What are these Isass processes?

Terry

http://www.eventid.net/display.asp?e... rver&phase=1

http://support.microsoft.com/kb/298490/en-us


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


Terry Pinnell wrote:
I forgot to add a screenshot of the SYSTEM section of Event Viewer:

http://i154.photobucket.com/albums/s...TEM10May09.jpg

"Gerry" wrote:

Terry

http://www.eventid.net/display.asp?e... rver&phase=1

http://support.microsoft.com/kb/298490/en-us

Thanks Gerry but most of that is beyond me!

I read the reasons listed using the link "What are the common reasons
for which a service may fail to start?" but I've no idea how to find
out which applies in my case.

That second link looked promising as it seemed to be telling me how to
*fix* it, but it doesn't seem to apply to XP, only 'Microsoft Windows
2000 Server'. I have no 'DHCP' under Control Panel Administrative
Services. My entries a

Component Services
Computer Management
Data Sources (ODBC)
desktop.ini
Event Viewer
Local Security Policy
Microsoft .NET Framework 1.1 Configuration
Microsoft .NET Framework 1.1 Wizards
Performance
Server Extensions Administrator
Services

--
Terry, East Grinstead, UK

"Gerry" wrote:

Terry


NVIDIA Display Driver Service. Why was it originally disabled?

It was one of several I disabled after reading (maybe at the
BlackViper site) that it was not strictly needed. Just trying to cull
my long list of services.

Can you please clarify what exactly you mean by "fast mode" and "slow
mode"?

Just my shorthand way of referring to the two states I observe. Fast
is normal, good, my test macro runs fast, ProcMon isn't dominated by
those Lsass.exe entries, things generally seem to run briskly. Slow is
the opposite, signaled by a feeling that things aren't running quite
so fast, after which I run my test macro and see it takes about 6 secs
instead of 1 sec to complete.

Can you please advise which choices you have made for Performance
Settings? Select Start, Control Panel, System, Advanced tab ,
Performance Settings, Advanced tab, Adjust for best
performance -Processor Scheduling -Programs or Background Services and
Memory Usage -Programs or System Cache?

Both are set to the default, Programs.

Your SENS service is missing from yet another location. Let's try the
Registry. Select Start, Run, type "regedit" without quotes and click on
OK. Place the cursor on My Computer and using Edit, Find search for the
guid which follows:
{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

From my computer these are the keys I would expect you to find:

HKEY_CLASSES_ROOT\AppID\{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes

HKEY_CLASSES_ROOT\CLSID\{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D3938A B0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes


HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3938A B0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem \{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{D789AB02-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Yes.

(And no more.)


The three services not appearing in msconfig are those you have
Disabled.

If you have flashget.exe you will find it he
C:\Program Files\FlashGet\flashget.exe

Use Windows Explorer not Autoruns to see if you have the file.

As mentioned, I searched Program Files first; no sign of Flashget.

Google Search on SiSoftware Database Agent
http://snurl.com/hq73y [www_google_co_uk]

I am not what this means but every one of the first 100 results involve
Hijack This and malware investigations.

Google Search on SiSoftware Sandra Agent
http://snurl.com/hq7rp [www_google_co_uk]

Similar result to my other search. I am not sure what to make of it.
Sandra seems to be a competitor to Everest , which I use occasionally.

I don't think SiSoft Sandra is anything to worry about. I've had this
same old version on a couple of XP PCs for years. AdAware, Spybot, AVG
(free) regularly find no threats.

Why have you disabled the SSDP Discovery Service? The setting is Manual.

Again, that was part of my recent housekeeping, based on advice like
http://www.majorgeeks.com/page.php?i...very%20Service
and
http://www.blackviper.com/WinXPx64/S...ry_Service.htm
"For security reasons, disable this service."

I've now switched it back to Manual Started.

