101 Error on Startup

  • Thread starter Thread starter Kenneth S
  • Start date Start date
K

Kenneth S

I receive a critical error, code 101, upon startup of the
AntiSpyware tool. Rebooting doesn't seem to help, nor does
a previous suggestion of running update through the setup
program.
 
Fully automated fix for XP or Windows 2000 users to correct the critical 101 error.

Here is a batch which uses the pskill utility to automate the killing of the process gcasServ.exe for XP home or Windows 2000 users. XP Pro users do not need to download pskill and may use the taskkill utility which comes with the XP Pro Operating system. See **note below.

XP Pro users - use the line in the batch with taskkill and omit the pskill line in the batch

XP home or Windows 2000 users - use pskill and omit the taskkill line in the batch
You may download pskill.zip from Sysinternals, which operates the same way as taskkill and unzip it to C:\Windows.

Directions:
1.) Copy the text in the quote box to a notepad text file.
2.) If you have XP Pro, omit the line in bold below from the text file which reads: "pskill gcasServ.exe", and proceed to step 4.
3.) If you have XP Home or Windows 2000, delete the line in bold which reads: "taskkill /F /IM gcasServ.exe" from the text file, and then save the file as in step 4.
4.) Save the file to your desktop as 101fix.bat, NOT 101fix.txt. To do that, be sure to set the "save as type' to all files)
5. ) To run, Just double-click the 101fix.bat icon on your desktop whenever you get the 101critical error. If you stiill experience problems, see the **Note below about using MSConfig (second paragraph), and that should fix it.

Net start DcomLaunch
cd \
IF EXIST C:\Program Files\Microsoft Antispyware\ .(
cd C:\Program Files\Microsoft Antispyware\ .
) ELSE (
cd C:\Program Files\GIANT Company Software\GIANT AntiSpyware\.
)
REM use the following line if you have XP Home or Win 2000 and have downloaded pskill
pskill gcasServ.exe
REM XP Pro users use the following line - no need to download pskill
taskkill /F /IM gcasServ.exe
gcasDTserv.exe -Embedding
gcasServ.exe
GiantAntiSpywareMain.exe
exit
**Note: If you have Panda AV 2005, its real-time protection will erroneously detect pskill as a hacker tool (false positive) and immediately disinfect it. Therefore you should use the manual method of terminating gcasServ.exe in Task Manager in this case, prior to running 101fix.bat.

In the process of trying to break Microsoft Antispyware/Giant to reproduce and test this error, I once ran into an instance where I still got the critical error 101 despite running 101fix.bat. If that happens, simply do this: Disable gcasServ.exe in MSConfig - selective startup, and then reboot. Then run the fix and you will be back to normal. To disable gcasServ.exe in MSConfig do this: Click Start-->run-->type in msconfig -->OK. Click startup and uncheck the process gcasServ.exe. Then reboot. Run the fix. Once the MS-AS/Giant Bullseye appears in the system tray icon, you make then go back and you can re-enable gcasServ.exe in MSConfig. I know MSConfig is not in Win 2000, so if anyone has that problem you may may download WinPatrol to manage your startups.
 
negster said:
Fully automated fix for XP or Windows 2000 users to correct the critical 101 error.

Here is a batch which uses the pskill utility to automate the killing of the process gcasServ.exe for XP home or Windows 2000 users. XP Pro users do not need to download pskill and may use the taskkill utility which comes with the XP Pro Operating system. See **note below.
Negster, I tired your procedure but it could not help me. I do get the 101 error on continued attempts to start MS AntiSpyware but I always get the error in a popup windows of "Unexpected error; quitting" on each startup of gcasDTserv.exe, gcasServ.exe and GiantAntiSpywareMain.exe processes. The gcasDTserv goes away once I click the OK button on the error dialog window and then gcasServ.exe process is running but no "bulleye" icon in the system tray. The MS AntiSpyware errors.log shows these errors:

