System Restore ..Cannot DO !!! AHHH

[Mike]

I have tried multiple dates to do the restore (Regulear Mode & Safe Mode )
and ..It starts it..but it all comes back and says it could not be done
...pick another date ...I have had updates to micro soft service packs and
all and things are just not right ..Can you go and do a restore before
having updates done or what ?...please help...Mike

[lvee]

the very first thing 'I'd do is to look at the Event Viewer>system, and look
for any events that are indicated with a RED error that have anything to do
with system restore.
There are many reasons why it may not work. Xp requires a certain amount of
free space..you may not have enough.
I guess, the really very first thing I'd do is turn it off, run a disk
cleanup.. which will free up some space,
Defrag, and then turn system restore back on.
If that doesn't do it, post back.

>>>...I have had updates to micro soft service packs and <<<<
> all and things are just not right <<<


Are you having other problems as well?


"Mike" > wrote in message
...
>I have tried multiple dates to do the restore (Regulear Mode & Safe Mode )
>and ..It starts it..but it all comes back and says it could not be done
>..pick another date ...I have had updates to micro soft service packs and
>all and things are just not right ..Can you go and do a restore before
>having updates done or what ?...please help...Mike
>
>
>

[Rich Barry]

Mike, try rt clicking on MyComputer>select Properties>System
Restore>Check the box Turn off System Restore on all
Drives click Apply, Ok and restart. When XP loads up just reverse the
procedure and try SR again.
"Mike" > wrote in message
...
>I have tried multiple dates to do the restore (Regulear Mode & Safe Mode )
>and ..It starts it..but it all comes back and says it could not be done
>..pick another date ...I have had updates to micro soft service packs and
>all and things are just not right ..Can you go and do a restore before
>having updates done or what ?...please help...Mike
>
>
>

[Gerry Cornell]

Mike

Why do you need to use System Restore?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

