 192.168.1.2 for the Network Card with network address
> > > 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
> > > Server
> > > sent a DHCPNACK message).
> > >
> > > Log into the Router or the server that assign the IP and click on the DHCP
> > > there and see the MAC address for the machine having trouble.
> > > You will find a log of bad IP addresses obtained by this machine, please
> > > delete this log and make sure the machine is get the IP address Auto.
> > > On the machine having trouble obtaining IP address Open a run command and
> > > type in:
> > > ipconfig /flushdns click [OK]
> > > ipconfig /renew click [OK]
> > > netsh winsock reset click [OK]
> > > Reboot the machine and see if the error will be lgged after a while.
> > >
> > >
> > > DHCP Across IP Routers
> > > http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
> > >
> > > HTH.
> > > nass
> > > ----
> > > http://www.nasstec.co.uk
>
>
> "DavidB" wrote:
>
> > The machine is not networked other than through a router to the Internet.
> > As I've stated previously, rebooting the machine without running a further
> > chkdsk while the errors are occuring resolves the problem.
> >
> > I installed Avast AV and did a boot time scan - no problem reported so I
> > scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
> > scan was aborted when it tried to run. On a subsequent reboot the scan ran
> > but of course i had not run chkdsk so the problem had disappeared again.
> >
> > One thing that also happens each time the fault occurs is a message as
> > Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
> > told you that before.
> >
> > I cannot access services.msc while the computer is faulting - therefore I
> > don't know if the IPsec service is running or not. It is running
> > automatically when the fault is not apparent
> >
> > Memory checks out OK.
> >
> > I am becoming more concerned that the problem may be in the BIOS of the
> > machine - is this possible?
> >
> > DavidB
>
> Did you update the Motherboard Drivers since you install XP on this machine?.
> Go to the Motherboard manufacturer website and download the latest drive4s
> for your Mobo and install them.
> What make is your Motherboard and version?.
> Try to access the services in Safe Mode, Does it work?.
> Also make sure your account having Admin privileges or permissions.

Adding to the above, to access the services.smc do the following:
For Repairing Services.msc try this:
Open a Run command and type in:
net service start click [Ok]
net services start click [OK]
regsvr32 filemgmt.dll click [OK]
Reboot you machine are you able to access services.msc?.

Do you have this file here:
c:\windows\system32\services.msc

If the above didn't help try to Restore to an earlier point, but please
backup your data before attempting to do so.
If still no luck then a Repair/Install of XP is a must:
http://www.michaelstevenstech.com/XPrepairinstall.htm
HTH.
nass
====
http://www.nasstec.co.uk
 
