DCOM Server Process stopped unexpectedly

Topic

New Reply

Windows 7 Home Premium, 32-bit, for the past 3 days, has been getting a dialog which indicates that DCOM has stopped…

41922-DCOM_Stopped

This is one of many screen snapshots relating to this problem.

For example, it is accompanied by the Power service and Plug & Play getting the same dialog. DCOM is the one presenting an issue since very little works without DCOM running (cannot run File Explorer, get to the control panel, etc.)

As a first stab at this, has onyone hit this issue. The web is replete with hits from years back but none recently. In particular, the Microsoft site is devoid of meaningful postings for this.

I will post additional information after others get a chance to respond.

In advance, thanks to anyone that can help.

Reply | Quote

Replies

An example two weeks ago was fixed by running an anti-malware scan: DCOM server process Launcher service terminated unexpectedly, forced restarts

Reply | Quote

Bruce:

Thanks for the reference in your post. I looked at the web page and was overwhelmed. The Farbar Recovery Scan tool seems to provide lots to work with but almost no indication as to what is causing the problem and little insight into how to fix it.

It appears the authors of that tool provided the fixit script that got the user back on the air. Ouch! How am I going to do that?

I have intalled the tool and produced the scan output. The tutorial for the tool provides no clear indication of what entries to use for the fixit script and in some of the situations, it seems there are possibly confusing exceptions.

I found a Microsoft entry which indicated the problem exhibited registry issues. However, when I installed the Microsoft tool, it did nothing. The behavior was to start and exit, without messages, in less than a second. This tool was supposed to clean up potential registry issues. I have run CCleaner and have no registry issues. The Microsoft tool is called RegCureProSetup.

Still looking for being able to identify the root cause and a workable solution. I have another 32-bit Win7 system that does not have this issue (plus a couple of 64-bit Win7 systems).

Some of the web pages I found made assumptions about doing things that depend on DCOM. File Explorer depends on DCOM. The control panel plus install/remove programs depends on DCOM. I can boot into Safe Mode and many of those things work (including DCOM), so among the stuff NOT running in Safe Mode, is somthing that is the root cause of the issue. That probably includes drivers.

Reply | Quote

I found a Microsoft entry which indicated the problem exhibited registry issues. However, when I installed the Microsoft tool, it did nothing. The behavior was to start and exit, without messages, in less than a second. This tool was supposed to clean up potential registry issues. I have run CCleaner and have no registry issues. The Microsoft tool is called RegCureProSetup.

RegCurePro is most definitely NOT a Microsoft tool.

It gets very mixed reviews (and that’s putting it mildly).

Reply | Quote

Give Tweaking.com’s Windows Repair All in One a shot:
http://www.tweaking.com/content/page/windows_repair_all_in_one.html

Jerry

Reply | Quote

Bruce: the reference to RegCurePro was on a Microsoft web page. I agree when it comes to any review (it has been removed from by system).

jwitalka: my bad…I indicated CCleaner when I should have said Tweeking All In One. It took hours to clean up many entries but I left 4 that I am familiar with, and when I ran CCleaner later, there were no issues of warrant.

At this point, I am running a full scan with MSE (yeah, slow, but this is to cover all bases).

I did invoke Repair Your Computer from the Win7 install disk. Chkdsk /F /R took a long time but all files were clear and no back sectors found. That is what chkdsk does. I then rant sfc /scannow (with appropriate parameters to point to the offending partition). If found files whose checksums did not match those in the store (backup storage that is uses), so those were consider corrupt and not replaced (in all likelihood, the files are probably fine; they are the 4 files supplied with the group policy editor download for Win7 Home Premium). I might download that again and reinstall it. Twice.

Reply | Quote

Update:

At this point, it seems I have a Win7 system that boots without the DCOM issue. To make a long story short (this has consumed the last 4 days of my life), I have found no root cause for the problem and no solution has been determined for fixing the issue. Some changes have been made but yet there has been no direct association with the base problem.

I un-installed the group policy editor to remove those 4 files from consideration of issues that might be found by sfc /scannow. At this point, the disk is clean, no corrupt files, no sector issues.

I have switched from my former internet security suite to MSE and Windows Firewall. That has high potential. A new version of the security suite has been obtained and will be tried. (the security suite will remain unnamed unless I am convinced it is the problem; I am working with the vendor to address this)

Backing to Tweaking All In One cleanup: it may have cleared the issue since it did so much in that long run. However, there is no indication of which item may have been the root cause, if in fact it did clear the root cause.

By the way, base on Google search results, this is not an uncommon problem. It seems to have a long history, but recent incantations seem to be rare. In many of those, not root cause was found thought some indicate a malwre based issue. Following up on multiple scans of my system with different tools, I did use the MalwareBytes Anti-root scanner and it found nothing.

Hmmm. Maybe I am good to go.

Reply | Quote

And the beat goes on…

After some success yesterday, where my Win7 system was able to boot multiple times without the DCOM problem, today the DCOM failure returns. I am now at a position to believe that something in the computer is failing somewhere, and it may never be found.

I do have the followng to add:

In many of the posts where this is discussed, there are references to making sure that DCOM is enabled to start, and other such things. When I check my Win7 systems, DCOM properties can not be set in any way, shape, or form (setup type is grayed out).

41962-DCOM_PlugPlayProperties

Below, notice the lack of Start/Stop/Restart:

41963-DCOM_Properties2

Below, notice that all recovery options are grayed out (only restart the computer is allowed):

41964-DCOM_Properties3

The following is from the help file link:

“To perform this procedure, you must be a member of the Account Operators group, the Domain Admins group, the Enterprise Admins group, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.”

It would seem prudent to set the first recovery to simple restart DCOM, but since it lacks those options, and without the above noted authorties, that can’t be done.

For PlugAndPlay & Power services, the failure option can be configured. DCOM is the critical component and little can be done if it fails.

