Strange error message

Goto Safe mode and run sfc /scannow. This should solve the problem. This occurs only when system modules are corrupted.

Doing this results in error message in CMD window that reads:

"Windows File Protection could not initiate a scan of protected system files.  The specific error code is 0x000006ba [The RPC server is unavailable.].


So I checked my services and I find that Remote Procedure Call (RPC) service is running.  The Remote Procedure Call (RPC) Locator however is set to manual.  Attempts to switch this latter service on failed, and resulted in another error message -- "the dependency service or group failed to start"

ugh.  I will probably just reformat the whole thing unless someone knows a solution.

grrrrrr xf$(#@)#@!!?x%^?! microsoft/.. grrrr

you're looking at spyware here i think... if you want to post a hijackthis log here, that would be cool...

or check the event log (start run eventvwr) for the error that was generated and post here?

or run sfc /scannow from within normal windows as opposed to safemode.  it will replace the in-use ones at reboot.

ran sfc /scannow from within normal windows as opposed to safemode.  it asked for the win2k disk and i gave it.  rebooted.  clicked on my computer, c: drive, properties -- boom -- same error.  
also ran adaware just to be sure, found nothing.


hijackthis log as follows --

Logfile of HijackThis v1.99.1
Scan saved at 10:00:19 PM, on 8/16/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\locator.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\ALCWZRD.EXE
C:\WINNT\ALCMTR.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\NSClean\BOClean\BOC412.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\AlfaClock\AlfaClock.exe
C:\Documents and Settings\bob\Desktop\HijackThis1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 193.86.103.19 guru.grisoft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [BOC-412] C:\PROGRA~1\NSClean\BOClean\BOC412.exe
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - Startup: AlfaClock.lnk = C:\Program Files\AlfaClock\AlfaClock.exe
O4 - Startup: Check for ContinuumClient Updates.lnk = C:\Program Files\Quote.com\ContinuumClient\WiseUpdt.exe
O4 - Startup: Check for QCharts Updates.lnk = C:\Program Files\Quote.com\QCharts 5.1\WiseUpdt.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O16 - DPF: DigiChat Applet - http://host13.digichat.com/DigiChat/DigiClasses/Client_IE.cab
O16 - DPF: {3CA15C82-6297-11D6-B8FA-00C04F5E375A} (BridgeChannel v3) - http://channel.bridge.com/bc/java/bc3_bridge_i.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124197998968
O16 - DPF: {69565A48-8A92-11D9-8BDE-F66BAD1E3F3A} (BridgeChannel v3.2) - http://channel.bridge.com/bc/java/rbc33_i.cab
O16 - DPF: {7CEEAB76-D59E-11D3-8394-00C04F7BDF10} (Application Class) - https://www.tradestation.com/tscom/ClientPlugIn/tsTemp.cab
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} - http://moneycentral.msn.com/cabs/pmupdate2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe




startup list log as follows --

StartupList report, 8/16/2005, 10:01:55 PM
StartupList version: 1.52
Started from : C:\Documents and Settings\bob\Desktop\StartupList.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\locator.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\ALCWZRD.EXE
C:\WINNT\ALCMTR.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\NSClean\BOClean\BOC412.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\AlfaClock\AlfaClock.exe
C:\Documents and Settings\bob\Desktop\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\bob\Start Menu\Programs\Startup]
AlfaClock.lnk = C:\Program Files\AlfaClock\AlfaClock.exe
Check for ContinuumClient Updates.lnk = C:\Program Files\Quote.com\ContinuumClient\WiseUpdt.exe
Check for QCharts Updates.lnk = C:\Program Files\Quote.com\QCharts 5.1\WiseUpdt.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
High Definition Audio Property Page Shortcut = HDAudPropShortcut.exe
SoundMan = SOUNDMAN.EXE
AlcWzrd = ALCWZRD.EXE
Alcmtr = ALCMTR.EXE
NvCplDaemon = RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
AVG7_CC = C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
AVG7_EMC = C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
Acrobat Assistant 7.0 = "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
(Default) =
BOC-412 = C:\PROGRA~1\NSClean\BOClean\BOC412.exe
MBM 5 = "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
Drag'n'Drop_Autolaunch = "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}