I am not sure what effect disabling the TCP/IP NetBIOS Helper might have
on your system. Normal setting is automatic.

http://www.blackviper.com/WinXPx64/S...er_Service.htm
"Safe Setting: Disabled "

I've now switched it back to Automatic Started

The Indexing Service can cause debates over it's value. Many maintain it
speeds up system performance. Others claim it wastes resources. On my
computer I have it set to Automatic. If you change from Disabled to
Automatic it can take several days to overcome an initial slow down in
system performance as it takes time to build the index.

I'm not a fan. Always found it slowed things down a lot, so one of the
first things I disable.

---------

Whether or not it's related to my intermittent slow performance, I
suspect that things aren't right with my 'networking configuration'
anyway. I'm clueless about networks. And as a sole end user I don't
really need to know much about that black art. But 15 months ago when
I got this new PC my son did help me set up a simple 'LAN' so that I
could connect a cable from my old XP Home SP2 PC to the new XP Pro SP2
one. Initially I used that extensively to transfer data and programs.
I doubt if I used it at all after last summer, but left the old PC and
cable in place just in case. I finally relegated it to my shed about a
month ago. But the software remains unchanged. I've done nothing, e.g.
I haven't removed whatever component was handling this 'network'. Too
worried I might screw something up. And anyway, maybe I have to
reconnect it someday.

I'm equally lost when it comes to topics like 'User Accounts' and
'Permissions'. So I fret that maybe at some stage I've inadvertently
altered something, so that might be why I get some of these event
error messages.

--
Terry, East Grinstead, UK

Terry

Please post a copy of the actual Event Viewer report. My earlier
response was a quick one as I was about to go out.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Terry Pinnell wrote:
"Gerry" wrote:

Terry

http://www.eventid.net/display.asp?e... rver&phase=1

http://support.microsoft.com/kb/298490/en-us

Thanks Gerry but most of that is beyond me!

I read the reasons listed using the link "What are the common reasons
for which a service may fail to start?" but I've no idea how to find
out which applies in my case.

That second link looked promising as it seemed to be telling me how to
*fix* it, but it doesn't seem to apply to XP, only 'Microsoft Windows
2000 Server'. I have no 'DHCP' under Control Panel Administrative
Services. My entries a

Component Services
Computer Management
Data Sources (ODBC)
desktop.ini
Event Viewer
Local Security Policy
Microsoft .NET Framework 1.1 Configuration
Microsoft .NET Framework 1.1 Wizards
Performance
Server Extensions Administrator
Services

Terry

Does your Registry contain this Key?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS]
"DependOnService"=hex(7):45,00,76,00,65,00,6e,00,7 4,00,53,00,79,00,73,00,74,00,\

65,00,6d,00,00,00,00,00

"Description"="Tracks system events such as Windows logon, network, and
power events. Notifies COM+ Event System subscribers of these events."

"DisplayName"="System Event Notification"

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,6 5,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73 ,00,00,00

"ObjectName"="LocalSystem"

"Group"="Network"

"Start"=dword:00000002

"Type"=dword:00000020



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00, 65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\

73,00,65,00,6e,00,73,00,2e,00,64,00,6c,00,6c,00,00 ,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Security]

"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00 ,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01 ,00,00,00,00,00,01,00,00,\

00,00,02,00,48,00,03,00,00,00,00,00,14,00,8d,01,02 ,00,01,01,00,00,00,00,00,\

05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00 ,00,00,05,12,00,00,00,01,\

01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00 ,00,05,12,00,00,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Enum]

"0"="Root\\LEGACY_SENS\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001



--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~



Terry Pinnell wrote:
"Gerry" wrote:

Terry


NVIDIA Display Driver Service. Why was it originally disabled?

It was one of several I disabled after reading (maybe at the
BlackViper site) that it was not strictly needed. Just trying to cull
my long list of services.

Can you please clarify what exactly you mean by "fast mode" and "slow
mode"?

Just my shorthand way of referring to the two states I observe. Fast
is normal, good, my test macro runs fast, ProcMon isn't dominated by
those Lsass.exe entries, things generally seem to run briskly. Slow is
the opposite, signaled by a feeling that things aren't running quite
so fast, after which I run my test macro and see it takes about 6 secs
instead of 1 sec to complete.

