Prev: XP SP3 Firewall
Next: Crypto Private Key Password Pop-Up
From: nass on 2 Oct 2008 06:17


"Abigail" wrote:

> Stopping and Starting WMI was successful but did not correct the error.
> I downloaded and run the WMI Diagnosis Utility and the following is the text
> in the report (parts pertaining to the errors only) ::
>
> ####################
> ...92 20:38:01 (1) !! ERROR: The SYSTEM32 folder is NOT in the PATH.
> ...93 20:38:01 (1) !! ERROR: The WBEM folder is NOT in the PATH.
> ...94 20:38:01 (3) The PATH environment variable has a maximum length of
> 512 characters. Current PATH length is 18 characters.
> ...95 20:38:01 (4) Reading registry (REG_DWORD)
> 'HKCU\Software\Microsoft\Windows Script Host\Settings\Timeout'.
> ...96 20:38:01 (4) Reading registry (REG_DWORD)
> 'HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings\Timeout'.
>
> ..446 20:38:29 (1) !! ERROR: (ReadRegistry) : 0x80070002 - Invalid root in
> registry key
> "HKCR\CLSID\{D71EE747-F455-4804-9DF6-2ED81025F2C1}\InProcServer32\".
> ..447 20:38:29 (1) !! ERROR: (CheckWMIDCOMComponentRegistrations) :
> 'C:\WINNT\SYSTEM32\WBEM\FASTPROX.DLL' is not registered correctly, missing
> '\CLSID\{D71EE747-F455-4804-9DF6-2ED81025F2C1}\InProcServer32'.
>
> ..451 20:38:29 (1) !! ERROR: (ReadRegistry) : 0x80070002 - Invalid root in
> registry key
> "HKCR\CLSID\{ED51D12E-511F-4999-8DCD-C2BAC91BE86E}\InProcServer32\".
> ..452 20:38:29 (1) !! ERROR: (CheckWMIDCOMComponentRegistrations) :
> 'C:\WINNT\SYSTEM32\WBEM\FASTPROX.DLL' is not registered correctly, missing
> '\CLSID\{ED51D12E-511F-4999-8DCD-C2BAC91BE86E}\InProcServer32'.
>
> ..580 20:38:29 (1) !! ERROR: (ReadRegistry) : 0x80070002 - Invalid root in
> registry key
> "HKCR\CLSID\{4C6055D8-84B9-4111-A7D3-6623894EEDB3}\InProcServer32\".
> ..581 20:38:29 (1) !! ERROR: (CheckWMIDCOMComponentRegistrations) :
> 'C:\WINNT\SYSTEM32\WBEM\WBEMPROX.DLL' is not registered correctly, missing
> '\CLSID\{4C6055D8-84B9-4111-A7D3-6623894EEDB3}\InProcServer32'.
>
> 18280 20:44:38 (1) !! ERROR: Environment:
> ................................................................................................. 3 ITEM(S)!
> 18281 20:44:38 (1) !! ERROR: => The following path(s) is/are missing from
> the PATH environment variable:
> 18282 20:44:38 (0) ** - C:\WINNT\SYSTEM32
> 18283 20:44:38 (0) ** - C:\WINNT\SYSTEM32\WBEM
> 18284 20:44:38 (0) ** Failing to have the listed path(s) in the
> PATH environment variable
> 18285 20:44:38 (0) ** could prevent the system to work properly.
> 18286 20:44:38 (0) ** INFO: => 4 incorrect shutdown(s) detected on:
> 18287 20:44:38 (0) ** - Shutdown on 22 September 2008 00:03:18
> (GMT+4).
> 18288 20:44:38 (0) ** - Shutdown on 24 September 2008 12:44:53
> (GMT+4).
> 18289 20:44:38 (0) ** - Shutdown on 24 September 2008 12:49:36
> (GMT+4).
> 18290 20:44:38 (0) ** - Shutdown on 26 September 2008 14:34:34
> (GMT+4).
>
> 18388 20:44:38 (0) ** ERROR: WMIDiag detected issues that could prevent WMI
> to work properly!. Check 'C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL
> SETTINGS\TEMP\WMIDIAG-V2.0_XP___.CLI.RTM.32_HAL-9000_2008.10.01_20.37.20.LOG'
> for details.
> ####################

