Any ideas what this is?

  • Thread starter Thread starter Mike Flanagan
  • Start date Start date
It's to do with the cursed mobsync and file synchronization. You can
double check that by searching for the GUID (
{6295DF2D-35EE-11D1-8707-00C04FD93327} ) in the registry, it will tell
you who or what owns it. If you don't use it you might want to disable
the mobsync annoyance and see if the error stops.

John
 
Event Type: Warning
Event Source: EventSystem
Event Category: Firing Agent
Event ID: 4100
Date: 12/20/2006
Time: 10:01:37 AM
User: N/A
Computer: <deleted>
Description:
The COM+ Event System failed to create an instance of the subscriber
{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned HRESULT
8000401A.
 
Hmmm, I did search in kb before I posted but did not see this, thanks!
(must've fat fingered the id)

Anyway when I do what the article tells me, I get an error
LoadLibrary "%.......\Mobsync.dll" failed. Module not found.
 
do a search for mobsync.dll on your system, and let us know in what
directory it is in ?
 
I'm not a registry hacker so I'm guessing what that means;
inferring from your answer, I search for the value as "data"
and found it in

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\
LastKey
 
No. In your original message you included the text of the Event ID
4100. In the Event we see:

"The COM+ Event System failed to create an instance of the subscriber
{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned
HRESULT 8000401A."

That doesn't tell us too much about why the error is happening or what
the subscriber is. To find that out we search the registry for the
subscriber GUID or: {6295DF2D-35EE-11D1-8707-00C04FD93327}

The search may find several instances of the GUID at different keys in
the registry, but all the entries will point to the same application in
the key data, for example, a search on it finds this (amongst others):

[HKEY_CLASSES_ROOT\AppID\{6295DF2D-35EE-11d1-8707-00C04FD93327}]
@="Mobsync"
"RunAs"="Interactive User"

or this:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6295DF2D-35EE-11d1-8707-00C04FD93327}]
@="Mobsync"
"AppID"="{6295DF2D-35EE-11d1-8707-00C04FD93327}"

This tells us that the GUID {6295DF2D-35EE-11D1-8707-00C04FD93327}
belongs to Mobsync and while it doesn't tell us exactly why the error is
happening, at least we now know what application is involved in the
fault and it helps with the troubleshooting by narrowing down our search
for answers. If we keep searching a bit deeper in the registry we will
find the "Event System subscriber" entry for the GUID:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{6295DF30-35EE-11D1-8707-00C04FD93327}]
"Active"=dword:00000001
"SubscriptionID"="{6295DF30-35EE-11D1-8707-00C04FD93327}"
"SubscriptionName"="Synchronization Manager"
"PublisherID"="{5FEE1BD6-5B9B-11D1-8DD2-00AA004ABD5E}"
"EventClassID"="{D5978620-5B9F-11D1-8DD2-00AA004ABD5E}"
"MethodName"="ConnectionMade"
"SubscriberCLSID"="{6295DF2D-35EE-11D1-8707-00C04FD93327}"
"PerUser"=dword:00000000
"OwnerSID"="S-1-5-21-1229272821-764733703-1343024091-1000"
"Enabled"=dword:ffffffff
"InterfaceID"="{D597BAB1-5B9F-11D1-8DD2-00AA004ABD5E}"

Now there is no doubt about it, the Synchronization Manager (Mobsync) is
involved with the error in some way or other. Now, as I said earlier,
it doesn't tell us how to fix the error or exactly why the error is
happening but it gives us a good starting point. The GUID in this case
belongs to the Synchronization Manager but it could just as easily have
belonged to an application that was uninstalled or to an unwanted pest.
Then we could simply delete the keys, or if it was from a third party
software product that we want to keep and use we could check with the
software vendor for the appropriate fix for the problem.

Do you use File Synchronization? If no try disabling it and see what
happens. It needs to be turned off in Folder Options (Offline Files)
and also in (IE) Internet Options | Advanced uncheck "Enable offline
items to be synchronized on a schedule". Maybe I'm forgeting another
location to change the settings, it can be a persistent and difficult
item to get rid of at times.

Another place that you can disable these DCOM server items is in the
DCOM Configuration Properties. In the Start | Run box enter
dcomcnfg.exe and the DCOM Properties utility will open. There you can
find the application by GUID or by name and look at/modify it's
properties or prevent it from running on the computer.

John
 
Thanks you! It was the Synchronization Manager, and I turned
it off in both places you mentioned.