"nass" <nass@discussions.microsoft.com> wrote in message
news:C5BB9472-399C-414E-80A4-9759A40C7292@microsoft.com...
>
>
> "nass" wrote:
>
>>
>>
>>
>> > "nass" <nass@discussions.microsoft.com> wrote in message
>> > news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
>> > >
>> > >
>> > > "DavidB" wrote:
>> > >
>> > > Please if you wish to "SNIP" snip all or leave all as we are"" NOT""
>> > > here for
>> > > links?.
>> > > That been said, I hope you performed a scan on your machine and made
>> > > sure
>> > > all okay.
>> > > There is another option but we will come to it if these steps didn't
>> > > help
>> > > or
>> > > not completely eliminate the Issue.
>> > >
>> > > My reply is under each error message:
>> > >
>> > > From application :
>> > >
>> > > Event Type: Error
>> > > Event Source: Application Error
>> > > Event Category: (100)
>> > > Event ID: 1000
>> > > Date: 13/12/2007
>> > > Time: 16:43:24
>> > > User: N/A
>> > > Computer: PHANTOM
>> > > Description:
>> > > Faulting application , version 0.0.0.0, faulting module unknown,
>> > > version
>> > > 0.0.0.0, fault address 0x00000000.
>> > >
>> > > This can indicate a memory is Bad so check your RAM sticks by
>> > > downloading
>> > > this tool to check it with:
>> > > You may have a bad RAM try to test your RAM by running Memtest by
>> > > downloading this tool and unzip it and make a floppy or CD/DVD and
>> > > run it
>> > > on
>> > > Reboot.
>> > > http://www.memtest86.com/
>> > > You may need to reposition/reset the RAM sticks in their slots.
>> > >
>> > >
>> > > From security:
>> > >
>> > > Event Type: Failure Audit
>> > > Event Source: Security
>> > > Event Category: Policy Change
>> > > Event ID: 615
>> > > Date: 13/12/2007
>> > > Time: 16:45:41
>> > > User: NT AUTHORITY\NETWORK SERVICE
>> > > Computer: PHANTOM
>> > > Description:
>> > > IPSec Services: IPSec Services failed to get the complete list of
>> > > network
>> > > interfaces on the machine. This can be a potential security hazard to
>> > > the
>> > > machine since some of the network interfaces may not get the
>> > > protection as
>> > > desired by the applied IPSec filters. Please run IPSec monitor
>> > > snap-in to
>> > > further diagnose the problem.
>> > >
>> > > Make sure this service "IPSec Service" is started Automatically or
>> > > manullay
>> > > in Services control panel.
>> > > When this error occur?.
>> > >
>> > > <MS::>
>> > > Event Message:
>> > >
>> > > IPSec policy agent changed: parameter PolicySource: parameter
>> > > parameter
>> > > Source Event Log Event ID Event Type
>> > > Security Security 615 Success Audit
>> > > Explanation:
>> > >
>> > > This event record indicates that a local group account has been
>> > > created.
>> > > </MS::>
>> > > Troubleshooting VPN over IPsec
>> > > http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
>> > > Step-by-Step Guide to Internet Protocol Security (IPSec)
>> > > http://technet.microsoft.com/en-us/library/bb742429.aspx
>> > >
>> > > IPsec Policy Agent Service Runtime
>> > > http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
>> > >
>> > >
>> > >
>> > > From System:
>> > >
>> > > Event Type: Error
>> > > Event Source: Dhcp
>> > > Event Category: None
>> > > Event ID: 1002
>> > > Date: 13/12/2007
>> > > Time: 16:46:15
>> > > User: N/A
>> > > Computer: PHANTOM
>> > > Description:
>> > > The IP address lease 192.168.1.2 for the Network Card with network
>> > > address
>> > > 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
>> > > Server
>> > > sent a DHCPNACK message).
>> > >
>> > > Log into the Router or the server that assign the IP and click on the
>> > > DHCP
>> > > there and see the MAC address for the machine having trouble.
>> > > You will find a log of bad IP addresses obtained by this machine,
>> > > please
>> > > delete this log and make sure the machine is get the IP address Auto.
>> > > On the machine having trouble obtaining IP address Open a run command
>> > > and
>> > > type in:
>> > > ipconfig /flushdns click [OK]
>> > > ipconfig /renew click [OK]
>> > > netsh winsock reset click [OK]
>> > > Reboot the machine and see if the error will be lgged after a while.
>> > >
>> > >
>> > > DHCP Across IP Routers
>> > > http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
>> > >
>> > > HTH.
>> > > nass
>> > > ----
>> > > http://www.nasstec.co.uk
>>
>>
>> "DavidB" wrote:
>>
>> > The machine is not networked other than through a router to the
>> > Internet.
>> > As I've stated previously, rebooting the machine without running a
>> > further
>> > chkdsk while the errors are occuring resolves the problem.
>> >
>> > I installed Avast AV and did a boot time scan - no problem reported so
>> > I
>> > scheduled a chkdsk and a boot time scan together - chkdsk ran and the
>> > boot
>> > scan was aborted when it tried to run. On a subsequent reboot the scan
>> > ran
>> > but of course i had not run chkdsk so the problem had disappeared
>> > again.
>> >
>> > One thing that also happens each time the fault occurs is a message as
>> > Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should
>> > have
>> > told you that before.
>> >
>> > I cannot access services.msc while the computer is faulting - therefore
>> > I
>> > don't know if the IPsec service is running or not. It is running
>> > automatically when the fault is not apparent
>> >
>> > Memory checks out OK.
>> >
>> > I am becoming more concerned that the problem may be in the BIOS of the
>> > machine - is this possible?
>> >
>> > DavidB
>>
>> Did you update the Motherboard Drivers since you install XP on this
>> machine?.
>> Go to the Motherboard manufacturer website and download the latest
>> drive4s
>> for your Mobo and install them.
>> What make is your Motherboard and version?.
>> Try to access the services in Safe Mode, Does it work?.
>> Also make sure your account having Admin privileges or permissions.
>
> Adding to the above, to access the services.smc do the following:
> For Repairing Services.msc try this:
> Open a Run command and type in:
> net service start click [Ok]
> net services start click [OK]
> regsvr32 filemgmt.dll click [OK]
> Reboot you machine are you able to access services.msc?.
>
> Do you have this file here:
> c:\windows\system32\services.msc
>
> If the above didn't help try to Restore to an earlier point, but please
> backup your data before attempting to do so.
> If still no luck then a Repair/Install of XP is a must:
> http://www.michaelstevenstech.com/XPrepairinstall.htm
> HTH.
> nass
> ====
> http://www.nasstec.co.uk
>

Services.msc does run ok when the machine is not faulting i.e. when i have
not just run a chkdsk. It is not available for me to see and find out when
the machine is faulting.

I have already reistalled XP (retail disc) to a brand new disc and the fault
was still apparent after running chkdsk before installing any further
programs.

The drivers for the chipset are up to date.

