LSASS.exe An invalid handle was specified

Since today I get "LSASS.exe An invalid handle was specified" on every boot.
Any ideas? Thanks. Graham.

Graham

More information please.

Please look in the System and Application logs in Event
Viewer for Warning and Error Reports over the last 2
days use and post copies here.

You can access Event Viewer by selecting Start,
Administrative Tools, and Event Viewer. When
researching the meaning of the error, information
regarding Event ID, Source and Description are
important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default...308427&sd=tech

Part of the Description of the error will include a link,
which you should double click for further information.
You can copy using copy and paste. Often the link will,
however, say there is no further information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event
Viewer and double click on the error you want to copy.
In the window, which appears is a button resembling
two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a
paste into the body of the message. This will paste
the info from the Event Viewer Error Report complete
with links into the message. Make sure this is the first
paste after exiting from Event Viewer.



Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

http://dts-l.org/goodpost.htm

~~~~~~~~~~~~~~~~~~~~~~~~



"Graham CK" <usenewsgroup@donotreply.com> wrote in message
news:dqPtf.14572$r4.4199@newsfe1-gui.ntli.net...
> Since today I get "LSASS.exe An invalid handle was specified" on every
> boot. Any ideas? Thanks. Graham.
>
>
>

Gerry,

Here is some info on my system:

I have XP Home SP2 on an HP Pavillion Celeron 330D. I run Grisoft AV and
Microsoft antispyware. I have Works 2005 installed too. My daughter has an
account on the machine: she uses MSN Messenger a lot. My son's PC is also on
the same network.

In the last week she installed and unistalled a MSN Messenger Plus! 3. I
installed a new IrDA USB driver and Alcatel phone software. I installed
FireFox 1.06 on the 30th but I have done a system restore to the 29th (on
1st Jan) to try to solve the error.

Below are warnings from the event long for the previous two days, as
requested:-

Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 01/01/2006
Time: 11:29:50
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature' failed during request for component
'{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 01/01/2006
Time: 11:29:50
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
exist.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 01/01/2006
Time: 11:29:47
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature' failed during request for component
'{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 01/01/2006
Time: 11:29:47
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
exist.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 01/01/2006
Time: 11:29:45
User: NT AUTHORITY\NETWORK SERVICE
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature' failed during request for component
'{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 01/01/2006
Time: 11:29:45
User: NT AUTHORITY\NETWORK SERVICE
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
exist.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 01/01/2006
Time: 11:01:15
User: NT AUTHORITY\SYSTEM
Computer: CKNEW
Description:
Windows saved user CKNEW\HP_Owner registry while an application or service
was still using the registry during log off. The memory used by the user's
registry has not been freed. The registry will be unloaded when it is no
longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 30/12/2005
Time: 16:20:04
User: CKNEW\Louisa
Computer: CKNEW
Description:
Windows cannot unload your classes registry file - it is still in use by
other applications or services. The file will be unloaded when it is no
longer in use.



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 30/12/2005
Time: 11:12:39
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature' failed during request for component
'{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 30/12/2005
Time: 11:12:39
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
exist.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 30/12/2005
Time: 11:12:38
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature' failed during request for component
'{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 30/12/2005
Time: 11:12:38
User: CKNEW\Graham
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
exist.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 30/12/2005
Time: 11:12:37
User: NT AUTHORITY\NETWORK SERVICE
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature' failed during request for component
'{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 30/12/2005
Time: 11:12:37
User: NT AUTHORITY\NETWORK SERVICE
Computer: CKNEW
Description:
Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
exist.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 30/12/2005
Time: 00:16:41
User: N/A
Computer: CKNEW
Description:
Faulting application wmplayer.exe, version 10.0.0.3646, faulting module
wmp.dll, version 10.0.0.3646, fault address 0x00327125.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 77 6d 70 ure wmp
0018: 6c 61 79 65 72 2e 65 78 layer.ex
0020: 65 20 31 30 2e 30 2e 30 e 10.0.0
0028: 2e 33 36 34 36 20 69 6e .3646 in
0030: 20 77 6d 70 2e 64 6c 6c wmp.dll
0038: 20 31 30 2e 30 2e 30 2e 10.0.0.
