What is SCAAutoRun???

[sujump]

I've been getting this error on servers and client computers alike. Usually it has lots of different info before and after it, but the most comman that I find within the error message is ........servername\SCAAutorun SID..... The error is located in the event viewer and as of yet I have not found anything on the web about what this (SCAAutoRun) means? Any Ideas, please explain or point me in the right direction.

Thanks in advance. Ed

 

[Stevehewitt]

Could you post the full event for me please? Including event ID, source and full description.

Also, how long has this been happening for? You mention all servers and clients - can you tell me what platforms you are running? (98, NT4, 2k, XP, Vista etc.)

Thanks,




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[sujump]

Full event:
Type:Error Event ID:10016 SourceCOM
User:"client"\SCAAutoRun

Discription:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {BA126AD1-2166-11D1-B1D0-00805FC1270E} to the user "clinet"\SCAAutoRun SID (S-1-5-21-2428023567-3672976133-2806376099-1-24). This security permission can be modified using the Component Services administrative tool.

Its been happening scince the biggining of time for us. I am using Win XP Pro and Win Srv 2003.

I pretty much tried everything to resolve this with no solution as of yet.

Thanks again for the help.

 

[itsp1965]

Check Eventid.net for postings regarding this;

http://www.eventid.net/display.asp?eventid=10016&eventno=4718&source=DCOM&phase=1

Hope this helps.

 

[SquaredNull]

Probably, you should go to Contol Panel|Administrative Tools|Component Services|My Computer|COM+ Applications|DCOM Config and set the permissions for that object.
Probably you have Windows Server 2003 with SMS 2003 SP1 installed? If so, check your event log for Event ID: 10021. Then you problbly should follow the steps listed here (

http://www.only4gurus.com/v3/kb.aspx?curURL=913119)

and add 6 local security accounts listed there to local DCOM users group on SMS site server or to the built-in DCOM Users group on a domain.

 

[sujump]

itsp1965
SquaredNull

Thanks for the reply but I've already tried both of these fixes with no resolve....still getting DCOM error on Win XP Pro clients. I'd still like to see if some can explain what "SCAAutoRun" is?? Any ideas.

Thanks again.

 

[SquaredNull]

If it's listed in Component Sevices snap-in you probably can find its Application ID GUID on the General tab within the Properties dialog box for this class. Then you can search through registry for this GUID to find the DLL which registered this. Then you can find the properties within the DLL.

 

[sujump]

Thank for all the responses,
I'm 95% sure I solved this problem....helps to step away and maybe ask someone about it. The SCAAutoRun is a component of Sophos Anti-Virus; I'm thinking it needs specific network permissions to access the Sophos Server. On the client machine that was encountering these errors....I simply added SCAAutoRun Locally as a client administrator (SCAAutoRun) "NOT" domain\SCAAutoRun. After I did this the error no longer resulted or appeared.

Thanks again

 

[darkrage]

Contact sca promotions that is created as part of their promotional software. I am unsure of what its specific use is but it is created during their installation. I have not seen a problem with this software integrating with anti-virus software.

 

[sujump]

I sent Sophos Anti-Virus an email regarding this and are denying any connection to this. I really was convinced that the SCAAutoRun was part of the Sophos software but according to them "It's not". Well...guess this is still a "what is SCAAutoRun" mystery. But...I still solve my DCOM problem. Below is a copy of the email I sent them, if your interested.

Hi,
The user SCAAutorun is not part of our software's installation or updating mechanism by default. Are you using this user as the updating user for Sophos?

However, the CLSID
{BA126AD1-2166-11D1-B1D0-00805FC1270E}

Belongs to the "Network Connection Manager Class", you can find that under the HKEY_CLASSES_ROOT\CLSID key in the registry. It's also known as "NetMan" under DCOM Config. It's associated with the user:

"user “client”\SCAAutoRun SID (S-1-5-21-3033045150-572920955-3378523363-1027)"

I'm assuming there's a local user named SCAAutoRun? There are some Sophos accounts created automatically during install, but SCAAutoRun is not a name for any Sophos user.

If you check locally, you should find "SophosSAUmachinename0" and 3 Sophos groups (SophosUser, SophosPowerUser, SophosAdministrator"). Those are the users/groups that are created by the installer.

Regards,

Matthew Prytuluk
Sophos Technical Support

US Support: +1 888 SOPHOS 9
Web:

http://www.sophos.com

Sophos - integrated threat management

--Original Message--
Date: 27/12/2006 06:24:26
To: supportus@sophos.com
Subject: RE: Support query submitted from

http://www.sophos.com:

Sophos Anti-Virus for Windows 2000/XP/2003

Deny, Deny, Deny.......out of site out of mind!!
Sophos teck persons,
After exhaustive research concerning the problem below I found the solution.....(imagine that). I simply added SCAAutoRun locally on the client machine as a local administrator and the error was completely gone. Since I did most of the work in trying to solve this problem, please make a little more effort in trying to solve user issues concerning your product. I take it that SCAAutoRun "is" a network component of Sophos. Please reply with solid confirmation of this resolve before replying with the standard "this is not our issue"
response.

-----Original Message-----
From: Sophos Support [mailto:supportus@sophos.com]
Sent: Wednesday, November 29, 2006 1:19 PM
Subject: Re: Support query submitted from

http://www.sophos.com:

Sophos Anti-Virus for Windows 2000/XP/2003 [#378851]

Hi,

Sorry, but this is not a Sophos-related error message.

http://forums.techarena.in/showthread.php?t=77311

http://www.ureader.com/message/986095.aspx

Hope that helps, there is more information than the above, but none of it is related to our products.

Regards,

Matthew Prytuluk
Sophos Technical Support

US Support: +1 888 SOPHOS 9
Web:

http://www.sophos.com

Sophos - integrated threat management

--Original Message--
From: contact_by_phone@sophos.com
Date: 29/11/2006 09:20:29
To: supportus@sophos.com
Subject: Support query submitted from

http://www.sophos.com:

Sophos Anti-Virus for Windows 2000/XP/2003

The following information was submitted on
29/11/2006 17:08:18
-----------------------------------------------------------------

country: United States
incident_type: Software Question
product: Sophos Anti-Virus for Windows 2000/XP/2003
product_version: 25226
product_version_text: 6.5.0
os: Windows 2003 Server R2
os_version: 25131
os_version_text: SP1
description: Keep getting lots of these's errors in the client error logs (see below) on most machines. Has been going on for months now.
Please help.

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {BA126AD1-2166-11D1-B1D0-00805FC1270E}
to the user “client”\SCAAutoRun SID (S-1-5-21-3033045150-572920955-3378523363-1027). This security permission can be modified using the Component Services administrative tool.

 

[wedwardbeck]

SCAAutorun is the client application for Syslist -aka Syslist Companion Agent. It creates that user on the local machine and uses it to run scheduled inventories of the system.

More info here:

http://www.syslist.com