Did you ever find the answer to this one? We are experiencing the exact same issue and are also using Trend Micro, so there could be something related. Ours is also a terminal server.
Main Topics
Browse All TopicsHi,
All my Windows 2003 servers give the following errors at random intervals.
Event Type: Warning
Event Source: PerfOS
Event Category: None
Event ID: 2012
Date: 6/19/2007
Time: 4:18:39 PM
User: N/A
Computer: SERVER
Description:
Unable to get system process information from system. The status code returned is in the first DWORD in the Data section.
For more information, see Help and Support Center at http://go.microsoft.com/fw
Data:
0000: a1 00 00 c0 ¡..À
Event Type: Error
Event Source: Application Popup
Event Category: None
Event ID: 333
Date: 6/20/2007
Time: 9:50:44 AM
User: N/A
Computer: SERVER
Description:
An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
For more information, see Help and Support Center at http://go.microsoft.com/fw
Data:
0000: 00 00 00 00 01 00 6c 00 ......l.
0008: 00 00 00 00 4d 01 00 c0 ....M..À
0010: 00 00 00 00 4d 01 00 c0 ....M..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
When these errors occur, the server is getting unresponsive. RDP sessions are rejected, applications are unable to open on the server stating that insufficient resources exit.
We're running Trend Micro Client/Server/Messaging Suite 3.6. When I stopped the Trend Micro agent on one of the servers, the PerfOS error messages stopped and the server became responsive again, however the Registry I/O errors still remain.
I've checked all the comments on EventID.net, but none of them apply to my situation.
Any ideas?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Ok, I've generated a call at MS. They state it's caused by a memory leak in tmasca. (Antispyware agent from Trend Micro). I've uninstalled all the instances on all servers from the antispyware agent yesterday and we are currently monitoring the servers to see if the problem still occurs. So far so good.
Business Accounts
Answer for Membership
by: AicoPosted on 2007-06-20 at 02:18:36ID: 19322963
Ok, the problem isn't caused by Trend Micro, but by something else. Can't find it.