windows2000 Problems after SP4 & Rollup installation

This is a plea for assistance. My 3 networked Windows 2000 Professional systems (lets call them A, B & C) now function only in protected mode since installing Windows 2000 SP4 and SP4 Roll-up. The desktop on machine A failed to appear on reboot after installation with message: "Can't find file "null" (or one of its components). Make sure file name is correct and all required libraries are available."

Desktops on the other 2 machines appeared but did not work. In
standard mode, clicking on start and then control panel did nothing.

In protected mode, desktops appeared but with speed and functionality
problems. A new icon appears in the lower left tray "Show Desktop" but it
doesn't do anything obvious in either mode.

I tried to check the history of downloaded updates to see if I had installed
them in the correct sequence. (Control panel "Add/Remove Programs" does not show dates.) There is a log file under C:WINNT NT for SP4 Roll-up but I
can't find a similar file for SP4 to compare the dates and times. I have
tried to understand the logs using suggestions and references shown in recent posts but still don't know what I am reading.

Attempting to turn back the clock, in safe mode, "reboot with last known
good configuration" made no obvious improvement. On machine B, I
un-installed SP4 Roll-Up but that made the desktop disappear in normal mode.

My portable external backup drive does not seem to want to mount in safe
mode so my belated backup attempt is stalled until that is sorted out.

Should I uninstall Rollup and SP4 and try again? Uninstall for SP4 gives scarey warnings about things that won't work after an uninstall.

Can the Winn 2000 OS be "repaired "?

What can I do to get back where I started?

How do I get may desktop back in normal mode? (It appears and works in Safe mode.)

Suggestions will be very much appreciated. Thanks!
--
alancello

 

Welcome to the forum and "ouch" on having so many problems hitting all at once.

First, the easy one. Show Desktop is normal and harmless. It's function is to give a one-click way to minimize all open windows and it's actually a windows explorer function with a couple of special switches.

Next a question - are you running a workgroup network with just these 3 machines?

 

Many thanks for taking an interest in my dilemma and for your explanation of the Show Desktop function. This feature performs just as you said in safe mode.

A qualified yes to your question about our network. I'm not sure about the term workgroup but clicking on My Network Places shows a MS Network of 3 MS2000 Professional systems. I say "qualified" because machine C is served by a wireless router while A, B and the wireless router and high speed modem are all hard wired. The wireless router also supports a 4th machine which has a different operating system (XP), is working fine and is not part of this problem or discussion.

Thanks again

alancello

 

Workgroup - the possibilities are to have a workgroup that is all peer machines with no central controller or to have a domain where you have a server set up as domain controller and some number of workstations. You have a workgroup network.

For now I'd love to get more information and I'm hoping your event logs will help out there. Many errors and warnings are written to these logs with enough detail to offer a starting place for fixing problems.

Pick one of the problem workstations and boot it into safe mode. Then click on start, on run, key eventvwr.msc into the run line and click OK. That should bring up your event viewer and there will be at least 3 logs there; system, security, applications. Right-click on each of them and select to clear the log (of probably hundreds of entries that would just clutter things up right now).

Try to boot normally which should generate some errors.

Back to safe mode and the event logs. You will hopefully have some juicy errors and warnings. Highlight System, click on View (on the toolbar), click on Filter, then uncheck the items as shown in the first attached picture.

Now double-click open the system log section and open an error. If it looks related, click on the icon below the up/down arrows to send a text copy to your clipboard and paste that in a reply here. Do this for 4 or 5 different errors that look to you like they might be related. We'll go from there.

 

Thanks for your reply. Your directions are perfectly clear but the attachment thumbnails were not apparent (no icons visible in the box labelled Thumbnails). Maybe this is because I am in safe mode?

As a result I don't know which boxes to check/uncheck.

 

Uncheck
- Information
- Success Audit

The data for these will still be captured and you can turn off the filter anytime you wish. For now, it just makes locating problems a little easier.

Leave the other 3 checked (or check them if they aren't already)

 

Thanks Newt,

Here is the requested info:

SYSTEM LOG

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 2005-08-10
Time: 6:43:48 PM
User: NT AUTHORITY\SYSTEM
Computer: ALAN
Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not register with DCOM within the required timeout.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 2005-08-10
Time: 6:43:14 PM
User: N/A
Computer: ALAN
Description:
The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8023
Date: 2005-08-10
Time: 6:42:57 PM
User: N/A
Computer: ALAN
Description:
The value for the parameter DirectHostBinding to the browser service was illegal.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 2005-08-10
Time: 6:42:51 PM
User: N/A
Computer: ALAN
Description:
The Background Intelligent Transfer Service service depends on the Windows Management Instrumentation Driver Extensions service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 2005-08-10
Time: 6:42:50 PM
User: N/A
Computer: ALAN
Description:
The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8023
Date: 2005-08-10
Time: 6:30:41 PM
User: N/A
Computer: ALAN
Description:
The value for the parameter DirectHostBinding to the browser service was illegal.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 2005-08-10
Time: 6:28:30 PM
User: NT AUTHORITY\SYSTEM
Computer: ALAN
Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not register with DCOM within the required timeout.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 2005-08-10
Time: 6:27:57 PM
User: N/A
Computer: ALAN
Description:
The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