Reply | Quote

You can normally tell if a problem is caused by an AV program when the problem doesn’t occur in Safe Mode etc. but does in a clean boot, as an AV program will reinstate itself in a clean boot even when its box is unchecked.

If the problem doesn’t occur in a clean boot then it won’t be your AV program but at least then, you will have something more to eliminate in finding the cause.

Does this error come straight up when you boot up or when you are performing a particular task ?

I haven’t enabled the hidden admin account on my Win 7 to see if any of DCOM’s Properties can be changed, but perhaps that is something you may care to try, although as long as it is set to Started and Auto, I’m not sure what else you could with it as it doesn’t have any Dependencies that could be trouble shooted.

Reply | Quote

Sudo:

You point out a couple of good items. Thanks.

I never hit this DCOM issue in Safe Mode. This gives me a list (the differences) to pursue for issues.

The DCOM fail comes up immediately after booting (within 100 seconds). If I don’t logon to my account (which has admin privileges), then behind the scenes, it reboots with 2.5-3 minutes.

I have the hidden admin account enabled. I should try it and see if any DCOM properties can be changed.

By the way, DCOM is NOT set to Started or Auto. It is set somewhere in its behind the scenes boot time configuration to always automatically start. Plug & Play is that way also.

I have two Win7 systems available. One is my normal use and the other is a clean install for recovery purposes. In the recovery system, DCOM shows a LONG list of dependents. In my normal use system, it show NO dependents when there is a DCOM failure, but shows a long list of RPC dependents when the system is functioning. That is a flaw to investigate. It may point out that the failure is in determining the list of dependents that use RPC (if so, that may be a bunch of crap having nothing to do with its actual function).

Reply | Quote

Your pic of Services shows that it is set to Started and Auto, so like all other services that are set that way, it should start on boot.

DCOM is listed as not having any Dependencies in my Win 7 x64 HP but RPC is dependent on DCOM, so if DCOM fails to start then that is going to cause a whole range of problems because quite a lot of other stuff is dependent upon RPC.

As the problem has been on going for just three days, you should have restore points that will take you back to before that, so have you tried those – clicking on Scan for affected programs for each.

We’ve had a couple of out of cycle Windows Updates recently and if you’ve had and installed those – they could just as easily be the conflict, although not sure if anything they would affect would be neutralised in Safe Mode.

Reply | Quote

The problem started Sep 1 and yesterday being Sep 5, this makes 5 full days, plus several reboots this morning to get to the same point as before. Sep 3 was my 1st post and that indicated 3 days of problems (now approaching 6 days).

I did go back to a restore point. The 1st boot after that recovery was successful. Since then, about half of the boot attempts failed.

I have been unable to determine any pattern of what caused DCOM to fail soon after booting, or what was done to produce a successful boot later. In fact, I am now down to just the following pattern – boot, fail, boot, fail, …, boot, succeed, LEAVE IT UP!

I have done 3 full sweeps for malware with different products. This includes scanning from a different booted partition on the same computer. Chkdsk and sfc /scannow have been run numerous times. I think I have put more busy hours on the disk drives this past week than in the previous couple of months total.

I do appreciate feedback from the Windows Secrets community. Thank you. But for now, I suspect this is unsolvable, and I will be moving my stuff to the (former) clean install partition, and abandoning this partition to the lost and hopeless.

When I pulled the help information from the links in the properties page on DCOM, one item indicated that I could specify a different hardware configuration, and then use that configuration to run through various services stopped/running to determine if a faulty one can be found. However, since I can take the same configuration and have it produce a successful boot AND failed boot, the error is likely not in any service.

And yes, the list of functions dependent on DCOM is long. I will attempt to produce that list here (it can’t be copy/pasted from the properties so that is a “one at a time” operation).

Reply | Quote

You could disable DCOM https://support.microsoft.com/en-us/kb/825750

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

It is annoying why something does work only now and again without being able to nail down the cause, but you’re probably taking the best course of action which could stave off the ulcers and grey hairs.

Reply | Quote

wavy:

On Windows7 you cannot disable DCOM. Your reference was for systems other than Windows 7. DCOM is used to communicate for information on the same computer. The list of functions that depend on DCOM is very long. I am working to create that list.

Sudo:

Too late on the grey hairs. That happened years ago.

Reply | Quote

wavy:

On Windows7 you cannot disable DCOM. Your reference was for systems other than Windows 7. DCOM is used to communicate for information on the same computer. The list of functions that depend on DCOM is very long. I

Sorry I poster the wrong link, RPC seems to be dependent on it on my system but nothing else. OOps now I see all the stuff under RPC….
The link for W7:https://technet.microsoft.com/en-us/library/Cc771387.aspx?f=255&MSPPError=-2147217396

Enable or Disable DCOM

Applies To: Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012If the computer using Component Services is part of a network, Component Services needs the DCOM wire protocol to communicate with Component Object Model (COM) components on other computers. In a Windows-based system, by default, network computers are initially configured to enable DCOM. You can disable DCOM, but doing so disables communication with components on other computers.