Can you please advise which choices you have made for Performance
Settings? Select Start, Control Panel, System, Advanced tab ,
Performance Settings, Advanced tab, Adjust for best
performance -Processor Scheduling -Programs or Background Services
and Memory Usage -Programs or System Cache?

Both are set to the default, Programs.

Your SENS service is missing from yet another location. Let's try the
Registry. Select Start, Run, type "regedit" without quotes and click
on OK. Place the cursor on My Computer and using Edit, Find search
for the guid which follows:
{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

From my computer these are the keys I would expect you to find:

HKEY_CLASSES_ROOT\AppID\{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes

HKEY_CLASSES_ROOT\CLSID\{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D3938AB 0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes


HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3938AB 0-5B9D-11D1-8DD2-00AA004ABD5E}

Yes


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\ {26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{D789AB02-5B9F-11D1-8DD2-00AA004ABD5E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Yes.

(And no more.)


The three services not appearing in msconfig are those you have
Disabled.

If you have flashget.exe you will find it he
C:\Program Files\FlashGet\flashget.exe

Use Windows Explorer not Autoruns to see if you have the file.

As mentioned, I searched Program Files first; no sign of Flashget.

Google Search on SiSoftware Database Agent
http://snurl.com/hq73y [www_google_co_uk]

I am not what this means but every one of the first 100 results
involve Hijack This and malware investigations.

Google Search on SiSoftware Sandra Agent
http://snurl.com/hq7rp [www_google_co_uk]

Similar result to my other search. I am not sure what to make of it.
Sandra seems to be a competitor to Everest , which I use
occasionally.

I don't think SiSoft Sandra is anything to worry about. I've had this
same old version on a couple of XP PCs for years. AdAware, Spybot, AVG
(free) regularly find no threats.

Why have you disabled the SSDP Discovery Service? The setting is
Manual.

Again, that was part of my recent housekeeping, based on advice like
http://www.majorgeeks.com/page.php?i...very%20Service
and
http://www.blackviper.com/WinXPx64/S...ry_Service.htm
"For security reasons, disable this service."

I've now switched it back to Manual Started.

I am not sure what effect disabling the TCP/IP NetBIOS Helper might
have on your system. Normal setting is automatic.

http://www.blackviper.com/WinXPx64/S...er_Service.htm
"Safe Setting: Disabled "

I've now switched it back to Automatic Started

The Indexing Service can cause debates over it's value. Many
maintain it speeds up system performance. Others claim it wastes
resources. On my computer I have it set to Automatic. If you change
from Disabled to Automatic it can take several days to overcome an
initial slow down in system performance as it takes time to build
the index.

I'm not a fan. Always found it slowed things down a lot, so one of the
first things I disable.

---------

Whether or not it's related to my intermittent slow performance, I
suspect that things aren't right with my 'networking configuration'
anyway. I'm clueless about networks. And as a sole end user I don't
really need to know much about that black art. But 15 months ago when
I got this new PC my son did help me set up a simple 'LAN' so that I
could connect a cable from my old XP Home SP2 PC to the new XP Pro SP2
one. Initially I used that extensively to transfer data and programs.
I doubt if I used it at all after last summer, but left the old PC and
cable in place just in case. I finally relegated it to my shed about a
month ago. But the software remains unchanged. I've done nothing, e.g.
I haven't removed whatever component was handling this 'network'. Too
worried I might screw something up. And anyway, maybe I have to
reconnect it someday.

I'm equally lost when it comes to topics like 'User Accounts' and
'Permissions'. So I fret that maybe at some stage I've inadvertently
altered something, so that might be why I get some of these event
error messages.

"Gerry" wrote:

Terry

Does your Registry contain this Key?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi ces\SENS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS]
"DependOnService"=hex(7):45,00,76,00,65,00,6e,00, 74,00,53,00,79,00,73,00,74,00,\

65,00,6d,00,00,00,00,00

"Description"="Tracks system events such as Windows logon, network, and
power events. Notifies COM+ Event System subscribers of these events."