0040: 33 36 34 36 20 61 74 20 3646 at
0048: 6f 66 66 73 65 74 20 30 offset 0
0050: 30 33 32 37 31 32 35 0d 0327125.
0058: 0a .

Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8021
Date: 30/12/2005
Time: 23:42:57
User: N/A
Computer: CKNEW
Description:
The browser was unable to retrieve a list of servers from the browser master
\\ELLIOT on the network
\Device\NetBT_Tcpip_{6C00BA43-04A6-47CF-85AA-5447CAA2D650}. The data is the
error code.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 35 00 00 00 5...

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 30/12/2005
Time: 16:20:25
User: CKNEW\Louisa
Computer: CKNEW
Description:
The server {0254F2B0-7116-40FC-8551-A2ED8C0C5872} did not register with DCOM
within the required timeout.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Thanks for any help you can give.
Graham.
ps I noticed that when I click on the OK button when the error on boot
"LSASS.exe An invalid handle was specified" arrives, the machine reboots
(successfully).

The Jouranl error might be something related to incomplete uninstall of MSN!
Aren't there newer versions out there?

maybe you need a registry cleaner software!

The other one I don't know!

"Graham CK" wrote:

> Gerry,
>
> Here is some info on my system:
>
> I have XP Home SP2 on an HP Pavillion Celeron 330D. I run Grisoft AV and
> Microsoft antispyware. I have Works 2005 installed too. My daughter has an
> account on the machine: she uses MSN Messenger a lot. My son's PC is also on
> the same network.
>
> In the last week she installed and unistalled a MSN Messenger Plus! 3. I
> installed a new IrDA USB driver and Alcatel phone software. I installed
> FireFox 1.06 on the 30th but I have done a system restore to the 29th (on
> 1st Jan) to try to solve the error.
>
> Below are warnings from the event long for the previous two days, as
> requested:-
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 01/01/2006
> Time: 11:29:50
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 01/01/2006
> Time: 11:29:50
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
> The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
> exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 01/01/2006
> Time: 11:29:47
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 01/01/2006
> Time: 11:29:47
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
> The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
> exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 01/01/2006
> Time: 11:29:45
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 01/01/2006
> Time: 11:29:45
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
> The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
> exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: Userenv
> Event Category: None
> Event ID: 1517
> Date: 01/01/2006
> Time: 11:01:15
> User: NT AUTHORITY\SYSTEM
> Computer: CKNEW
> Description:
> Windows saved user CKNEW\HP_Owner registry while an application or service
> was still using the registry during log off. The memory used by the user's
> registry has not been freed. The registry will be unloaded when it is no
> longer in use.
>
> This is often caused by services running as a user account, try configuring
> the services to run in either the LocalService or NetworkService account.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: Userenv
> Event Category: None
> Event ID: 1524
> Date: 30/12/2005
> Time: 16:20:04
> User: CKNEW\Louisa
> Computer: CKNEW
> Description:
> Windows cannot unload your classes registry file - it is still in use by
> other applications or services. The file will be unloaded when it is no
> longer in use.
>
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 30/12/2005
> Time: 11:12:39
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 30/12/2005
> Time: 11:12:39
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
> The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
> exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 30/12/2005
> Time: 11:12:38
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 30/12/2005
> Time: 11:12:38
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
> The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
> exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 30/12/2005
> Time: 11:12:37
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 30/12/2005
> Time: 11:12:37
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}' failed.