http://dts-l.org/goodpost.htm

~~~~~~~~~~~~~~~~~~~~~~~~


"Mike" > wrote in message
...
>I have tried multiple dates to do the restore (Regulear Mode & Safe
>Mode ) and ..It starts it..but it all comes back and says it could not
>be done ..pick another date ...I have had updates to micro soft service
>packs and all and things are just not right ..Can you go and do a
>restore before having updates done or what ?...please help...Mike
>
>
>

[Gerry Cornell]

Rich

You only need System Restore on your drive / partition containing your
Windows operating system!

--


Regards.

Gerry

~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~


"Rich Barry" > wrote in message
...
> Mike, try rt clicking on MyComputer>select Properties>System
> Restore>Check the box Turn off System Restore on all
> Drives click Apply, Ok and restart. When XP loads up just
> reverse the procedure and try SR again.
> "Mike" > wrote in message
> ...
>>I have tried multiple dates to do the restore (Regulear Mode & Safe
>>Mode ) and ..It starts it..but it all comes back and says it could not
>>be done ..pick another date ...I have had updates to micro soft
>>service packs and all and things are just not right ..Can you go and
>>do a restore before having updates done or what ?...please help...Mike
>>
>>
>>
>
>

[leoliver]

I had so many problems with system restore I gave up on it. Now I use Norton
Goback! "Go back" always works and is much morte powerfull than system
restore.
--
your friend,
Larry


"Mike" wrote:

> I have tried multiple dates to do the restore (Regulear Mode & Safe Mode )
> and ..It starts it..but it all comes back and says it could not be done
> ...pick another date ...I have had updates to micro soft service packs and
> all and things are just not right ..Can you go and do a restore before
> having updates done or what ?...please help...Mike
>
>
>
>

[Bert Kinney]

Hi Mike,

Hi,

There are several reasons this may occur. Let's take a look at Event
Viewer for any System Restore logs that may have been created recently
that may help us diagnosing the problem.

Go to Start - Run and type eventvwr.msc and press enter.
Click on System in the left pane.
Click the gray title “Source” at the top of the source name column in
the right pane to sort by source name, look for "sr" and "srservice".
Double click on each of these events, then click on the button below the
two arrows in the upper right corner. This will copy the event
information to the clipboard. Paste the information for each of the two
event here.

How do I use the Event Viewer to search for System Restore logs?
http://bertk.mvps.org/html/tips.html#EventViewer

For more troubleshooting System Restore.

System Restore Failures to restore:
http://bertk.mvps.org/html/srfail.html


Mike wrote:
> I have tried multiple dates to do the restore (Regulear Mode & Safe
> Mode ) and ..It starts it..but it all comes back and says it could
> not be done ..pick another date ...I have had updates to micro soft
> service packs and all and things are just not right ..Can you go and
> do a restore before having updates done or what ?...please help...Mike


--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org

[Erin]

Hello,
I was unable to run System Restore to a date in the past. Previously it
always worked. When I log on I get a warning message saying
C:\windows\wystem32\afsixjiw\syshost.exe script contains suspicious material.
When I click stop running the script everything is fine. If I don't click
stop running the script right away it brings me a blue screen telling me
there is an error and to find the software or hardware creating the proble.
It gives me a stop error 0x000000F4. I've searched and cannot find anything.

Can someone help??
Erin

"Bert Kinney" wrote:

> Hi Mike,
>
> Hi,
>
> There are several reasons this may occur. Let's take a look at Event
> Viewer for any System Restore logs that may have been created recently
> that may help us diagnosing the problem.
>
> Go to Start - Run and type eventvwr.msc and press enter.
> Click on System in the left pane.
> Click the gray title “Source� at the top of the source name column in
> the right pane to sort by source name, look for "sr" and "srservice".
> Double click on each of these events, then click on the button below the
> two arrows in the upper right corner. This will copy the event
> information to the clipboard. Paste the information for each of the two
> event here.
>
> How do I use the Event Viewer to search for System Restore logs?
> http://bertk.mvps.org/html/tips.html#EventViewer
>
> For more troubleshooting System Restore.
>
> System Restore Failures to restore:
> http://bertk.mvps.org/html/srfail.html
>
>
> Mike wrote:
> > I have tried multiple dates to do the restore (Regulear Mode & Safe
> > Mode ) and ..It starts it..but it all comes back and says it could
> > not be done ..pick another date ...I have had updates to micro soft
> > service packs and all and things are just not right ..Can you go and
> > do a restore before having updates done or what ?...please help...Mike
>
>
> --
> Regards,
> Bert Kinney MS-MVP Shell/User
> http://bertk.mvps.org
>
>
>

[Gerry Cornell]

Try testing your RAM memory

Memtest86 - Memory Diagnostic Page:
http://www.memtest86.com/

Would you check this statement "C:\windows\wystem32\afsixjiw\syshost.exe
script " for typographical errors.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

http://dts-l.org/goodpost.htm

~~~~~~~~~~~~~~~~~~~~~~~~


"Erin" > wrote in message
...
> Hello,
> I was unable to run System Restore to a date in the past. Previously
> it
> always worked. When I log on I get a warning message saying
> C:\windows\wystem32\afsixjiw\syshost.exe script contains suspicious
> material.
> When I click stop running the script everything is fine. If I don't
> click
> stop running the script right away it brings me a blue screen telling
> me
> there is an error and to find the software or hardware creating the
> proble.
> It gives me a stop error 0x000000F4. I've searched and cannot find
> anything.
>
> Can someone help??
> Erin
>
> "Bert Kinney" wrote:
>
>> Hi Mike,
>>
>> Hi,
>>
>> There are several reasons this may occur. Let's take a look at Event
>> Viewer for any System Restore logs that may have been created
>> recently
>> that may help us diagnosing the problem.
>>
>> Go to Start - Run and type eventvwr.msc and press enter.
>> Click on System in the left pane.
>> Click the gray title “Source� at the top of the source name column in
>> the right pane to sort by source name, look for "sr" and "srservice".
>> Double click on each of these events, then click on the button below
>> the
>> two arrows in the upper right corner. This will copy the event
>> information to the clipboard. Paste the information for each of the
>> two
>> event here.
>>
>> How do I use the Event Viewer to search for System Restore logs?
>> http://bertk.mvps.org/html/tips.html#EventViewer
>>
>> For more troubleshooting System Restore.
>>
>> System Restore Failures to restore:
>> http://bertk.mvps.org/html/srfail.html
>>
>>
>> Mike wrote:
>> > I have tried multiple dates to do the restore (Regulear Mode & Safe
>> > Mode ) and ..It starts it..but it all comes back and says it could
>> > not be done ..pick another date ...I have had updates to micro soft
>> > service packs and all and things are just not right ..Can you go
>> > and
>> > do a restore before having updates done or what ?...please
>> > help...Mike
>>
>>
>> --
>> Regards,
>> Bert Kinney MS-MVP Shell/User
>> http://bertk.mvps.org
>>
>>
>>