The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update ulitity
cannot be installed (part of the same fault I presume) and therefore I
cannot easily flash the BIOS.

DavidB
 
"DavidB" wrote:

>
> "nass" <nass@discussions.microsoft.com> wrote in message
> news:C5BB9472-399C-414E-80A4-9759A40C7292@microsoft.com...
> >
> >
> > "nass" wrote:
> >
> >>
> >>
> >>
> >> > "nass" <nass@discussions.microsoft.com> wrote in message
> >> > news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
> >> > >
> >> > >
> >> > > "DavidB" wrote:
> >> > >
> >> > > Please if you wish to "SNIP" snip all or leave all as we are"" NOT""
> >> > > here for
> >> > > links?.
> >> > > That been said, I hope you performed a scan on your machine and made
> >> > > sure
> >> > > all okay.
> >> > > There is another option but we will come to it if these steps didn't
> >> > > help
> >> > > or
> >> > > not completely eliminate the Issue.
> >> > >
> >> > > My reply is under each error message:
> >> > >
> >> > > From application :
> >> > >
> >> > > Event Type: Error
> >> > > Event Source: Application Error
> >> > > Event Category: (100)
> >> > > Event ID: 1000
> >> > > Date: 13/12/2007
> >> > > Time: 16:43:24
> >> > > User: N/A
> >> > > Computer: PHANTOM
> >> > > Description:
> >> > > Faulting application , version 0.0.0.0, faulting module unknown,
> >> > > version
> >> > > 0.0.0.0, fault address 0x00000000.
> >> > >
> >> > > This can indicate a memory is Bad so check your RAM sticks by
> >> > > downloading
> >> > > this tool to check it with:
> >> > > You may have a bad RAM try to test your RAM by running Memtest by
> >> > > downloading this tool and unzip it and make a floppy or CD/DVD and
> >> > > run it
> >> > > on
> >> > > Reboot.
> >> > > http://www.memtest86.com/
> >> > > You may need to reposition/reset the RAM sticks in their slots.
> >> > >
> >> > >
> >> > > From security:
> >> > >
> >> > > Event Type: Failure Audit
> >> > > Event Source: Security
> >> > > Event Category: Policy Change
> >> > > Event ID: 615
> >> > > Date: 13/12/2007
> >> > > Time: 16:45:41
> >> > > User: NT AUTHORITY\NETWORK SERVICE
> >> > > Computer: PHANTOM
> >> > > Description:
> >> > > IPSec Services: IPSec Services failed to get the complete list of
> >> > > network
> >> > > interfaces on the machine. This can be a potential security hazard to
> >> > > the
> >> > > machine since some of the network interfaces may not get the
> >> > > protection as
> >> > > desired by the applied IPSec filters. Please run IPSec monitor
> >> > > snap-in to
> >> > > further diagnose the problem.
> >> > >
> >> > > Make sure this service "IPSec Service" is started Automatically or
> >> > > manullay
> >> > > in Services control panel.
> >> > > When this error occur?.
> >> > >
> >> > > <MS::>
> >> > > Event Message:
> >> > >
> >> > > IPSec policy agent changed: parameter PolicySource: parameter
> >> > > parameter
> >> > > Source Event Log Event ID Event Type
> >> > > Security Security 615 Success Audit
> >> > > Explanation:
> >> > >
> >> > > This event record indicates that a local group account has been
> >> > > created.
> >> > > </MS::>
> >> > > Troubleshooting VPN over IPsec
> >> > > http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
> >> > > Step-by-Step Guide to Internet Protocol Security (IPSec)
> >> > > http://technet.microsoft.com/en-us/library/bb742429.aspx
> >> > >
> >> > > IPsec Policy Agent Service Runtime
> >> > > http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
> >> > >
> >> > >
> >> > >
> >> > > From System:
> >> > >
> >> > > Event Type: Error
> >> > > Event Source: Dhcp
> >> > > Event Category: None
> >> > > Event ID: 1002
> >> > > Date: 13/12/2007
> >> > > Time: 16:46:15
> >> > > User: N/A
> >> > > Computer: PHANTOM
> >> > > Description:
> >> > > The IP address lease 192.168.1.2 for the Network Card with network
> >> > > address