> The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\' does not
> exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Error
> Event Source: Application Error
> Event Category: None
> Event ID: 1000
> Date: 30/12/2005
> Time: 00:16:41
> User: N/A
> Computer: CKNEW
> Description:
> Faulting application wmplayer.exe, version 10.0.0.3646, faulting module
> wmp.dll, version 10.0.0.3646, fault address 0x00327125.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 77 6d 70 ure wmp
> 0018: 6c 61 79 65 72 2e 65 78 layer.ex
> 0020: 65 20 31 30 2e 30 2e 30 e 10.0.0
> 0028: 2e 33 36 34 36 20 69 6e .3646 in
> 0030: 20 77 6d 70 2e 64 6c 6c wmp.dll
> 0038: 20 31 30 2e 30 2e 30 2e 10.0.0.
> 0040: 33 36 34 36 20 61 74 20 3646 at
> 0048: 6f 66 66 73 65 74 20 30 offset 0
> 0050: 30 33 32 37 31 32 35 0d 0327125.
> 0058: 0a .
>
> Event Type: Warning
> Event Source: BROWSER
> Event Category: None
> Event ID: 8021
> Date: 30/12/2005
> Time: 23:42:57
> User: N/A
> Computer: CKNEW

Graham

Can we establish what these products are?

Select Start, Run, type "regedit" without quotes and hit OK.
Then use Edit, Find to search for these guids:

43DCF766-6838-4F9A-8C91-D92DA586DFA8

A4AD656D-72E9-43A7-9DD0-E5F6AF438E72

9F47ECA8-A740-EC80-1AE2-C48048D83AA4

It will stop and you will see on the same line the name of a programme or
application. I normally use the F3 key a few times to make sure I have got
the right programme. You may not get a programme for each guid but if
we can get one or two it will help.

The main problem could well be an uninstall that went wrong.

I believe you may have some other problems but you need to start
somewhere.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


"Graham CK" <usenewsgroup@donotreply.com> wrote in message
news:th_tf.52793$Cj5.26283@newsfe6-win.ntli.net...
> Gerry,
>
> Here is some info on my system:
>
> I have XP Home SP2 on an HP Pavillion Celeron 330D. I run Grisoft AV and
> Microsoft antispyware. I have Works 2005 installed too. My daughter has an
> account on the machine: she uses MSN Messenger a lot. My son's PC is also
> on the same network.
>
> In the last week she installed and unistalled a MSN Messenger Plus! 3. I
> installed a new IrDA USB driver and Alcatel phone software. I installed
> FireFox 1.06 on the 30th but I have done a system restore to the 29th (on
> 1st Jan) to try to solve the error.
>
> Below are warnings from the event long for the previous two days, as
> requested:-
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 01/01/2006
> Time: 11:29:50
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 01/01/2006
> Time: 11:29:50
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
> Viewer\' does not exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 01/01/2006
> Time: 11:29:47
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 01/01/2006
> Time: 11:29:47
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
> Viewer\' does not exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 01/01/2006
> Time: 11:29:45
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 01/01/2006
> Time: 11:29:45
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
> Viewer\' does not exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: Userenv
> Event Category: None
> Event ID: 1517
> Date: 01/01/2006
> Time: 11:01:15
> User: NT AUTHORITY\SYSTEM
> Computer: CKNEW
> Description:
> Windows saved user CKNEW\HP_Owner registry while an application or service
> was still using the registry during log off. The memory used by the user's
> registry has not been freed. The registry will be unloaded when it is no
> longer in use.
>
> This is often caused by services running as a user account, try
> configuring the services to run in either the LocalService or
> NetworkService account.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: Userenv
> Event Category: None
> Event ID: 1524
> Date: 30/12/2005
> Time: 16:20:04
> User: CKNEW\Louisa
> Computer: CKNEW
> Description:
> Windows cannot unload your classes registry file - it is still in use by
> other applications or services. The file will be unloaded when it is no
> longer in use.
