Prev: McAfee update: File SK_det.mcs is corrupt
Next: Multiple epmap TCP connections established with one XP client
From: Fredly on 4 Jun 2005 12:12
Just ran another scan and she came up clean.

Last night, after running OK for 5+hrs, it came up these two in the app log
first. Then went on to it's slew of Exchange / GC errors. Same as the last
post.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/3/2005
Time: 7:33:11 PM
User: NT AUTHORITY\SYSTEM
Computer:x
Description:
Windows cannot establish a connection to x.local with (1364).

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/3/2005
Time: 7:33:11 PM
User: NT AUTHORITY\SYSTEM
Computer: x
Description:
Windows cannot query for the list of Group Policy objects . A message that
describes the reason for this was previously logged by this policy engine.

"Fredly" <abc(a)email.com> wrote in message
news:#ACpFIRaFHA.2884(a)tk2msftngp13.phx.gbl...
> The system can not log you on due to the following error. The network
> request is not supported.
>
> Seems to be a rash of this problem in the last few days. Several people
> reference a virus, worm or bot.
>
> http://www.experts-exchange.coým/Operating_Systems/Win2000/Q_ý21439641....
>
> http://www.experts-exchange.coým/Operating_Systems/Win2000/Q_ý21443828....
>
> I'm having trouble with exchange errors and then the system itself. I
too,
> ran into this one time a few weeks ago, then nothing until 6/1. Now it's
> every few hours, hard boot, happens again.
>
> We run SAVCE 8.0 and it's defs are up to date.
>
> I going in to fight with this today. Anybody here anything new? I saw
> someone already called MS. Any luck??
>
>


From: Frank McCallister SBS MVP on 4 Jun 2005 12:14
Sorry you posted in SBS 2k3 group I assumed 2k3 not 2000. Yes 9 is
compatible, 10 is latest.

