wmiprvse.exe - app error unknown soft exception (0xc0000409) in the app at loc 0x716714a1

[JJ]

HP Media Center PC

About once a day I get dialog box

wmiprvse.exe - application error, unknown software exception
(0xc0000409) in the app at loc 0x716714a1

Research on the Internet suggested I run SFC /SCANNOW

SFC wants Windows XP CD and HP PC's don't ship with CD's everything on
D drive.

Used HP's Recovery CD-DVD Creator to burn DVDs from HP's restore
partition on D:, then copied the i386 folder from the DVD to c:\
and modifyed registry for SFC to look in that i386 folder instead of
under C:\windows\i386 which must have had some corrupt dll's since SFC
kept asking for Windows XP CD #2.

SFC ran fine against the new C:\i386 gave no messages of any kind did
not ask for Windows XP CD#2 but this did not solve the problem.

I note that WMIPRVSE.EX_ in my new C;i386 which came from the DVD
which came from the D: drive is a different size than the two copies
located in

C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\dllcache\wmiprvse.exe

I don't think running SFC /SCANNOW replaced either one of those files.

Have run Norton AntiVirus and Trojan Hunters and they find nothing.
John "J.J." Jackson

 

[Gerry Cornell]

The original wmiprvse.exe was replaced by a new version included
with the SP2 update.

Please look in the System and Application logs in Event Viewer for
Warning and Error Reports over the last 2 days use and post
copies here.

You can access Event Viewer by selecting Start, Administrative
Tools, and Event Viewer. When researching the meaning of the
error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;enus;308427&Product=winxp

Part of the Description of the error will include a link, which you should
double click for further information. You can copy using copy and paste.
Often the link will, however, say there is no further information.
http://go.microsoft.com/fw.link/events.asp
(Please note the hyperlink above is for illustration purposes only)

A tip for posting copies of Error Reports! Run Event Viewer and
double click on the error you want to copy. In the window, which
appears is a button resembling two pages. Double click the button
and close Event Viewer. Now start your message (email) and do a
paste into the body of the message. This will paste the info from the
Event Viewer Error Report complete with links into the message.
Make sure this is the first paste after exiting from Event Viewer.


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[JJ]

Thanks for trying to help me. The next time I get the error dialog I
will look and see if it has a time stamp to compare with the Event
Log.

Below are some warnings and errors I pasted from the Administrative
Tools Event Viewer
~~~~~~~~~~~~~~~~~~~~~~~~
SYSTEM EVENT VIEWER
~~~~~~~~~~~~~~~~~~~~~~~~

Event Type: Warning
Event Source: W32Time
Event Category: None
Event ID: 36
Date: 12/24/2005
Time: 9:16:11 AM
User: N/A
Computer: BIGBOY
Description:
The time service has not been able to synchronize the system time for
49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.For
more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
=============================
Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 12/22/2005
Time: 7:49:18 PM
User: N/A
Computer: BIGBOY
Description:
TCP/IP has reached the security limit imposed on the number of
concurrent TCP connect attempts.For more information, see Help and
Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
=============================
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7009
Date: 12/22/2005
Time: 7:38:37 PM
User: N/A
Computer: BIGBOY
Description:
Timeout (30000 milliseconds) waiting for the Symantec Network Drivers
Service service to connect.For more information, see Help and Support
Center at http://go.microsoft.com/fwlink/events.asp.
=============================


~~~~~~~~~~~~~~~~~~~~~~~~
APPLICATION EVENT VIEWER
~~~~~~~~~~~~~~~~~~~~~~~~
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/14/2005
Time: 6:33:51 PM
User: N/A
Computer: BIGBOY
Description:
Faulting application ccapp.exe, version 103.5.6.3, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x000111de.For more
information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 63 63 61 ure cca
0018: 70 70 2e 65 78 65 20 31 pp.exe 1
0020: 30 33 2e 35 2e 36 2e 33 03.5.6.3
0028: 20 69 6e 20 6e 74 64 6c in ntdl
0030: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
0038: 31 2e 32 36 30 30 2e 32 1.2600.2
0040: 31 38 30 20 61 74 20 6f 180 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 31 31 64 65 0d 0a 0111de..
=============================
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 12/14/2005
Time: 6:28:03 PM
User: NT AUTHORITY\SYSTEM
Computer: BIGBOY
Description:
Windows saved user BIGBOY\JJ registry while an application or service
was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when
it is no longer in use.

