9 Replies Latest reply on Apr 10, 2008 4:14 AM by PBateman

    mcshield.exe - application error

      Hello guys

      I'm having a problem with VSE8.0i Patch 16 on x2 Windows x64 bit 2003 R2 servers.

      We get the following error before the servers shut down

      Windows is shutting down........

      Then a box appears

      The exception unknown software exception at 0xc0000005 occurred in the application at location 0x7d620fda

      Click OK to terminate the application

      I have upgraded from patch 13 to patch 16 and also reinstalled the agent and VSE several times.

      Its an intermittant problem which normally wouldn't bother me but the servers are brand new , its happening on both of them or i think it may be a bug.

      I've had a look around the web and searched many forums but can not find this error message, can anyone help me?

      Thanks in advance

      Paul


      We have recently installed
        • 1. RE: mcshield.exe - application error
          tonyb99
          Can you post the relevant section of the CMA agent logfile from C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db
          • 2. Many Thanks
            20080410091022 I #3812 naCmnLib Random seed = 0x8b70****
            20080410091022 I #4908 naCmnLib Random seed = 0x45bf****
            20080410091022 I #3812 Agent Agent communication thread started
            20080410091022 i #4908 Agent Agent will connect to Server in randomized full ASCI interval : 3600 seconds
            20080410091022 i #3812 Agent Agent will connect to the ePO Server in 60 minutes and 0 seconds.
            20080410091022 I #4908 naCmnLib Random seed = 0xef25****
            20080410091022 I #4312 naCmnLib Random seed = 0x5e98****
            20080410091022 I #4312 Agent Agent event worker thread started
            20080410091022 I #1960 Agent Subsystem started
            20080410091022 I #4848 naCmnLib Random seed = 0x013c****
            20080410091022 I #4848 Agent Agent Immediate Events worker thread started
            20080410091022 I #2060 naCmnLib Random seed = 0xd28a****
            20080410091022 i #2060 Agent Next policy enforcement in 5 minutes
            20080410091022 I #1960 naCmnLib Random seed = 0xc741****
            20080410091022 I #1960 FrmSvc Starting Subsystem <Listen Server>
            20080410091022 I #1960 naCmnLib Random seed = 0x220b****
            20080410091022 I #4908 Agent Agent worker thread started
            20080410091022 i #4908 Agent Agent will connect to Server in : 2893 seconds
            20080410091022 I #1960 InetMgr IP address for ePO Server =151.176.68.201
            20080410091022 I #5060 naCmnLib Random seed = 0xb737****
            20080410091022 I #4804 naCmnLib Random seed = 0x47c0****
            20080410091022 I #700 naCmnLib Random seed = 0x20a9****
            20080410091022 I #3772 naCmnLib Random seed = 0x3826****
            20080410091022 I #4364 naCmnLib Random seed = 0x4f7c****
            20080410091022 I #3776 naCmnLib Random seed = 0xbee2****
            20080410091022 I #4008 naCmnLib Random seed = 0xaf0a****
            20080410091022 I #4292 naCmnLib Random seed = 0xce0a****
            20080410091022 I #4560 naCmnLib Random seed = 0xe203****
            20080410091022 I #4792 naCmnLib Random seed = 0x3581****
            20080410091022 I #2072 naCmnLib Random seed = 0x382d****
            20080410091022 I #4436 naCmnLib Random seed = 0x5952****
            20080410091022 I #1976 naCmnLib Random seed = 0x25cb****
            20080410091022 I #4844 naCmnLib Random seed = 0x6946****
            20080410091022 I #4484 naCmnLib Random seed = 0xd8c3****
            20080410091022 I #192 naCmnLib Random seed = 0xc58a****
            20080410091022 I #4136 naCmnLib Random seed = 0x7775****
            20080410091022 I #1572 naCmnLib Random seed = 0xb735****