[Mike]

Here ya go ..I have 6 of the srservice and 9 of the TCPIP listed ..What
gives any Idea ?...
Mike


Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 10/22/2005
Time: 4:24:01 AM
User: N/A
Computer: GUYS
Description:
TCP/IP has reached the security limit imposed on the number of concurrent
TCP connect attempts.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

--------------------------------------
Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 111
Date: 10/22/2005
Time: 11:10:53 AM
User: N/A
Computer: GUYS
Description:
A restoration to "System Checkpoint" restore point failed. No changes have
been made to the system.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Bert Kinney" > wrote in message
...
> Hi Mike,
>
> Hi,
>
> There are several reasons this may occur. Let's take a look at Event
> Viewer for any System Restore logs that may have been created recently
> that may help us diagnosing the problem.
>
> Go to Start - Run and type eventvwr.msc and press enter.
> Click on System in the left pane.
> Click the gray title “Source” at the top of the source name column in the
> right pane to sort by source name, look for "sr" and "srservice".
> Double click on each of these events, then click on the button below the
> two arrows in the upper right corner. This will copy the event information
> to the clipboard. Paste the information for each of the two event here.
>
> How do I use the Event Viewer to search for System Restore logs?
> http://bertk.mvps.org/html/tips.html#EventViewer
>
> For more troubleshooting System Restore.
>
> System Restore Failures to restore:
> http://bertk.mvps.org/html/srfail.html
>
>
> Mike wrote:
>> I have tried multiple dates to do the restore (Regulear Mode & Safe
>> Mode ) and ..It starts it..but it all comes back and says it could
>> not be done ..pick another date ...I have had updates to micro soft
>> service packs and all and things are just not right ..Can you go and
>> do a restore before having updates done or what ?...please help...Mike
>
>
> --
> Regards,
> Bert Kinney MS-MVP Shell/User
> http://bertk.mvps.org
>
>

[Mike]

Here is another one ...Mike ..this isa RED ERROR

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 10/22/2005
Time: 3:04:59 PM
User: N/A
Computer: GUYS
Description:
The Application Management service terminated with the following error:
The specified module could not be found.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.





"lvee" > wrote in message
...
> the very first thing 'I'd do is to look at the Event Viewer>system, and
> look for any events that are indicated with a RED error that have anything
> to do with system restore.
> There are many reasons why it may not work. Xp requires a certain amount
> of free space..you may not have enough.
> I guess, the really very first thing I'd do is turn it off, run a disk
> cleanup.. which will free up some space,
> Defrag, and then turn system restore back on.
> If that doesn't do it, post back.
>
>>>>...I have had updates to micro soft service packs and <<<<
>> all and things are just not right <<<
>
>
> Are you having other problems as well?
>
>
> "Mike" > wrote in message
> ...
>>I have tried multiple dates to do the restore (Regulear Mode & Safe Mode )
>>and ..It starts it..but it all comes back and says it could not be done
>>..pick another date ...I have had updates to micro soft service packs and
>>all and things are just not right ..Can you go and do a restore before
>>having updates done or what ?...please help...Mike
>>
>>
>>
>
>

[Gerry Cornell]

Mike

Found this information relating to you TCP/IP error.