Does kinda look like it ‘needs’ to run..:cheers:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

I have the following update from my two Windows 7 systems. This is the list of items that depend on DCOM running.
———————————————————————–
Win7 production system DCOM dependents (functions dependent on DCOM running)

—At the top level (1 entry)

+Remote Procedure Call (RPC)

—At the levels below RPC

Acronis Scheduler2 Service
Acronis Sync Agent Service
ActiveX Installer (AxInstSV)
Application Identity
Application Information
Background Intelligent Transfer Service
Base Filtering Engine
Bluetooth Support Service
BrYNSvc
Certificate Propagation
CNG Key Isolation
COM+ Event System
COM+ System Application
Credential Manager
Cryptographic Services
Diagnostics Tracking Service
Disk Defragmenter
Distributed Link Tracking Client
Encrypting File System (EFS)
Extensible Authentication Protocol
Fax
Function Discovery Provider Host
Function Discovery Resouce Publication
Google Update Service (gupdate)
Google Update Service (gupdatem}
Group Policy Client
Health Key and Certificate Management
IP Helper
KtmRm for Distributed Transaction Coordinator
Link-Layer Topology Discovery Mapper
Microsoft Antimalware Service
Microsft Software Shadow Copy Provider
Network Access Protection Agent
+Network Connections
Internet Connection Sharing (ICS)
+Network List Service
HomeGroup Provider
+Network Location Awareness
+Network List Service
HomeGroup Provider
WWAN AutoConfig
Parental Controls
PDFProFitSrvPP
Performance Logs & Alerts
+PnP-X IP Bus Enumerator
Media Center Extender Service
Portable Device Enumerator Service
+Print Spooler
Fax
Program Compatibility Assitant Service
Protected Storage
Quality Windows Audio Video Experience
Remote Desktop Configuration
+Remote Desktop Services
Media Center Extender Service
Remote Registry
Routing and Remote Access
+Security Accounts Manager
Distributed Transaction Coordinator
KtmRm for Distribute Transaction Coordinator
+Server
Computer Browser
HomeGroup Listener
Security Center
+Shell Hardware Detection
Windows Image Acquisition (WIA)
Smart Card Removal Policy
Software Protection
Superfetch
Tablet PC Input Service
Task Scheduler
+Telephony
Fax
Remote Access Auto Connection Manager
+Remote Access Connection Manager
Internet Connection Sharing (ICS)
Remote Access Auto Connection Manager
Routing and Remote Access
+User Profile Service
Application Information
Virtual Disk
Volume Shadow Copy
Windows Audio
WIndows Backup
Windows Biometric Service
Windows Color System
Windows Connect Now – Config Registar
Windows Defender
Windows Image Acquisition (WIA)
+Windows Management Instrumentation
Internet Connection Sharing (ICS)
IP Helper
Security Center
Windows Media Center Receiver Service
Windows Media Center Scheduler Service
Windows Remote Management (WS-Management)
Windows Search
Windows Update
Wired AutoConfig
WLAN AutoConfig
WWAN AutoConfig

— Clean install Windows 7 system has above but also this:

+Base Filtering Engine
IKE and AuthIP IPsec Keying Modules
Internet Connection Sharing (ICS)
IPSec Policy Agent
+Microsoft Network Inspection System
Mocrosoft Network Inspection
Routing and Remote Access
Windows Firewall

Finally, some kind of difference to investigate.
———————————————————
As you can see, there are lots of things that don’t work when DCOM fails. When DCOM fails, an entry is placed in the system event log, but that message has no error code:

41982-DCOM_event7031

DCOM is apparently not instrumented with specific error codes for this situation, making the determination of root cause almost impossible.

Reply | Quote

What do the plus signs in front of the items denote ?

In Event Viewer did you click on the blue online help link to see if there was any more info ?

Before moving onto the clean installation did you try the clean boot ?

Reply | Quote

Sudo:

“What do the plus signs in front of the items denote ?”

My bad. Should have explained, though this is a normal presentation for some displays of information on Windows related dialogs.

If you go to the DCOM service properties, under dependencies, it should show RPC with a plus sign. Click on the plus sigh and it opens up the entire list.

Each item in the list has a + sign, though each item does NOT have a sublist. You have to click each plus sign to clear it, or open up the sublist, and there are sub-lists as well.

In my presentation, the + sign indicates those that had sub-list (including lower levels where discovered). I do need to tag the sub-levels with something other than spaces in front as pasting into these replies seems to remove those spaces.

wavy:

The Microsoft reference is incorrect in that you cannot stop or disable DCOM. The properties dialog shows those options disabled. But, go ahead and try it (I have Home Premium, so higher level versions may allow DCOM to be stopped or disabled; disable at your own risk…when you reboot, it might not come back up).

Update for all:

I am now getting consistent startup with DCOM running as expected. However, a new issue pops up in that the network does not come up. The LAN eventually shows up after a couple of minutes but the internet requires intervention, sometimes not becoming active for 5 minutes or longer. This NEVER happens on my two other computer nodes or other systems booted on any of my computers…only on this Windows 7 system that has experienced the DCOM issue.

I am now marking out the differences in services and drivers between this system and my clean install Windows 7 system. I suspect one of those differences is responsible for the issues that are being encountered.

Reply | Quote

wavy:

The Microsoft reference is incorrect in that you cannot stop or disable DCOM. The properties dialog shows those options disabled. But, go ahead and try it (I have Home Premium, so higher level versions may allow DCOM to be stopped or disabled; disable at your own risk…when you reboot, it might not come back up).

Given that long list of dependencies perhaps it is wise to pass on that!

Good luck w/ your trouble shooting.

:cheers:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

Thanks for the explanation about the plus signs.

As this is a clean/fresh install, there are a couple of things to check out regards the Network – as well as checking the drivers are up to date.

In Network and Sharing Center/Change adapter settings then right click on whichever adapter you are using, select Properties and uncheck (TCP/IPv6) to see if it makes any difference.

In Device Manager/View/Show hidden devices/Network adapters as well as checking for any yellow alerts, you may also have a listing for MS Virtual Miniport adapters.

Sometimes DHCP attempts to assign these with an IP address which will cause a hold up and if you aren’t using a VPN, they can be disabled with this command in an elevated command prompt –

netsh wlan set hostednetwork mode=disallow

And then reboot to see if anything has improved with disabling either.

The Miniports can be re-enabled by redoing the cmd and changing disallow to allow.

Reply | Quote

DCOM is so embedded in the system, there are so many things that can’t be done when it fails. For example, turning TCP/IPv6 back on requires a successful boot where DCOM does NOT fail.

Hostednetwork disallow made no difference. However, the list of non-Plug and Play drivers is interesting:

42181-PlugPlayList

This list is shown under Device Manager/View/show hidden devices.

