Windows 2000 Professional - Felermeldung unter Computerverwaltung/Ereignissanzeige/Anw.. Boba Fett - 24.11.2003, 20:43 Titel:
Hier der Text für die 4097:
Source: EventSystem
Type: Error
Description: The com+ Event System detected a bad return code during its internal processing. HRESULT was 800705AA from line 309 of .\eventsystem2.cpp. Please contact Microsoft Product Support Services to report this error.
Comments Adrian Grigorof (Last update 8/13/2003):
This may occur if the system is infected by the MSBlaster or LoveSAN Internet worm. See Q823980 for details. See Symantec Security Response on how to detect it and remove it.
This event may also show up in other circumstances. See the links below for some conditions on which such event can occur.
Guido Holly (Last update 11/2/2003):
This happened to me when the system was infected with the W32/Nachi.worm. After removing the worm and applying the latest RPC Patch, all problems were gone.
Thérèse Hanquet (Last update 11/2/2003):
After (successfully) installing either Q823980 or Q824146, I get a slightly different sort of message for this event: "The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8000FFFF from line 137 of .\service.cpp". This accompanies severe problems at reboot: no more task bar, no more start menu, no more desktop icons, explorer.exe cannot be launched from task manager, etc. Machine is unusable until patch is rolled back. Thoroughly checked for virus, none found.
Gabi Schütz (Last update 8/18/2003):
In my case, this problem was fixed after I installed the latest Windows service pack.
Jean-Francois Frechette (Last update 8/13/2003):
This may be caused by an RPC vulnerability recently discovered on Windows servers. See: Windows RPC Vulnerability Fix for more details as well as the Microsoft Security Bulletin MS03-026.
Cédric Guillemette (Last update 8/13/2003):
If you had problems lately with IIS (Unexpected Crash - EventID 28 Or/And 37 in system log) and you get this event (id 4097) in your application log then have a look at Q282073.
Hier der Text für 4106:
Source: EventSystem
Type: Warning
Description: The com+ Event System detected a corrupt IEventSubscription object. The COM+ Event System has removed object ID {<object ID>}. The subscriber will no longer be notified when the event occurs.
Comments Ionut Marin (Last update 10/25/2003):
See Q819995 for a hotfix.
Will Eaton
Object ID: A5978620-5B3F-F1D1-8ED2-00FA0035B753. This points to Messenger ISensLogon Subscription. I resolved this problem by deleting the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{A5978620-5B3F-F1D1-8ED2-00FA0035B753}.
Rebooted, no more event log entries and everything is running fine now.
Our Approach This information is only available to subscribers. An example of "approach" is available here.
Links Q819995
Source: EventSystem
Type: Error
Description: The com+ Event System failed to create an instance of the subscriber partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoGetObject returned HRESULT 8000401A.
Comments Sean Wallbridge
We found that deselecting the QOS Packet Scheduler and rebooting stopped this event from occurring. By default, this is selected but we are yet to find any use for this functionality in our day to day usage.
Source: EventSystem
Type: Error
Description: The com+ Event System raised an unexpected access violation at address 0x7629E4D5, attempting to access address 0xFFFFFFE8. Please contact Microsoft Product Support Services to report this error.
es!Ordinal3+0xe4d5