Limited number of simultaneous incomplete outbound TCP connection
attempts

Detailed description
The TCP/IP stack now limits the number of simultaneous incomplete
outbound TCP connection attempts. After the limit has been reached,
subsequent connection attempts are put in a queue and will be resolved
at a fixed rate. Under normal operation, when applications are
connecting to available hosts at valid IP addresses, no connection
rate-limiting will occur. When it does occur, a new event, with ID 4226,
appears in the system’s event log.

Why is this change important? What threats does it help mitigate?
This change helps to limit the speed at which malicious programs, such
as viruses and worms, spread to uninfected computers. Malicious programs
often attempt to reach uninfected computers by opening simultaneous
connections to random IP addresses. Most of these random addresses
result in a failed connection, so a burst of such activity on a computer
is a signal that it may have been infected by a malicious program.

What works differently?
This change may cause certain security tools, such as port scanners, to
run more slowly.

How do I resolve these issues?
Stop the application that is responsible for the failing connection
attempts.

I am trying to find out how to determine which application.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.

http://dts-l.org/goodpost.htm

~~~~~~~~~~~~~~~~~~~~~~~~


"Mike" > wrote in message
...
> Here ya go ..I have 6 of the srservice and 9 of the TCPIP listed
> ..What gives any Idea ?...
> Mike
>
>
> Event Type: Warning
> Event Source: Tcpip
> Event Category: None
> Event ID: 4226
> Date: 10/22/2005
> Time: 4:24:01 AM
> User: N/A
> Computer: GUYS
> Description:
> TCP/IP has reached the security limit imposed on the number of
> concurrent TCP connect attempts.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 01 00 54 00 ......T.
> 0008: 00 00 00 00 82 10 00 80 ....?..?
> 0010: 01 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> --------------------------------------
> Event Type: Information
> Event Source: SRService
> Event Category: None
> Event ID: 111
> Date: 10/22/2005
> Time: 11:10:53 AM
> User: N/A
> Computer: GUYS
> Description:
> A restoration to "System Checkpoint" restore point failed. No changes
> have been made to the system.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> "Bert Kinney" > wrote in message
> ...
>> Hi Mike,
>>
>> Hi,
>>
>> There are several reasons this may occur. Let's take a look at Event
>> Viewer for any System Restore logs that may have been created
>> recently that may help us diagnosing the problem.
>>
>> Go to Start - Run and type eventvwr.msc and press enter.
>> Click on System in the left pane.
>> Click the gray title “Source” at the top of the source name column in
>> the right pane to sort by source name, look for "sr" and "srservice".
>> Double click on each of these events, then click on the button below
>> the two arrows in the upper right corner. This will copy the event
>> information to the clipboard. Paste the information for each of the
>> two event here.
>>
>> How do I use the Event Viewer to search for System Restore logs?
>> http://bertk.mvps.org/html/tips.html#EventViewer
>>
>> For more troubleshooting System Restore.
>>
>> System Restore Failures to restore:
>> http://bertk.mvps.org/html/srfail.html
>>
>>
>> Mike wrote:
>>> I have tried multiple dates to do the restore (Regulear Mode & Safe
>>> Mode ) and ..It starts it..but it all comes back and says it could
>>> not be done ..pick another date ...I have had updates to micro soft
>>> service packs and all and things are just not right ..Can you go and
>>> do a restore before having updates done or what ?...please
>>> help...Mike
>>
>>
>> --
>> Regards,
>> Bert Kinney MS-MVP Shell/User
>> http://bertk.mvps.org
>>
>>
>
>

[Bert Kinney]

Hi Erin,