Reply | Quote

Yes, you do get quite a lot of items in the Non-Plug and Play section and some of those are Dependencies to the main services.

While the good news from what I can read (don’t have magnifying glass :)) is that there are no yellow alerts.

Did you update/reinstall the drivers ?

Reliability history or Event Viewer may have something on the network hesitancy.

Does the rest of the computer appear to be working normally or also a bit slow.

After a reinstall the Temp folder can become highly populated which can slow things down and can be checked by going Start – type %temp% and press enter.

Reply | Quote

Sudo:

I have not performed a re-install.

%temp% is loaded but not anything unusual.

There has been no update or re-install of drivers. Typically, such action is asking for trouble. On my Windows 7 clean install partition, all of these same drivers are running and that system does not have any DCOM issues.

The computer seems to be running normally except you can’t access anything that requires DCOM.

Considerations for moving to the clean install system seem to be the best out.

Reply | Quote

If you want to get the DCOM error fixed, you could go to http://www.techsupportforum.com and post in the Microsoft/Win 7 section where DavidRen on my recommendation, is already getting Windows expert help with a DCOM problem, but not as serious as yours.

However, it is a little bit slow going because the guy who is helping lives in Oz and there is the time difference to consider.

If you decide to go there, then it would be protocol to close this thread for the time being and then later, let us know it was fixed.

But have you considered a repair install of that Win 7 or an offboot sfc /scannow if you have an install disk that includes SP1 ?

Reply | Quote

I believe that repair install only fixes files but not registry issues (or other things in one’s userid directory).

I have done the offboot sfc /scannow (no change).

I will try the Microsoft forums again. No respone on my previous post.

Reply | Quote

Can you give me a link to that thread so that I can follow it.

Reply | Quote

Sudo: I have not been able to recover a link to that thread. I think MS reviews the posts and may not have allowed it.

I have a new clue as to the possible source of the issue…

– Recently, I have noticed on boot operations, with or without DCOM failure, that certain desktop items have lost their icon image. They start showing up as generic images.

– Next, with or without the DCOM failure, my taskbar hidden icons view is missing a number of entries, not always the same ones. The programs behind the entries may or may not be running as they are expected to be.

– Finally, over an extended period of uptime (> 16 hours after a boot where DCOM did not fail), more than a dozen of my desktop icons have disappeared altogether. Those desktop items had been showing up with the generic icon. Further, these items are also no longer show up in the Desktop folder of my userid, the public access Desktop folder, or the Administrator Desktop folder.

There seems to be a common point in all of this, and that is possibly as follows:

When DCOM fails, it apparently does so because it hits some error. Where could that error be? Probably in one or more of the database files that DCOM uses to provide information to the rest of Windows. When DCOM dies, large segments of Windows can’t get access to the data they need for normal operation (that is, if you run shutdown -r to cancel the restart).

Even when DCOM does not fail, it now appears that sections of Windows still fail to function fully but in a somewhat “soft” sense. Elements of what are normally expected, don’t show up. Those elements are described above.

So, how does one identify what elements DCOM uses. That is, which database files are used by DCOM to provide information to the rest of Windows.

If these elements can be identified, is there some program or routine that can validate the contents of these file and/or “fix” them if database structure errors are found?

So, can someone help to identify the DCOM elements (database files) and if so, is there a way to analyze those file and make corrections so they work as expected?

Reply | Quote

It wasn’t the MS forum I suggested but the MS section in http://www.techsupportforum.com and then the Win 7 and Vista section.

You could run this batch file to rebuild the icon cache, but as for what elements use DCOM – you’re probably looking at a volume as large as War and Peace for those who would know.

http://www.sevenforums.com/tutorials/49819-icon-cache-rebuild.html

Reply | Quote

I had posted something on the regular Microsoft forums long before your suggestion. It really shouldn’t make any difference if they are doing their job (doing their job…if the failure in DCOM, Plug & Play, or Power is handled properly, an error code should be generated indicating WHY it failed; it would make things a lot easier).

I tried to run the batch file. Unfortunately, that can only be done on a running system where the DCOM failure HAS NOT OCCURRED!!!

About 9 out of 10 boot attempts end up with the DCOM failure. I have found no rhyme or reason as to why it succeeds that one time out of ten. When it does succeed, the system stays up for an extended period of time.

From the link provided, it appears (so far) that DCOM files are hidden *.db files. So the hunt is on. Anyone else with information about DCOM files should post it here (please).

Reply | Quote

Regarding the change to the desktop icons, are there any more associated errors in Event Viewer that could be tied to DCOM which could give you a bit more to go on ?

I don’t suppose last Known Good Configuration in the Advanced Boot options would be much help as that could be just a shot in the dark as to what isn’t joining the dots up.

Reply | Quote

It depends on how “Last Known Good Configuration” is defined. This seems to imply the system has the equivalent of a system restore point that it can refer to. Is this something the OS takes care of, or would I have to create such a restore point each time I have a successful boot (no DCOM failure), or just before shutting down from a boot session that did not suffer from the DCOM failure.

Remember, my system is multi-boot, involving a Linux partition (meaning GRUB2 is in the equation), and the BCD for 4 different Windows partitions. In a normal situation, more than 90% of my time is spent in my “production” Win7 partition. XP no longer gets booted but is there as the 1st system on disk 0 and as such, is really hard to get rid of. Lately I have been spending more time on the Win7 clean install system.

My tack these days is to discover all the DCOM database files, then compare those between my normal system and my clean install system. I am certain that one of these is woefully screwed up, which leads to the DCOM failure.

Yet, there still may be a registry issue, though several different programs report the registry is about as clean as you can get it.

Thanks for the continued feedback.

[begin off-topic]

By the way, this weekend, I spent many hours resurrecting an old PC for my daughter, no inboard bootable CD/DVD drive, broken hard disk (was originally an XP Media Center Edition system, including hardware in the case), and the interior had to be vacuumed out.

