Registry Hive Recovery - Win2003 Server SP2

[leopard96]

Hi Everyone,

I have 3 Windows 2003 servers with SP2 installed. All three will show a popup message that states: Registry Hive (File): C:\windows\temp\sst12c5.tmp was corrupted and it has been recovered.

The servers run fine and reboot fine as well. They are running their current firmware & drivers for RAID controllers and BIOS updates from Dell.

Has anyone else seen these messages before on Server 2003? It doesn't seem to be affecting anything. Chkdsk /f returns no errors on any of the three servers but I'd like to know where they came from.

The only thing they have in common is SP2 and IE7. Could IE7 have something to do with this?

Thanks for your time!


The event information is:

Type: Information
Event ID: 26

Text:
Application popup: Windows - Registry Hive Recovered : Registry hive (file): C:\WINDOWS\Temp\SST12C5.tmp was corrupted and it has been recovered. Some data might have been lost.

 

[itsp1965]

Since this is referring to a file in the TEMP drive did you try removing it? It may be it is trying to deleting since this file may be indeed corrupted.

 

[leopard96]

The files don't exist. I forgot to mention that in my first post. The file name isn't always the same either, it changes a little bit but I believe it always starts with SSxxx.tmp.

 

[itsp1965]

Did you try running chkdsk to see if you have any corruption on the disk itself?

 

[leopard96]

Yes, I've run chkdsk with /f and /r. /F returns no corrections or bad sectors. /R does pretty much the same only takes a while longer.

It just struck me as strange that three servers are having the same issue. I have one Win2003 box that doesn't have IE7 on it yet. I guess I could update that server and see if the problem appears. I guess it can't hurt...

 

[ITBanker06]

I am having this same problem. I have 10 servers, all of which are running Windows 2003 Server and IE7. I am getting this same error on all of them. Does anyone anywhere have any suggestions? Thanks!

 

[leopard96]

I haven't made much progress on fixing the issue but I have confirmed that it isn't disk or file corruption. I've run the thorough chkdsk on all of the servers and nothing came back with errors.

All of my affected servers are also Win2003 with IE7.

My only guess is that it has something to do with IE7's protected working mode where it playing its own little sandbox and is separated from other parts of the system. Maybe these files aren't being cleaned up properly or appear to be locked somehow and are acting like they are corrupt.

I'm not sure if this protected mode is active on Win2003 or if its just a Vista feature.

Aside from the annoying error there have been no stability issues yet.

 

[ITBanker06]

leopard96,

By any chance, are you running Spy Sweeper on these machines? I found a Google search that indicated SSTxxx.tmp files might be written by Spy Sweeper. I'm trying to verify if this could be the case.

Thanks!

 

[leopard96]

Yes we do have SpySweeper running on all of the servers. We do not have any of the active shields running on the servers right now and I've played with some other settings in SSweeper but nothing changed.

Maybe SS is just not IE7 friendly yet. Do you also use SSweeper? If so, what build? We have 3.1.0.1795 installed at this time but there appears to be a 3.1.0.1844 available through the console. I may try that.

 

[ITBanker06]

Yes, I have SpySweeper on these servers. I am running version 3.1.0.1844. Interestingly enough, two of my servers do not have SpySweeper installed on them, and I have not received the error messages on them.

I tend to think it does not have to do with IE7 because I have had IE7 installed since March and have never received these messages until about a few weeks ago. However, I could be wrong.

I have emailed Webroot's support to verify my suspicion of the temp files being from SpySweeper. I will post their response when I receive it.

 

[leopard96]

Great, thanks for chasing that down too. I thought of SpySweeper briefly but I couldn't figure out why it would be storing files in C:\windows\temp and also couldn't determine why Windows was identifying them as a registry hive.

Never a dull moment! Thanks!

 

[ITBanker06]

Here's the reply from Spy Sweeper Enterprise Technical Support:

"I do beleive that those .tmp files are created by our Spy Sweeper software, both enterprise and consumer."

I have responded with a description of the exact error we are receiving. Surely you and I aren't the only ones experiencing the same issue. When I hear back from Webroot, I will again post the response.

And you are exactly right - there is NEVER a dull moment in the IT field!

 

[ITBanker06]

Well, we have a resolution! Here's the latest reply from Spy Sweeper Tech Support:

"That is actually an issue we were having trouble with the version of the software you are running at the moment. We are hoping the newly release 3.5 version resolves this.

Would you consider upgrading to 3.5 to try to resolve this?

If so, please note the correct update folder to use below.

In order to update your server, you will need to manually execute SSEUpdate.exe from within your server package located in the Program Files\Webroot\Server\Updates folder. Your specific package will depend on the server version you are running:

1. 0058C1E0 – 2.5 to 3.5 Server Update
2. 0058C1E1 – 3.0/3.1 to 3.5 Server Update
3. 0058C1E2 – 3.1.5 to 3.5 Server Update"

I will run this update, and hopefully, that will take care of the problem.

Nothing like a good problem resolution to end the week on an excellent note!!

 

[ITBanker06]

Here's a link that might be of some assitance in the upgrade:

http://now.eloqua.com/es.asp?s=323&...5110BF35&elq=3078E28655734FA982B7384B79A7448B

 

[leopard96]

I just got the new admin server installed and will try the client soon. Then it will just be a waiting game to see if the error comes back.