This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.For more information, see Help and Support
Center at http://go.microsoft.com/fwlink/events.asp.
=============================
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/14/2005
Time: 6:22:20 PM
User: N/A
Computer: BIGBOY
Description:
Faulting application ccapp.exe, version 103.5.6.3, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00011f6c.For more
information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 63 63 61 ure cca
0018: 70 70 2e 65 78 65 20 31 pp.exe 1
0020: 30 33 2e 35 2e 36 2e 33 03.5.6.3
0028: 20 69 6e 20 6e 74 64 6c in ntdl
0030: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
0038: 31 2e 32 36 30 30 2e 32 1.2600.2
0040: 31 38 30 20 61 74 20 6f 180 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 31 66 36 63 0d 0a 011f6c..

John "J.J." Jackson

 

[Gerry Cornell]

JJ

Are you running Windows Server 2003? If yes have installed
all updates?

From the messages posted it is difficult to appreciate whether
these are past or current problems. Messages over the last
two days use are actually more help. However, there may be a
common theme -Norton! Are you using Norton Internet Security?
If yes which version?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

The operating system is Windows Media Center Edition 2005 (based on XP
Home in 2005, I think), which is what shipped with this HP Media
Center PC.

Also the system came with Norton Internet Security which I generally
have disabled (the Internet Security part, not the AntiVirus) despite
Norton's recommendation to use their stuff instead of the Windows
Firewall. I have Windows Firewall enabled.

In the past I have used Zone Alarm, but right now am pretty much using
the Windows Firewall with Norton Internet Security disabled. I'm
behind a router.

Anyhow Norton Internet Security is the trial that came with the PC,
and I own Norton System Works 2005 which includes AntiVirus, and some
other stuff but does not include Norton Internet Security, so I was
thinking of uninstalling the Norton trialware and isntalling what I
own from Norton.

Do you think Norton Internet Security could be causing a problem even
when it is disabled, or do you think it is catching something I should
be concerned about?

I have run Virus Scan's and some Trojan Hunters.

Norton has given me a couple of Virus messages, AntiSpy.exe, and a
couple of others where it said access to file is denied, which I think
means that Norton was unable to get rid of the file, but I go looking
for these files with hidden files shown, and even in safe mode and I
don't see the files it thinks it found, and when I run a full system
scan it comes up empty and does not warn me again.

I have always used Norton AntiVirus. Don't really like Symantec as a
company. Do you have a recommendation of another Virus Product?

Any thoughts on Microsoft's Beta Security Software?

Thanks again for your help.

JJ

Are you running Windows Server 2003? If yes have installed
all updates?

From the messages posted it is difficult to appreciate whether
these are past or current problems. Messages over the last
two days use are actually more help. However, there may be a
common theme -Norton! Are you using Norton Internet Security?
If yes which version?

John "J.J." Jackson

 

[Gerry Cornell]

In Services is the Windows Management Instrumentation StartUp set
as Automatic as it should be? Also Remote Procedure Call set as
Automatic?

My feeling is that the Norton products are dependent on WMI and
not the reverse. However, whilst the Norton Anti-Virus offers a
reasonable level of protection they are "resource" hungry and some
Norton Utilities create their own problems. I have just dumped
Norton Anti Virus and opted for AVG 7 (Free) and Norton Personal
Firewall for the Windows Firewall ( and Router Firewall ). Only time
will tell whether the change of anti-virus programme will prove a
good choice.

In my view it is too early to make a judgement on the Microsoft
Windows One Care Beta. Now the Microsoft Anti-Spywate Beta is
a reasonable option but not as an Anti-Virus programme.

None of the Event Viewer Error Reports you posted cover the original
error message. wmiprvse.exe - application error, unknown software
exception (0xc0000409) in the app at loc 0x716714a1. Is this error
report no longer there?