So, after a couple of days getting that system to run, this morning, my DCOM offended PC would not boot. What else could go wrong?

[end off-topic]

Reply | Quote

Not being able to get into the Advanced Boot options to run Startup Repair

The OS would sift through its records for when everything boots up as it should, but having multiple boots could put a spanner in the works for that, but LKGC could resolve the no boot though.

Reply | Quote

Yet, it still depends on what the OS thinks is the last known good configuration. Most likely, that simply means the last boot that is without some serious error or that you were able to login successfully. I am certain it doesn’t include some possible known failure conditions, such as the DCOM termination, in the consideration. Thus, Windows would likely consider any successful boot, and failures beyond that boot might not be in the mix.

However, if the last known good configuration is not established until your next shutdown, then a boot scenario where DCOM fails is likely to be considered a good configuration because the boot was successful and the shutdown was successful. We need better information as to what Windows considers a good configuration, and when that information is established (after successul boot or at shutdown, be that a forced shutdown as DCOM sets it up, or when the user elects to shutdown).

I think last known good configuration is questionable.

By the way, I am now running on a successful boot where DCOM did not fail. Thus, I have taken a system restore point that I can go back to, hopefully, to gain another successful configuration. However, that means losing any changes made, one of which is in front of me now, the opportunity to rebuild my icon database. Once done, this requires a restart to implement, or see the results (did it work or not?)

By the way, the DCOM activity now becomes integral to successful operations of a Windows PC, ALMOST AS NECESSARY AS THE REGISTRY!

It also becomes a known failure point that currently has NO known investigation, recovery, or analysis tool, such as we see for the registry. All someone has to do in infect or damage DCOM database files and one is in the toilet (so to speak).

Reply | Quote

I think last known good configuration is questionable.

By the way, I am now running on a successful boot where DCOM did not fail. Thus, I have taken a system restore point that I can go back to, hopefully, to gain another successful configuration. However, that means losing any changes made, one of which is in front of me now, the opportunity to rebuild my icon database. Once done, this requires a restart to implement, or see the results (did it work or not?)

.

IIRC in NT you had do chose that option on the very next boot after the failure.
Having a ‘good’ restore point gives you the opportunity to eliminate some things. I would say if you restart after applying your ‘good’ restore point and it craps out it is not just your system files but some interaction that maybe time dependent. A clue but still need a Sherlock :confused:

:cheers:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

If you have made any changes while in a successful DCOM, then create a new restore point before the reboot.

The resolution MS gives for resolving DCOM problems is to usually reinstall whichever program is causing it – but how are you supposed to find that and I share your frustration in that.

I get the odd DCOM errors in my Event Viewer which mean absolutely sod all to me and because I haven’t noticed any adverse effects, I just ignore them.

Have you considered posting on http://www.techsupportform.com where they have people who specialise in Windows ?

Reply | Quote

Something good to report…

Having indicated earlier that multiple malware and/or anti-virus scans have been done, with nothing found, I tried one more item mentioned in a couple of web posts with regard to this DCOM failure: Spybot Search and Destroy.

Two items were discovered and removed from Alternate Data Streams (ADS). The fact that no other package even looked at ADS junk seems a big gap, especially when ADS seems to be a big item for hiding malware.

After the removal, I have had 4 consecutive boots that DID NOT enounter the DCOM Launcher failure.

I attempted to go back to Spybot S&D to peruse the log files and dig into items that were removed. Unfortunately, these files are kept someplace that is seemingly unreachable though normal File Explorer means.

However, my failed desktop icons and missing icon images are still an issue to fix.

There are several tools that can be used to search out ADS entries. Most of them are fraught with problems. For example, the Sysinternals streams program attempts to find ADS elements and gets thousands of errors, even when run with elevated privileges. I put the output of the command to a text file and it was over 180 mebabytes in length, and when reduced to just essentials, only a couple of megabytes had any meaningful information.

Other tools ignored these errors but had issues that were just beyond comprehension. For example, I have a folder for running KEGS, an Apple II emulator under Windows. It is loaded with Apple disk image files (*.img) of floppy disks and hard drives. Most of the files are IIgs related. These other scanners go into those image files, and discover individual IIgs resource forks, and report them as problems, when in fact those image files should never have been opened (IIgs and Mac resouce forks are unusable in Windows).

However, Windows Live Essentials, or Windows Essentials 2012, are replete with use of ADS, accounting for thousands of meaningless hits. I no longer use any of these programs so they were all un-installed anyway.

Of one hit that Spybot removed (I selected it to be manually deleted), involved a file that could not be found in its targer folder, perhaps because it had ONLY ADS data. The folder was part of a Visual Studio command line project.

Apparently, in their infinite wisdom, Microsoft programmers, beyond implementing ADS without any Windows tools to deal with ADS, included the ability to execute programs from an ADS (probably scripts, HTML etc. as well). I bet no software engineere asked for that feature to be included in Windows. Who in their right mind would provide for executing a program from an unidentifiable data stream?

Anyhow, I have made some progress. It appears to have been malware related, but the end result appears to look like a denial of service (forcing a reboot). As yet, I don’t know where or how the malware in the data stream was being invoked as that invocation failure is not showing up anywhere. Oh yeah, AND HOW DID IT GET THERE?

Reply | Quote

That is the $64,000 question !

Perhaps you may have to reinstall programs to resolve the icons but any for files, Win 7 has a restore default option.

http://www.sevenforums.com/tutorials/920-desktop-icons-change-restore-default-icon.html

Reply | Quote

One correction to my most recent post…

The one identified element discovered by SpyBot S&D, was actually an ADS on the directory name vc. The actual name was

“C:vc:ok54.exe” [that ingracious icon in there is o]

Thus, an ADS was added to the directory with the name ok54.exe and the data was an executable file.