> >> > > 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
> >> > > Server
> >> > > sent a DHCPNACK message).
> >> > >
> >> > > Log into the Router or the server that assign the IP and click on the
> >> > > DHCP
> >> > > there and see the MAC address for the machine having trouble.
> >> > > You will find a log of bad IP addresses obtained by this machine,
> >> > > please
> >> > > delete this log and make sure the machine is get the IP address Auto.
> >> > > On the machine having trouble obtaining IP address Open a run command
> >> > > and
> >> > > type in:
> >> > > ipconfig /flushdns click [OK]
> >> > > ipconfig /renew click [OK]
> >> > > netsh winsock reset click [OK]
> >> > > Reboot the machine and see if the error will be lgged after a while.
> >> > >
> >> > >
> >> > > DHCP Across IP Routers
> >> > > http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
> >> > >
> >> > > HTH.
> >> > > nass
> >> > > ----
> >> > > http://www.nasstec.co.uk
> >>
> >>
> >> "DavidB" wrote:
> >>
> >> > The machine is not networked other than through a router to the
> >> > Internet.
> >> > As I've stated previously, rebooting the machine without running a
> >> > further
> >> > chkdsk while the errors are occuring resolves the problem.
> >> >
> >> > I installed Avast AV and did a boot time scan - no problem reported so
> >> > I
> >> > scheduled a chkdsk and a boot time scan together - chkdsk ran and the
> >> > boot
> >> > scan was aborted when it tried to run. On a subsequent reboot the scan
> >> > ran
> >> > but of course i had not run chkdsk so the problem had disappeared
> >> > again.
> >> >
> >> > One thing that also happens each time the fault occurs is a message as
> >> > Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should
> >> > have
> >> > told you that before.
> >> >
> >> > I cannot access services.msc while the computer is faulting - therefore
> >> > I
> >> > don't know if the IPsec service is running or not. It is running
> >> > automatically when the fault is not apparent
> >> >
> >> > Memory checks out OK.
> >> >
> >> > I am becoming more concerned that the problem may be in the BIOS of the
> >> > machine - is this possible?
> >> >
> >> > DavidB
> >>
> >> Did you update the Motherboard Drivers since you install XP on this
> >> machine?.
> >> Go to the Motherboard manufacturer website and download the latest
> >> drive4s
> >> for your Mobo and install them.
> >> What make is your Motherboard and version?.
> >> Try to access the services in Safe Mode, Does it work?.
> >> Also make sure your account having Admin privileges or permissions.
> >
> > Adding to the above, to access the services.smc do the following:
> > For Repairing Services.msc try this:
> > Open a Run command and type in:
> > net service start click [Ok]
> > net services start click [OK]
> > regsvr32 filemgmt.dll click [OK]
> > Reboot you machine are you able to access services.msc?.
> >
> > Do you have this file here:
> > c:\windows\system32\services.msc
> >
> > If the above didn't help try to Restore to an earlier point, but please
> > backup your data before attempting to do so.
> > If still no luck then a Repair/Install of XP is a must:
> > http://www.michaelstevenstech.com/XPrepairinstall.htm
> > HTH.
> > nass
> > ====
> > http://www.nasstec.co.uk
> >
>
> Services.msc does run ok when the machine is not faulting i.e. when i have
> not just run a chkdsk. It is not available for me to see and find out when
> the machine is faulting.
>
> I have already reistalled XP (retail disc) to a brand new disc and the fault
> was still apparent after running chkdsk before installing any further
> programs.
>
> The drivers for the chipset are up to date.
>
> The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update ulitity
> cannot be installed (part of the same fault I presume) and therefore I
> cannot easily flash the BIOS.
>
> DavidB