Open a notepad and copy and paste the following and save on the desktop as
WMI.bat and then double click it to excute!
regsvr32 wbemprox.dll
regsvr32 Fastprox.dll
regsvr32 hnetcfg.dll
regsvr32 netcfgx.dll
regsvr32 netman.dll
regsvr32 atl.dll
regsvr32 netshell.dll


Make sure these services are started or restart them again:
Event Log << Auto
Windows Management Instrumentation << Auto (first RPC not the
second one set to Manuall)
Remote Procedure Call (RPC) << Auto
DCOM Server Process Launcher << Auto

Reboot your machine and wait for a while and see the timestamp to the event
logs, does it log the error again?
Setting The Default WMI Namespace Security:
http://community.spiceworks.com/education/projects/Setting_The_Default_WMI_Namespace_Security?query=WMI
Setting The Default DCOM Properties And Security:
http://community.spiceworks.com/education/projects/Setting_The_Default_DCOM_Properties_And_Security


Right click My Computer and select Properties. On the System Properties
click on Advanced tab then click on [ Environment Variables ] Button and
under System Variables make sure these settings correct:
Variable | Value
ComSpec %SystemRoot%\system32\cmd.exe

Path
C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem

PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
TEMP %SystemRoot%\TEMP
TMP %SystemRoot%\TEMP
windir %SystemRoot%

NOTE the above copied from the Edit Window, it will take the Path letter
C:\Windows\Temp for Exm..

Disabling Windows Script Host
http://www.microsoft.com/technet/scriptcenter/guide/sas_sbp_lhak.mspx?mfr=true

HTH,
nass
---
http://www.nasstec.co.uk



From: Abigail on 2 Oct 2008 15:54
Thanks for the tip; this is the result for the entries registration:
After each execution there was a prompt response:

regsvr32 wbemprox.dll (LoadLibrary failed module not found)
regsvr32 Fastprox.dll (LoadLibrary failed module not found)
regsvr32 hnetcfg.dll (Success)
regsvr32 netcfgx.dll (Success)
regsvr32 netman.dll (Success)
regsvr32 atl.dll (Success)
regsvr32 netshell.dll (Success)

“Event Error SecurityCenter ID: 1802” Still present
Question: Should I try to look for the missing dll files and install them?

Your help is greatly appreciated
Abigail

"nass" wrote:

>
> Open a notepad and copy and paste the following and save on the desktop as
> WMI.bat and then double click it to excute!
> regsvr32 wbemprox.dll
> regsvr32 Fastprox.dll
> regsvr32 hnetcfg.dll
> regsvr32 netcfgx.dll
> regsvr32 netman.dll
> regsvr32 atl.dll
> regsvr32 netshell.dll
>
>
> Make sure these services are started or restart them again:
> Event Log << Auto
> Windows Management Instrumentation << Auto (first RPC not the
> second one set to Manuall)
> Remote Procedure Call (RPC) << Auto
> DCOM Server Process Launcher << Auto
>
> Reboot your machine and wait for a while and see the timestamp to the event
> logs, does it log the error again?
> Setting The Default WMI Namespace Security:
> http://community.spiceworks.com/education/projects/Setting_The_Default_WMI_Namespace_Security?query=WMI
> Setting The Default DCOM Properties And Security:
> http://community.spiceworks.com/education/projects/Setting_The_Default_DCOM_Properties_And_Security
>
>
> Right click My Computer and select Properties. On the System Properties
> click on Advanced tab then click on [ Environment Variables ] Button and
> under System Variables make sure these settings correct:
> Variable | Value
> ComSpec %SystemRoot%\system32\cmd.exe
>
> Path
> C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
>
> PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
> TEMP %SystemRoot%\TEMP
> TMP %SystemRoot%\TEMP
> windir %SystemRoot%
>
> NOTE the above copied from the Edit Window, it will take the Path letter
> C:\Windows\Temp for Exm..
>
> Disabling Windows Script Host
> http://www.microsoft.com/technet/scriptcenter/guide/sas_sbp_lhak.mspx?mfr=true
>
> HTH,
> nass
> ---
> http://www.nasstec.co.uk
>
>
>
From: nass on 2 Oct 2008 17:31