One additional observation…

In subsequent scans using the sysinternals program streams, most (if not all) Temp directorys have an ADS. At this point, reason unknown.

Sudo: please, that reference has to do with when you delete a desktop icon. My problem is that desktop icons have disappeared and they are NOT in the recycle bin (not deleted by any users). Further, many of the desktop entries that still remain are no longer using their unique icon image but are using the system default icon. And just where did the reference to re-installing programs come from in this discussion? One can manually restore individual icons through the properties of any desktop item as icon images are generally part of the installed software. I believe the actual icons are not gone from the software install but are not being used due to corruption in the icon database (therefore, the rebuild of the icon database).

Reply | Quote

I know you can create a new desktop icon from the programs Properties – it’s just there’s no way of knowing just how much corruption has occurred which is why my suggestion of “may”.

So have you tried http://www.sevenforums.com/tutorials/49819-icon-cache-rebuild.html

Well, this is where that file came from – if this is the problematic thingy that DCOM is having problems with, then uninstall if practicable, but removing the .exe would seemed to have killed it.

http://www.file.net/process/vc.exe.html

Reply | Quote

I have run the script to rebuild the icon database, but unfortunately, for the ones that were bad (but still showed as items on the desktop), it pointed to the wrong disk drive partition. I had to manually correct each of these (done – works).

Remember, the file is NOT vc.exe and it is NOT located in Program Files. A file level *.exe file was not the item removed by SpyBot S&D.

The item removed was an ADS added to a directory on my C: drive…

C:vc

When you add an ADS to a file or folder, it shows up in a scan as a name appended to the folder or file name, in this case “OK54.exe” was the ADS. The file with ADS then shows up as

C:vcok54.exe

Put a “:” in place of . Otherwise, this is what o turns into .

What was removed by SpyBot S&D was the ADS appended to C:vc. C:vc was a folder I created to hold my Visual Studio Express C and C++ programs.

The file inserted into the ADS appears to have been named ok54.exe.

Reply | Quote

After 6 successful boots in a row, once again “DCOM terminated unexpectedly” reared its ugly head. However, I immediately noticed that two desktop items had lost their icons. I bypassed the automatic restart, manually fixed those icons, then rebooted successfully (this time with no DCOM failure).

This sugests a strong relationship between the DCOM failure and missing icons for desktop items. I have 54 desktop items, and all are tightly placed (small icons and squeezed together by shrinking the icon sizes). However, I have seen desktops where the entire screen was filled with icons of full size (a hundred or more).

Time will tell…

Reply | Quote

Here is the posting (with no replies) that I placed on Sysinternals. Apparently, even they don’t want to jump into this most difficult issue or nobody knows anything about it:

http://forum.sysinternals.com/display-dcom-database-files_topic31684.html

I haven’t been able to backtrack to my posting on the Microsoft site yet.

Reply | Quote

@jwood:

First of all, thanks for posting. Much appreciated.

Streams – being a former user of Apple computers (IIgs, Mac), I am familiar with resource forks, and streams is an incantation to deal with those. Use DIR /S /R to get similar information as the Sysinternals streams program. All a big pain in the butt.

SpyBot – I agree with your assessment.

I have run perfmon /report, and it provided…no help. In particular, it did not assess the Windows system event log entries for the DCOM failure. However, I ran the report on my system that booted sucessfully (no DCOM failure). I am suspicious that perfmon will not run on my system if DCOM has failed (will test and report back if that happens).

YouTube video: I was amazed that the steps it provided actually did get into being able to reconfigure DCOM. In all previous attempts, the items referred to in the video are normall greyed out and cannot be changed. I may yet pursue this avenue. However, even though I get messages that indicate DCOM Launcher, Plug & Play, or the Power service has failed, ALL 3 of thes are still running but not functional. You can do a few things in this circumstance but not important things (no windows update, no file explorer, no disk manager, etc.)

With regard to the GUID you referenced, here is the XML of the event (same for DCOM launcher, Plug & Play, and Power service failures):

–
–

7031
0
2
0
0
0x8080000000000000

837576

System
******

–
DCOM Server Process Launcher
1
60000
2
Reboot the machine

I blocked out the computer name with ******.

The GUID is for the Service Control Manager. The error code seems to be 0x80800000.

This provides little help. The failure appears to be in some code of the Service Control Manager. I will run that now instead of the external DCOM indicated failure.

Reply | Quote

Not a lot of help at that web site…
——————————————-
Event ID: 7031 Source: Service Control Manager
Source: Service Control Manager
Type: Error
Description:
The service terminated unexpectedly. It has done this time(s). The following corrective action will be taken in milliseconds: .
English: This information is only available to subscribers.
——————————————
I got that much information out of the XML

There is no specific meaningful error code, and as of yet, no known useful diagnosis of WHY the Service Control Manager failed (had problems with DCOM, Plug&Play, and Power).

Today I have been up for 15 hours on a successful boot. Re-boot almost guarantees a failure, but who knows.

Reply | Quote

But that 7031 information is of no value. I got more from the event XML. The user comments were two wide spread, many very old, and as before, no root cause was found and no specific solution set was provided.

I think the “no-reformat non-destructive re-install” is perhaps a pipe dream. If it succeeds, it take you back to ground zero with the possibility of days of re-installing patches from the baseline that is established.

I am still pursuing some diagnostic that will examine the *.db files for corruption, though that may never be achieved.

I am running wmidiag.vbs but when the boot results in a DCOM failure, that run also fails since it depends on a working DCOM to provide results (the wmidiag output file goes from 26K in size to 812K in size without a working DCOM; the file is most error messages).

I did test running perfmon /report on the failed boot (where DCOM terminates). It also has issues getting some data due to DCOM not responding (in particular, it can’t test what version of Windows is running).