For Event ID: 1517 download and install the User Profile Hive Cleanup
Service. Download details: User Profile Hive Cleanup Service
http://snipurl.com/5b61

UPHClean v1.5e readme.txt
http://snipurl.com/ko8m

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

In Services is the Windows Management Instrumentation StartUp set

as Automatic as it should be? Also Remote Procedure Call set as
Automatic?

Both are started and set automatic.

There is another entry Remote Call Locator which is not set to
automatic.

None of the Event Viewer Error Reports you posted cover the original
error message. wmiprvse.exe - application error, unknown software
exception (0xc0000409) in the app at loc 0x716714a1. Is this error
report no longer there?

I still get the original error about once a day.

For Event ID: 1517 download and install the User Profile Hive Cleanup
Service. Download details: User Profile Hive Cleanup Service
http://snipurl.com/5b61

I installed it. Do I have to run it or something, or does it just run
automatically every time I start my PC?

Thanks for your help.

John "J.J." Jackson

 

[Gerry Cornell]

JJ

I still get the original error about once a day.

Is the error occurring on Start Up or later?

Can you not find this Error in Event Viewer. I need an
exact copy to make progress.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

The error does not occur on startup.

I never shut my machine down, unless I have too, (software updates
etc.). It runs a P2P application that does not require user
intervention (eMule).

I'll come back to the machine, e.g. when I get up in the morning and
the error message will be on my desktop.

I'm also getting the renewal reminder from Norton Internet Security so
it is possible that the two messages are interrelated.

I can't find any error in the event manager that specifically talks
about anything resembling the original error message I posted.

ALSO !!

User Profile Hive Cleanup
Service. Download details: User Profile Hive Cleanup Service
http://snipurl.com/5b61

I installed it. Do I have to run it or something, or does it just run
automatically every time I start my PC?

JJ

I still get the original error about once a day.

Is the error occurring on Start Up or later?

Can you not find this Error in Event Viewer. I need an
exact copy to make progress.

John "J.J." Jackson

 

[Rock]

JJ wrote:

ALSO !!




I installed it. Do I have to run it or something, or does it just run
automatically every time I start my PC?

It installs and loads a service called User Profile Hive Cleanup.
Normally the installation sets the startup as automatic for this service
so it loads every time. To check this go to Start | Run. Type in
services.msc. Click Ok. Scroll to that service and check it's startup
type - should be set to automatic.

 

[Gerry Cornell]

JJ

What warnings / errors are you getting. These reports can be very
difficult to interpret. Unless you share with us the benefit of these
reports it becomes very difficult to help.

You need to restart the machine to see the benefit from installing
User Profile Hive Cleanup.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

User Profile Hive Cleanup Service is installed an runninng on both my
PC's now.

Back to my original error

wmiprvse.exe - app error unknown soft exception (0xc0000409) in the
app at loc 0x716714a1

In the Event Viewer it shows up under System and not as a sever
warning but just the "Information" "I" icon, and opening it can take
me to a support page that says something about reinstalling an
application to grant correct user priviledge. I'm the only user of the
computer, and my personal log in has Admin priviledges. I would
reinstall the application, but I don't know what application is
causing the error so I don't know what to reinstall.

Here is some more info:

C:\WINDOWS\system32\wbem\wmiprvse.exe
5.1.2600.2180

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 1/12/2006
Time: 12:31:06 PM
User: N/A
Computer: BIGBOY
Description:
Application popup: wmiprvse.exe - Application Error : The exception
unknown software exception (0xc0000409) occurred in the application at
location 0x716714a1.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
====================
Details
Product: Windows Operating System
Event ID: 26
Source: Application Popup
Version: 5.2
Symbolic Name: STATUS_LOG_HARD_ERROR
Message: Application popup: %1 : %2

Explanation
The program could not load a driver because the program user doesn't
have sufficient privileges to access the driver or because the drive
is missing or corrupt.

