Errors in Event Viewer

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello,

I am hoping someone in this area might recognize this issue and know how to
fix it. The issue is error messages appearing in Event Viewer Applications
after an application is uninstalled and (apparently) no amount of registry or
file cleaning will eradicate what vestiges remain. I'm referring to Windows
Onecare Beta. After uninstalling WOC three error messages similar to the
following appear in EV:

Error Properties:

Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 24
Date: 12/29/2005
Time: 1:12:54 PM
User: N/A
Computer: XXXPC
Description: Event provider attempted to register query "SELECT *
FROM __InstanceDeletionEvent WHERE TargetInstance ISA "MPSSVC_Agent" " whose
target class "MPSSVC_Agent" does not exist. The query will be ignored.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Additionally, these entries were found in the mofcomp.log dated after WOC
was uninstalled on (12/31/205):

(Sun Jan 01 12:19:36 2006.707406) : File
'C:\WINDOWS\system32\MPS\mpssvcEvents.mof' not found!
(Sun Jan 01 12:22:58 2006.909031) : File '/mof' not found!

Where are references to mpssvcEvents.mof coming from? The directory
C:\WINDOWS\system32\MPS\ no longer exists!

From Wbemess.log:

(Sun Jan 01 14:55:17 2006.49281) : Could not get class MPSSVC_Agent for
which provider claims to provider events. Error code: 80041002
(Sun Jan 01 14:55:17 2006.49281) : Unable to add definition query SELECT *
FROM __InstanceCreationEvent WHERE TargetInstance ISA "MPSSVC_Agent" to a
provider proxy. Error code: 80041002
(Sun Jan 01 14:55:17 2006.49281) : Skipping provider MPSSVC_Provider
registration query SELECT * FROM __InstanceCreationEvent WHERE TargetInstance
ISA "MPSSVC_Agent"
failed to merge: 80041002

And .mof files were still present in C:\WINDOWS\system32\wbem\AutoRecover
referring to MPSSVC. Example:

#line 1 "C:\\WINDOWS\\TEMP\\MpsSvc.mof"

#pragma namespace("\\\\.\\root\\cimv2")

[
Dynamic: ToInstance,
DYNPROPS: ToInstance,
Description("The MPSSVC_Agent class is the interface to use to
manipulate the MPSSVC Agent system"): ToSubClass,
UUID("{5B1018A4-FC9E-45e9-9563-5319D2B91884}"): ToInstance,
provider("MPSSVC_Provider"),
Singleton
]
class MPSSVC_Agent
{
[read]
string AgentVersion;

[read]
DATETIME LastPolicyUpdate;

[implemented]
uint32 WriteCurrentEnforcedPolicy([in] string szFilePath);

[implemented]
uint32 ReplacePolicies([in] string PolicyData[]);

[implemented]
uint32 ReplacePolicyFiles([in] string FilePaths[]);

[implemented]
uint32 DeleteAllPolicies();
};

[UUID("{d5c7393d-ad45-4645-9e56-a8b6bba26201}"):ToInstance]
class MPSSVC_Application : Win32_MethodParameterClass
{
[read, write]
string name;

[Values{"binary", "windows", "catalog", "signed"}, read, write]
sint32 appIdMethod;

[read, write]
string version;

[read, write]
string path;
};

[
Dynamic: ToInstance,
DYNPROPS: ToInstance,
Description("The MPSSVC_Policy class is the interface to use to
manipulate the MPSSVC Policies"): ToSubClass,
UUID("{219B096F-E460-4a8e-8AFB-4F9F7EA09270}"): ToInstance,
provider("MPSSVC_Provider"),
SupportsCreate,
SupportsDelete
]
class MPSSVC_Policy
{
[read, key]
string Name;

[read]
string XMLDocument;

[read]
DATETIME TimeModified;

[read]
DATETIME TimeDownloaded;


[implemented]
uint32 SetPolicy([in] string szPolicyFilename);

[implemented]
uint32 SetPolicyData([in] string szPolicyData);

[implemented]
uint32 AddApplication([in] string szDefinition,
[in] MPSSVC_Application application);