Reply | Quote

While this addresses a different Event ID, the built in dcomcnfg may find what app. is failing to start.

http://windowsitpro.com/systems-management/use-dcomcnfgexe-stop-dcom-10000-and-10005-errors

Reply | Quote

I am not getting any DCOM 10000 or 10005 errors.

I have used dcomcnfg.exe and it has not helped. Most certainly, it has not pointed out any errors in the files that it need to access.

Additional:

When DCOM failes, if you choose to bypass the automatic restart, then the system is also unable to find your userid (DCOM fails, how can it find your userid?) As a result, temporary userid directories show up in the c:users folder. They are labeled TEMP.[computer-name], TEMP.[computer-name].000, etc. Mine is up to 007 at this point. The contents of each directory looks like the nomal contents of a valid userid directory:

42453-TEMP_computer-name_007

What I have been doing lately is to simply re-boot immediately after the DCOM failure until the computer boots successfully. This take anywhere from 5 to 10 attempts (each attempts is about 3 minutes of time wasted).

Once again, I have a Win7 clean install partition that does not suffer from the DCOM failure issue. I am in the process of essentially moving all of my work to that partition. At some point, I am likely to hit the same problem but then my tracking will tell me what caused the issue.

On the failing system, I have been gradually cleaning it out in an attempt to rid it of the issue (if that is possible).

I am still looking for a program that can scan the *.db files used by DCOM as I still suspect an error in one of those files as the root cause (not certain this will help but it should get me closer to finding a root cause and a definitive solution).

As ever, my thanks to those that have contributed to this thread.

Reply | Quote

I thought that perhaps the dcomcnfg.exe may have popped up an error as well for yours, but if you can only run it when you don’t get the DCOM error, then it won’t.

Hopefully moving everything across will ID the offending app – which will pretty much be the same as performing a clean boot.

Reply | Quote

Just a stray thought, and my thoughts often stray, considering the ‘identity crisis’ that seems to be going on, have you tried creating a new user and trying that a bit?

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

wavy:

Good question about using another logon userid. I have determined the following…

1. The administrator account is activated. Logging on with that account instead produces exactly the same result.

2. I have added a user-only (no admin privileges) account. Loggin on with that account instead produces exactly the same result.

3. Not loggin on produces that same result – an automatice re-boot but without any of the dialog boxes that announce the DCOM failure. It just takes a bit longer since you have to wait for the 60 second automatic re-boot interval to complete.

If one invokes Run & shutdown -a, examination of the users directory shows a number of temp directories being produced. Each one is for the user that eventually logged on, and since DCOM failed, apparently the actual user profile can’t be found and a temporary profile is generated (I had 9 such temporary profiles). In some cases, the DCOM failure comes quickly even before one gets logged on.

Finally, I have now established a pattern of the failure, and posible sucess.

It turns out that for the past several weeks, there are ALWAYS 5 boot failures (DCOM fails) and then 1 boot success (no DCOM failure). Thus, after power up of the computer, I have taken to simply booting 6 times as rapidly as possible. Each failed boot is 2-3 minutes of time. Pain in the butt, however it has turned out to be totally predictable and workable. In some cases, I have run the shutdown -a option and used the computer in its failed situation for non-trivial amount of time before continuing the re-boot scenario to reach the 6th boot where all comes up okay.

It is interesting to note that the successful boot takes longer, displays the boot scenario windows differently (some blank screens, no desktop icon displays, no “please wait” message, etc.), but eventually & predictably completes WITHOUT the DCOM failure.

However, any subsequent re-boot, say for Windows Update fixes applied that require a boot, the 6 boot scenario starts over. Thus, one out of six boot operations is a success. This has probably always been the case but many of my earlier attempts at determining this pattern were often masked by booting into different partitions, coupled with sfc and chkdsk runs along with defrags.

Still, no definitive root cause for the failure (or root cause for the success on the 6th boot), though a horse’s butt workaround is now available.

Reply | Quote

Are you actually able to do anything on the computer when you get the DCOM error ?

I was wondering if this could be linked to the Lanman Server.

If you can get into services.msc and check to see if the Server service is started – if it is then it won’t be.

If you can’t do anything when you get the DCOM error, then when you do have a successful boot, go into services.msc, right click on Server – select Properties and change to either Auto (Delayed) or Disabled to see if that resolves the error with subsequent reboots.

You could create a boot log through msconfig/Boot tab and view the log in C:Windowsntbtlog but it is overwritten with each boot, so getting to see the failed one, saving it and then continue rebooting until you get a successful boot could be problematic.

I think the length of time that you have spent on this and not being able to ID whatever is causing it, I would have factory reset by now and then reinstalled bits at a time to see if any was the cause.

Reply | Quote

1st question: there are many things that function without DCOM. If you want to see what REQUIRES DCOM, go to services, select properties on DCOM Launcher, click on the ‘+’ sign of the only entry, and the list goes on for 3 or 4 pages. Without DCOM, those things DON’T work.

Such items include no Windows Update, no File Explorer, no control panels, no printing, no local file sharing, no registration of history of file access, etc.

However, you can still open files with Office (I have Office 2007, newer versions might be more constrained), I can use my Eudor7 email client (any Microsoft products for email might fail), I can run IE and FireFox. My Internet security suite still functions though it seems to behave differently than expected. A number of items don’t get populated to the taskbar (or the hidden icons popup).

Your reference “Lanman Server” is somewhat cryptic. After searching the web, it really references the Server service on Windows 7. In my case, the Server service is running (on a successful boot) but might be crippled when DCOM fails (several network related items are listed in the DCOM Launcher dependencies). When DCOM fails, it shows NO dependencies.

I have looked at the boot log. It tells me nothing. I have used Sysinternals Autoruns. Thus far, not a big help.

With regard to reset of the OS or re-install, since I already have a fully functional separate Win7 partition that works, I am gradually shifting everything over.