>
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 30/12/2005
> Time: 11:12:39
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 30/12/2005
> Time: 11:12:39
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
> Viewer\' does not exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 30/12/2005
> Time: 11:12:38
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 30/12/2005
> Time: 11:12:38
> User: CKNEW\Graham
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
> Viewer\' does not exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1001
> Date: 30/12/2005
> Time: 11:12:37
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature' failed during request for component
> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Warning
> Event Source: MsiInstaller
> Event Category: None
> Event ID: 1004
> Date: 30/12/2005
> Time: 11:12:37
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: CKNEW
> Description:
> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
> Viewer\' does not exist.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Error
> Event Source: Application Error
> Event Category: None
> Event ID: 1000
> Date: 30/12/2005
> Time: 00:16:41
> User: N/A
> Computer: CKNEW
> Description:
> Faulting application wmplayer.exe, version 10.0.0.3646, faulting module
> wmp.dll, version 10.0.0.3646, fault address 0x00327125.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 77 6d 70 ure wmp
> 0018: 6c 61 79 65 72 2e 65 78 layer.ex
> 0020: 65 20 31 30 2e 30 2e 30 e 10.0.0
> 0028: 2e 33 36 34 36 20 69 6e .3646 in
> 0030: 20 77 6d 70 2e 64 6c 6c wmp.dll
> 0038: 20 31 30 2e 30 2e 30 2e 10.0.0.
> 0040: 33 36 34 36 20 61 74 20 3646 at
> 0048: 6f 66 66 73 65 74 20 30 offset 0
> 0050: 30 33 32 37 31 32 35 0d 0327125.
> 0058: 0a .
>
> Event Type: Warning
> Event Source: BROWSER
> Event Category: None
> Event ID: 8021
> Date: 30/12/2005
> Time: 23:42:57
> User: N/A
> Computer: CKNEW
> Description:
> The browser was unable to retrieve a list of servers from the browser
> master \\ELLIOT on the network
> \Device\NetBT_Tcpip_{6C00BA43-04A6-47CF-85AA-5447CAA2D650}. The data is
> the error code.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 35 00 00 00 5...
>
> Event Type: Error
> Event Source: DCOM
> Event Category: None
> Event ID: 10010
> Date: 30/12/2005
> Time: 16:20:25
> User: CKNEW\Louisa
> Computer: CKNEW
> Description:
> The server {0254F2B0-7116-40FC-8551-A2ED8C0C5872} did not register with
> DCOM within the required timeout.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Thanks for any help you can give.
> Graham.
> ps I noticed that when I click on the OK button when the error on boot
> "LSASS.exe An invalid handle was specified" arrives, the machine reboots
> (successfully).
>

Gerry,

Here are the most intelligible entries I found using regedit:-

1) for 43DCF766-6838-4F9A-8C91-D92DA586DFA8:-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\667FCD348386A9F4C8199DD25A68FD8A\Insta llProperties:
ModifyPath: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
UninstallString: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\{43DCF766-6838-4F9A-8C91-D92DA586DFA8}:
Comments: A viewer for Windows Journal documents.
DisplayName: Microsoft Windows Journal Viewer
DisplayVersion: 1.5.2316.0
InstallSource: C:\DOCUME~1\Graham\LOCALS~1\Temp\IXP000.TMP\
ModifyPath: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
UninstallString: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}

Note that the "installsource" folder above does not exist on my hard drive.

2) for A4AD656D-72E9-43A7-9DD0-E5F6AF438E72
No entries found.

3) for 9F47ECA8-A740-EC80-1AE2-C48048D83AA4
No entries found.

Thanks for your help.
Graham.


"Gerry Cornell" <gcjc@tenretnitb.com> wrote in message
news:OzP3o9zDGHA.3984@TK2MSFTNGP14.phx.gbl...
> Graham
>
> Can we establish what these products are?
>
> Select Start, Run, type "regedit" without quotes and hit OK.