User Action
To correct this problem:Ensure that the program user has sufficient
privileges to access the directory in which the driver is installed.
Reinstall the program to restore the driver to the correct location.If
these solutions do not work, contact Product Support Services.


Version: 5.0
Symbolic Name: status_log_hard_error
Message: Unable to Load Device Driver : device driver could not
be loaded.

Explanation
The program could not load a driver because the program user doesn't
have sufficient privileges to access the driver or because the drive
is missing or corrupt.

User Action
To correct this problem:Reinstall the program to restore the driver to
the correct location.If these solutions do not work, contact Product
Support Services.

Related Knowledge Base articles
You can find additional information on this topic in the
following Microsoft Knowledge Base articles:
• File Lock or Access Denied Error Message When You Save Files
Over the Network
When you try to save a file such as a Microsoft Excel workbook
that you opened by using a universal naming convention (UNC) path, you
may receive an error message that is similar to one of the following:
Cannot read file. File is locked Access...

 

[Gerry Cornell]

JJ

Are there any Warnings / Error Reports in the Security log of
Event Viewer?

Have you installed Net.framework? If yes what version?

What function does the other computer on your network perform?
Do you share files?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

JJ

Are there any Warnings / Error Reports in the Security log of
Event Viewer?

The Event Viewer Security Log shows one entry dated 11/22 called
Success Audit.

Seems like there were more entries in the past but it could have been
on another tab in the Event Viewer.

Have you installed Net.framework? If yes what version?

Yes

Microsoft .Net Framework 1.1 and .Net Framework HotFix (KB886903)

What function does the other computer on your network perform?
Do you share files?

The other computer on my network is a Notebook and is almost always
turned off.

I have a Konica Minolta Network Laser Printer which is also usually
turned off and there is a VoIP MTA hanging off the router as well.




John "J.J." Jackson

 

[Gerry Cornell]

JJ

I would update Net Framework. Try Start, Help and Support, Keep your
computer up-to-date with
Windows Update. Opt for a Custom install.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

Sorry to be checking back so seldom.

I pretty much try to keep my computer up to date but will experiment
with what you suggest.

I have pinpointed my original error

wmiprvse.exe - app error unknown soft exception (0xc0000409) in the
app at loc 0x716714a1

seems to occur every day, and always between 5:30 and 6:00am.

It shows up in the Event Viewer under SYSTEM / as INFORMATION (i) /
SOURCE=Application PopUp

JJ

I would update Net Framework. Try Start, Help and Support, Keep your
computer up-to-date with
Windows Update. Opt for a Custom install.

John "J.J." Jackson

 

[JJ]

I updated Windows. Control Panel Add / Remove Programs shows three
different entries for .NET framework.

.NET Framework 1.1
.NET Framework 1.1HotFix

and

.NET 2.0

Is this how it should look?

I.E. can I / should I uninstall 1.1 and the 1.1 HotFix, since I have
2.0 installed or do some applications require the older version?

Anyhow I still have my daily popup

wmiprvse.exe - app error unknown soft exception (0xc0000409) in the
app at loc 0x716714a1

triggered by something between the hours of 5:30am and 6:00am.

Can I create a log file or is there some tool that will give more
information than I am getting from the Event Manager?

Thanks.

JJ

I would update Net Framework. Try Start, Help and Support, Keep your
computer up-to-date with
Windows Update. Opt for a Custom install.

John "J.J." Jackson

 

[Gerry Cornell]

JJ

Have you looked in Scheduled Tasks? Start, All Programs,
Accessories, System Tools, Scheduled Tasks?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[JJ]

Yes, I assume you mean look for something scheduled to run at 5:30 am.
I looked and don't see anything.

JJ

Have you looked in Scheduled Tasks? Start, All Programs,
Accessories, System Tools, Scheduled Tasks?

John "J.J." Jackson

 

[Gerry Cornell]

JJ

You might try filemon
http://www.sysinternals.com/Utilities/Filemon.html

This freeware utility does, however, produce collossal amounts
of data. You can filter and search.

It occurs to me that you may be able to fool the system into
producing the error at a more hospitable time of day and as
required by changing the time on your computer.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~