"Abigail" wrote:

> Thanks for the tip; this is the result for the entries registration:
> After each execution there was a prompt response:
>
> regsvr32 wbemprox.dll (LoadLibrary failed module not found)
> regsvr32 Fastprox.dll (LoadLibrary failed module not found)
> regsvr32 hnetcfg.dll (Success)
> regsvr32 netcfgx.dll (Success)
> regsvr32 netman.dll (Success)
> regsvr32 atl.dll (Success)
> regsvr32 netshell.dll (Success)
>
> “Event Error SecurityCenter ID: 1802” Still present
> Question: Should I try to look for the missing dll files and install them?
>
> Your help is greatly appreciated
> Abigail

Okay Abi,
# From Ramesh:
http://windowsxp.mvps.org/repairwmi.htm

Run >> Type in:

rundll32 wbemupgd, UpgradeRepository click [OK]
Reboot your machine and see if that will help!

Or Get the XP CD and copy and paste this command:
rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf
click [OK]
Reboot your machine and see if that will help!
You will find a copy here:
C:\Windows\ServicePackFiles\i386

#Try these commands:
regsvr32 /u Fastprox.dll click [OK]
regsvr32 /u wbemprox.dll click [OK]
regsvr32 Fastprox.dll click [OK]
regsvr32 wbemprox.dll click [OK]
Reboot your machine and see if that will help.

# Rebuilding the Repository again in a different way, open the command
prompt again and type in:
sc stop winmgmnt click [OK]
Locate the direcorty for the Repository and rename it to Repository.old
C:\Windows\system32\wbem\Repository
sc start winmgmnt click [OK]
Reboot your machine and test.

# You experience slow system performance when you run a program that uses
the WMI service on a Windows XP SP2-based computer or a Windows Server 2003
SP1-based computer

http://support.microsoft.com/kb/911262
HTH,
nass

From: Abigail on 3 Oct 2008 17:23
Sorry to tell you that everything failed, below each of your steps is either
the unsuccessful attempt prompt response or the result (in caps):

#######################################
"nass" wrote:
>
> Run >> Type in:
>
> rundll32 wbemupgd, UpgradeRepository click [OK]
> Reboot your machine and see if that will help!
ERROR LOADING WBEMUPGD THE SPECIFIED MODULE COULD NOT BE FOUND

>
> Or Get the XP CD and copy and paste this command:
> rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf
> click [OK]
> Reboot your machine and see if that will help!
> You will find a copy here:
> C:\Windows\ServicePackFiles\i386
COPIES A BUNCH OF FILES FROM CD CORRECTLY AND AFTER A WILE PROMPS ME THAT A
NAPCLIENTPROV.MOF(UNKNOWN) FILE IS NEEDED AND CANNOT BE FOUND
NEITHER IN THE XP CD OR CURRENT WINNT FOLDER

>
> #Try these commands:
> regsvr32 /u Fastprox.dll click [OK]
> regsvr32 /u wbemprox.dll click [OK]
> regsvr32 Fastprox.dll click [OK]
> regsvr32 wbemprox.dll click [OK]
> Reboot your machine and see if that will help.
LOAD LYBRARY (XXXXXX.DLL) FAILED - THE SPECIFIED MODULE COUL NOT BE FOUND
**FOR ALL**
>
> # Rebuilding the Repository again in a different way, open the command
> prompt again and type in:
> sc stop winmgmnt click [OK]
> Locate the direcorty for the Repository and rename it to Repository.old
> C:\Windows\system32\wbem\Repository
> sc start winmgmnt click [OK]
> Reboot your machine and test.
AT ATTEMPTING TO STOP FOR STARTERS THIS WAS THE RESPONSE:
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

