5 replies to this topic

[mechanic]

i love ccleaner, works great...

I have a question about my logs file...it has these two files in it....wbemess & wmiprov. I was wondering if anyone can help me make some sense out the error logs. I am running xp pro sp2.




heres the text in the file wbemess: it repeats its self over and over again. ccleaner cleanes them, but they start over every log on.

(Wed Aug 09 14:15:46 2006.6982860) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5
(Wed Aug 09 14:15:46 2006.6983021) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001
(Wed Aug 09 14:15:46 2006.6983121) : Failed the first attempt to retrieve the sink to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.
WMI will reload and retry.
(Wed Aug 09 14:15:46 2006.6983131) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5
(Wed Aug 09 14:15:46 2006.6983131) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001
(Wed Aug 09 14:15:46 2006.6983141) : Failed the second attempt to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.
This event is dropped for this consumer.
(Wed Aug 09 14:15:46 2006.6983141) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Wed Aug 09 14:15:46 2006.6983161) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Wed Aug 09 14:15:46 2006.6983221) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Wed Aug 09 14:15:46 2006.6983231) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Wed Aug 09 14:15:46 2006.6983231) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Wed Aug 09 14:15:46 2006.6983241) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5
(Wed Aug 09 14:15:46 2006.6983251) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001
(Wed Aug 09 14:15:46 2006.6983261) : Failed the first attempt to retrieve the sink to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.
WMI will reload and retry.
(Wed Aug 09 14:15:46 2006.6983271) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5
(Wed Aug 09 14:15:46 2006.6983281) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001
(Wed Aug 09 14:15:46 2006.6983281) : Failed the second attempt to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.
This event is dropped for this consumer.
(Wed Aug 09 14:15:46 2006.6983291) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Wed Aug 09 14:24:52 2006.121124) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:24:52 2006.121124) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:24:52 2006.121124) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:28:10 2006.318858) : NCProv: Didn't find function info for index 30(Wed Aug 09 14:28:11 2006.319679) : NCProv: Didn't find function info for index 30(Wed Aug 09 14:28:11 2006.319689) : NCProv: Didn't find function info for index 30(Wed Aug 09 14:28:11 2006.319809) : NCProv: Didn't find function info for index 30(Wed Aug 09 14:28:11 2006.319940) : NCProv: Didn't find function info for index 30(Wed Aug 09 14:31:56 2006.75408) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:32:20 2006.98741) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:32:22 2006.101265) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:32:26 2006.104930) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:32:30 2006.109447) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:33:24 2006.162673) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:35:35 2006.294503) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:35:42 2006.300602) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:35:42 2006.300642) : Failed to log an event: 6B5
(Wed Aug 09 14:35:42 2006.300642) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:35:42 2006.300672) : Failed to log an event: 6B5
(Wed Aug 09 14:35:42 2006.300702) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Wed Aug 09 14:35:42 2006.300732) : Failed to log an event: 6B5





This is in the wmiprov folder:

(Wed Aug 09 14:27:19 2006.267875) : WDM call returned error: 4200
(Wed Aug 09 14:52:54 2006.306000) : WDM call returned error: 4200
(Wed Aug 09 15:02:10 2006.319319) : WDM call returned error: 4200


any help or links or anything to get me in the right direction to what may be causing this would be greatly appreciated. If you need anymore info, please let me know.
Thanks in advance,
Randy

*edit* this is in /windows/debug/usermode/

USERENV(218.21c) 14:17:03:890 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(218.21c) 14:17:03:910 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(d8.dc) 14:23:08:103 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(d8.dc) 14:23:08:103 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(220.224) 14:31:03:782 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(220.224) 14:31:03:782 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(220.224) 14:31:03:782 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(224.228) 14:36:45:040 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(224.228) 14:36:45:061 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(224.228) 14:41:45:272 MyRegUnLoadKey: Failed to unmount hive 00000005
USERENV(224.228) 14:41:45:302 UnLoadClassHive: failed to unload classes key with 5
USERENV(224.228) 14:41:45:312 DumpOpenRegistryHandle: 3 user registry Handles leaked from \Registry\User\S-1-5-21-343818398-2111687655-842925246-1003_Classes
USERENV(224.228) 14:41:45:312 ReportError: Impersonating user.
USERENV(d8.dc) 14:42:53:405 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(d8.dc) 14:42:53:425 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(21c.220) 14:48:10:071 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(21c.220) 14:48:10:101 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(21c.220) 14:48:10:101 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(228.22c) 14:57:18:368 CUserProfile::CleanupUserProfile: Ref Count is not 0
USERENV(228.22c) 14:57:18:398 CUserProfile::CleanupUserProfile: Ref Count is not 0

[DjLizard]

For the bottom part, you might try installing User Profile Hive Cleanup Service.

http://www.microsoft.com/downloads/details...;displaylang=en

[mechanic]

thank you for the reply, could you maybe idea on what may be going on? Ive visited the dial a fix site.....awesone job! Ill give the link a try...Thanks again

I know you guys dont like to spoon feed new members every detail, I just need a little help to get on the right foot w/ this.

[hazelnut]

Hello mechanic,
Regarding the WDM call returned error 4200, I've had a quick look round and could find 2 people with a similar problem, One found it was caused by Norton firewall and the other by an nVidia driver. Either apply to you?

[mechanic]

DjLizard, on Aug 10 2006, 02:36 AM, said:

For the bottom part, you might try installing User Profile Hive Cleanup Service.

http://www.microsoft.com/downloads/details...;displaylang=en

Thanks alot! Good call, this took care of the error causing the debug entry, now there is a file "framework" in the log folder along w/ the 2 previously mentioned files. I downloaded a wmi diagnostic program from microsoft, ran it and it reports back all good...i can post the results.

hazelnut, on Aug 10 2006, 10:28 AM, said:

Hello mechanic,
Regarding the WDM call returned error 4200, I've had a quick look round and could find 2 people with a similar problem, One found it was caused by Norton firewall and the other by an nVidia driver. Either apply to you?

Thank you for your reply. Yes, I am running norton firewall, I would like to uninstall and use windows firewall, but idk how to uninstall just the firewall from norton a/v. I think I may have read what you are refering to, the guy who figurerd out what was wrong uninstalled his norton firewall for zonealarm fw.

I just want to say the help is greatly appreciated!

[Andavari]

mechanic, on Aug 10 2006, 11:59 AM, said:

Yes, I am running norton firewall, I would like to uninstall and use windows firewall, but idk how to uninstall just the firewall from norton a/v. I think I may have read what you are refering to, the guy who figurerd out what was wrong uninstalled his norton firewall for zonealarm fw.

That Norton stuff can cause allot of problems! Although this doesn't diagnose your system you can grab a fully featured 1 year trial of eTrust EZ Antivirus, or free all the time Avira AntiVir PersonalEdition Classic, AVG Free, Avast Home Edition, and combine either one of them with ZoneAlarm and you're set.