PCTech Forums

I just recently started having a problem where my computer would restart after these errors in Event viewer. I have my anti virus software up to date and I had and removed Sasser as well as patched windows xp pro. This is what it says in event viewer(application tab):
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.
error 4609

and then six seconds later:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

same thing..I have been sitting at my computer and I think I've seen this happen. An error box comes up that acts like a programs crashed (happened while I was using mozilla) The error was something like "Win32 generic host fault". Then it gave me the RPC countdown of 60 seconds before it would shut down. Any ideas? I'm not seeing any virus warnings and the last time this happened was last night after I feel asleep. I woke up to a restarted computer. Any information would be greatly appreciated.
Thanks.

Oh and under system I have this error:
Access denied attempting to launch a DCOM Server using DefaultLaunchPermssion. The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable.
event id:10003

You have to run the Sasser removal tool after you install the MS Patch. I'd also turn off System Restore until it's fixed.
.
brad

Hi Brad,
Thanks for the reply. I had deleted all of the Sasser infections with my anti-virus, but I ran the microsoft removal tool anyway. It didn't find any more. Any other suggestions? This is very odd.

Sounds like you need to reinstall WinXp over itself. Here's how: . You'll have to get the Windows Critical Updates again.
But, first, try one last thing:
Download and install . Now Run it and post a copy of the Log File here.

brad

Hijack this log:
Logfile of HijackThis v1.97.7
Scan saved at 11:28:05 AM, on 5/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\Program Files\FSI\F-Prot\F-StopW.exe
C:\Trillian\trillian.exe
C:\WINDOWS\System32\dllhost.exe
C:\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0357955E-79E6-49A1-BF91-AB3B2758B553}: NameServer = 208.237.80.5 208.237.80.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{0357955E-79E6-49A1-BF91-AB3B2758B553}: NameServer = 208.237.80.5 208.237.80.6



What are the bottom two objects? Any ideas? 017 doesnt seem right. Is any of this wrong?
thanks again

What is the source for those event id errors?

Try closing all other open Windows and have HiJackThis Fix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{0357955E-79E6-49A1-BF91-AB3B2758B553}: NameServer = 208.237.80.5 208.237.80.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{0357955E-79E6-49A1-BF91-AB3B2758B553}: NameServer = 208.237.80.5 208.237.80.6

brad

Ok I removed the two entries with Hijackthis, but after doing so Mozilla wouldn't go to any webpages at all. Just gave me an error so I restored them. Why is there a specific IP there though? That seems odd.

Jocobo:
The source for the Event id 4609 error is: EventSystem
The source for the Event id 10003 error is: DCOM

Any more suggestions would be appreciated. Is it possible some application I am running (like mozilla) is causing the "Win32 generic host fault" to come up? Like I said I was at my computer only once or twice when it has restarted but that error came up then it did it.
Thanks for the replies.

For the DCOM Event:

As per Microsoft: "The Distributed component Object Model (DCOM) server that is failing to launch is Machine Debug Manager (0C0A3666-30C9-11D0-8F20-00805F2CD064). This occurs because Machine Debug Manager lacks sufficient DCOM permissions.".

See Knowledge base article Q290398

For the EventSystem event:

There are a few diffrent codes.
Error Code: 800706BF - See Knowledge base Q325409 for information related to this error code.

Error Code: 8007041F = The service database is locked.
Error Code: 800706BF = From a newsgroup post: "This error is associated with a misbehaving DCOM call"

Try these Knowledge base articles:

Q325409 , Q823772 , Q823980

*Information thanks to eventID.Net

Jocobo

Not sure what that means Jocobo. Is a program screwing this up or is it Windows acting up?
Thanks for the help.