--
Frank McCallister SBS MVP
COMPUMAC
"Fredly" <abc(a)email.com> wrote in message
news:%23tNq70RaFHA.3400(a)tk2msftngp13.phx.gbl...
> Thanks Dave and Frank.
>
> Frank, SAVCE is compatible with SBS 2000. I'm not very impressed by 10 at
> this time. I'd stick with 9 until they iron it out...
>
> Dave, I'm looking for someone who is having this problem and has had some
> luck with it. Thank you for your response.
>
> "You posted all over the place and haven't supplied any substantiating
> information."
>
> Anything in particular you were looking for?
>
> SBS 2000
> SAVCE 8.0
> Watchguard
>
> Here is my post from yesterday.
>
> -----------------
>
> I've got an SBS 2000 server that keeps locking up. Users cannot use
> Outlook
> or shared folders.
>
> When you try and logon at the server locally (on the console) you get:
>
> "The system can not log you on due to the following error.
>
> The network request is not supported.
>
> Please try again or ..."
>
> We must hold in the power button and hard boot. Then it works for a
> while.
> Less and less time it seems.
>
> In the time I can get in after reboots this is what I'm seeing in the
> event
> log (app) prior to lock up. In no certain order:
>
> Event Type: Error
> Event Source: MSExchangeMTA
> Event Category: Directory Access
> Event ID: 155
> Date: 6/3/2005
> Time: 7:05:09 AM
> User: N/A
> Computer: x
> Description:
> Error 0X80004005 occurred while reading information for directory name
> (DN)
> CN=SMTP
> (x-{D968AE78-98D6-45FE-AE89-EB1F92726DBA}),CN=CONNECTIONS,CN=x,CN=MICROSOFT
> EXCHANGE,CN=SERVICES,CN=CONFIGURATION,DC=x,DC=LOCAL from the directory.
> [MTA
> OPERATOR 25 38] (12)
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
> Event Type: Error
> Event Source: MSExchangeIS Public Store
> Event Category: Replication Errors
> Event ID: 3079
> Date: 6/3/2005
> Time: 6:50:46 AM
> User: N/A
> Computer: x
> Description:
> Unexpected replication thread error 0x80004005 on database "First Storage
> Group\Public Folder Store (x)"
>
> FReplAgent
>
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
> Event Type: Warning
> Event Source: MSExchangeMU
> Event Category: General
> Event ID: 1040
> Date: 6/3/2005
> Time: 6:24:04 AM
> User: N/A
> Computer: x
> Description:
> Metabase Update failed replication 5 times with error 80004005
> (Unspecified
> error). Please change the diagnostic logging level of MSExchangeMU to
> 'minimum' or greater to find the source of the problem.
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
> Event Type: Error
> Event Source: MSExchangeSA
> Event Category: General
> Event ID: 9188
> Date: 6/3/2005
> Time: 6:17:37 AM
> User: N/A
> Computer: x
> Description:
> Microsoft Exchange System Attendant failed to read the membership of group
> 'cn=Exchange Domain Servers,cn=Users,dc=x,dc=local'. Error code
> '8007203b'.
>
> Please check whether the local computer is a member of the group. If it is
> not, stop all the Microsoft Exchange services, add the local computer into
> the group manually and restart all the services.
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1000
> Date: 6/3/2005
> Time: 6:07:04 AM
> User: NT AUTHORITY\SYSTEM
> Computer: x
> Description:
> Windows cannot determine the user or computer name. Return value (1747).
>
>
> Event Type: Error
> Event Source: MSExchangeIS Public Store
> Event Category: General
> Event ID: 7200
> Date: 6/3/2005
> Time: 6:03:00 AM
> User: N/A
> Computer: x
> Description:
> Background thread FDoUpdateCatalog halted on database "First Storage
> Group\Public Folder Store (x)" due to error code 0x80004005.
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
> Event Type: Error
> Event Source: MSExchangeDSAccess
> Event Category: Topology
> Event ID: 2103
> Date: 6/3/2005
> Time: 6:03:04 AM
> User: N/A
> Computer: x
> Description:
> Process MAD.EXE (PID=2748). All Global Catalog Servers in use are not
> responding:
> x.x.local
>
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
> Event Type: Error
> Event Source: MSExchangeSA
> Event Category: General
> Event ID: 9153
> Date: 6/3/2005
> Time: 8:33:37 AM
> User: N/A
> Computer: x
> Description:
> Microsoft Exchange System Attendant reported an error '0x8007203b' when
> setting DS notification.
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
> Event Type: Error
> Event Source: MSExchangeSA
> Event Category: RFR Interface
> Event ID: 9143
> Date: 6/3/2005
> Time: 8:35:19 AM
> User: N/A
> Computer: x
> Description:
> Referral Interface cannot contact any Global Catalog that supports the
> NSPI
> Service. Clients making RFR requests will fail to connect until a Global
> Catalog becomes available again. After a Domain Controller is promoted to
> a
> Global Catalog, it must be rebooted to support MAPI Clients.
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
> Event Type: Error
> Event Source: MSExchangeDSAccess
> Event Category: Topology
> Event ID: 2102
> Date: 6/3/2005
> Time: 8:00:34 AM
> User: N/A
> Computer: x
> Description:
> Process MAD.EXE (PID=2748). All Domain Controller Servers in use are not
> responding:
> x.x.local
>
>
> For more information, click http://www.microsoft.com/contentredirect.asp.
>
>
>
>
>
> "Fredly" <abc(a)email.com> wrote in message
> news:#ACpFIRaFHA.2884(a)tk2msftngp13.phx.gbl...
>> The system can not log you on due to the following error. The network
>> request is not supported.
>>
>> Seems to be a rash of this problem in the last few days. Several people
>> reference a virus, worm or bot.
>>
>> http://www.experts-exchange.coým/Operating_Systems/Win2000/Q_ý21439641....
>>
>> http://www.experts-exchange.coým/Operating_Systems/Win2000/Q_ý21443828....
>>
>> I'm having trouble with exchange errors and then the system itself. I
> too,
>> ran into this one time a few weeks ago, then nothing until 6/1. Now it's
>> every few hours, hard boot, happens again.
>>
>> We run SAVCE 8.0 and it's defs are up to date.
>>
>> I going in to fight with this today. Anybody here anything new? I saw
>> someone already called MS. Any luck??
>>
>>
>
>


From: Fredly on 4 Jun 2005 12:16
David-

Sorry for the broken links! This link thread says it all. Towards the end
there are two additional links that really nail it.

http://groups-beta.google.com/group/microsoft.public.win2000.networking/browse_thread/thread/27b69c439da224e2/803ce711ac10a3e0?q=%22the+system+can+not+log+you+on+due+to+the+following+error%22&rnum=3&hl=en#803ce711ac10a3e0

If that doesn't work try copying and pasting the line below into a google
groups search. This is the subject (not my post). It should come up 5th...

The network request is not supported - Help needed !!!

Thank you!


"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:eQpT56RaFHA.1040(a)TK2MSFTNGP10.phx.gbl...
> From: "Fredly" <abc(a)email.com>
>
> | Thanks Dave and Frank.
> |
> | Frank, SAVCE is compatible with SBS 2000. I'm not very impressed by 10
at
> | this time. I'd stick with 9 until they iron it out...
> |
> | Dave, I'm looking for someone who is having this problem and has had
some
> | luck with it. Thank you for your response.
> |
> | "You posted all over the place and haven't supplied any substantiating
> | information."
> |
> | Anything in particular you were looking for?
> |
> | SBS 2000
> | SAVCE 8.0
> | Watchguard
> |
> | Here is my post from yesterday.
>
> < event log entries snipped >
>
> I pcked you up in the MS Security/Virus NG. The URLs posted are brokend
and and don't see
> viral activity from anything posted thus far.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>


From: David H. Lipman on 4 Jun 2005 12:21
From: "Fredly" <abc(a)email.com>

Run a scan using the McAfee Command Line Scanner to see if there is anthing SAV missed.