Look like a virus/Trojan. I suggest you do a virus/malware scan on the
system with up to date anti virus/malware software.

Here are some tips on Virus and Spyware removal and prevention.
http://bertk.mvps.org/html/spyware.html

--
Regards,
Bert Kinney MS-MVP Shell/User
http://bertk.mvps.org

Erin wrote:
> Hello,
> I was unable to run System Restore to a date in the past. Previously
> it always worked. When I log on I get a warning message saying
> C:\windows\wystem32\afsixjiw\syshost.exe script contains suspicious
> material. When I click stop running the script everything is fine.
> If I don't click stop running the script right away it brings me a
> blue screen telling me there is an error and to find the software or
> hardware creating the proble. It gives me a stop error 0x000000F4.
> I've searched and cannot find anything.
>
> Can someone help??
> Erin
>
> "Bert Kinney" wrote:
>
>> Hi Mike,
>>
>> Hi,
>>
>> There are several reasons this may occur. Let's take a look at Event
>> Viewer for any System Restore logs that may have been created
>> recently that may help us diagnosing the problem.
>>
>> Go to Start - Run and type eventvwr.msc and press enter.
>> Click on System in the left pane.
>> Click the gray title "Source" at the top of the source name column in
>> the right pane to sort by source name, look for "sr" and "srservice".
>> Double click on each of these events, then click on the button below
>> the two arrows in the upper right corner. This will copy the event
>> information to the clipboard. Paste the information for each of the
>> two event here.
>>
>> How do I use the Event Viewer to search for System Restore logs?
>> http://bertk.mvps.org/html/tips.html#EventViewer
>>
>> For more troubleshooting System Restore.
>>
>> System Restore Failures to restore:
>> http://bertk.mvps.org/html/srfail.html
>>
>>
>> Mike wrote:
>>> I have tried multiple dates to do the restore (Regulear Mode & Safe
>>> Mode ) and ..It starts it..but it all comes back and says it could
>>> not be done ..pick another date ...I have had updates to micro soft
>>> service packs and all and things are just not right ..Can you go and
>>> do a restore before having updates done or what ?...please
>>> help...Mike
>>
>>
>> --
>> Regards,
>> Bert Kinney MS-MVP Shell/User
>> http://bertk.mvps.org

[lvee]

One way to find the application may be to look in the Application section of
event viewer and match up any events there with the timing of the errors in
System Restore errors.

"Gerry Cornell" > wrote in message
...
> Mike
>
> Found this information relating to you TCP/IP error.
>
> Limited number of simultaneous incomplete outbound TCP connection attempts
>
> Detailed description
> The TCP/IP stack now limits the number of simultaneous incomplete outbound
> TCP connection attempts. After the limit has been reached, subsequent
> connection attempts are put in a queue and will be resolved at a fixed
> rate. Under normal operation, when applications are connecting to
> available hosts at valid IP addresses, no connection rate-limiting will
> occur. When it does occur, a new event, with ID 4226, appears in the
> system’s event log.
>
> Why is this change important? What threats does it help mitigate?
> This change helps to limit the speed at which malicious programs, such as
> viruses and worms, spread to uninfected computers. Malicious programs
> often attempt to reach uninfected computers by opening simultaneous
> connections to random IP addresses. Most of these random addresses result
> in a failed connection, so a burst of such activity on a computer is a
> signal that it may have been infected by a malicious program.
>
> What works differently?
> This change may cause certain security tools, such as port scanners, to
> run more slowly.
>
> How do I resolve these issues?
> Stop the application that is responsible for the failing connection
