glnz

jaclaz - Actually, I'd like to get the Indexing Service working better on my XP machine. Indexing Service seemed to work well UNTIL I replaced my hard drive last November. The old drive was a normal hard drive that was starting to go bad. I had a very lightly used leftover Maxtor Momentus XT from my wife's dead XP laptop, and so I set up that Maxtor Momentus XT to become my replacement hard drive. It's one of the early HD-SSD hybrids. I used Aomei Backupper to Backup everything out to a separate external drive and then to Restore everything to the Maxtor Momentus XT. I had boot problems, so I used my Macrium disk to fix the MBR and other boot files. Since then, the Maxtor Momentus XT seems to be working quite well generally in my Dell Optiplex 755 desktop (Win XP SP3 with the POS hack for continued updates) with one exception: Since the hard drive swap last November, the native Indexing Service in my XP has thrown error messages regarding Ci in every reboot and seems not to have been updating new or changed files after the hard drive swap last November. This has been an issue even before I turned off IIS earlier this month. These are the error messages: I'm afraid that, if I now "remove" anything related to the Indexing Service, then I'll forever lose what's already been indexed through last November and be unable to Query Search anything. ALSO - In Add or Remove Windows Components, the Indexing Service is NOT checked. (So why can I still do queries?) (And, as you know from above, IIS is now also NOT checked.) What do you think about getting the Indexing Service working again? Thanks.

Well ... there is ONE issue. On reboots since I turned off IIS on July 4, I now get warning message: However, ever since I replaced my hard drive last November, Ci has been throwing other error messages and indicating it is not working. So I'm not sure whether this new warning about "IISADMIN service is not available" actually makes a difference. But I'd prefer to straighten this out. Thoughts? Thanks. EDIT - HEY - I just noticed the reference to "virtual roots". Is it possible IIS started originally because I once tried to play with virtual on this machine (but gave up because I don't understand it)?

Happy that I don't have the loop problem. But a few weeks ago, just before these updates, I turned off IIS in my XP machine because I was getting scary error messages. (Thanks again for help from jaclaz, dencorso and others here.) Maybe the .NET update loop is related to IIS on your XP machines?

jaclaz - done. Email is still working. I can still link in from another computer using Teamviewer or LogMeIn. Wonder what program had me start IIS in the first place. Many thanks.

Ok - more stuff and I don't know if it's related to this issue. Yesterday 8:21pm - turned off and then on the IIS, as I described above. No immediate Warning notices. Yesterday 10:55pm - One of these warning notices by itself without a TCP-IP overflow message. "The server was unable to logon the Windows NT account 'admin' due to the following error: Logon failure: unknown user name or bad password." Yesterday 11:21pm - After some more fussing, I did a reboot. Got a BSOD noting ipnat.sys as the culprit. "The computer has rebooted from a bugcheck. The bugcheck was: 0x100000d1 (0x04c08a29, 0x00000002, 0x00000000, 0xa0328787)." Yesterday 11:25pm - Have now rebooted again, OK, but later notice this error message: This morning 8:23am - Did a sfc / scanonce on a reboot. Tonight, starting 6:13pm, get the following messages. Only the first is a warning. The others are a bit new - haven't seen them recently. Could it be that whatever is acting is now succeeding instead of getting blocked for bad password? Thoughts? Thanks.