> Then use Edit, Find to search for these guids:
>
> 43DCF766-6838-4F9A-8C91-D92DA586DFA8
>
> A4AD656D-72E9-43A7-9DD0-E5F6AF438E72
>
> 9F47ECA8-A740-EC80-1AE2-C48048D83AA4
>
> It will stop and you will see on the same line the name of a programme or
> application. I normally use the F3 key a few times to make sure I have got
> the right programme. You may not get a programme for each guid but if
> we can get one or two it will help.
>
> The main problem could well be an uninstall that went wrong.
>
> I believe you may have some other problems but you need to start
> somewhere.
>
> --
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
>
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~
>
>
> "Graham CK" <usenewsgroup@donotreply.com> wrote in message
> news:th_tf.52793$Cj5.26283@newsfe6-win.ntli.net...
>> Gerry,
>>
>> Here is some info on my system:
>>
>> I have XP Home SP2 on an HP Pavillion Celeron 330D. I run Grisoft AV and
>> Microsoft antispyware. I have Works 2005 installed too. My daughter has
>> an account on the machine: she uses MSN Messenger a lot. My son's PC is
>> also on the same network.
>>
>> In the last week she installed and unistalled a MSN Messenger Plus! 3. I
>> installed a new IrDA USB driver and Alcatel phone software. I installed
>> FireFox 1.06 on the 30th but I have done a system restore to the 29th (on
>> 1st Jan) to try to solve the error.
>>
>> Below are warnings from the event long for the previous two days, as
>> requested:-
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 01/01/2006
>> Time: 11:29:50
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 01/01/2006
>> Time: 11:29:50
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 01/01/2006
>> Time: 11:29:47
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 01/01/2006
>> Time: 11:29:47
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 01/01/2006
>> Time: 11:29:45
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 01/01/2006
>> Time: 11:29:45
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: Userenv
>> Event Category: None
>> Event ID: 1517
>> Date: 01/01/2006
>> Time: 11:01:15
>> User: NT AUTHORITY\SYSTEM
>> Computer: CKNEW
>> Description:
>> Windows saved user CKNEW\HP_Owner registry while an application or
>> service was still using the registry during log off. The memory used by
>> the user's registry has not been freed. The registry will be unloaded
>> when it is no longer in use.
>>
>> This is often caused by services running as a user account, try
>> configuring the services to run in either the LocalService or
>> NetworkService account.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: Userenv
>> Event Category: None
>> Event ID: 1524
>> Date: 30/12/2005
>> Time: 16:20:04
>> User: CKNEW\Louisa
>> Computer: CKNEW
>> Description:
>> Windows cannot unload your classes registry file - it is still in use by
>> other applications or services. The file will be unloaded when it is no
>> longer in use.
>>
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 30/12/2005
>> Time: 11:12:39
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 30/12/2005
>> Time: 11:12:39
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 30/12/2005
>> Time: 11:12:38
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 30/12/2005
>> Time: 11:12:38
>> User: CKNEW\Graham
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1001
>> Date: 30/12/2005
>> Time: 11:12:37
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature' failed during request for component
>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Warning
>> Event Source: MsiInstaller
>> Event Category: None
>> Event ID: 1004
>> Date: 30/12/2005
>> Time: 11:12:37
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: CKNEW
>> Description:
>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>> Viewer\' does not exist.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Event Type: Error
>> Event Source: Application Error
>> Event Category: None
>> Event ID: 1000
>> Date: 30/12/2005
>> Time: 00:16:41
>> User: N/A
>> Computer: CKNEW
>> Description:
>> Faulting application wmplayer.exe, version 10.0.0.3646, faulting module
>> wmp.dll, version 10.0.0.3646, fault address 0x00327125.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 41 70 70 6c 69 63 61 74 Applicat
>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
>> 0010: 75 72 65 20 20 77 6d 70 ure wmp
>> 0018: 6c 61 79 65 72 2e 65 78 layer.ex
>> 0020: 65 20 31 30 2e 30 2e 30 e 10.0.0
>> 0028: 2e 33 36 34 36 20 69 6e .3646 in
>> 0030: 20 77 6d 70 2e 64 6c 6c wmp.dll
>> 0038: 20 31 30 2e 30 2e 30 2e 10.0.0.