"DisplayName"="System Event Notification"

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00, 65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73 ,00,00,00

"ObjectName"="LocalSystem"

"Group"="Network"

"Start"=dword:00000002

"Type"=dword:00000020






[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00 ,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\

73,00,65,00,6e,00,73,00,2e,00,64,00,6c,00,6c,00,00 ,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Security]

"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,0 0,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01 ,00,00,00,00,00,01,00,00,\

00,00,02,00,48,00,03,00,00,00,00,00,14,00,8d,01,02 ,00,01,01,00,00,00,00,00,\

05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00 ,00,00,05,12,00,00,00,01,\

01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00 ,00,05,12,00,00,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Enum]

"0"="Root\\LEGACY_SENS\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001

Gerry,

This is all I see at that registry location:
http://i154.photobucket.com/albums/s...rry-SENS-1.jpg

--
Terry, East Grinstead, UK

Terry

Are these two keys similarly damaged?

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S ENS

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\S ENS

Unless I am mistaken they look identical to the original key I queried
namely:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS

You can restore the System Registry Hive from a backup but if you do you
lose all your customised settings.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Terry Pinnell wrote:
"Gerry" wrote:

Terry

Does your Registry contain this Key?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS]
"DependOnService"=hex(7):45,00,76,00,65,00,6e,00,7 4,00,53,00,79,00,73,00,74,00,\

65,00,6d,00,00,00,00,00

"Description"="Tracks system events such as Windows logon, network,
and
power events. Notifies COM+ Event System subscribers of these
events."

"DisplayName"="System Event Notification"

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,6 5,00,6d,00,52,00,6f,00,6f,00,\


74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d ,00,33,00,32,00,5c,00,73,\


00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00 ,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73 ,00,00,00

"ObjectName"="LocalSystem"

"Group"="Network"

"Start"=dword:00000002

"Type"=dword:00000020






[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00, 65,00,6d,00,52,00,6f,00,6f,\


00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00 ,6d,00,33,00,32,00,5c,00,\

73,00,65,00,6e,00,73,00,2e,00,64,00,6c,00,6c,00,00 ,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Security]

"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00 ,14,00,00,00,30,00,00,00,02,\


00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01 ,00,00,00,00,00,01,00,00,\


00,00,02,00,48,00,03,00,00,00,00,00,14,00,8d,01,02 ,00,01,01,00,00,00,00,00,\


05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\


20,02,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00 ,00,00,05,12,00,00,00,01,\

01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00 ,00,05,12,00,00,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SENS\Enum]

"0"="Root\\LEGACY_SENS\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001

Gerry,

This is all I see at that registry location:
http://i154.photobucket.com/albums/s...rry-SENS-1.jpg

"Gerry" wrote:

Terry

Please post a copy of the actual Event Viewer report. My earlier
response was a quick one as I was about to go out.

Gerry,

Assuming you mean the DHCP error, this was it:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 10/05/2009
Time: 00:47:49
User: N/A
Computer: TERRY-INTEL
Description:
The IP address lease 192.168.1.33 for the Network Card with network
address 001E8CD64F1B has been denied by the DHCP server 192.168.1.1
(The DHCP Server sent a DHCPNACK message).

(The one at 23:45:13 on 09/05/2009 was identical.)

---------

FWIW:
- No Event errors so far today (11th May)

- Currently in slow mode, which appears to have been the case all
morning

- HD light is flashing constantly although I have no major application
running

- in Task Mgr with processes sorted by I/O Writes (or I/O Reads) I can
see that the main activity is from lsass.exe, avgwdsvc.exe,
avgemc.exe, svchost.exe and explorer.exe. These two screenshots were
taken about 10 seconds apart.

http://i154.photobucket.com/albums/s...Activity-2.jpg
http://i154.photobucket.com/albums/s...Activity-1.jpg

All that AVG (free) activity looks odd, especially as I have its
'Resident Shield' switched off and there are no scans occurring. I'm
tempted to uninstall it completely for a while. BTW, what anti-virus
application do you use?