I'm going to copy here some additional information that I also posted in the VOIP forum of DSL Reports: ________________ Mediaguy and Anon - Thanks again for your interest. As you can tell, my day job is NOT tech, and I rely on excellent forums like this one to survive and to help my wife's business as her fake IT guy. (She once said, "glnz, you aspire to be a geek, but you're only a nerd.") I am again looking at the router in my wife's mini-office by going to its embedded web pages. It's a Westell 7500 Wireless Gateway (a modem-router) that's a leftover from my home Verizon DSL. Two and a half years ago, I got it out of the closet to see if I could make it into a router for her new rented mini-office. Somehow, maybe with help here, I managed to do so. Looks like I changed its "Protocol" from PPPo? for Vz DSL to "Bridge". In fact, inspired by mediaguy's questions here, I am checking again, and I see that the Westell 7500 is actually in "Routed Bridge" mode, and one of its embedded web pages says "Routed IP". Another page says "Routed IP WAN (Routed Bridge)". That seems to be different from plain-vanilla "bridge". So, it looks like we're all correct more or less. It looks like the landlord's network server has its own IP of "Server: 10.xxx.yyy.17". In turn, it looks like the DHCP function in our landlord's network server has (from its perspective) given my Westell router an IP of 10.xxx.yyy.19. (I'm hiding some of the numbers for security purposes. The xxx.yyy are the same six digits in both places.)) From my side, on the LAN side of the Westell, the Westell has an IP of 192.168.0.1. It continues to act as DHCP server to our mini-office computers, with a range of 192.168.0.15 through 192.168.0.47. Right now, on our LAN side, the Connect Me Freetalk 1200 has an IP within this range. The Westell has four ethernet ports, and apparently one of them, the "VersaPort", is configured for "WAN uplink port" and is connected by ethernet cable to the landlord's network socket in the wall. That leaves three other ethernet ports on the Westell and its WiFi. The three ethernet ports are connected by ethernet cables to two Windows PCs (including the one I'm using now) and our Connect Me Freetalk 1200 for the incoming Skype telephone number. The Westell's WiFi connects to our HP printer and anything else that walks into the tiny office that is configured to connect with the WPA2 password and is already on the MAC Address filter list, like our employee's and my wife's iPhones, iPads and iShoes (and my wife's MacBook Pro laptop). In this way, all our equipment in the mini-office is on the same LAN and (theoretically) can see each other. At least, the PCs can print to the printer and can access the embedded web pages of the Westell and the Connect Me Freetalk 1200. I don't think my landlord can "see" what's on the LAN side of our Westell because the Westell is not in plain-vanilla "bridge" mode, but I could be wrong about that. By the way, the Westell's "Firewall Settings" web page says "No security (None) - All traffic is allowed". There are four other possible settings with some level of security, but the Westell has always been set to None. So, getting back to the difficulties and miracle cure for our incoming Skype telephone calls, what do you think happened? Did our landlord block them and then remove the block? What do you think? Happy 4th!

jaclaz and dibya - before I turn off IIS, I am concerned that my Outlook Express 6 will stop working correctly, because various screens indicate that SMTP depends on IIS, and I assume that Outlook Express depends on that SMTP. See the new Word doc attached here - 5 pages with screenshots of "Properties" tabs from IIS and SMTP in services.msc. They indicate that SMTP depends on IIS (and that SMTP is a dependency of IIS). But is the SMTP in my attached screenshots different from the SMTP used by my Outlook Express? In my Outlook Express account settings, it says, "Server Information: Outgoing Mail (SMTP): smtp.verizon.net". It also says, "Server Port Numbers: Outgoing Mail (SMTP): 465". If there's only one SMTP, how can I turn off IIS? Thanks for working with me on this. About SMTP and IIS.doc

Well, gents, first I found World Wide Web Publishing in services.msc, stopped and restarted it. Then, I found the IIS snap-in and the restart control and ran the restart. There's nothing new in the Event Viewer System messages from the two restarts other than that the services were stopped and restarted. jaclaz - you wrote above that if the IIS was badly configured, the error messages would repeat on the restart. But they didn't. After the restart, other things seem to run as before, including my browser (on which I'm typing now) and my Outlook Express 6 for emails (which I assume depends on SMTP, which I saw depends on IIS). Also, I don't have any scheduled tasks near the 5:30 pm ± Eastern time start point of the Event Viewer messages. I guess we'll wait until tomorrow 5:30pm ± Eastern Time. Meantime, while in the IIS snap-in, I saw that the two IPs that appear in the W3SVC logs have something to do with Default SMTP Virtual Server, whatever that is. See the screenshot I've uploaded here (as a Word .doc). I have no idea what this is. And another clue: If I use my browser to try to go to 192.168.56.1 or 192.168.1.6 (the two IPs in the W3SVC logs), I am prompted for a username and password, which I don't have. If I guess, I get However, 192.168.1.6 is this computer - my XP Dell Optiplex 755. I have no idea what is 192.168.56.1. Any thoughts? Screenshot IIS - Default SMTP Virtual Server.doc

NSA?? Hahahahahahahaaaaaaaaaaaaaaaa!!!! I have tears in my eyes! Hahahahahahaaaaaaaaaa !!!!! Oh! They would die of boredom!!!! Yes, my little home LAN also has a Win 7 (dual-booting with Win 10 so varies), my wife's new Apple, a Kindle, a Blackberry Classic, an HP printer, and a pair of shoes. Maybe the umbrella. Do you think it's the shoes? They were made in China. OK - but how DO I monitor to see what is going on at approx. 5:30pm? Is there a netstat setting that will leave a log? I don't want just to turn off IIS or World Wide Web service - more curious to see what this is first, to learn something. Maybe I could schedule a task to start logging the instant there's the event viewer warning about too many TCP connect attempts? How would I write that? Thanks, guys, and, Dibya, please TRY to have a happy 4th.