Hi David,
If the link provided below didn't help I will doubt the Motherboard having
issue, sine you said this a new install!.
Asus M2R32-MVP
Model: M2R32-MVP: Please select the correct Model/Socket for your Mobo:
http://support.asus.com/download/download.aspx?SLanguage=en-us
I read something about turning the "AsusProbe" can help, you can do it from
the BIOS settings.
HTH.
nass
----
http://www.nasstec.co.uk
 
"nass" <nass@discussions.microsoft.com> wrote in message
news:2BA3D32D-48CA-4C38-8BE5-256917DE4503@microsoft.com...
>
>
> "DavidB" wrote:
>
>>
>> "nass" <nass@discussions.microsoft.com> wrote in message
>> news:C5BB9472-399C-414E-80A4-9759A40C7292@microsoft.com...
>> >
>> >
>> > "nass" wrote:
>> >
>> >>
>> >>
>> >>
>> >> > "nass" <nass@discussions.microsoft.com> wrote in message
>> >> > news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
>> >> > >
>> >> > >
>> >> > > "DavidB" wrote:
>> >> > >
>> >> > > Please if you wish to "SNIP" snip all or leave all as we are""
>> >> > > NOT""
>> >> > > here for
>> >> > > links?.
>> >> > > That been said, I hope you performed a scan on your machine and
>> >> > > made
>> >> > > sure
>> >> > > all okay.
>> >> > > There is another option but we will come to it if these steps
>> >> > > didn't
>> >> > > help
>> >> > > or
>> >> > > not completely eliminate the Issue.
>> >> > >
>> >> > > My reply is under each error message:
>> >> > >
>> >> > > From application :
>> >> > >
>> >> > > Event Type: Error
>> >> > > Event Source: Application Error
>> >> > > Event Category: (100)
>> >> > > Event ID: 1000
>> >> > > Date: 13/12/2007
>> >> > > Time: 16:43:24
>> >> > > User: N/A
>> >> > > Computer: PHANTOM
>> >> > > Description:
>> >> > > Faulting application , version 0.0.0.0, faulting module unknown,
>> >> > > version
>> >> > > 0.0.0.0, fault address 0x00000000.
>> >> > >
>> >> > > This can indicate a memory is Bad so check your RAM sticks by
>> >> > > downloading
>> >> > > this tool to check it with:
>> >> > > You may have a bad RAM try to test your RAM by running Memtest by
>> >> > > downloading this tool and unzip it and make a floppy or CD/DVD and
>> >> > > run it
>> >> > > on
>> >> > > Reboot.
>> >> > > http://www.memtest86.com/
>> >> > > You may need to reposition/reset the RAM sticks in their slots.
>> >> > >
>> >> > >
>> >> > > From security:
>> >> > >
>> >> > > Event Type: Failure Audit
>> >> > > Event Source: Security
>> >> > > Event Category: Policy Change
>> >> > > Event ID: 615
>> >> > > Date: 13/12/2007
>> >> > > Time: 16:45:41
>> >> > > User: NT AUTHORITY\NETWORK SERVICE
>> >> > > Computer: PHANTOM
>> >> > > Description:
>> >> > > IPSec Services: IPSec Services failed to get the complete list of
>> >> > > network
>> >> > > interfaces on the machine. This can be a potential security hazard
>> >> > > to
>> >> > > the
>> >> > > machine since some of the network interfaces may not get the
>> >> > > protection as
>> >> > > desired by the applied IPSec filters. Please run IPSec monitor
>> >> > > snap-in to
>> >> > > further diagnose the problem.
>> >> > >
>> >> > > Make sure this service "IPSec Service" is started Automatically or
>> >> > > manullay
>> >> > > in Services control panel.
>> >> > > When this error occur?.
>> >> > >
>> >> > > <MS::>
>> >> > > Event Message:
>> >> > >
>> >> > > IPSec policy agent changed: parameter PolicySource: parameter
>> >> > > parameter
>> >> > > Source Event Log Event ID Event Type
>> >> > > Security Security 615 Success Audit
>> >> > > Explanation:
>> >> > >
>> >> > > This event record indicates that a local group account has been
>> >> > > created.
>> >> > > </MS::>
>> >> > > Troubleshooting VPN over IPsec
>> >> > > http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
>> >> > > Step-by-Step Guide to Internet Protocol Security (IPSec)
>> >> > > http://technet.microsoft.com/en-us/library/bb742429.aspx
>> >> > >
>> >> > > IPsec Policy Agent Service Runtime
>> >> > > http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
>> >> > >
>> >> > >
>> >> > >
>> >> > > From System:
>> >> > >
>> >> > > Event Type: Error
>> >> > > Event Source: Dhcp
>> >> > > Event Category: None
>> >> > > Event ID: 1002
>> >> > > Date: 13/12/2007
>> >> > > Time: 16:46:15
>> >> > > User: N/A
>> >> > > Computer: PHANTOM
>> >> > > Description:
>> >> > > The IP address lease 192.168.1.2 for the Network Card with network
>> >> > > address
>> >> > > 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The
>> >> > > DHCP
>> >> > > Server