429::ln 15:ActiveX component can't create object::GIANTAntiSpywareMain:modMain:Main::7/7/2005 12:03:09 AM:XP:1.0.614
91::ln 15:Object variable or With block variable not set::GIANTAntiSpywareMain:modMain:Main::7/7/2005 12:03:09 AM:XP:1.0.614
91::ln 15:Object variable or With block variable not set::GIANTAntiSpywareMain:modMain:Main::7/7/2005 12:03:09 AM:XP:1.0.614
0::ln 0::gcasDtServ not Authorized, 2nd try.::GIANTAntiSpywareMain:modMain:Main::7/7/2005 12:03:09 AM:XP:1.0.614


I've been hunting for a solution to this problem for days. No help from Microsoft and their support newsgroup. It use to install and work fine before this last new BETA release. Can you help?

-Dave

Windows XP Pro SP2
 
This Update fix sometimes works:
Open up control panel and double-click on add/remove programs.
Select Microsoft AntiSpyware
Select "Change"
On the Microsoft AntiSpyware Maintenance Wizard, click next.
On the next screen (Microsoft AntiSpyware Maintenance Wizard) select Update
Microsoft AntiSpyware and click next.
Select Install
Let the product update.
Click Finish.

The quitting error usually prevents the standard automatic fix I gave from working. You may very possibly have a program conflict, especially if you use NAV as your antivirus, which many people do.

I can only direct you to this thread, but alas alack the only solution arrived at there, was to dump either NAV or MS-AS:
http://castlecops.com/t120274-quot_Unexpected_error_quitting_quot_who_does_this_happen.html
 
I will try your suggestion when I get home tonight. I'm afraid that it will not help because anytime any of the EXE files that make up AntiSpyware are run, I get the "Unexpected error; quitting" pop-up window and it terminates. And that includes the part of the installation near the end when it starts up the software.

After some investigating I found that all these problems started when the latest Beta came out. The previous Beta was running fine before that. When the notification of the new Beta appeared on the desktop and asked to upgrade the software, my daughter happened to be using the PC. She happens to also be in the Administrators group (because she plays SIMS2 and it won't run without being administrator. My nasty words to EA Games fell on deaf ears.) but her account is locked down by various Group Policies. But, she did select and okay the upgrade. It installed fine and ran. After that when I sign-on as unrestricted Administrator, it pops-up the "Unexpected error; quitting" when it starts up.

I read somewhere that the Microsoft Installer had a problem with uninstalling with other accounts other than the one that actually did the install originally. So I did go back and unrestricted her account so I could use her account to uninstall AntiSpyware and I did. This time I reinstalled AntiSpyware with my account and I still get the error. Argh!

I tried again to install AntiSpyware using her account again (still unrestricted) and it installed perfectly. Now why would my account refuse to run this. Nothing changed as far as configuration and policies (have none) with my account. The errors.log file hint at either an ActiveX component or DCOM problem???

I do not use any of the Norton AntiVirus. I'm using McAfee VirusScan.
 
The DCOM error may be caused by DcomLaunch not being set to automatic. To check:
1. Click Start, and then click Run.
2. Type services.msc and then click OK.
3. In the list of services, right-click the DcomLaunch service, and then click Properties.
4. In the Startup type list, select Automatic.
5. Verify that the service status is started.

The active-X component. I don't know what is causing that. I have Giant not MS-AS and it does not as far as I know have an Active-X component, judging by the 016 entries in my HJT log. The rest of the processes are identical, though. I'll try to find a MS-AS log and check.
 
Some good news. I found the problem! As I reported earlier in this thread, my daughter OK'd the install of the new BETA when prompted. It also ran for her but not me. It also did not work when I reinstalled it under my admin account. So I went snooping around the Registry tonight after all attempts and suggestions had failed me.

First thing I notice is that the Registry was full of keys pertaining to gcasDtServ.* with most of them under the HKCR\clsid keys. These keys existed even after I uninstalled the product and rebooted just to make sure. This was a bad sign.

I also ran DCOMCNFG and check for odd setting for permissions on DCOM Config since the MSAS errors.log file mention DCOM problems. The permissions was still set to default out-of-the-box so no problem there. But I notice two gcasDtServ objects (gcasDTServ.Agents and gcasDtServ.Manager). They should also not be there after I uninstalled the product. I had nothing to lose so I deleted those objects.

