Windows BBS The Place for Microsoft Windows Support! Windows, Support, Help Site

Go Back   Windows BBS > Operating Systems > Windows XP

Windows XP Post your Windows XP related questions here.

Register your FREE account to unlock additional features at WindowsBBS.com
Register
Welcome to WindowsBBS.com
Microsoft Windows Support

Mission Statement

WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.

Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.


Discussion Forums
Operating Systems
Windows 7 Windows 7
Windows Vista Windows Vista
Windows XP Windows XP
Windows Server System Windows Server System
Windows 2000 Windows 2000
Windows 95/98/Me/NT Windows 95/98/Me/NT
Internet & Networking
Networking
Internet Explorer
Microsoft Mail
Firefox, Thunderbird
      & SeaMonkey

General Internet
Security
General Security
Malware and Virus
     Removal

Other
Other Software
Hardware
Test Posts
Community
Introductions
General Discussions
Comments
      & Suggestions

News @ WindowsBBS

Forum Sponsor
 Image

Closed Thread
 
LinkBack Thread Tools
Old 24th January 2005   #1
Inactive
 
Profile:
Join Date: Jan 2005
Posts: 38
Computer Experience:
Experienced
coop Reputation Level


Continual DMA problem

I am having a strange problem with the DMA settings for my DVD RW the last few days. Every so often it the DMA becomes disabled (per Device Manager) and sets to PIO mode (tho' the DMA if Available option is still enabled). I know how to re-install the DMA - simply uninstall my primary controller and let windows reinstall it on boot up. When I do this DMA 5 is availabe and all works great for a while. But eventually the DMA will become disabled again.

All other DMA devices appear to be unaffected when this happens.

I've checked the System Information and there appears to be no conflicts - tho' I admit I am not sure what I am looking for (my computer innerworkings knowledge is very good in some places, almost nil in others). Nothing is flagged in SysInfo or device manager - that much I know.

At first I thought the problem was happening only after burning DVD media - especially through the Sony proggy MyDVD (perhaps six consecutive errors while encoding/writing shoddy authored .mpg or the like). I seemed to have a problem with that prog twice in a row while freeware progs like DVD Encrypter worked like a charm.

I then thought it could be the HDD in sleep mode or the CPU going into hibernation (as I have read elsewhere) - so I disabled both of these options.

But today DMA became disabled even when no media was being worked on - only graphic files - but no media device was accessed between the times when I know DMA was enabled on my DVD writer - primary - device 0) and when I noticed it was back to being set to PIO mode).

I cannot think of any major changes that I've made recently, except I installed several codec packs for decoding various video/audio formats (divx, etc.) It is possible that I installed some codecs twice - or the same type of codec in two places (after mis-reading a description).

Could this have anything to do with the problem? It does seem that the problem may have started shortly after installing the various codecs. That could just be a coincidence - for I see no reason that audio/video codecs would conflict with DMA settings.

I've already disabled hibernation and turning the HDD off in sleep mode (I read about that causing problems somewhere), but my knowledge on DMA is limited to what I have read the last two days and my recent tinkering around.

My computer is only a few months old - all BIOS info and drivers are up to date.

SEC ND 3450a DVD RW
I have an INTEL Chip Set
P4 3Ghz
1Gig of RAM
DELL Dimension 3000

Any suggestions would be greatly appreciated.

coop is offline  
Didn't find the information you thought to find?
Check out these Similar Threads
Old 24th January 2005   #2
Inactive
 
Profile:
Join Date: Jan 2005
Posts: 38
Computer Experience:
Experienced
coop Reputation Level


Scratch the above. This is actually happening on my Primary IDE Channel wiich is my HDD a Samsung SpinPoint P Series
SP0802N
.

So it is changing from DMA 5 to PIO for some reason during usage. The rest of my aboive discription still goes... and suggestions?

Thank you.

coop is offline  
Old 25th January 2005   #3
Staff
 
Christer's Avatar
 
Profile:
Join Date: Dec 2002
Location: Sweden
Posts: 5,162
Computer Experience:
I'm trying!
Christer Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation Level


Hello coop,
welcome to the Windows BBS ...... ...... !

Have a look in DMA Mode for ATA/ATAPI Devices in Windows XP for a possible cause or explanation.

Christer

Christer is offline  
Old 25th January 2005   #4
Staff
 
PeteC's Avatar
 
Profile:
Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,683
Computer Experience:
Usually not enough
PeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation Level

My System

More info here and here
PeteC is offline  
Old 25th January 2005   #5
Inactive
 
Profile:
Join Date: Jan 2005
Posts: 38
Computer Experience:
Experienced
coop Reputation Level


Quote:
Originally Posted by Christer
Hello coop,
welcome to the Windows BBS ...... ...... !

Have a look in DMA Mode for ATA/ATAPI Devices in Windows XP for a possible cause or explanation.

Christer
Christer and PeteC - many thanks! I was just starting down the correct path after checking the Event Viewer and seeing the HD time out. It was never consecutive - tho', strangely, it was usually at 1hr intervals. Maybe while the HD was in sleep mode?

I'm not sure. It seem like one time it occured was during high usage and no errors, on the user end, were observed.