[implemented]
uint32 DeleteApplication([in] string szDefinition,
[in] MPSSVC_Application application);

[implemented]
uint32 GetApplications([in] string szDefinition,
[out] MPSSVC_Application applications[]);
};

[
Dynamic: ToInstance,
DYNPROPS: ToInstance,
Description("The MPSSVC_Notification class is the interface to use to
manipulate Notifications"): ToSubClass,
UUID("{902f5d04-ea9e-48e4-85b4-0248c4ebfd48}"): ToInstance,
provider("MPSSVC_Provider")
]

class MPSSVC_Notification
{

[read, key]
uint32 NotificationId;


[read]
string PolicyName;


[read]
string RuleName;


[read]
uint32 NotificationType;

[read]
string NoticationTextLocales[];


[read]
string NotificationTexts[];


[read]
string ApplicationPath;


[read]
boolean IsIPV6;


[read]
string IPAddress[];


[read]
uint16 Port[2];

[read]
uint8 Protocol;


[read]
boolean IsTrafficIncoming;


[read]
boolean IsHashAvailable;


[read]
string ApplicationHash;

[read]
uint32 AppHashAlgorithm;


[read]
boolean IsAppWindowsCatalogSigned;


[read]
boolean IsAppMPSCatalogSigned;


[read]
boolean IsAppHasValidAndTrustedDigitalSignature;


[read]
string AppDigitalSigner;


[read]
uint32 DigitalSignatureCollectionStatus;

};


Instance of __Win32Provider as $P
{
Name = "MPSSVC_Provider";

[Description ( "Decoupled provider CLSID, do not change. Do not
override" ) , Override("Clsid")]
Clsid = "{54D8502C-527D-43F7-A506-A9DA075E229C}" ;

[Description ( "Hosting Model, provides compatibility with Windows
XP and Windows Server .NET. Do not override." ) , Override("HostingModel")]
HostingModel = "Decoupled:Com:FoldIdentity(FALSE)";

[Description("..."),Override("SecurityDescriptor")]
SecurityDescriptor = "O:BAG:BAD:(A;;0x1;;;SY)";

PerLocaleInitialization = false;

InitializeAsAdminFirst = false;



ImpersonationLevel = 1;

PerUserInitialization = FALSE;

Pure = False;

version = 1;
} ;

instance of __InstanceProviderRegistration
{
Provider = $P;
SupportsPut = TRUE;
SupportsGet = TRUE;
SupportsDelete = TRUE;
SupportsEnumeration = TRUE;
};

instance of __MethodProviderRegistration
{
Provider = $P;
};


instance of __EventProviderRegistration
{
Provider = $P;
EventQueryList =
{
"SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA
\"MPSSVC_Notification\" ",
"SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA
\"MPSSVC_Agent\" ",
"SELECT * FROM __InstanceDeletionEvent WHERE TargetInstance ISA
\"MPSSVC_Agent\" "
};

};


I apologize for the length of this post, but I wanted to provide some info
to work with.

Can anyone help? This is a fairly wide-spead and persitant problem with WOC
Beta and any help or direction would be greatly appreciated. Thank you.

jmike
 
After uninstalling Microsoft OneCare (beta) some users are reporting error
messages in the Application log of Event Viewer similar to the following:
"Event provider attempted to register query "SELECT * FROM
__InstanceCreationEvent WHERE TargetInstance ISA "MPSSVC_Agent" " whose
target class "MPSSVC_Agent" does not exist. The query will be ignored. "

The following procedure should do away with these error messages.

- go to Start|Run.

- Type "services.msc" (without quotes).

- Look for this service : Windows Management Instrumentation

- Right-click on it and choose Stop.

- Windows will warn you that Security Center and Windows Firewall will
also be stopped. Say YES.

- Using "Windows Explorer" or "My Computer" navigate to the
C:\Windows\System32\Wbem folder.

- Delete the REPOSITORY subfolder that you will find in there.

- Windows will rebuild a new one after reboot.

- Restart the WMI service and any other services which you stopped above by
right clicking on it and choosing Start.

- After one minute restart your PC and test.

- The three error messages should no longer be there.