            20080410091022 I #4316 naCmnLib Random seed = 0xa649****
            20080410091022 I #4680 naCmnLib Random seed = 0xb8ff****
            20080410091022 I #3184 naCmnLib Random seed = 0x9895****
            20080410091022 I #3896 naCmnLib Random seed = 0xa3ab****
            20080410091022 I #4604 naCmnLib Random seed = 0x9428****
            20080410091022 I #1764 naCmnLib Random seed = 0xf02e****
            20080410091022 I #1164 naCmnLib Random seed = 0x21b3****
            20080410091022 I #4812 naCmnLib Random seed = 0x3aa1****
            20080410091022 I #5012 naCmnLib Random seed = 0xc87b****
            20080410091022 I #4828 naCmnLib Random seed = 0x6be6****
            20080410091022 I #4980 naCmnLib Random seed = 0x23ac****
            20080410091022 I #4724 naCmnLib Random seed = 0xcc5d****
            20080410091022 I #1300 naCmnLib Random seed = 0x76e3****
            20080410091022 I #3976 naCmnLib Random seed = 0xb3e0****
            20080410091022 I #4932 naCmnLib Random seed = 0x6233****
            20080410091022 I #5084 naCmnLib Random seed = 0x8928****
            • 3. RE: Many Thanks
              20080410091022 I #5060 InetMgr IP address for ePO Server =151.176.68.201
              20080410091022 I #5060 LstnSvr CAsyncSocket::Socket() m_hSocket=1144, this=0x00cc7fd0
              20080410091022 I #5060 LstnSvr CAsyncSocket::AttachHandle hSocket=1144 ,pSocket = 0x00cc7fd0, bRet=1
              20080410091022 x #1960 LstnSvr Subsystem started
              20080410091022 I #1960 FrmSvc Starting Subsystem <Trusted Connection>
              20080410091022 I #1960 TrstCon Start
              20080410091022 I #1960 FrmSvc Service started
              20080410091530 I #1352 naCmnLib Random seed = 0xe1fa****
              20080410091530 I #1356 naCmnLib Random seed = 0xef1e****
              20080410091530 I #1336 FrmSvc START cmdline="C:\Program Files (x86)\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart
              20080410091530 I #1336 FrmSvc ServiceStart
              20080410091530 I #1336 FrmSvc Running
              20080410091530 I #1368 FrmSvc Starting Subsystem <Logging>
              20080410091530 x #1368 Logging Subsystem started
              20080410091530 I #1368 naCmnLib Random seed = 0x9f17****
              20080410091530 I #1368 FrmSvc Starting Subsystem <Internet Manager>
              20080410091530 i #1368 InetMgr Subsystem started
              20080410091530 I #1368 FrmSvc Starting Subsystem <User Space Controller>
              20080410091530 I #1368 naCmnLib Random seed = 0x70ae****
              20080410091530 I #1368 naCmnLib Random seed = 0xaaad****
              20080410091530 I #1368 FrmSvc Starting Subsystem <Management>
              20080410091530 I #1416 naCmnLib Random seed = 0xa9df****
              20080410091530 I #1416 Manage Mangement plugin watch worker thread started
              20080410091530 I #1368 Cmalib Referencer 1 VIRUSCAN8000
              20080410091530 x #1368 Manage Subsystem started
              20080410091530 I #1368 naCmnLib Random seed = 0x5b37****
              20080410091530 I #1368 FrmSvc Starting Subsystem <Script>
              20080410091530 i #1368 Script Subsystem started
              20080410091530 I #1368 naCmnLib Random seed = 0x6ed9****
              20080410091530 I #1368 FrmSvc Starting Subsystem <Updater>
              20080410091530 i #1368 Updater Subsystem started
              20080410091530 I #1368 naCmnLib Random seed = 0x8e36****
              20080410091530 I #1368 FrmSvc Starting Subsystem <Scheduler>
              20080410091530 I #1368 Sched >>--CSchedule::Start
              20080410091530 I #1368 naCmnLib Random seed = 0x7baf****
              20080410091530 I #1368 naCmnLib Random seed = 0x6ff1****