>> 0040: 33 36 34 36 20 61 74 20 3646 at
>> 0048: 6f 66 66 73 65 74 20 30 offset 0
>> 0050: 30 33 32 37 31 32 35 0d 0327125.
>> 0058: 0a .
>>
>> Event Type: Warning
>> Event Source: BROWSER
>> Event Category: None
>> Event ID: 8021
>> Date: 30/12/2005
>> Time: 23:42:57
>> User: N/A
>> Computer: CKNEW
>> Description:
>> The browser was unable to retrieve a list of servers from the browser
>> master \\ELLIOT on the network
>> \Device\NetBT_Tcpip_{6C00BA43-04A6-47CF-85AA-5447CAA2D650}. The data is
>> the error code.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 35 00 00 00 5...
>>
>> Event Type: Error
>> Event Source: DCOM
>> Event Category: None
>> Event ID: 10010
>> Date: 30/12/2005
>> Time: 16:20:25
>> User: CKNEW\Louisa
>> Computer: CKNEW
>> Description:
>> The server {0254F2B0-7116-40FC-8551-A2ED8C0C5872} did not register with
>> DCOM within the required timeout.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> Thanks for any help you can give.
>> Graham.
>> ps I noticed that when I click on the OK button when the error on boot
>> "LSASS.exe An invalid handle was specified" arrives, the machine reboots
>> (successfully).
>>
>
>

Thanks.
It occurs to me that the Messenger Plus uninstall was carried out on a XP
Home Restricted User account. That may explain the unistalll problem.
Graham

Graham

I am wondering whether the use of System Restore could have solved some
problems only to create others. However, that is speculation.

The Microsoft Windows Journal Viewer is an optional extra not often
mentioned.
I think I would uninstall and see whether it has an impact on the number of
errors
being generated.

To remove Microsoft Journal Viewer, follow these steps:
1.Click Start, and then point to Control Panel.
2.Double-click Add or Remove Programs, and then click Change or Remove
Programs.
3.Click Microsoft Windows Journal Viewer, and then click Remove.
4.Follow the instructions on the screen to remove the program.

Note You may have to restart the computer to remove any files that were in
use.

Why was Journal Viewer installed originally? I ask this as the act of
uninstalling does
not prohibit you from reinstalling later.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~




"Graham CK" <usenewsgroup@donotreply.com> wrote in message
news:8P5uf.23075$q4.875@newsfe2-gui.ntli.net...
> Gerry,
>
> Here are the most intelligible entries I found using regedit:-
>
> 1) for 43DCF766-6838-4F9A-8C91-D92DA586DFA8:-
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Installer\UserData\S-1-5-18\Products\667FCD348386A9F4C8199DD25A68FD8A\Insta llProperties:
> ModifyPath: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
> UninstallString: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\{43DCF766-6838-4F9A-8C91-D92DA586DFA8}:
> Comments: A viewer for Windows Journal documents.
> DisplayName: Microsoft Windows Journal Viewer
> DisplayVersion: 1.5.2316.0
> InstallSource: C:\DOCUME~1\Graham\LOCALS~1\Temp\IXP000.TMP\
> ModifyPath: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
> UninstallString: MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
>
> Note that the "installsource" folder above does not exist on my hard
> drive.
>
> 2) for A4AD656D-72E9-43A7-9DD0-E5F6AF438E72
> No entries found.
>
> 3) for 9F47ECA8-A740-EC80-1AE2-C48048D83AA4
> No entries found.
>
> Thanks for your help.
> Graham.
>
>
> "Gerry Cornell" <gcjc@tenretnitb.com> wrote in message
> news:OzP3o9zDGHA.3984@TK2MSFTNGP14.phx.gbl...