--
~john aka: jopa


I don't have access to the Newsgroups for this beta App. and perhaps they
have already addressed this issue. Possibly Carey Frisch or PA Bear or
someone would forward this on...?? It may be useful information.



jmike said:
Hello,

I am hoping someone in this area might recognize this issue and know how
to
fix it. The issue is error messages appearing in Event Viewer Applications
after an application is uninstalled and (apparently) no amount of registry
or
file cleaning will eradicate what vestiges remain. I'm referring to
Windows
Onecare Beta. After uninstalling WOC three error messages similar to the
following appear in EV:
Click to expand...
snip
 
jopa66,

Thank you! You're solution worked. I would like to post it to both the
private and public NG's. Or if you prefer you can post it via Carey Frisch or
PA Bear. I wil post it with credit to jopa66. Either way, thanks again.

jmike
 
Thanx jmike - Ok to post it where you think it will help.

This was driving me bonkers till I figured it out. Uninstalled OneCare a
couple weeks ago and I've been plagued with those EV error messages ever
since. Couldn't find a solution on the Web but, I did find something similar
and adapted the procedure. And now I'm a happy camper. I'm glad this can
also help a few other people.
 
jopa66 said:
Thanx jmike - Ok to post it where you think it will help.

This was driving me bonkers till I figured it out. Uninstalled OneCare a
couple weeks ago and I've been plagued with those EV error messages ever
since. Couldn't find a solution on the Web but, I did find something similar
and adapted the procedure. And now I'm a happy camper. I'm glad this can
also help a few other people.


--
~john aka: jopa



"jmike" wrote in message
news:[email protected]...
> jopa66,
>
> Thank you! You're solution worked. I would like to post it to both the
> private and public NG's. Or if you prefer you can post it via Carey Frisch
> or
> PA Bear. I wil post it with credit to jopa66. Either way, thanks again.
>
> jmike
>
>
>
> "jopa66" wrote:
>
>> After uninstalling Microsoft OneCare (beta) some users are reporting
>> error
>> messages in the Application log of Event Viewer similar to the following:
>> "Event provider attempted to register query "SELECT * FROM
>> __InstanceCreationEvent WHERE TargetInstance ISA "MPSSVC_Agent" " whose
>> target class "MPSSVC_Agent" does not exist. The query will be ignored. "
>>
>> The following procedure should do away with these error messages.
>>
>> - go to Start|Run.
>>
>> - Type "services.msc" (without quotes).
>>
>> - Look for this service : Windows Management Instrumentation
>>
>> - Right-click on it and choose Stop.
>>
>> - Windows will warn you that Security Center and Windows Firewall will
>> also be stopped. Say YES.
>>
>> - Using "Windows Explorer" or "My Computer" navigate to the
>> C:\Windows\System32\Wbem folder.
>>
>> - Delete the REPOSITORY subfolder that you will find in there.
>>
>> - Windows will rebuild a new one after reboot.
>>
>> - Restart the WMI service and any other services which you stopped above
>> by
>> right clicking on it and choosing Start.
>>
>> - After one minute restart your PC and test.
>>
>> - The three error messages should no longer be there.
>>
>>
>> --
>> ~john aka: jopa
>>
>>
>> I don't have access to the Newsgroups for this beta App. and perhaps they
>> have already addressed this issue. Possibly Carey Frisch or PA Bear or
>> someone would forward this on...?? It may be useful information.
>>
>>
>>
>> "jmike" wrote in message
>> news:[email protected]...
>> > Hello,
>> >
>> > I am hoping someone in this area might recognize this issue and know
>> > how
>> > to
>> > fix it. The issue is error messages appearing in Event Viewer
>> > Applications
>> > after an application is uninstalled and (apparently) no amount of
>> > registry
>> > or
>> > file cleaning will eradicate what vestiges remain. I'm referring to
>> > Windows
>> > Onecare Beta. After uninstalling WOC three error messages similar to
>> > the
>> > following appear in EV:
>> snip
>>
>>
>>
Click to expand...
i have the same problem and have tried doing the above numerously but it does not work.please can somebody help as i am desperate to solve this problem!
 
Back
Top