              20080410091530 I #1368 Sched Glbs.szMyPlatform: WXPS:5:2:2
              20080410091530 I #1368 Sched Servers Update @ 2hrs - Last run time(local) is Thu Apr 10 08:02:00 2008
              20080410091530 I #1368 Sched
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
              20080410091530 I #1368 Sched CNaiSchedule::GetRandomizedDelayMins() : 11
              20080410091530 i #1368 Sched Next time(local) of task Servers Update @ 2hrs: 10 April 2008 10:11:00
              20080410091530 I #1368 Sched eP0 Update @ Logon - Last run time is : not run yet
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
              20080410091530 I #1368 Sched eP0 Wakeup @ Logon - Last run time is : not run yet
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
              20080410091530 I #1368 Sched eP0 Update @ 11.00AM - Last run time is : not run yet
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
              20080410091530 I #1368 Sched CNaiSchedule::GetRandomizedDelayMins() : 133
              20080410091530 i #1368 Sched Next time(local) of task eP0 Update @ 11.00AM: 10 April 2008 13:13:00
              20080410091530 I #1368 Sched Immediate Update - Last run time is : not run yet
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
              20080410091530 I #1368 Sched Deployment Task - Last run time(local) is Wed Apr 09 17:34:34 2008
              20080410091530 I #1368 Sched
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
              20080410091530 I #1368 Sched {A14CD6FC-3BA8-4703-87BF-E3247CE382F5} - Last run time is : not run yet
              20080410091530 I #1368 Manage DoesSoftwareExists SoftwareID=VIRUSCAN8000
              20080410091530 I #1368 Sched CNaiSchedule::GetRandomizedDelayMins() : 45
              20080410091530 i #1368 Sched Next time(local) of task {A14CD6FC-3BA8-4703-87BF-E3247CE382F5}: 10 April 2008 17:45:00
              20080410091530 I #1368 Sched All the tasks are successfully loaded from the file
              20080410091530 i #1368 Sched Scheduler is now running
              20080410091530 I #1368 Sched <<--CSchedule::Start
              20080410091530 I #2020 naCmnLib Random seed = 0x2f23****
              20080410091530 I #2020 naCmnLib Random seed = 0xa880****
              20080410091530 I #2016 naCmnLib Random seed = 0x3360****
              20080410091530 I #2016 naCmnLib Random seed = 0xfc25****
              20080410091530 I #1368 naCmnLib Random seed = 0xdda2****
              20080410091530 I #1368 FrmSvc Starting Subsystem <Agent>
              20080410091530 I #1368 Agent Subsystem starting...
              20080410091530 I #2032 naCmnLib Random seed = 0x3288****
              20080410091530 I #2032 Agent Agent communication thread started
              20080410091530 I #2036 naCmnLib Random seed = 0x0ba8****
              20080410091530 i #2032 Agent
              20080410091530 i #2036 Agent Agent will connect to Server in randomized full ASCI interval : 3600 seconds
              • 4. RE: Many Thanks
                20080410091530 I #2036 naCmnLib Random seed = 0xd039****
                20080410091530 I #2040 naCmnLib Random seed = 0x8e11****
                20080410091530 I #2044 naCmnLib Random seed = 0xaeed****
                20080410091530 I #2040 Agent Agent event worker thread started
                20080410091530 I #2044 Agent Agent Immediate Events worker thread started
                20080410091530 I #1368 Agent Subsystem started
                20080410091530 I #144 naCmnLib Random seed = 0xd93d****
                20080410091530 i #144 Agent Next policy enforcement in 5 minutes
                20080410091530 E #2036 Cmalib Error trace:
                20080410091530 I #1368 naCmnLib Random seed = 0x4ccf****
                20080410091530 E #2036 Cmalib [Add to Windows Firewall]->