Well, it started working! I didn't do anything! Maybe my landlord's IT guys fixed something in their outside network (my WAN side). Maybe they were blocking a port, which was needed for my incoming calls? No idea. FYI - from my landlord's perspective, I don't know what IP number his network assigns to my router. From my perspective, the landlord's (my WAN) network gateway (outside my office, and outside my control) is 192.168.1.1. For that reason, from my PC's perspective, my router inside my office has a gateway IP of 192.168.0.1. My router is in bridge mode with DHCP, and so on my LAN side I have IP range 192.168.0.2 through (I think) 192.168.0.99. My router is not doing any NAT, as far as I can see. Its NAT setting is none. The embedded web server in the Freetalk is (I recall) 192.168.0.45. I have always been able to access the embedded web server in the Freetalk, but only today did its settings "take". Let's see how it goes over the next days. Happy 4th!

Maybe the good crowd here can help. Suddenly, our Skype phone isn't ringing (or is ringing too little) and incoming calls are going too fast to voicemail. None of the adjustments seems to help. This problem is only a few weeks old. (There is NO problem making outgoing calls!) We have the Connect Me Freetalk 1200 device, which is connected to our router (internet access) and to our deskphone. It has been good for two years until this problem. We also have a Skype telephone number. Anyone can call that telephone number and our deskphone will ring (until now). It should ring four or five times before the call goes into Skype voicemail, but now either it is not ringing or ringing only once and already the call is diverted to voicemail. This has been happening in my wife's mini-office, which she rents from a mini-office company. The router in our mini-office is connected to the ethernet socket in the wall, and the mini-office company provides internet access through its own network, which we do not control, to that socket. Until this, all has been working very nicely, with a good internet connection with very low Ping and fast speed up and down. Our Freetalk is connected to that router and our deskphone. Here's my only clue: I took the little Connect Me Freetalk 1200 device home, hooked it up to my home LAN, and it worked perfectly. The little deskphone rang five times and I could either pick it up or let it go to voicemail. And I could make some adjustments (how long it rings) with the Freetalk's embedded web server. But when I brought these back to the mini-office, the symptoms revived - no ring or one ring and the incoming call is already diverted to voicemail. And adjustments don't help. Any thoughts? I'm not a tech person. But maybe the mini-office company did something to its network that interferes with our incoming calls. (But outgoing calls work fine.) Thanks.

To all - haven't disabled the World Wide Web Publishing service yet, and I got the same System event viewer Warnings yesterday starting 5:48pm. The IPs this time are 192.168.1.6 and again 192.168.56.1. However, I don't know how to figure out where they are coming from, as my look at the internal web pages of my DSL modem-router much later didn't show anything with those IP numbers. How should I set up netstat (or something else) to monitor and make some kind of log so that I can figure out later "who" is waking up at about 5:30pm and trying to connect, and also what preceding avalanche of connections causes all of this to start with the message "TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts." Thanks.

EDIT - I HAVE THE WARNINGS MANY MORE DAYS, ONE SET PER DAY. Not every day, but maybe five out of seven days. On one occasion, it did NOT start with tcp/ip overrun. dibya, allen2 and jaclaz - First, many thanks for your quick responses. Happy to be a (very modest) contributor to MSFN. And, yes, MSFN has helped me run the POS hack on my XP, so I am happy to hear that something is hardened (other than my hearing). Second, an Avast boottime scan last night did not find anything interesting. It did find two recent emails where I was testing Avast with the EICAR fake virus, so that's good. It also found Win32:OpenCandy-D [PUP] in three old setup programs -- Downloads\avc-free.exe|>{tmp}\OCSetupHlp.dll ; Downloads\siw-setup(2).exe|>{tmp}\OCSetupHlp.dll ; and Downloads\SUPERsetup(1).exe|>{tmp}\OCSetupHlp.dll -- but I doubt that's important. Third, W3SVC is World Wide Web Publishing, which uses the Internet Information Services snap-in and C:\WINDOWS\system32\inetsrv\inetinfo.exe. I vaguely remember turning on IIS a million years ago for some valid purpose but I don't remember what. I do NOT run a web site or similar, but who knows what's needed on my home PC + network? W3SVC is Started (running) and Automatic. Why do you think this is on? Do other things I'm using depend on it? Teamviewer? LogMeIn? Cubby? Avast? (I've been using these for many years now.) Fourth, I've never touched my XP firewall. What exactly should I do with it? Fifth - jaclaz - my four most recent W3SVC1 log files (last four days) show this - Does anything look interesting? EDIT - AS NOTED, this has been happening for a while. I'll try to match the logs with the warnings later. Sixth - I have only very rarely run the netstat commands but will play with them tonight when I get home. Or should I leave that running in cmd all day? Thanks, all.