Anyway, I think the arcticles led to the correct reg edit for my problem. Again - many thanks.

coop is offline  
Old 25th January 2005   #6
Staff
 
Christer's Avatar
 
Profile:
Join Date: Dec 2002
Location: Sweden
Posts: 5,162
Computer Experience:
I'm trying!
Christer Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation Level


coop,
You're welcome ...... ...... !

Please post back with additional feedback if the problem recurs!

Christer

Christer is offline  
Old 25th January 2005   #7
Inactive
 
Profile:
Join Date: Jan 2005
Posts: 38
Computer Experience:
Experienced
coop Reputation Level


Quote:
Originally Posted by Christer
coop,
You're welcome ...... ...... !

Please post back with additional feedback if the problem recurs!

Christer
Seemed to fix the problem... at least overnight... however there is some activity in my Event Viewer that I wonder about. If you don't mind, I'm gonna post some of the strange entires here... I'm almost afraid that it is a tojan - altho' I'm kinda a security nut.

Quote:
Type Date Time Source Category Event User Computer
Success Audit 1/25/2005 7:04:00 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:04:00 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 7:00:22 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:22 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:22 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:30:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 6:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:30:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 5:00:21 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 4:00:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:46:36 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:46:36 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:30:20 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 3:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:30:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 2:00:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:19 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:19 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:18 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:30:18 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 1:00:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:39:16 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:39:16 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:30:17 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/25/2005 12:00:16 AM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:30:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 11:00:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:16 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:16 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:30:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 10:00:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:30:15 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Privilege Use 576 NETWORK SERVICE HAL2000
Success Audit 1/24/2005 9:00:14 PM Security Logon/Logoff 528 NETWORK SERVICE HAL2000


More info on the Logon/Logoff entries reads:
Quote:
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 1/25/2005
Time: 7:04:00 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: HAL2000
Description:
Successful Logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Logon Type: 5
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name:
Logon GUID: {00000000-0000-0000-0000-000000000000}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


And the Privilege entry reads:
Quote:
Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 1/25/2005
Time: 7:04:00 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: HAL2000
Description:
Special privileges assigned to new logon:
User Name: NETWORK SERVICE
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Privileges: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Is this activity a little over the top? Does it suggest a remote hack - or are therse normal entries?

coop is offline  
Old 25th January 2005   #8
Staff
 
Christer's Avatar
 
Profile:
Join Date: Dec 2002
Location: Sweden
Posts: 5,162
Computer Experience:
I'm trying!
Christer Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation Level


coop,
it seems like You may have a virus:

advapi - advapi.exe - Process Information

advapi.exe

For better assistance, post a new thread in Removing Spyware & Viruses

Christer


Last edited by Christer; 25th January 2005 at 15:49. Reason: additional link
Christer is offline  
Old 25th January 2005   #9
Inactive
 
Profile:
Join Date: Jan 2005
Posts: 38
Computer Experience:
Experienced
coop Reputation Level


Quote:
Originally Posted by Christer
coop,
it seems like You may have a virus:

advapi - advapi.exe - Process Information

advapi.exe

For better assistance, post a new thread in Removing Spyware & Viruses

Christer
Eh, man, I'm stumped. I posted at the virus forum - but this is a strange one. My McAffee scan found no virus and the file advapi.exe can not be found in any folder.

Also, advapi.exe does not show up as a running process or boot process.

Additional searches seem to show that advapi is a legit WIN service that registers events during a logon. The question is why are there so many logons of this type?

The Logon Type 5 suggests a Service Controller access - which would mean that it is a legit opporation and not a remote access or anything - wouldn't it?

I cannot find anything in regard to advapi as a system event 528 except to find peeple with a similar problem to mine - multiple entries - but no resolutions.

coop is offline  
Old 25th January 2005   #10
Staff
 
Christer's Avatar
 
Profile:
Join Date: Dec 2002
Location: Sweden
Posts: 5,162
Computer Experience:
I'm trying!
Christer Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation Level


I checked my event log on XP-pro ...... ...... and I don't have a single event with neither id 528 nor id 576.

Since You posted in Removing Spyware & Viruses, I suggest that we close this thread and continue the other one!

Christer

Christer is offline  
Old 26th January 2005   #11
Staff
 
PeteC's Avatar
 
Profile:
Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,683
Computer Experience:
Usually not enough
PeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation LevelPeteC Reputation Level

My System

Thread closed - original problem solved - secondary problem in this thread ....

Advapi [please help understand Sucurity Event logged]

PeteC is offline  
Closed Thread

Thread Tools


Similar Threads
Thread Thread Starter Forum Replies Last Post
mirc webnet server problem z4u General Internet 0 22nd September 2003 08:20
Weird IE/XP Problem, please help a tortured Microsoft soul!!! PhantomLord Internet Explorer 6 22nd December 2002 01:38
DMA problem? jrl117 Hardware 2 11th May 2002 06:24
Weird Keyboard Problem dkline Hardware 3 26th February 2002 02:47


All times are GMT +1. The time now is 04:46.






Advertisements do not imply our endorsement of the product or service advertised.
Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.3.2
Copyright © 2002 - 2009 WindowsBBS.com. All rights reserved.
Terms of Use, Legal Information & Privacy Policy
[]