Re: Freaky Event ID Errors

From: Agnar Arason (agnararason_at_yahoo.com)
Date: 05/24/04 

Date: 24 May 2004 03:22:36 -0700

I had a similar problem. A Windows 2000 server was logging the exactly
same 10003 Events and also crashing a few times per day. It stopped
logging the 10003 Events when I uninstalled winword but kept crashing.
I tried many things to fix it but finally I discovered that the system
was infected by hacker defender. I think I have now removed it, at
least the system stopped crashing.
Try downloading and running RKDetector:
http://bag***.swan.ac.uk/comms/RKDetectorv0[1].62.zip

That should tell you if your PC is infected.

Agnar
"Glenn" <g_egg@sympatico.ca> wrote in message news:<1059201c43f66$8dcccd80$a001280a@phx.gbl>...
> Application Log:
> EVENT 1517
> User: NT Authority\System
> Type: Warning
> Computer: Glenn
> Source: Userenv
>
> Windows saved user GLENN\Administrator registry while an
> application or service was still using the registry during
> log off. The memory used by the user's registry has not
> been freed. The registry will be unloaded when it is no
> longer in use.
>
> This is often caused by services running as a user
> account, try configuring the services to run in either the
> LocalService or NetworkService account.
>
> **********************************************************
> Also this one...
>
> Source: Event System
> Category: (50)
> Event ID: 4609
> Type: Error
> User: N/A
>
> The COM+ Event System detected a bad return code during
> its internal processing. HRESULT was 8007043C from line
> 44 of d:\nt_qxp\com\com1x\src\events\tier1
> \eventsystemobj.cpp. Please contact Microsoft Product
> Support Services to report this error.
>
> ***********************************************************
> the wierd thing is that the D:\ is a DVD-Rom
> drive...Whenever i get that error, it restarts my computer
> which is normal for severe errors...
>
> System Log:
> Type: Error
> Event ID: 10003
> User: N\A
> Source: DCOM
> Access denied attempting to launch a DCOM Server using
> DefaultLaunchPermssion. The server is:
> {00020906-0000-0000-C000-000000000046}
> The user is Unavailable/Unavailable, SID=Unavailable.
>
> I got no clue what that one is...it appends to the System
> log randomly however there are about 5 instances per
> minute logged.
>
> If any1 has any Ideas to what is going on please email me
> at g_egg@sympatico.ca