>> Graham
>>
>> Can we establish what these products are?
>>
>> Select Start, Run, type "regedit" without quotes and hit OK.
>> Then use Edit, Find to search for these guids:
>>
>> 43DCF766-6838-4F9A-8C91-D92DA586DFA8
>>
>> A4AD656D-72E9-43A7-9DD0-E5F6AF438E72
>>
>> 9F47ECA8-A740-EC80-1AE2-C48048D83AA4
>>
>> It will stop and you will see on the same line the name of a programme or
>> application. I normally use the F3 key a few times to make sure I have
>> got
>> the right programme. You may not get a programme for each guid but if
>> we can get one or two it will help.
>>
>> The main problem could well be an uninstall that went wrong.
>>
>> I believe you may have some other problems but you need to start
>> somewhere.
>>
>> --
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~
>> FCA
>> Stourport, England
>>
>> Enquire, plan and execute
>> ~~~~~~~~~~~~~~~~~~~
>>
>>
>> "Graham CK" <usenewsgroup@donotreply.com> wrote in message
>> news:th_tf.52793$Cj5.26283@newsfe6-win.ntli.net...
>>> Gerry,
>>>
>>> Here is some info on my system:
>>>
>>> I have XP Home SP2 on an HP Pavillion Celeron 330D. I run Grisoft AV and
>>> Microsoft antispyware. I have Works 2005 installed too. My daughter has
>>> an account on the machine: she uses MSN Messenger a lot. My son's PC is
>>> also on the same network.
>>>
>>> In the last week she installed and unistalled a MSN Messenger Plus! 3. I
>>> installed a new IrDA USB driver and Alcatel phone software. I installed
>>> FireFox 1.06 on the 30th but I have done a system restore to the 29th
>>> (on 1st Jan) to try to solve the error.
>>>
>>> Below are warnings from the event long for the previous two days, as
>>> requested:-
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1001
>>> Date: 01/01/2006
>>> Time: 11:29:50
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature' failed during request for component
>>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1004
>>> Date: 01/01/2006
>>> Time: 11:29:50
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>>> Viewer\' does not exist.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1001
>>> Date: 01/01/2006
>>> Time: 11:29:47
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature' failed during request for component
>>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1004
>>> Date: 01/01/2006
>>> Time: 11:29:47
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>>> Viewer\' does not exist.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1001
>>> Date: 01/01/2006
>>> Time: 11:29:45
>>> User: NT AUTHORITY\NETWORK SERVICE
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature' failed during request for component
>>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1004
>>> Date: 01/01/2006
>>> Time: 11:29:45
>>> User: NT AUTHORITY\NETWORK SERVICE
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>>> Viewer\' does not exist.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: Userenv
>>> Event Category: None
>>> Event ID: 1517
>>> Date: 01/01/2006
>>> Time: 11:01:15
>>> User: NT AUTHORITY\SYSTEM
>>> Computer: CKNEW
>>> Description:
>>> Windows saved user CKNEW\HP_Owner registry while an application or
>>> service was still using the registry during log off. The memory used by
>>> the user's registry has not been freed. The registry will be unloaded
>>> when it is no longer in use.
>>>
>>> This is often caused by services running as a user account, try
>>> configuring the services to run in either the LocalService or
>>> NetworkService account.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: Userenv
>>> Event Category: None
>>> Event ID: 1524
>>> Date: 30/12/2005
>>> Time: 16:20:04
>>> User: CKNEW\Louisa
>>> Computer: CKNEW
>>> Description:
>>> Windows cannot unload your classes registry file - it is still in use by
>>> other applications or services. The file will be unloaded when it is no
>>> longer in use.