My suspicion is that one of the DCOM database files is hosed. Nobody has come up with any way to find these or provide an integry check of the file contents. At one time, I did rebuild the icon database. The reference procedure for doing this failed and each one had to be done manually. This only brought back my lost desktop icons (nothing else changed).

The other possibility is some part of the registry is hosed. I have run 3 different routines to address registry issues with no luck.

Your feedback is still much appreciated.

Reply | Quote

It was just a thought anyway.

As you have a workaround by transferring to the other system, perhaps just go with that instead of stressing yourself trying to find why it is happening on this other system – although finding the cause once it nags is something difficult to let go.

I had a DCOM 1010 error earlier but I think it was due to my losing wireless internet connectivity three times in quick succession even though all of the lights on the router remained on.

I’ve since uninstalled the wireless driver and reinstalled it from my Downloads folder where I keep one for such occasions and that seems to have fixed that with no more disconnections.

The Boot log would only tell you anything if you could save a bad one with what it had difficulty in loading.

Have you considered running the Windows Repair program from http://www.tweaking.com – it may or not tell what particular fix that could or could not fix it or the cause, but at least if it did sort it then it would get it out of what hair you have left

Reply | Quote

Sudo is right some times you can not figure out what a problem is from. And this is from some one who has a 13? year old XP install moved to a 2 core from a single core intel chip. I spent 6 months t/s ing a W7 install and finally just did a total wipe. $()it happens. Imaging is a wonderment, do it next time. :cheers:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

During this entire process, I have restored from an image and even rolled back to an earlier restore point. Those actions did not help to resolve the issue except for the moment of recovery.

My boot log does not show any issues with loading of any functions. The failure is beyond the actual boot process.

I have run the Windows Repair program from tweaking.com. The first time was more than a year ago and I had to rebuild that system because it was destroyed. The 2nd time was early in the game with this DCOM failure (less than 3 months ago). The program was significantly improved and made big time changes to my registry but did not solve the DCOM issue.

If only the DCOM failures would pinpoint an error code that identified what failed along with relevant data about the failure (i.e. the database access that failed, or the database request call that spawned the failure, or some such).

But, you are correct…time is winning out and shortly I should be able to run soley from the other partition.

Reply | Quote

This thread has been going on for a while and without going back through it, have you checked msinfo32/Components and checked Problem Devices ?

Reply | Quote

Is my memory correct that you have not tried a clean boot, but a safe boot does not have the problem?

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

Have you seen this? Do not know if it could be a help to turn on the dump option, but maybe:D

42601-Untitled:cheers:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote

In that specification, the dump option activation is greyed out and can’t be set.

The same on my computer.

Reply | Quote

In response to earlier comments:

Msinfo32 reveals no problem devices (nor much other information that might apply).

Clean boot and safe boot constrain much of what can be done in those configurations. In particular, one or both of these can behave much like the DCOM failure situation. One or both were tried very early in the game, yielding little to help out (but will be tried once again for clarification).

Updates:

In my boot scenario, I have 4 active partitions across 3 drives. XP (disk 0) is no longer used but the disk holds the MBR and essential boot information. Disk 1 (also MBR) has my Win8 partition (the only partition), while disk 2 (also MBR) has 2 partitions with Win7 – one is the normal configuration and one is the clean install configuration.

Up to this point, the Win8 boot manager was in charge of booting and presenting the selection list of which OS to bring up (Win8 is the default selection). This is a GUI selection list. It has the predictable sequence of needing to boot and select my Win7 normal configuration 6 times, where the 6th rendition now always yields a running system where DCOM does NOT fail.

I have switched the default selection to my Win7 normal configuration. Of course, this changes to a text selection screen, but yields EXACTLY the same result – I must endure 5 failed boots (DCOM fails) in order to get the 6th boot where DCOM does not fail. This sequence takes about 1/2 the time (5-6 minutes versus 10-12 minutes).

Reply | Quote

Have you tried booting up into the Advanced Boot options – select Repair your Computer to navigate to the Recovery Environment to see what Startup Repair reports, or in Command Prompt if bootrec /fixmbr then exit – Restart has any beneficial effects ?

Reply | Quote

Update: with a low degree of confidence for long term success, from Dec 4 to today (Dec 8), I have been able to boot WITHOUT a DCOM failure. That covers 9 boots without the DCOM failure.

Updates that may have influenced this:

– used the GWX control panel (a misnomer if there ever was one) to eliminate the possibility of this 32-bit system ever upgrading to Win10 (primarily since GWX said the computer DOES NOT QUALIFY due to lack of driver support for my Nvidia GEForce 7300).

– I shut down SuperFetch and ReadyBoot (please don’t confuse that with ReadyBoost, which I don’t use anyway).

– installed the latest version of Classic Shell (the successful boots started before this operation).

There are still issues:

– in the old failed boot where DCOM prematurely terminates, the taskbar hidden icons view would usually have a half dozen or more entries. All the successful boots, even the last 9, only show 1, 2, or 3 items in the hidden icons view. Others must be manually invoked.

– my network connection is unstable in that it always shows as no internet connection available. However, I can bring up my mail client and access emal, plus bring up a browser and access the internet (after the browser starts, the “no internet connection” flag goes away.

– the boot process is significantly slower (minutes rather than seconds, though better than multiple boots to get one that avoids the DCOM failure).

On a side note, today is patch Tuesday and out of 6 bootable partitions across my systems, none found any updates via Windows Update. One failed with a Windows Update error code, which has been hit in the past, and the Microsoft provided resolution for that error was of no help.

Keeping my fingers crossed for continued avoidance of the DCOM failure. By the way, I have no feedback from Microsoft whatsoever on this problem. I have reached out to a few industry experts and they have nothing either. As it stands, the root cause is indeterminate which leaves a real solution unobtainable. Further, nobody has responded with any feedback on how to identify the DCOM databases that might be infolved so they can be checked out. Apparently this is some kind of industry secret.

Reply | Quote