--------------------------------------------------

Enumerating Download Program Files:

[BridgeChannel v3]
InProcServer32 = C:\WINNT\system32\MSJAVA.DLL
CODEBASE = http://channel.bridge.com/bc/java/bc3_bridge_i.cab

[MSN Money Charting]
InProcServer32 = C:\Program Files\Microsoft Money 2006\MNYCoreFiles\prtstb06.dll
CODEBASE = http://moneycentral.msn.com/cabs/pmupd806.exe

[WUWebControl Class]
InProcServer32 = C:\WINNT\system32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124197998968

[BridgeChannel v3.2]
InProcServer32 = C:\WINNT\system32\MSJAVA.DLL
CODEBASE = http://channel.bridge.com/bc/java/rbc33_i.cab

[Application Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\tstemp.dll
CODEBASE = https://www.tradestation.com/tscom/ClientPlugIn/tsTemp.cab

[{963BE66B-121D-4E6C-BF9F-1A774D9A2E41}]
CODEBASE = http://moneycentral.msn.com/cabs/pmupdate2.exe

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38450.9213888889

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\system32\macromed\flash\Flash.ocx
CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\system32\webcheck.dll
SysTray: stobject.dll

--------------------------------------------------
End of report, 5,829 bytes

Next time please don't paste the whole hijacklog here, but paste it to hijackthis.de/en, click on analyze and then on Save analysis, and only post the URL to the new link here. I've done that for now. Use hijackthis to remove the unknown and nasty opbjects, then reboot and run another instance of hijackthis, follow my above instructions and post the url here.

http://hijackthis.de/logfiles/10b0d0ce0e47e8e26789ac95f7e8a8bb.html

doesnt look like the nasty things in there (1 or 2) are going to be the cause...

do you have any USB drives attached when you get the error?

if something is broke with usb, drivers or the device, that can easily trip up windows...
as can a cd drive that went bad.

perhaps you should update your motherboard chipset drivers just in case...

and, hows the event log look relating to these error times?

does explorer just close and reopen, or do you have to reboot?

oh, here we go... here's exactly what you said:
"exploer.exe has generated error and will be closed by Windows. You will need to restart the program. An error log is being created."

note that you typed first "exploer.exe" WITHOUT the R to make it "explorer"...

is that a typo, or is that the case??

if that is the case, then you must do these:
kill process on any "rundll32"'s running...
search for files called "exploer.exe"  note the lack of an R
delete anything found.

go in your windows\directory and verify that explorer.exe DOES exist there.  if it does, continue to the next lines... if not, post the results of above...

go to your windows\system32 directory... does exploer or explorer exist here, if so, delete them.

note you might have to open task manager, kill explorer.exe first, then do File > New Task (run):  CMD
cd\windows\system32
del explorer.exe

search your registry for all instances of "exploer.exe" and delete any references to it... note the lack of an R there.

reboot and see what happens

2 more possible solutions, non invasive and wont hurt much:

lots of users report that the nvidia conrol panel driver became corrupt.. to check this on your system, go in the windows system32 folder and find "nvtuicpl.cpl."  rename the extension to something like "nvtuicpl.cpl..old" and reboot.  test.  test explore things and test the control panel, see if they open ok.

AND / OR

some users report that deleting some IE related files out of c:\windows\inf had fixed their problem right away.
if you dont want to delete them, make a folder calld BAD and MOVE them there... make it so they dont exist inside of any previously existing folder...

these files from c:\windows\inf:
ie.inf
ie.pnf
ieaccess.inf
ieaccess.pnf
iereset.inf
iereset.pnf


lets do those too and see what happens...

Windows File Protection May Not Start
http://support.microsoft.com/default.aspx?scid=kb;EN-US;296241

1. "do you have any USB drives attached when you get the error?"