> attempts.
>
> I am trying to find out how to determine which application.
>
> --
>
>
> Hope this helps.
>
> Gerry
> ~~~~~~~~~~~~~~~~~~~~~~~~
> FCA
>
> Using invalid email address
>
> Stourport, Worcs, England
> Enquire, plan and execute.
> ~~~~~~~~~~~~~~~~~~~~~~~~
> Please tell the newsgroup how any
> suggested solution worked for you.
>
> http://dts-l.org/goodpost.htm
>
> ~~~~~~~~~~~~~~~~~~~~~~~~
>
>
> "Mike" > wrote in message
> ...
>> Here ya go ..I have 6 of the srservice and 9 of the TCPIP listed ..What
>> gives any Idea ?...
>> Mike
>>
>>
>> Event Type: Warning
>> Event Source: Tcpip
>> Event Category: None
>> Event ID: 4226
>> Date: 10/22/2005
>> Time: 4:24:01 AM
>> User: N/A
>> Computer: GUYS
>> Description:
>> TCP/IP has reached the security limit imposed on the number of concurrent
>> TCP connect attempts.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 00 00 00 00 01 00 54 00 ......T.
>> 0008: 00 00 00 00 82 10 00 80 ....?..?
>> 0010: 01 00 00 00 00 00 00 00 ........
>> 0018: 00 00 00 00 00 00 00 00 ........
>> 0020: 00 00 00 00 00 00 00 00 ........
>>
>> --------------------------------------
>> Event Type: Information
>> Event Source: SRService
>> Event Category: None
>> Event ID: 111
>> Date: 10/22/2005
>> Time: 11:10:53 AM
>> User: N/A
>> Computer: GUYS
>> Description:
>> A restoration to "System Checkpoint" restore point failed. No changes
>> have been made to the system.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> "Bert Kinney" > wrote in message
>> ...
>>> Hi Mike,
>>>
>>> Hi,
>>>
>>> There are several reasons this may occur. Let's take a look at Event
>>> Viewer for any System Restore logs that may have been created recently
>>> that may help us diagnosing the problem.
>>>
>>> Go to Start - Run and type eventvwr.msc and press enter.
>>> Click on System in the left pane.
>>> Click the gray title “Source” at the top of the source name column in
>>> the right pane to sort by source name, look for "sr" and "srservice".
>>> Double click on each of these events, then click on the button below the
>>> two arrows in the upper right corner. This will copy the event
>>> information to the clipboard. Paste the information for each of the two
>>> event here.
>>>
>>> How do I use the Event Viewer to search for System Restore logs?
>>> http://bertk.mvps.org/html/tips.html#EventViewer
>>>
>>> For more troubleshooting System Restore.
>>>
>>> System Restore Failures to restore:
>>> http://bertk.mvps.org/html/srfail.html
>>>
>>>
>>> Mike wrote:
>>>> I have tried multiple dates to do the restore (Regulear Mode & Safe
>>>> Mode ) and ..It starts it..but it all comes back and says it could
>>>> not be done ..pick another date ...I have had updates to micro soft
>>>> service packs and all and things are just not right ..Can you go and
>>>> do a restore before having updates done or what ?...please help...Mike
>>>
>>>
>>> --
>>> Regards,
>>> Bert Kinney MS-MVP Shell/User
>>> http://bertk.mvps.org
>>>
>>>
>>
>>
>

[Mike]

Thank You

"lvee" > wrote in message
...
> One way to find the application may be to look in the Application section
> of event viewer and match up any events there with the timing of the
> errors in System Restore errors.
>
> "Gerry Cornell" > wrote in message
> ...
>> Mike
>>
>> Found this information relating to you TCP/IP error.
>>
>> Limited number of simultaneous incomplete outbound TCP connection
>> attempts
>>
>> Detailed description
>> The TCP/IP stack now limits the number of simultaneous incomplete
>> outbound TCP connection attempts. After the limit has been reached,
>> subsequent connection attempts are put in a queue and will be resolved at
>> a fixed rate. Under normal operation, when applications are connecting to
>> available hosts at valid IP addresses, no connection rate-limiting will
>> occur. When it does occur, a new event, with ID 4226, appears in the