>> >> > > sent a DHCPNACK message).
>> >> > >
>> >> > > Log into the Router or the server that assign the IP and click on
>> >> > > the
>> >> > > DHCP
>> >> > > there and see the MAC address for the machine having trouble.
>> >> > > You will find a log of bad IP addresses obtained by this machine,
>> >> > > please
>> >> > > delete this log and make sure the machine is get the IP address
>> >> > > Auto.
>> >> > > On the machine having trouble obtaining IP address Open a run
>> >> > > command
>> >> > > and
>> >> > > type in:
>> >> > > ipconfig /flushdns click [OK]
>> >> > > ipconfig /renew click [OK]
>> >> > > netsh winsock reset click [OK]
>> >> > > Reboot the machine and see if the error will be lgged after a
>> >> > > while.
>> >> > >
>> >> > >
>> >> > > DHCP Across IP Routers
>> >> > > http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
>> >> > >
>> >> > > HTH.
>> >> > > nass
>> >> > > ----
>> >> > > http://www.nasstec.co.uk
>> >>
>> >>
>> >> "DavidB" wrote:
>> >>
>> >> > The machine is not networked other than through a router to the
>> >> > Internet.
>> >> > As I've stated previously, rebooting the machine without running a
>> >> > further
>> >> > chkdsk while the errors are occuring resolves the problem.
>> >> >
>> >> > I installed Avast AV and did a boot time scan - no problem reported
>> >> > so
>> >> > I
>> >> > scheduled a chkdsk and a boot time scan together - chkdsk ran and
>> >> > the
>> >> > boot
>> >> > scan was aborted when it tried to run. On a subsequent reboot the
>> >> > scan
>> >> > ran
>> >> > but of course i had not run chkdsk so the problem had disappeared
>> >> > again.
>> >> >
>> >> > One thing that also happens each time the fault occurs is a message
>> >> > as
>> >> > Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I
>> >> > should
>> >> > have
>> >> > told you that before.
>> >> >
>> >> > I cannot access services.msc while the computer is faulting -
>> >> > therefore
>> >> > I
>> >> > don't know if the IPsec service is running or not. It is running
>> >> > automatically when the fault is not apparent
>> >> >
>> >> > Memory checks out OK.
>> >> >
>> >> > I am becoming more concerned that the problem may be in the BIOS of
>> >> > the
>> >> > machine - is this possible?
>> >> >
>> >> > DavidB
>> >>
>> >> Did you update the Motherboard Drivers since you install XP on this
>> >> machine?.
>> >> Go to the Motherboard manufacturer website and download the latest
>> >> drive4s
>> >> for your Mobo and install them.
>> >> What make is your Motherboard and version?.
>> >> Try to access the services in Safe Mode, Does it work?.
>> >> Also make sure your account having Admin privileges or permissions.
>> >
>> > Adding to the above, to access the services.smc do the following:
>> > For Repairing Services.msc try this:
>> > Open a Run command and type in:
>> > net service start click [Ok]
>> > net services start click [OK]
>> > regsvr32 filemgmt.dll click [OK]
>> > Reboot you machine are you able to access services.msc?.
>> >
>> > Do you have this file here:
>> > c:\windows\system32\services.msc
>> >
>> > If the above didn't help try to Restore to an earlier point, but please
>> > backup your data before attempting to do so.
>> > If still no luck then a Repair/Install of XP is a must:
>> > http://www.michaelstevenstech.com/XPrepairinstall.htm
>> > HTH.
>> > nass
>> > ====
>> > http://www.nasstec.co.uk
>> >
>>
>> Services.msc does run ok when the machine is not faulting i.e. when i
>> have
>> not just run a chkdsk. It is not available for me to see and find out
>> when
>> the machine is faulting.
>>
>> I have already reistalled XP (retail disc) to a brand new disc and the
>> fault
>> was still apparent after running chkdsk before installing any further
>> programs.
>>
>> The drivers for the chipset are up to date.
>>
>> The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update
>> ulitity
>> cannot be installed (part of the same fault I presume) and therefore I
>> cannot easily flash the BIOS.
>>
>> DavidB
>
> Hi David,
> If the link provided below didn't help I will doubt the Motherboard having
> issue, sine you said this a new install!.
> Asus M2R32-MVP
> Model: M2R32-MVP: Please select the correct Model/Socket for your Mobo:
> http://support.asus.com/download/download.aspx?SLanguage=en-us
> I read something about turning the "AsusProbe" can help, you can do it
> from
> the BIOS settings.
> HTH.
> nass
> ----
> http://www.nasstec.co.uk
>
OK Nass