John John said:
No. In your original message you included the text of the Event ID
4100. In the Event we see:

"The COM+ Event System failed to create an instance of the subscriber
{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned
HRESULT 8000401A."

That doesn't tell us too much about why the error is happening or what
the subscriber is. To find that out we search the registry for the
subscriber GUID or: {6295DF2D-35EE-11D1-8707-00C04FD93327}

The search may find several instances of the GUID at different keys in
the registry, but all the entries will point to the same application in
the key data, for example, a search on it finds this (amongst others):

[HKEY_CLASSES_ROOT\AppID\{6295DF2D-35EE-11d1-8707-00C04FD93327}]
@="Mobsync"
"RunAs"="Interactive User"

or this:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6295DF2D-35EE-11d1-8707-00C04FD9
3327}]
@="Mobsync"
"AppID"="{6295DF2D-35EE-11d1-8707-00C04FD93327}"

This tells us that the GUID {6295DF2D-35EE-11D1-8707-00C04FD93327}
belongs to Mobsync and while it doesn't tell us exactly why the error is
happening, at least we now know what application is involved in the
fault and it helps with the troubleshooting by narrowing down our search
for answers. If we keep searching a bit deeper in the registry we will
find the "Event System subscriber" entry for the GUID:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-
00805fc79216}\Subscriptions\{6295DF30-35EE-11D1-8707-00C04FD93327}]
"Active"=dword:00000001
"SubscriptionID"="{6295DF30-35EE-11D1-8707-00C04FD93327}"
"SubscriptionName"="Synchronization Manager"
"PublisherID"="{5FEE1BD6-5B9B-11D1-8DD2-00AA004ABD5E}"
"EventClassID"="{D5978620-5B9F-11D1-8DD2-00AA004ABD5E}"
"MethodName"="ConnectionMade"
"SubscriberCLSID"="{6295DF2D-35EE-11D1-8707-00C04FD93327}"
"PerUser"=dword:00000000
"OwnerSID"="S-1-5-21-1229272821-764733703-1343024091-1000"
"Enabled"=dword:ffffffff
"InterfaceID"="{D597BAB1-5B9F-11D1-8DD2-00AA004ABD5E}"

Now there is no doubt about it, the Synchronization Manager (Mobsync) is
involved with the error in some way or other. Now, as I said earlier,
it doesn't tell us how to fix the error or exactly why the error is
happening but it gives us a good starting point. The GUID in this case
belongs to the Synchronization Manager but it could just as easily have
belonged to an application that was uninstalled or to an unwanted pest.
Then we could simply delete the keys, or if it was from a third party
software product that we want to keep and use we could check with the
software vendor for the appropriate fix for the problem.

Do you use File Synchronization? If no try disabling it and see what
happens. It needs to be turned off in Folder Options (Offline Files)
and also in (IE) Internet Options | Advanced uncheck "Enable offline
items to be synchronized on a schedule". Maybe I'm forgeting another
location to change the settings, it can be a persistent and difficult
item to get rid of at times.

Another place that you can disable these DCOM server items is in the
DCOM Configuration Properties. In the Start | Run box enter
dcomcnfg.exe and the DCOM Properties utility will open. There you can
find the application by GUID or by name and look at/modify it's
properties or prevent it from running on the computer.

John
I'm not a registry hacker so I'm guessing what that means;
inferring from your answer, I search for the value as "data"
and found it in

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\
LastKey
Click to expand...
Click to expand...
 
You're welcome.

John
Thanks you! It was the Synchronization Manager, and I turned
it off in both places you mentioned.

No. In your original message you included the text of the Event ID
4100. In the Event we see:

"The COM+ Event System failed to create an instance of the subscriber
{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned
HRESULT 8000401A."

That doesn't tell us too much about why the error is happening or what
the subscriber is. To find that out we search the registry for the
subscriber GUID or: {6295DF2D-35EE-11D1-8707-00C04FD93327}

The search may find several instances of the GUID at different keys in
the registry, but all the entries will point to the same application in
the key data, for example, a search on it finds this (amongst others):

[HKEY_CLASSES_ROOT\AppID\{6295DF2D-35EE-11d1-8707-00C04FD93327}]
@="Mobsync"
"RunAs"="Interactive User"

or this:


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6295DF2D-35EE-11d1-8707-00C04FD9
3327}]

@="Mobsync"
"AppID"="{6295DF2D-35EE-11d1-8707-00C04FD93327}"