>> system’s event log.
>>
>> Why is this change important? What threats does it help mitigate?
>> This change helps to limit the speed at which malicious programs, such as
>> viruses and worms, spread to uninfected computers. Malicious programs
>> often attempt to reach uninfected computers by opening simultaneous
>> connections to random IP addresses. Most of these random addresses result
>> in a failed connection, so a burst of such activity on a computer is a
>> signal that it may have been infected by a malicious program.
>>
>> What works differently?
>> This change may cause certain security tools, such as port scanners, to
>> run more slowly.
>>
>> How do I resolve these issues?
>> Stop the application that is responsible for the failing connection
>> attempts.
>>
>> I am trying to find out how to determine which application.
>>
>> --
>>
>>
>> Hope this helps.
>>
>> Gerry
>> ~~~~~~~~~~~~~~~~~~~~~~~~
>> FCA
>>
>> Using invalid email address
>>
>> Stourport, Worcs, England
>> Enquire, plan and execute.
>> ~~~~~~~~~~~~~~~~~~~~~~~~
>> Please tell the newsgroup how any
>> suggested solution worked for you.
>>
>> http://dts-l.org/goodpost.htm
>>
>> ~~~~~~~~~~~~~~~~~~~~~~~~
>>
>>
>> "Mike" > wrote in message
>> ...
>>> Here ya go ..I have 6 of the srservice and 9 of the TCPIP listed ..What
>>> gives any Idea ?...
>>> Mike
>>>
>>>
>>> Event Type: Warning
>>> Event Source: Tcpip
>>> Event Category: None
>>> Event ID: 4226
>>> Date: 10/22/2005
>>> Time: 4:24:01 AM
>>> User: N/A
>>> Computer: GUYS
>>> Description:
>>> TCP/IP has reached the security limit imposed on the number of
>>> concurrent TCP connect attempts.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>> Data:
>>> 0000: 00 00 00 00 01 00 54 00 ......T.
>>> 0008: 00 00 00 00 82 10 00 80 ....?..?
>>> 0010: 01 00 00 00 00 00 00 00 ........
>>> 0018: 00 00 00 00 00 00 00 00 ........
>>> 0020: 00 00 00 00 00 00 00 00 ........
>>>
>>> --------------------------------------
>>> Event Type: Information
>>> Event Source: SRService
>>> Event Category: None
>>> Event ID: 111
>>> Date: 10/22/2005
>>> Time: 11:10:53 AM
>>> User: N/A
>>> Computer: GUYS
>>> Description:
>>> A restoration to "System Checkpoint" restore point failed. No changes
>>> have been made to the system.
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> "Bert Kinney" > wrote in message
>>> ...
>>>> Hi Mike,
>>>>
>>>> Hi,
>>>>
>>>> There are several reasons this may occur. Let's take a look at Event
>>>> Viewer for any System Restore logs that may have been created recently
>>>> that may help us diagnosing the problem.
>>>>
>>>> Go to Start - Run and type eventvwr.msc and press enter.
>>>> Click on System in the left pane.
>>>> Click the gray title “Source” at the top of the source name column in
>>>> the right pane to sort by source name, look for "sr" and "srservice".
>>>> Double click on each of these events, then click on the button below
>>>> the two arrows in the upper right corner. This will copy the event
>>>> information to the clipboard. Paste the information for each of the two
>>>> event here.
>>>>
>>>> How do I use the Event Viewer to search for System Restore logs?
>>>> http://bertk.mvps.org/html/tips.html#EventViewer
>>>>
>>>> For more troubleshooting System Restore.
>>>>
>>>> System Restore Failures to restore:
>>>> http://bertk.mvps.org/html/srfail.html
>>>>
>>>>
>>>> Mike wrote:
>>>>> I have tried multiple dates to do the restore (Regulear Mode & Safe
>>>>> Mode ) and ..It starts it..but it all comes back and says it could
>>>>> not be done ..pick another date ...I have had updates to micro soft
>>>>> service packs and all and things are just not right ..Can you go and
>>>>> do a restore before having updates done or what ?...please help...Mike
>>>>
>>>>
>>>> --
>>>> Regards,
>>>> Bert Kinney MS-MVP Shell/User
>>>> http://bertk.mvps.org
>>>>
>>>>
>>>
>>>
>>
>
>