--
Terry, East Grinstead, UK

Terry Pinnell wrote:

"Gerry" wrote:

Terry

Please post a copy of the actual Event Viewer report. My earlier
response was a quick one as I was about to go out.

Gerry,

Assuming you mean the DHCP error, this was it:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 10/05/2009
Time: 00:47:49
User: N/A
Computer: TERRY-INTEL
Description:
The IP address lease 192.168.1.33 for the Network Card with network
address 001E8CD64F1B has been denied by the DHCP server 192.168.1.1
(The DHCP Server sent a DHCPNACK message).

(The one at 23:45:13 on 09/05/2009 was identical.)

---------

FWIW:
- No Event errors so far today (11th May)

- Currently in slow mode, which appears to have been the case all
morning

- HD light is flashing constantly although I have no major application
running

- in Task Mgr with processes sorted by I/O Writes (or I/O Reads) I can
see that the main activity is from lsass.exe, avgwdsvc.exe,
avgemc.exe, svchost.exe and explorer.exe. These two screenshots were
taken about 10 seconds apart.

http://i154.photobucket.com/albums/s...Activity-2.jpg
http://i154.photobucket.com/albums/s...Activity-1.jpg

All that AVG (free) activity looks odd, especially as I have its
'Resident Shield' switched off and there are no scans occurring. I'm
tempted to uninstall it completely for a while. BTW, what anti-virus
application do you use?

And, staying with the performance issue rather than the missing
Service, here is a typical screen (fraction of a second) from ProcMon:
http://i154.photobucket.com/albums/s...s-Activity.jpg

Any ideas about the cause of all those countless Security\Policy
entries?

--
Terry, East Grinstead, UK

"Gerry" wrote:

Terry

Are these two keys similarly damaged?

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ SENS

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ SENS

Unless I am mistaken they look identical to the original key I queried
namely:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi ces\SENS

Yes, and both look identical to the one I posted.

You can restore the System Registry Hive from a backup but if you do you
lose all your customised settings.

That sounds unpleasant!

--
Terry, East Grinstead, UK

Terry

http://www.eventid.net/display.asp?e...Dhcp& phase=1

The earlier link was based on the wrong version of the error. Just shows
guessing is not always best. However, I am not sure the comments help
over much.

Select Start, Run, type "cmd" without quotes and click on OK. Type
"ipconfig" without quotes and hit enter. What is the response?

The response I get is:

Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : home
IP Address. . . . . . . . . . . . : 192.168.1.64
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.254

http://www.ncsu.edu/resnet/windows/ipconfig/

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


Terry Pinnell wrote:
"Gerry" wrote:

Terry

Please post a copy of the actual Event Viewer report. My earlier
response was a quick one as I was about to go out.

Gerry,

Assuming you mean the DHCP error, this was it:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 10/05/2009
Time: 00:47:49
User: N/A
Computer: TERRY-INTEL
Description:
The IP address lease 192.168.1.33 for the Network Card with network
address 001E8CD64F1B has been denied by the DHCP server 192.168.1.1
(The DHCP Server sent a DHCPNACK message).

(The one at 23:45:13 on 09/05/2009 was identical.)

---------

FWIW:
- No Event errors so far today (11th May)

- Currently in slow mode, which appears to have been the case all
morning

- HD light is flashing constantly although I have no major application
running

- in Task Mgr with processes sorted by I/O Writes (or I/O Reads) I can
see that the main activity is from lsass.exe, avgwdsvc.exe,
avgemc.exe, svchost.exe and explorer.exe. These two screenshots were
taken about 10 seconds apart.

http://i154.photobucket.com/albums/s...Activity-2.jpg
http://i154.photobucket.com/albums/s...Activity-1.jpg

All that AVG (free) activity looks odd, especially as I have its
'Resident Shield' switched off and there are no scans occurring. I'm
tempted to uninstall it completely for a while. BTW, what anti-virus
application do you use?