#######################################
>
> # You experience slow system performance when you run a program that uses
> the WMI service on a Windows XP SP2-based computer or a Windows Server 2003
> SP1-based computer
>
> http://support.microsoft.com/kb/911262
> HTH,
> nass
>
From: nass on 3 Oct 2008 17:35


"Abigail" wrote:

> Sorry to tell you that everything failed, below each of your steps is either
> the unsuccessful attempt prompt response or the result (in caps):
>
> #######################################
> "nass" wrote:
> >
> > Run >> Type in:
> >
> > rundll32 wbemupgd, UpgradeRepository click [OK]
> > Reboot your machine and see if that will help!
> ERROR LOADING WBEMUPGD THE SPECIFIED MODULE COULD NOT BE FOUND
>
> >
> > Or Get the XP CD and copy and paste this command:
> > rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf
> > click [OK]
> > Reboot your machine and see if that will help!
> > You will find a copy here:
> > C:\Windows\ServicePackFiles\i386
> COPIES A BUNCH OF FILES FROM CD CORRECTLY AND AFTER A WILE PROMPS ME THAT A
> NAPCLIENTPROV.MOF(UNKNOWN) FILE IS NEEDED AND CANNOT BE FOUND
> NEITHER IN THE XP CD OR CURRENT WINNT FOLDER
>
> >
> > #Try these commands:
> > regsvr32 /u Fastprox.dll click [OK]
> > regsvr32 /u wbemprox.dll click [OK]
> > regsvr32 Fastprox.dll click [OK]
> > regsvr32 wbemprox.dll click [OK]
> > Reboot your machine and see if that will help.
> LOAD LYBRARY (XXXXXX.DLL) FAILED - THE SPECIFIED MODULE COUL NOT BE FOUND
> **FOR ALL**
> >
> > # Rebuilding the Repository again in a different way, open the command
> > prompt again and type in:
> > sc stop winmgmnt click [OK]
> > Locate the direcorty for the Repository and rename it to Repository.old
> > C:\Windows\system32\wbem\Repository
> > sc start winmgmnt click [OK]
> > Reboot your machine and test.
> AT ATTEMPTING TO STOP FOR STARTERS THIS WAS THE RESPONSE:
> [SC] OpenService FAILED 1060:
>
> The specified service does not exist as an installed service.
>
> #######################################
> >
> > # You experience slow system performance when you run a program that uses
> > the WMI service on a Windows XP SP2-based computer or a Windows Server 2003
> > SP1-based computer
> >
> > http://support.microsoft.com/kb/911262
> > HTH,
> > nass

Abi
Can you search for these two files on your System and let me know the
whereabout they located if any.
Did you tried to create a new profile and see if that will work okay?
Mine located here:

c:\Windows\System32\wbem
C:\Windows\$NtServicePackUninstall$
C:\Windows\ServicePackFiles\i386
C:\Windows\SoftwareDistrubition\SelfUpdate\16b......

If you find it in one of these direcoties copy it to the other and Reboot
your machine please do this for both files and Reboot your machine and see if
the WMI is restored.

If the above didn't help please contact me with your Hijackthis log.
Download Hijackthis and send me the log.
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)
my address is : to_you_ross(at remove this and repalce with the
obvious)yahoo.co.uk
( _ is underscore)
HTH.
nass
---
http://www.nasstec.co.uk
First  |  Prev  |  Next  |  Last
Pages: 1 2 3
Prev: XP SP3 Firewall
Next: Crypto Private Key Password Pop-Up