View Single Post
  #6  
Old 01-05-2006, 02:49 AM
Graham CK
 
Posts: n/a
Default Re: LSASS.exe An invalid handle was specified

Gerry,

Here are the most intelligible entries I found using regedit:-

1) for 43DCF766-6838-4F9A-8C91-D92DA586DFA8:-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\667FCD348386A9F4C8199DD25A68FD8A\Insta llProperties:
ModifyPath: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
UninstallString: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\{43DCF766-6838-4F9A-8C91-D92DA586DFA8}:
Comments: A viewer for Windows Journal documents.
DisplayName: Microsoft Windows Journal Viewer
DisplayVersion: 1.5.2316.0
InstallSource: C:\DOCUME~1\Graham\LOCALS~1\Temp\IXP000.TMP\
ModifyPath: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
UninstallString: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}

Note that the "installsource" folder above does not exist on my hard drive.

2) for A4AD656D-72E9-43A7-9DD0-E5F6AF438E72
No entries found.

3) for 9F47ECA8-A740-EC80-1AE2-C48048D83AA4
No entries found.

Thanks for your help.
Graham.


"Gerry Cornell" <gcjc@tenretnitb.com> wrote in message
news:OzP3o9zDGHA.3984@TK2MSFTNGP14.phx.gbl...
> Graham
>
> Can we establish what these products are?
>
> Select Start, Run, type "regedit" without quotes and hit OK.
> Then use Edit, Find to search for these guids:
>
> 43DCF766-6838-4F9A-8C91-D92DA586DFA8
>
> A4AD656D-72E9-43A7-9DD0-E5F6AF438E72
>
> 9F47ECA8-A740-EC80-1AE2-C48048D83AA4
>
> It will stop and you will see on the same line the name of a programme or
> application. I normally use the F3 key a few times to make sure I have got
> the right programme. You may not get a programme for each guid but if
> we can get one or two it will help.
>
> The main problem could well be an uninstall that went wrong.
>
> I believe you may have some other problems but you need to start
> somewhere.
>
> --
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
>
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~
>
>
> "Graham CK" <usenewsgroup@donotreply.com> wrote in message
> news:th_tf.52793$Cj5.26283@newsfe6-win.ntli.net...
>> Gerry,
>>
>> Here is some info on my system:
>>
>> I have XP Home SP2 on an HP Pavillion Celeron 330D. I run Grisoft AV and
>> Microsoft antispyware. I have Works 2005 installed too. My daughter has
>> an account on the machine: she uses MSN Messenger a lot. My son's PC is
>> also on the same network.
>>
>> In the last week she installed and unistalled a MSN Messenger Plus! 3. I
>> installed a new IrDA USB driver and Alcatel phone software. I installed
>> FireFox 1.06 on the 30th but I have done a system restore to the 29th (on
>> 1st Jan) to try to solve the error.
>>
>> Below are warnings from the event long for the previous two days, as
>> requested:-
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 01/01/2006
>> Time: 11:29:50
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 01/01/2006
>> Time: 11:29:50
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 01/01/2006
>> Time: 11:29:47
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 01/01/2006
>> Time: 11:29:47
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 01/01/2006
>> Time: 11:29:45
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 01/01/2006
>> Time: 11:29:45
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: Userenv
>> Event Category: None
>> Event ID: 1517
>> Date: 01/01/2006
>> Time: 11:01:15
>> User: NT AUTHORITY\SYSTEM
>> Computer: CKNEW
>> Description:
>> Windows saved user CKNEW\HP_Owner registry while an application or
>> service was still using the registry during log off. The memory used by
>> the user's registry has not been freed. The registry will be unloaded
>> when it is no longer in use.
>>
>> This is often caused by services running as a user account, try
>> configuring the services to run in either the LocalService or
>> NetworkService account.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: Userenv
>> Event Category: None
>> Event ID: 1524
>> Date: 30/12/2005
>> Time: 16:20:04
>> User: CKNEW\Louisa
>> Computer: CKNEW
>> Description:
>> Windows cannot unload your classes registry file - it is still in use by
>> other applications or services. The file will be unloaded when it is no
>> longer in use.
>>
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 30/12/2005
>> Time: 11:12:39
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 30/12/2005
>> Time: 11:12:39
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 30/12/2005
>> Time: 11:12:38
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 30/12/2005
>> Time: 11:12:38
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 30/12/2005
>> Time: 11:12:37
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 30/12/2005
>> Time: 11:12:37
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Error
>> Event Source: Application Error
>> Event Category: None
>> Event ID: 1000
>> Date: 30/12/2005
>> Time: 00:16:41
>> User: N/A
>> Computer: CKNEW
>> Description:
>> Faulting application wmplayer.exe, version 10.0.0.3646, faulting module
>> wmp.dll, version 10.0.0.3646, fault address 0x00327125.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 41 70 70 6c 69 63 61 74 Applicat
>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
>> 0010: 75 72 65 20 20 77 6d 70 ure wmp
>> 0018: 6c 61 79 65 72 2e 65 78 layer.ex
>> 0020: 65 20 31 30 2e 30 2e 30 e 10.0.0
>> 0028: 2e 33 36 34 36 20 69 6e .3646 in
>> 0030: 20 77 6d 70 2e 64 6c 6c wmp.dll
>> 0038: 20 31 30 2e 30 2e 30 2e 10.0.0.
>> 0040: 33 36 34 36 20 61 74 20 3646 at
>> 0048: 6f 66 66 73 65 74 20 30 offset 0
>> 0050: 30 33 32 37 31 32 35 0d 0327125.
>> 0058: 0a .
>>
>> Event Type: Warning
>> Event Source: BROWSER
>> Event Category: None
>> Event ID: 8021
>> Date: 30/12/2005
>> Time: 23:42:57
>> User: N/A
>> Computer: CKNEW
>> Description:
>> The browser was unable to retrieve a list of servers from the browser
>> master \\ELLIOT on the network
>> \Device\NetBT_Tcpip_{6C00BA43-04A6-47CF-85AA-5447CAA2D650}. The data is
>> the error code.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 35 00 00 00 5...
>>
>> Event Type: Error
>> Event Source: DCOM
>> Event Category: None
>> Event ID: 10010
>> Date: 30/12/2005
>> Time: 16:20:25
>> User: CKNEW\Louisa
>> Computer: CKNEW
>> Description:
>> The server {0254F2B0-7116-40FC-8551-A2ED8C0C5872} did not register with
>> DCOM within the required timeout.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Thanks for any help you can give.
>> Graham.
>> ps I noticed that when I click on the OK button when the error on boot
>> "LSASS.exe An invalid handle was specified" arrives, the machine reboots
>> (successfully).
>>

>
>



Reply With Quote