You can run it in Normal Mode if you like if you don't want to bring down the server.


Dump the contents of the IE Temporary Internet Folder cache (TIF)
Start --> Settings --> Control Panel --> Internet Options --> Delete Files

Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
Tools --> Options --> Privacy --> Cache --> Clear


Download CLEAN.EXE from the URL --
http://www.ik-cs.com/programs/virtools/clean.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
{ http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
(.lnk) files and a PDF instruction file.

GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
Scanner. You may have to disable your FireWall or allow FTP.EXE to go through your FireWall
to allow the FTP utility to download the needed files

CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
to scan again at a future date, run this batch file. It will automatically check the date
of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
signature files and install them before performing the scan.

DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
you have booted from an Emergency Boot Disk or DOS disk and have already executed;
c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
http://www.bootdisk.com/bootdisk.htm

I need you to perform the following...

Execute; CLEAN.EXE
Choose; Unzip
Choose; Close

Execute; c:\mcafee\GetFiles.BAT
{ or Double-click on 'GetFiles Link' in c:\mcafee }

Reboot the PC into Safe Mode [F8 key during boot]

Shutdown as many applications as possible !
It would also help for you to read - "How to perform a clean boot in Windows XP"
http://support.microsoft.com/kb/310353

Execute; c:\mcafee\CLEAN.BAT
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


* * * Please report back your results * * *




--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


From: Fredly on 4 Jun 2005 12:26
Frank. You're right. My fault. Oops. I'm so used to posting to this SBS
group, I forgot it was a 2K3 group. I should have been specific. Duh.

