0 Replies Latest reply on May 21, 2010 12:04 PM by ccbee

    McLog Event invalid filename from NaiFltr re SearchIndexer

      One of the three computers on my home network has been slow, slow, slow (XP SP3).  There's a bit of backstory below, the essence of my questions are in bold near the bottom.

       

      This morning I checked Event Viewer and saw over the past 5 days an enormous number of this message referring to database corruption in SearchIndexer:

      Event Type: Error
      Event Source: ESENT
      Event Category: Database Corruption
      Event ID: 467
      Date:  5/20/2010
      Time:  10:59:38 AM
      User:  N/A
      Computer: SYBIL
      Description:
      SearchIndexer (1448) Index SystemIndex_Gthr of table indexRecovery is corrupted (0).

       

      I suspected this was related to the shared Network Magic folders (a Cisco Linksys program recently installed on all 3 computers on my home network, along with a Linksys wireless router).  To test this I removed all folders on the problem computer from the Network Magic shared folders program (I believe it's name is Pure Networks Platform) and rebooted the computer. (Computer is XP SR3)

       

      The error messages I referred to above did NOT reappear, indicating there had been some conflict with the Network Magic file sharing program.  There was one error message after reboot, and it was a McAfee error message:

      Event Type: Warning
      Event Source: McLogEvent
      Event Category: None
      Event ID: 5028
      Date:  5/20/2010
      Time:  3:39:30 PM
      User:  NT AUTHORITY\SYSTEM
      Computer: SYBIL
      Description:
      McAfee McShield service received an invalid filename from the NaiFiltr device driver.
      Received name =
      Process = C:\WINDOWS\system32\SearchIndexer.exe

       

      I want to understand what this error message means before troubleshooting the Network Magic folder sharing program conflict with McAfee.

       

      This computer is the only one of three that had trouble with the Linksys Router and Network Magic setup.  In fact, I paid McAfee $99 last month to get tech support to clean out viruses and trojans on this machine.  It was a difficult clean up involving multiple sessions.   The problems I was having with a slow machine seemed to be cleared up after McAfee tech support did its thing, but soon after (or right after, hard to recall) the Linksys wireless connection failed.  I am now connecting this computer to the Linksys router using an ethernet cable, not wireless.  I had better things to do with my time than troubleshoot a wireless connection when a wired connection worked and the computer was not slow.  However, last week (perhaps 5 days ago when this all started) I did try to connect some folders on this computer to the Network Magic folder sharing program.  It makes sense, then, that disconnecting those folders removes those error messages.  However, it has NOT made the computer and Internet Explorer any faster.  In fact, while researching this at the community my Internet Explorer program got hung up (I had to restart IE) and generated the following events:

       

      Event Type: Error
      Event Source: Application Hang
      Event Category: (101)
      Event ID: 1002
      Date:  5/20/2010
      Time:  5:38:32 PM
      User:  N/A
      Computer: SYBIL
      Description:
      Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

      For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
      Data:
      0000: 41 70 70 6c 69 63 61 74   Applicat
      0008: 69 6f 6e 20 48 61 6e 67   ion Hang
      0010: 20 20 69 65 78 70 6c 6f     iexplo
      0018: 72 65 2e 65 78 65 20 38   re.exe 8
      0020: 2e 30 2e 36 30 30 31 2e   .0.6001.
      0028: 31 38 37 30 32 20 69 6e   18702 in
      0030: 20 68 75 6e 67 61 70 70    hungapp
      0038: 20 30 2e 30 2e 30 2e 30    0.0.0.0
      0040: 20 61 74 20 6f 66 66 73    at offs
      0048: 65 74 20 30 30 30 30 30   et 00000
      0050: 30 30 30                  000  

      Event Type: Error
      Event Source: Application Hang
      Event Category: None
      Event ID: 1001
      Date:  5/20/2010
      Time:  5:38:48 PM
      User:  N/A
      Computer: SYBIL
      Description:
      Fault ****** 1180947459.

      For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
      Data:
      0000: 42 75 63 6b 65 74 3a 20   ******:
      0008: 31 31 38 30 39 34 37 34   11809474
      0010: 35 39 0d 0a               59.. 

      So, I want to understand the error message above so that I can determine whether McShield is contributing to the SearchIndexer problem.

       

      I also ran a complete virus scan after the reboot.  It located 2 potentially unwated programs.  I thought the screen told me the unwanted programs were removed, but the printed security report says nothing about that.  It also mentioned detecting 84 Trojans, but gave no indication that anything had been done about those Trojans or what they were.  The Firewall allowed 136 programs and blocked none.

       

      What does it mean that the scan detected 84 Trojans?  Isn't this something that should be fixed?

       

      Can I find out more about the Potentially Unwanted Programs?  There doesn't seem to be any more information than that there were 2 of them found.