I have a USB drive that is not attached.  Iomega CD-RW.  I've loaded the software that comes with the drive.  That's installed on the machine.  But the drive is not attached when the error occurs.

2. "if something is broke with usb, drivers or the device, that can easily trip up windows...
as can a cd drive that went bad."

cd drives all seem to be working perfectly.

3. "perhaps you should update your motherboard chipset drivers just in case..."

ok but last resort for now.

4. " the event log look relating to these error times?"

not even sure where to find the event log, but i can look at it and give you the results here.

5. "does explorer just close and reopen, or do you have to reboot?"

Let me explain the exact sequence.  I have two accounts in Win2K.  One is the Admin account the other is an account that I added (my day-to-day account).  The problem [[only]] occurs in the one account that I added.  The problem occurs when -- I right click on the Local Disk (C:) and select "Properties."  this action immediately generates the message "explorer.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created."

1. "do you have any USB drives attached when you get the error?"

I have a USB drive that is not attached.  Iomega CD-RW.  I've loaded the software that comes with the drive.  That's installed on the machine.  But the drive is not attached when the error occurs.

2. "if something is broke with usb, drivers or the device, that can easily trip up windows...
as can a cd drive that went bad."

cd drives all seem to be working perfectly.

3. "perhaps you should update your motherboard chipset drivers just in case..."

ok but last resort for now.

4. " the event log look relating to these error times?"

not even sure where to find the event log, but i can look at it and give you the results here.

5. "does explorer just close and reopen, or do you have to reboot?"

Let me explain again the exact sequence.  I have two accounts under Win2K.  One is the Admin account, and the other is an Account that I added.  The problem only occurs in the one account that I added.  The problem occurs when I right click on the Local Disk (C:) and select "Properties."  It generates the

--side comment.  i took SystmProg's advice, and followed the microsoft instructions for "Windows File Protection May Not Start" http://support.microsoft.com/default.aspx?scid=kb;EN-US;296241 ... after doing that (using a good machine to generate the certificate, and then transfering to the machine with problem) and rebooting into safemode, and attempting to run sfc /scannow, i still get the same error message "Windows File Protection could not initiate a scan of protected system files.  The specific error code is 0x000006ba [The RPC server is unavailable.].  I checked my services and I find that Remote Procedure Call (RPC) service is running, and Remote Procedure Call (RPC) is also running.  

But this is a side issue to the main issue, which is, that when i right click on the C: drive and select properties, i get the error message "explorer.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created."

i think you should go with my other most recent post above this...
from 7:44 and 7:53pm yesterday (PDT time)... i've seen it on 6 sites that this fixed it, and multiple users on those sites report good.

the event log can be found here:
Start > Run > eventvwr

just look in system and in application, for the exact times the errors occured... but it would be quicker to just do my two posts from those specified times :)

hack-4-good.

i meant "explorer.exe" --

just now, i tried both of your other ideas .. i.e., rename nvtuicpl.cpl, and move the windows/inf files.  

still getting same error when i right click on the c: drive.

>>>i get the error message "explorer.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created."

This is because of the following reasons:

_If a module running in your system is not consistent.
_If registry informations for drive property are corrupted.
_If a module running has no function calls and conflict with running modules.

Do you get the same error message when you right click on Folder or File property?

Thanks
SystmProg

hi SystemProg,

no, i do not get the same message when right click on either Folders or Files, and then select Property.  Those do not cause any error.  Only C: drive.  and only in one of my accounts.  (the error is not duplicable in the Adminstrator account).

much thks

Because Property Sheet Handler are profile-dependent and not machine-dependent so in your profile some extra Handlers have been registered and are buil-in Ntuser.dat file. If you try to open Property of C drive which contains some extra handlers and Windows Shell (explorer.exe) is not able to recognize them then you will get this error.

Hope this helps you.

SP.

ok, so basically, delete that profile, and build a new one .. right?

Correct. The right solution instead of troubleshooting for a month :-)