This tells us that the GUID {6295DF2D-35EE-11D1-8707-00C04FD93327}
belongs to Mobsync and while it doesn't tell us exactly why the error is
happening, at least we now know what application is involved in the
fault and it helps with the troubleshooting by narrowing down our search
for answers. If we keep searching a bit deeper in the registry we will
find the "Event System subscriber" entry for the GUID:


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-
00805fc79216}\Subscriptions\{6295DF30-35EE-11D1-8707-00C04FD93327}]

"Active"=dword:00000001
"SubscriptionID"="{6295DF30-35EE-11D1-8707-00C04FD93327}"
"SubscriptionName"="Synchronization Manager"
"PublisherID"="{5FEE1BD6-5B9B-11D1-8DD2-00AA004ABD5E}"
"EventClassID"="{D5978620-5B9F-11D1-8DD2-00AA004ABD5E}"
"MethodName"="ConnectionMade"
"SubscriberCLSID"="{6295DF2D-35EE-11D1-8707-00C04FD93327}"
"PerUser"=dword:00000000
"OwnerSID"="S-1-5-21-1229272821-764733703-1343024091-1000"
"Enabled"=dword:ffffffff
"InterfaceID"="{D597BAB1-5B9F-11D1-8DD2-00AA004ABD5E}"

Now there is no doubt about it, the Synchronization Manager (Mobsync) is
involved with the error in some way or other. Now, as I said earlier,
it doesn't tell us how to fix the error or exactly why the error is
happening but it gives us a good starting point. The GUID in this case
belongs to the Synchronization Manager but it could just as easily have
belonged to an application that was uninstalled or to an unwanted pest.
Then we could simply delete the keys, or if it was from a third party
software product that we want to keep and use we could check with the
software vendor for the appropriate fix for the problem.

Do you use File Synchronization? If no try disabling it and see what
happens. It needs to be turned off in Folder Options (Offline Files)
and also in (IE) Internet Options | Advanced uncheck "Enable offline
items to be synchronized on a schedule". Maybe I'm forgeting another
location to change the settings, it can be a persistent and difficult
item to get rid of at times.

Another place that you can disable these DCOM server items is in the
DCOM Configuration Properties. In the Start | Run box enter
dcomcnfg.exe and the DCOM Properties utility will open. There you can
find the application by GUID or by name and look at/modify it's
properties or prevent it from running on the computer.

John
I'm not a registry hacker so I'm guessing what that means;
inferring from your answer, I search for the value as "data"
and found it in
Click to expand...
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\
LastKey




You look at the registry key data.

John

Zilla wrote:



I see it in the registry, but how do I find out who "owns" it?




It's to do with the cursed mobsync and file synchronization. You can
double check that by searching for the GUID (
{6295DF2D-35EE-11D1-8707-00C04FD93327} ) in the registry, it will tell
you who or what owns it. If you don't use it you might want to
Click to expand...
disable
the mobsync annoyance and see if the error stops.

John

Zilla wrote:



Event Type: Warning
Event Source: EventSystem
Event Category: Firing Agent
Event ID: 4100
Date: 12/20/2006
Time: 10:01:37 AM
User: N/A
Computer: <deleted>
Description:
The COM+ Event System failed to create an instance of the subscriber
{6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned

HRESULT



8000401A.
Click to expand...
Click to expand...
Click to expand...
 
Sounds like you are missing the dll but since I've never found a use for it, so what!

I had a similar or the same problem this week on a new install of 2K after I lazily let Windows update update me. There was nothing like that before the update so it must be in one of the KBs.

"The COM+ Event System failed to create an instance of the subscriber {6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned HRESULT 8000401A."

All I could find on the net since www.eventid.com seems to have vapourized was:

"Event ID 4100 or Event ID 4356 is logged in the application event log of Advanced Clients in Systems Management Server 2003" KB831648.

Which didin't help a lot since I am running a stock W2Ksp4.

Googling like crazy, from a commercial site, I got this, which worked fine:

"To resolve this behavior, use the Regsvr32 tool to unregister the Mobsync.dll file from the server:

1. Click Start, click Programs, click Accessories, and then click Command Prompt.

2. Type the following line, and then press ENTER: regsvr32 "%systemroot%\system32\mobsync.dll" /u

3. Quit Command Prompt."

Which repeats the oft-seen lesson, "if it bugs you, dump it!"

Now my event log is clean. "All is calm, all is bright"

Hope that helps. Merry Christmas!




EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com
 
Back
Top