APPLICATION LOG

Event Type: Error
Event Source: rasctrs
Event Category: None
Event ID: 2001
Date: 2005-08-10
Time: 6:43:14 PM
User: N/A
Computer: ALAN
Description:
The description for Event ID ( 2001 ) in Source ( rasctrs ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: The event log file is corrupt..

Event Type: Error
Event Source: PerfDisk
Event Category: None
Event ID: 1000
Date: 2005-08-10
Time: 6:43:13 PM
User: N/A
Computer: ALAN
Description:
Unable to open the Disk performance object. Status code returned is data DWORD 0.
Data:
0000: 70 10 00 00 p...

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 2005-08-10
Time: 6:39:17 PM
User: NT AUTHORITY\SYSTEM
Computer: ALAN
Description:
Windows cannot unload your registry file. If you have a roaming profile, your settings are not replicated. Contact your administrator.
DETAIL - Access is denied. , Build number ((2195)).

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 61
Date: 2005-08-10
Time: 6:32:01 PM
User: N/A
Computer: ALAN
Description:
WMI ADAP was unable to process the RemoteAccess performance library due to a time violation in the open function

SECURITY LOG - No entries

alancello

 

Thanks. Some of those are what I class as harmless errors as I see them on various machines and nothing bad seems to be happening.

There are a couple that are worrying though and at a guess, one 'master' failure might be causing several others.

I was hoping to find info on 1BE1F766-5536-11D1-B726-00C04FB926AF by searching but other than seeing a couple other folks with similar issues and that particular service, no luck. I think we need to know whose critter that is. Take a look at http://www.microsoft.com/technet/su...indows+Operating+System&LCID=1033&ProdVer=5.0 for a detailed how-to and when you find out which service vendor, post back.

Side note - are you sure the PCs are free from spyware? Several sorts can cause this kind of problem.

 

Newt, the Technet URL you gave me lead me to a page of instructions which starts out:

"1. Using Regedit, navigate to the following registry value
HKLM\System\CurrentControlSet\Services\Service Name
The service name is the information displayed in the message. "

I am way over my head poking around in the Registry and don't really know what I am looking for. Does the above instruction mean that the "Service Name" is "1BE1F766-5536-11D1-B726-00C04FB926AF "?
If so, there is no such folder under "HKLM\System\CurrentControlSet\Services\
I have assumed that HKLM is a short form for HKEY_LOCAL_MACHINE. If that assumption is incorrect then there is no entry in this tree called exactly "HKLM" . Redirect please.

alancello

 

You have it correct. HKLM is HKEY_LOCAL_MACHINE and the entry should be near the top on the left side under Current Control Set and then under Services.

If you don't have it, the problem may simply be that it is registered with DCOM and that DCOM is looking for a service that no longer exists. That would certainly cause the error.

I'm gonna have to do some looking around for details on DCOM and registered services to see how to unregister it and what the likely effects might be. I have to admit this isn't an area I have ever gotten familiar with.

I seriously think at this point that you might do better with the experts at Microsoft tech support. They can probably get you fixed up safely and quickly. It will probably be a free call if SP4 or a subsequent roll-up did the damage. Otherwise I think the fee is something like $35 for a workstation case.

I'm guessing but I'd bet the same problem hit all of your PCs and the fix for one will fix the others so you are only looking at a single support case.

 

Thanks Newt. I did a scan with Ad-Aware but came up only with 14 tracking cookies, a coulomb dialer and a possible highjack attempt. I did post this problem previously on an MS Windows Update Newsgroup where there is much similar update anguish but nobody took an interest in my specific problem. I very much appreciate your response. I realize that the Newsgroup was not the official MS support group.

I'll be out of town and away from my systems from later this morning until next Tuesday morning. If you find anything that might help me in the interim, I would surely appreciate it. Thanks again.

alancello

 

Hi Wilf,

Sorry to be dense on this but I think you have said that there should be a service name folder = 1BE1F766-5536-11D1-B726-00C04FB926AF and it should appear like this: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\1BE1F766-5536-11D1-B726-00C04FB926AF.

Is that correct?

I'll be leaving shortly on my trip but wondered if you would mind taking a swing at some of the general questions in my initial post in this thread. All of that stuff is still a mystery to me and any light would help. Thanks...

alancello