Terry

That second link looked promising as it seemed to be telling me how to
*fix* it, but it doesn't seem to apply to XP, only 'Microsoft Windows
2000 Server'. I have no 'DHCP' under Control Panel Administrative
Services. My entries a

Is this earlier statement still true?

You should see DHCP Client

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


Terry Pinnell wrote:
"Gerry" wrote:

Terry

http://www.eventid.net/display.asp?e... rver&phase=1

http://support.microsoft.com/kb/298490/en-us

Thanks Gerry but most of that is beyond me!

I read the reasons listed using the link "What are the common reasons
for which a service may fail to start?" but I've no idea how to find
out which applies in my case.

That second link looked promising as it seemed to be telling me how to
*fix* it, but it doesn't seem to apply to XP, only 'Microsoft Windows
2000 Server'. I have no 'DHCP' under Control Panel Administrative
Services. My entries a

Component Services
Computer Management
Data Sources (ODBC)
desktop.ini
Event Viewer
Local Security Policy
Microsoft .NET Framework 1.1 Configuration
Microsoft .NET Framework 1.1 Wizards
Performance
Server Extensions Administrator
Services

Terry

I have now realised where things have gone awry.

Your list came from the wrong page. Your list comes from Administative
Tools. You need to open Services to see DHCP Client.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry wrote:
Terry

That second link looked promising as it seemed to be telling me how
to *fix* it, but it doesn't seem to apply to XP, only 'Microsoft
Windows 2000 Server'. I have no 'DHCP' under Control Panel
Administrative Services. My entries a

Is this earlier statement still true?

You should see DHCP Client


Terry Pinnell wrote:
"Gerry" wrote:

Terry

http://www.eventid.net/display.asp?e... rver&phase=1

http://support.microsoft.com/kb/298490/en-us

Thanks Gerry but most of that is beyond me!

I read the reasons listed using the link "What are the common reasons
for which a service may fail to start?" but I've no idea how to find
out which applies in my case.

That second link looked promising as it seemed to be telling me how
to *fix* it, but it doesn't seem to apply to XP, only 'Microsoft
Windows 2000 Server'. I have no 'DHCP' under Control Panel
Administrative Services. My entries a

Component Services
Computer Management
Data Sources (ODBC)
desktop.ini
Event Viewer
Local Security Policy
Microsoft .NET Framework 1.1 Configuration
Microsoft .NET Framework 1.1 Wizards
Performance
Server Extensions Administrator
Services

"Gerry" wrote:

Terry

http://www.eventid.net/display.asp?e...Dhcp& phase=1

The earlier link was based on the wrong version of the error. Just shows
guessing is not always best. However, I am not sure the comments help
over much.

Select Start, Run, type "cmd" without quotes and click on OK. Type
"ipconfig" without quotes and hit enter. What is the response?

The response I get is:

Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : home
IP Address. . . . . . . . . . . . : 192.168.1.64
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.254

http://www.ncsu.edu/resnet/windows/ipconfig/

Gerry,

1) I get
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.1.33
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1

What does that tell you?

---------

2) Re my earlier post about AVG. (Still interested to hear what AV you
use BTW.) I uninstalled AVG 8.5 (free) completely (with difficulty -
took a couple of hours). But to my disappointment my intermittent
performance problem is not changed.


3) As per my earlier post, do you think that the performance issue and
the missing System Event Notification Service (SENS) are unrelated?
Looks that way to me. Presumably SENS is nothing to do with the Error
Log service?

4) Did my various screenshots offer any further clues?

--
Terry, East Grinstead, UK

"Gerry" wrote:

Terry

That second link looked promising as it seemed to be telling me how to
*fix* it, but it doesn't seem to apply to XP, only 'Microsoft Windows
2000 Server'. I have no 'DHCP' under Control Panel Administrative
Services. My entries a

Is this earlier statement still true?

You should see DHCP Client

No DHCP.

http://i154.photobucket.com/albums/s...yCP-NoDHCP.jpg

Is this connected with the issue of missing SENS? Can you amplify your
line of thought please, as I'm getting a bit lost!

--
Terry, East Grinstead, UK