In my XP SP3 event viewer, in system, there are two sets of seven warning messages that have me spooked. Am I being hacked? I don't have passwords on my user accounts. I;ve never seen messages like this before. The only think I did recently was to run sfc /scanonce a few times in the last 24 ± hours. Could that have started something? Also, I've had some problems with my Tasks folder and Task Scheduler service caused by Avast AV, and I've monkeyed with that folder although it now seems to be better. Also, I link in to this computer a few times a day from work, using Teamviewer, but it has never caused Warnings like this before. Here are the warning messages. This set of seven messages appears together, and this set occurs twice, about 24 hours apart: Thanks.

If anyone would like to contribute to my new thread on the Avast forum about this, here it is: https://forum.avast.com/index.php?topic=187822.0 There are still problems with this. Thanks.

Dave-H - Many thanks for hitting the bulls eye. It seems that the task avast! Emergency Update.job - the Avast Emergency Updater - is wrecking my Tasks. I still have to test further, but "Repairing" Avast AV, which reinstalls that job, causes the problems. I am attaching that avast! Emergency Update.job file here as a zip, but I would suggest NOT installing it in normal XP. If you have a virtual XP you can discard, I'd try installing it in that. (I don't have a virtual XP here at the moment. I might try later in XP Mode in my Win 7, but I'm not sure how to discard a change after a reboot and get back to the prior version.) avast! Emergency Update.zip

Just noticed that my Task Scheduler service won't start. If I try to "run" a scheduled task, I get error messages that end with "Error 5". Although it might be something in the POS updates, I've started a new thread on this forum at 175752-task-scheduler-service-wont-start-error-5 Please all here go look and comment. Thanks.

Just noticed that my Task Scheduler service won't start. If I try to "run" a scheduled task, I get error messages that end with "Error 5". See screenshots attached (three pages). My PC is XP SP3 32-bit, kept updated with the POS hack discussed elsewhere on this very good forum. There's a complicated suggestion at http://www.realgeek.com/forums/task-scheduler-service-access-is-denied-334006.html , but the steps aren't well described. Any simpler ideas? (I already turned the service off and on - no help.) Could anyone translate that realgeek series of steps for me? EDIT - I just ran cacls for tasks and it seems to show FULL CONTROL for EVERYONE. That's at the end of the screenshot attachment. But is that good enough? Thanks. Screenshots when try to run scheduled task.doc

dencorso - thanks. I get the impression from your other thread that KB3161647 Windows Update Client for Windows 7 and Windows Server 2008 R2: June 2016 is OK and might even help with the update delays. But does anyone here see a GWX effect after it's installed? (And I understand we cannot uninstall an individual KB from a rollup using, for example, wusa /uninstall /kb:3161647 . Am I correct about that?)

On the Win 7 Pro SP1 64-bit machine in my wife's mini-office, Windows Update has a "Rollup" update as "Optional", and it would install the following - what do you all think? This update package fixes the issues that are documented in the following Microsoft Knowledge Base articles: •KB3154228 32-bit icons can't be loaded in OleLoadPictureEx in Windows •KB3153727 Windows Installer with certain actions can't be installed on Windows Server 2012 R2 or Windows Server 2008 R2 SP1 •KB3161647 Windows Update Client for Windows 7 and Windows Server 2008 R2: June 2016 •KB3161897 WDS deployment fails when UEFI clients are in routed environments in Windows Server 2008 R2 SP1 •KB3161639 Update to add new cipher suites to Internet Explorer and Microsoft Edge in Windows •KB3163644 Microsoft Office 2010 doesn't start when EMET is enabled in Windows 7 or Windows Server 2008 R2 Of course, I'm suspicious about "•KB3161647 Windows Update Client for Windows 7 and Windows Server 2008 R2: June 2016". Thanks.

Apologies if this is off-topic, but do you think the latest POS updates in XP are now causing a clash between my Avast AV and my old useful Acrobat and PhotoShop Elements? Here's what I just posted in the Avast forum, but maybe it's the latest round of XP updates ?? Any thoughts?

Well, I installed all updates from Tuesday and the PC hums along the same as before. Nothing dramatic, no catharsis, life remains meaningless. BUT ... there were fireworks in Central Park two evenings in a row!

NoelC - Thanks. How different from SpywareBlaster or the Immunize function of Spybot S&D?

Well, team, today (day after Patch Tuesday) I have 11 possible updates in my Windows Update for my Win 7 Pro 64-bit. Any thoughts ? Thanks.

Installed. So boooooring. Can't wait until Tuesday's excitement!