"Frank McCallister SBS MVP" <anonymous> wrote in message
news:OHaxCCSaFHA.3808(a)TK2MSFTNGP14.phx.gbl...
> Sorry you posted in SBS 2k3 group I assumed 2k3 not 2000. Yes 9 is
> compatible, 10 is latest.
>
> --
> Frank McCallister SBS MVP
> COMPUMAC
> "Fredly" <abc(a)email.com> wrote in message
> news:%23tNq70RaFHA.3400(a)tk2msftngp13.phx.gbl...
> > Thanks Dave and Frank.
> >
> > Frank, SAVCE is compatible with SBS 2000. I'm not very impressed by 10
at
> > this time. I'd stick with 9 until they iron it out...
> >
> > Dave, I'm looking for someone who is having this problem and has had
some
> > luck with it. Thank you for your response.
> >
> > "You posted all over the place and haven't supplied any substantiating
> > information."
> >
> > Anything in particular you were looking for?
> >
> > SBS 2000
> > SAVCE 8.0
> > Watchguard
> >
> > Here is my post from yesterday.
> >
> > -----------------
> >
> > I've got an SBS 2000 server that keeps locking up. Users cannot use
> > Outlook
> > or shared folders.
> >
> > When you try and logon at the server locally (on the console) you get:
> >
> > "The system can not log you on due to the following error.
> >
> > The network request is not supported.
> >
> > Please try again or ..."
> >
> > We must hold in the power button and hard boot. Then it works for a
> > while.
> > Less and less time it seems.
> >
> > In the time I can get in after reboots this is what I'm seeing in the
> > event
> > log (app) prior to lock up. In no certain order:
> >
> > Event Type: Error
> > Event Source: MSExchangeMTA
> > Event Category: Directory Access
> > Event ID: 155
> > Date: 6/3/2005
> > Time: 7:05:09 AM
> > User: N/A
> > Computer: x
> > Description:
> > Error 0X80004005 occurred while reading information for directory name
> > (DN)
> > CN=SMTP
> >
(x-{D968AE78-98D6-45FE-AE89-EB1F92726DBA}),CN=CONNECTIONS,CN=x,CN=MICROSOFT
> > EXCHANGE,CN=SERVICES,CN=CONFIGURATION,DC=x,DC=LOCAL from the directory.
> > [MTA
> > OPERATOR 25 38] (12)
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Event Type: Error
> > Event Source: MSExchangeIS Public Store
> > Event Category: Replication Errors
> > Event ID: 3079
> > Date: 6/3/2005
> > Time: 6:50:46 AM
> > User: N/A
> > Computer: x
> > Description:
> > Unexpected replication thread error 0x80004005 on database "First
Storage
> > Group\Public Folder Store (x)"
> >
> > FReplAgent
> >
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Event Type: Warning
> > Event Source: MSExchangeMU
> > Event Category: General
> > Event ID: 1040
> > Date: 6/3/2005
> > Time: 6:24:04 AM
> > User: N/A
> > Computer: x
> > Description:
> > Metabase Update failed replication 5 times with error 80004005
> > (Unspecified
> > error). Please change the diagnostic logging level of MSExchangeMU to
> > 'minimum' or greater to find the source of the problem.
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Event Type: Error
> > Event Source: MSExchangeSA
> > Event Category: General
> > Event ID: 9188
> > Date: 6/3/2005
> > Time: 6:17:37 AM
> > User: N/A
> > Computer: x
> > Description:
> > Microsoft Exchange System Attendant failed to read the membership of
group
> > 'cn=Exchange Domain Servers,cn=Users,dc=x,dc=local'. Error code
> > '8007203b'.
> >
> > Please check whether the local computer is a member of the group. If it
is
> > not, stop all the Microsoft Exchange services, add the local computer
into
> > the group manually and restart all the services.
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Event Type: Error
> > Event Source: Userenv
> > Event Category: None
> > Event ID: 1000
> > Date: 6/3/2005
> > Time: 6:07:04 AM
> > User: NT AUTHORITY\SYSTEM
> > Computer: x
> > Description:
> > Windows cannot determine the user or computer name. Return value (1747).
> >
> >
> > Event Type: Error
> > Event Source: MSExchangeIS Public Store
> > Event Category: General
> > Event ID: 7200
> > Date: 6/3/2005
> > Time: 6:03:00 AM
> > User: N/A
> > Computer: x
> > Description:
> > Background thread FDoUpdateCatalog halted on database "First Storage
> > Group\Public Folder Store (x)" due to error code 0x80004005.
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Event Type: Error
> > Event Source: MSExchangeDSAccess
> > Event Category: Topology
> > Event ID: 2103
> > Date: 6/3/2005
> > Time: 6:03:04 AM
> > User: N/A
> > Computer: x
> > Description:
> > Process MAD.EXE (PID=2748). All Global Catalog Servers in use are not
> > responding:
> > x.x.local
> >
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> > Event Type: Error
> > Event Source: MSExchangeSA
> > Event Category: General
> > Event ID: 9153
> > Date: 6/3/2005
> > Time: 8:33:37 AM
> > User: N/A
> > Computer: x
> > Description:
> > Microsoft Exchange System Attendant reported an error '0x8007203b' when
> > setting DS notification.
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> > Event Type: Error
> > Event Source: MSExchangeSA
> > Event Category: RFR Interface
> > Event ID: 9143
> > Date: 6/3/2005
> > Time: 8:35:19 AM
> > User: N/A
> > Computer: x
> > Description:
> > Referral Interface cannot contact any Global Catalog that supports the
> > NSPI
> > Service. Clients making RFR requests will fail to connect until a Global
> > Catalog becomes available again. After a Domain Controller is promoted
to
> > a
> > Global Catalog, it must be rebooted to support MAPI Clients.
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> > Event Type: Error
> > Event Source: MSExchangeDSAccess
> > Event Category: Topology
> > Event ID: 2102
> > Date: 6/3/2005
> > Time: 8:00:34 AM
> > User: N/A
> > Computer: x
> > Description:
> > Process MAD.EXE (PID=2748). All Domain Controller Servers in use are not
> > responding:
> > x.x.local
> >
> >
> > For more information, click
http://www.microsoft.com/contentredirect.asp.
> >
> >
> >
> >
> >
> > "Fredly" <abc(a)email.com> wrote in message
> > news:#ACpFIRaFHA.2884(a)tk2msftngp13.phx.gbl...
> >> The system can not log you on due to the following error. The network
> >> request is not supported.
> >>
> >> Seems to be a rash of this problem in the last few days. Several
people
> >> reference a virus, worm or bot.
> >>
> >>
http://www.experts-exchange.coým/Operating_Systems/Win2000/Q_ý21439641....
> >>
> >>
http://www.experts-exchange.coým/Operating_Systems/Win2000/Q_ý21443828....
> >>
> >> I'm having trouble with exchange errors and then the system itself. I
> > too,
> >> ran into this one time a few weeks ago, then nothing until 6/1. Now
it's
> >> every few hours, hard boot, happens again.
> >>
> >> We run SAVCE 8.0 and it's defs are up to date.
> >>
> >> I going in to fight with this today. Anybody here anything new? I saw
> >> someone already called MS. Any luck??
> >>
> >>
> >
> >
>
>


First  |  Prev  |  Next  |  Last
Pages: 1 2 3
Prev: McAfee update: File SK_det.mcs is corrupt
Next: Multiple epmap TCP connections established with one XP client