I went back to the Registry and started to manually delete any keys that had gcasDtServ.* written on it. Again, I had nothing to lose. There were a lot of keys under HKCR as gcasDtServ.*. 22 entries to be exact and I won't list them here. Also a lot of keys IDs under HKCR\CLSID pertaining to gcasDtServ.*.

This is where it got interesting. I found many gcasDTServ.* keys under HKLM\SOFTWARE\Classes. When I went to delete them I could not. It said Access Denied. Then it hit me that the uninstall did a lousy job of cleaning up is because it error out when it got to this point. Of course it never reported any such difficulties! I went to check the permissions of those particular keys and it had my daughters account name as one of it's granted permissions along with Administrators group and the System account. BUT, Administrators and System only had Full Control of the primary key (gcasDtServ.Agent for example) but not the subkey which all these subkeys had. The subkeys are called Clsid which referenced the values of the appropriate HKCR\CLSID key. The were no values for the Clsid by the way.

It turns out that who ever installs the AntiSpyware product is the ONLY account granted permission to the subkey Clsid. Since my daughter did the upgrade she had permission to them. I had to grant myself to each of the gcasDtServ.* keys so I could even delete them. I surmise that after she install the new Beta and I then tried to remove it, it did a partial uninstalled and could not remove some of these keys. When I went to reinstall the product again, I did not had permission to write the value to the Clsid subkeys. But of course it did not tell me that this was the case and it thought it installed it successfully per Event Viewer entry as well (until I ran it of course).

Once everything was deleted I did the reinstall of the product. It went in and worked without a hitch. BTW, I notice many many more keys in the Registry when the product is install then what I saw when it was partially uninstalled.

I do not understand why this sole account that did the install was the only one granted Full Control permission and why the Administrator and System was not. Is this a bug of their install? I never got one reply from the "official" Microsoft Newsgroup to post questions or problems about AntiSpyware. So I sought out other message boards to see if I could get any help. That is where you came in to help. I thank you for taking an interest and your time on this! I wonder if I should repost this back into Microsoft's Newsgroup as well?

Well I can sleep well tonight! ;-)

Again, thanks Negster for you suggestions and help!

-Dave
 
Hi Dave,

Sounds like you took the bull by the horns. Good for you!

Just wondering if MS-AS asks whether you want to install it for all user accounts when it is being installed? Was it installed as a global startup or your daughters user account only.
For example:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup --> for all users
C:\Documents and Settings\{Username}\Start Menu\Programs\Startup --> a single user

There is a fast way to search for and remove registry remnants that survive uninstalls. I used it to remove 155 symantec entries. It is semi-automated, and just requires editing a text file to make a registry script. This thread describes how to do it for My WAy, but you can apply it to anything:
http://castlecops.com/t123820-Get_rid_of_My_Way_Search_Bar.html

I didn't finish the explanation ther, because the user never returned, but if you want I can tell you, if your interested. :)
 
negster said:
Just wondering if MS-AS asks whether you want to install it for all user accounts when it is being installed? Was it installed as a global startup or your daughters user account only.
For example:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup --> for all users
C:\Documents and Settings\{Username}\Start Menu\Programs\Startup --> a single user
The install did not give the choice for All Users or just the user. The MSAS program group is listed under the C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft AntiSpyware. The startup of the program itself is not under any Startup folder. It's run out of the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Registry entry is gcasServ.

The big problem now is many of the Registry keys used by MSAS do not allow the Users group access hence all my local user account can not use the program. Even any other accounts that have admind rights. Only the installer account. I've not have the time to go through and reset the Registry permissions to include the Users group in the permissions for Read access. If changed, at least then they will be able to run it but can not change any of the settings (which is good I guess). If it was running for the users and it finds some spyware, will it quarantine it with just read access? Who knows what it will do. It will be a lot of work to change the permissions as many of the keys permission and their subkeys are set not to inherent from the parent.

I will look at the Registry removal program you mention.
 
Back
Top