Thanks very much for your time and your help. If ever I find a fix (before
I change the MB which I expect I will have to do anyway) I will post and let
you know.

Asus Probe simply monitors voltages, fan speeds and temperatures.

Thanks again

DavidB
 
"DavidB" wrote:

>
> "nass" <nass@discussions.microsoft.com> wrote in message
> news:2BA3D32D-48CA-4C38-8BE5-256917DE4503@microsoft.com...
> >
> >
> > "DavidB" wrote:
> >
> >>
> >> "nass" <nass@discussions.microsoft.com> wrote in message
> >> news:C5BB9472-399C-414E-80A4-9759A40C7292@microsoft.com...
> >> >
> >> >
> >> > "nass" wrote:
> >> >
> >> >>
> >> >>
> >> >>
> >> >> > "nass" <nass@discussions.microsoft.com> wrote in message
> >> >> > news:1F02A66C-2AD6-4D12-AAD4-8B851F03F217@microsoft.com...
> >> >> > >
> >> >> > >
> >> >> > > "DavidB" wrote:
> >> >> > >
> >> >> > > Please if you wish to "SNIP" snip all or leave all as we are""
> >> >> > > NOT""
> >> >> > > here for
> >> >> > > links?.
> >> >> > > That been said, I hope you performed a scan on your machine and
> >> >> > > made
> >> >> > > sure
> >> >> > > all okay.
> >> >> > > There is another option but we will come to it if these steps
> >> >> > > didn't
> >> >> > > help
> >> >> > > or
> >> >> > > not completely eliminate the Issue.
> >> >> > >
> >> >> > > My reply is under each error message:
> >> >> > >
> >> >> > > From application :
> >> >> > >
> >> >> > > Event Type: Error
> >> >> > > Event Source: Application Error
> >> >> > > Event Category: (100)
> >> >> > > Event ID: 1000
> >> >> > > Date: 13/12/2007
> >> >> > > Time: 16:43:24
> >> >> > > User: N/A
> >> >> > > Computer: PHANTOM
> >> >> > > Description:
> >> >> > > Faulting application , version 0.0.0.0, faulting module unknown,
> >> >> > > version
> >> >> > > 0.0.0.0, fault address 0x00000000.
> >> >> > >
> >> >> > > This can indicate a memory is Bad so check your RAM sticks by
> >> >> > > downloading
> >> >> > > this tool to check it with:
> >> >> > > You may have a bad RAM try to test your RAM by running Memtest by
> >> >> > > downloading this tool and unzip it and make a floppy or CD/DVD and
> >> >> > > run it
> >> >> > > on
> >> >> > > Reboot.
> >> >> > > http://www.memtest86.com/
> >> >> > > You may need to reposition/reset the RAM sticks in their slots.
> >> >> > >
> >> >> > >
> >> >> > > From security:
> >> >> > >
> >> >> > > Event Type: Failure Audit
> >> >> > > Event Source: Security
> >> >> > > Event Category: Policy Change
> >> >> > > Event ID: 615
> >> >> > > Date: 13/12/2007
> >> >> > > Time: 16:45:41
> >> >> > > User: NT AUTHORITY\NETWORK SERVICE
> >> >> > > Computer: PHANTOM
> >> >> > > Description:
> >> >> > > IPSec Services: IPSec Services failed to get the complete list of
> >> >> > > network
> >> >> > > interfaces on the machine. This can be a potential security hazard
> >> >> > > to
> >> >> > > the
> >> >> > > machine since some of the network interfaces may not get the
> >> >> > > protection as
> >> >> > > desired by the applied IPSec filters. Please run IPSec monitor
> >> >> > > snap-in to
> >> >> > > further diagnose the problem.
> >> >> > >
> >> >> > > Make sure this service "IPSec Service" is started Automatically or
> >> >> > > manullay
> >> >> > > in Services control panel.
> >> >> > > When this error occur?.
> >> >> > >
> >> >> > > <MS::>
> >> >> > > Event Message:
> >> >> > >
> >> >> > > IPSec policy agent changed: parameter PolicySource: parameter
> >> >> > > parameter
> >> >> > > Source Event Log Event ID Event Type
> >> >> > > Security Security 615 Success Audit
> >> >> > > Explanation:
> >> >> > >
> >> >> > > This event record indicates that a local group account has been
> >> >> > > created.
> >> >> > > </MS::>
> >> >> > > Troubleshooting VPN over IPsec
> >> >> > > http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
> >> >> > > Step-by-Step Guide to Internet Protocol Security (IPSec)
> >> >> > > http://technet.microsoft.com/en-us/library/bb742429.aspx
> >> >> > >
> >> >> > > IPsec Policy Agent Service Runtime
> >> >> > > http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true
> >> >> > >
> >> >> > >
> >> >> > >
> >> >> > > From System:
> >> >> > >
> >> >> > > Event Type: Error
> >> >> > > Event Source: Dhcp
> >> >> > > Event Category: None
> >> >> > > Event ID: 1002
> >> >> > > Date: 13/12/2007
> >> >> > > Time: 16:46:15
> >> >> > > User: N/A
> >> >> > > Computer: PHANTOM
> >> >> > > Description:
> >> >> > > The IP address lease 192.168.1.2 for the Network Card with network
> >> >> > > address
> >> >> > > 0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The
> >> >> > > DHCP
> >> >> > > Server
> >> >> > > sent a DHCPNACK message).
> >> >> > >
> >> >> > > Log into the Router or the server that assign the IP and click on
> >> >> > > the
> >> >> > > DHCP
> >> >> > > there and see the MAC address for the machine having trouble.
> >> >> > > You will find a log of bad IP addresses obtained by this machine,
> >> >> > > please
> >> >> > > delete this log and make sure the machine is get the IP address
> >> >> > > Auto.
> >> >> > > On the machine having trouble obtaining IP address Open a run
> >> >> > > command
> >> >> > > and
> >> >> > > type in:
> >> >> > > ipconfig /flushdns click [OK]
> >> >> > > ipconfig /renew click [OK]
> >> >> > > netsh winsock reset click [OK]
> >> >> > > Reboot the machine and see if the error will be lgged after a
> >> >> > > while.
> >> >> > >
> >> >> > >
> >> >> > > DHCP Across IP Routers
> >> >> > > http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true
> >> >> > >
> >> >> > > HTH.
> >> >> > > nass
> >> >> > > ----
> >> >> > > http://www.nasstec.co.uk
> >> >>
> >> >>
> >> >> "DavidB" wrote:
> >> >>
> >> >> > The machine is not networked other than through a router to the
> >> >> > Internet.
> >> >> > As I've stated previously, rebooting the machine without running a
> >> >> > further
> >> >> > chkdsk while the errors are occuring resolves the problem.
> >> >> >
> >> >> > I installed Avast AV and did a boot time scan - no problem reported
> >> >> > so
> >> >> > I
> >> >> > scheduled a chkdsk and a boot time scan together - chkdsk ran and
> >> >> > the
> >> >> > boot
> >> >> > scan was aborted when it tried to run. On a subsequent reboot the
> >> >> > scan
> >> >> > ran
> >> >> > but of course i had not run chkdsk so the problem had disappeared
> >> >> > again.
> >> >> >
> >> >> > One thing that also happens each time the fault occurs is a message
> >> >> > as
> >> >> > Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I
> >> >> > should
> >> >> > have
> >> >> > told you that before.
> >> >> >
> >> >> > I cannot access services.msc while the computer is faulting -
> >> >> > therefore
> >> >> > I
> >> >> > don't know if the IPsec service is running or not. It is running
> >> >> > automatically when the fault is not apparent
> >> >> >
> >> >> > Memory checks out OK.
> >> >> >
> >> >> > I am becoming more concerned that the problem may be in the BIOS of
> >> >> > the
> >> >> > machine - is this possible?
> >> >> >
> >> >> > DavidB
> >> >>
> >> >> Did you update the Motherboard Drivers since you install XP on this
> >> >> machine?.
> >> >> Go to the Motherboard manufacturer website and download the latest
> >> >> drive4s
> >> >> for your Mobo and install them.
> >> >> What make is your Motherboard and version?.
> >> >> Try to access the services in Safe Mode, Does it work?.
> >> >> Also make sure your account having Admin privileges or permissions.
> >> >
> >> > Adding to the above, to access the services.smc do the following:
> >> > For Repairing Services.msc try this:
> >> > Open a Run command and type in:
> >> > net service start click [Ok]
> >> > net services start click [OK]
> >> > regsvr32 filemgmt.dll click [OK]
> >> > Reboot you machine are you able to access services.msc?.
> >> >
> >> > Do you have this file here:
> >> > c:\windows\system32\services.msc
> >> >
> >> > If the above didn't help try to Restore to an earlier point, but please
> >> > backup your data before attempting to do so.
> >> > If still no luck then a Repair/Install of XP is a must:
> >> > http://www.michaelstevenstech.com/XPrepairinstall.htm
> >> > HTH.
> >> > nass
> >> > ====
> >> > http://www.nasstec.co.uk
> >> >
> >>
> >> Services.msc does run ok when the machine is not faulting i.e. when i
> >> have
> >> not just run a chkdsk. It is not available for me to see and find out
> >> when
> >> the machine is faulting.
> >>
> >> I have already reistalled XP (retail disc) to a brand new disc and the
> >> fault
> >> was still apparent after running chkdsk before installing any further
> >> programs.
> >>
> >> The drivers for the chipset are up to date.
> >>
> >> The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update
> >> ulitity
> >> cannot be installed (part of the same fault I presume) and therefore I
> >> cannot easily flash the BIOS.
> >>
> >> DavidB
> >
> > Hi David,
> > If the link provided below didn't help I will doubt the Motherboard having
> > issue, sine you said this a new install!.
> > Asus M2R32-MVP
> > Model: M2R32-MVP: Please select the correct Model/Socket for your Mobo:
> > http://support.asus.com/download/download.aspx?SLanguage=en-us
> > I read something about turning the "AsusProbe" can help, you can do it
> > from
> > the BIOS settings.
> > HTH.
> > nass
> > ----
> > http://www.nasstec.co.uk
> >
> OK Nass
>
> Thanks very much for your time and your help. If ever I find a fix (before
> I change the MB which I expect I will have to do anyway) I will post and let
> you know.
>
> Asus Probe simply monitors voltages, fan speeds and temperatures.
>
> Thanks again
>
> DavidB

I wish I was of a help in this matter but I really wasn't, so hopefully you
will get a gripe on this issue ASAP and know the culprit (mobo or Hdd).
Good luck and Merry Xmas to you.
Regards,
nass
---
http://www.nasstec.co.uk
 

Similar threads

AWS
Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices
Replies
0
Views
239
AWS
AWS
AWS
A closer look at Qakbot’s latest building blocks (and how to knock them down)
Replies
1
Views
293
Tony D
Tony D
AWS
September 2023 - Microsoft 365 US Public Sector Roadmap Newsletter
Replies
0
Views
159
AWS
AWS
AWS
Tarrask malware uses scheduled tasks for defense evasion
Replies
0
Views
244
AWS
AWS
AWS
Hive ransomware gets upgrades in Rust
Replies
0
Views
229
AWS
AWS
Back
Top