>>>
>>>
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1001
>>> Date: 30/12/2005
>>> Time: 11:12:39
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature' failed during request for component
>>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1004
>>> Date: 30/12/2005
>>> Time: 11:12:39
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>>> Viewer\' does not exist.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1001
>>> Date: 30/12/2005
>>> Time: 11:12:38
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature' failed during request for component
>>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1004
>>> Date: 30/12/2005
>>> Time: 11:12:38
>>> User: CKNEW\Graham
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>>> Viewer\' does not exist.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1001
>>> Date: 30/12/2005
>>> Time: 11:12:37
>>> User: NT AUTHORITY\NETWORK SERVICE
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature' failed during request for component
>>> '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Warning
>>> Event Source: MsiInstaller
>>> Event Category: None
>>> Event ID: 1004
>>> Date: 30/12/2005
>>> Time: 11:12:37
>>> User: NT AUTHORITY\NETWORK SERVICE
>>> Computer: CKNEW
>>> Description:
>>> Detection of product '{43DCF766-6838-4F9A-8C91-D92DA586DFA8}', feature
>>> 'DefaultFeature', component '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'
>>> failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Journal
>>> Viewer\' does not exist.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Event Type: Error
>>> Event Source: Application Error
>>> Event Category: None
>>> Event ID: 1000
>>> Date: 30/12/2005
>>> Time: 00:16:41
>>> User: N/A
>>> Computer: CKNEW
>>> Description:
>>> Faulting application wmplayer.exe, version 10.0.0.3646, faulting module
>>> wmp.dll, version 10.0.0.3646, fault address 0x00327125.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 41 70 70 6c 69 63 61 74 Applicat
>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
>>> 0010: 75 72 65 20 20 77 6d 70 ure wmp
>>> 0018: 6c 61 79 65 72 2e 65 78 layer.ex
>>> 0020: 65 20 31 30 2e 30 2e 30 e 10.0.0
>>> 0028: 2e 33 36 34 36 20 69 6e .3646 in
>>> 0030: 20 77 6d 70 2e 64 6c 6c wmp.dll
>>> 0038: 20 31 30 2e 30 2e 30 2e 10.0.0.
>>> 0040: 33 36 34 36 20 61 74 20 3646 at
>>> 0048: 6f 66 66 73 65 74 20 30 offset 0
>>> 0050: 30 33 32 37 31 32 35 0d 0327125.
>>> 0058: 0a .
>>>
>>> Event Type: Warning
>>> Event Source: BROWSER
>>> Event Category: None
>>> Event ID: 8021
>>> Date: 30/12/2005
>>> Time: 23:42:57
>>> User: N/A
>>> Computer: CKNEW
>>> Description:
>>> The browser was unable to retrieve a list of servers from the browser
>>> master \\ELLIOT on the network
>>> \Device\NetBT_Tcpip_{6C00BA43-04A6-47CF-85AA-5447CAA2D650}. The data is
>>> the error code.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 35 00 00 00 5...
>>>
>>> Event Type: Error
>>> Event Source: DCOM
>>> Event Category: None
>>> Event ID: 10010
>>> Date: 30/12/2005
>>> Time: 16:20:25
>>> User: CKNEW\Louisa
>>> Computer: CKNEW
>>> Description:
>>> The server {0254F2B0-7116-40FC-8551-A2ED8C0C5872} did not register with
>>> DCOM within the required timeout.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>>
>>> Thanks for any help you can give.
>>> Graham.
>>> ps I noticed that when I click on the OK button when the error on boot
>>> "LSASS.exe An invalid handle was specified" arrives, the machine
>>> reboots (successfully).
>>>
>>
>>
>
>

Gerry
The Journal Viewer unistall seems to have stopped the event errors and
warnings. And the LSASS error on startup has gone!
Thanks for your help!
Graham.

Graham

That's great. Thanks for reporting the outcome.

--

Regards.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


"Graham CK" <usenewsgroup@donotreply.com> wrote in message
news:HKCuf.25793$q4.3276@newsfe2-gui.ntli.net...
> Gerry
> The Journal Viewer unistall seems to have stopped the event errors and
> warnings. And the LSASS error on startup has gone!
> Thanks for your help!
> Graham.
>