                20080410091530 E #2036 Cmalib error -2147023143: There are no more endpoints available from the endpoint mapper.
                20080410091530 I #2036 Agent Agent worker thread started
                20080410091530 i #2036 Agent Agent will connect to Server in : 3169 seconds
                20080410091530 I #1368 FrmSvc Starting Subsystem <Listen Server>
                20080410091530 I #1368 naCmnLib Random seed = 0xde22****
                20080410091530 E #1368 Cmalib Error trace:
                20080410091530 E #1368 Cmalib [Add to Windows Firewall]->
                20080410091530 E #1368 Cmalib error -2147023143: There are no more endpoints available from the endpoint mapper.
                20080410091530 I #1368 InetMgr IP address for ePO Server =151.176.68.201
                20080410091530 I #152 naCmnLib Random seed = 0xcfd0****
                20080410091530 I #200 naCmnLib Random seed = 0x11d8****
                20080410091530 I #196 naCmnLib Random seed = 0x6a2b****
                20080410091530 I #204 naCmnLib Random seed = 0x4005****
                20080410091530 I #188 naCmnLib Random seed = 0xa2c7****
                20080410091530 I #232 naCmnLib Random seed = 0x52ba****
                20080410091530 I #224 naCmnLib Random seed = 0xb67c****
                20080410091530 I #240 naCmnLib Random seed = 0x6b58****
                20080410091530 I #244 naCmnLib Random seed = 0xa020****
                20080410091530 I #252 naCmnLib Random seed = 0x8a1e****
                20080410091530 I #308 naCmnLib Random seed = 0xe175****
                20080410091530 I #304 naCmnLib Random seed = 0x8aa1****
                20080410091530 I #368 naCmnLib Random seed = 0x16b3****
                20080410091530 I #364 naCmnLib Random seed = 0x5cc9****
                20080410091530 I #372 naCmnLib Random seed = 0x8dcc****
                20080410091530 I #384 naCmnLib Random seed = 0x0ed3****
                20080410091530 I #376 naCmnLib Random seed = 0x7497****
                20080410091530 I #388 naCmnLib Random seed = 0x8536****
                20080410091530 I #380 naCmnLib Random seed = 0x279c****
                20080410091530 I #132 naCmnLib Random seed = 0xe848****
                20080410091530 I #448 naCmnLib Random seed = 0xb781****
                20080410091530 I #192 naCmnLib Random seed = 0x739e****
                20080410091530 I #604 naCmnLib Random seed = 0xf32b****
                20080410091530 I #488 naCmnLib Random seed = 0x0422****
                20080410091530 I #628 naCmnLib Random seed = 0x359c****
                20080410091530 I #672 naCmnLib Random seed = 0x6407****
                20080410091530 I #548 naCmnLib Random seed = 0xfb23****
                20080410091530 I #720 naCmnLib Random seed = 0xf42b****
                20080410091530 I #780 naCmnLib Random seed = 0x5e20****
                20080410091530 I #784 naCmnLib Random seed = 0xf0ee****
                20080410091530 I #788 naCmnLib Random seed = 0xbf77****
                20080410091530 I #812 naCmnLib Random seed = 0xbc87****
                20080410091530 I #892 naCmnLib Random seed = 0x9d60****
                20080410091530 I #964 naCmnLib Random seed = 0x99a7****
                20080410091530 I #152 InetMgr IP address for ePO Server =151.176.68.201
                20080410091530 I #152 LstnSvr CAsyncSocket::Socket() m_hSocket=1128, this=0x00cccab0
                20080410091530 I #152 LstnSvr CAsyncSocket::AttachHandle hSocket=1128 ,pSocket = 0x00cccab0, bRet=1
                20080410091530 x #1368 LstnSvr Subsystem started
                20080410091530 I #1368 FrmSvc Starting Subsystem <Trusted Connection>
                20080410091530 I #1368 TrstCon Start
                20080410091530 I #1368 FrmSvc Service started
                • 5. RE: Many Thanks
                  I stopped all 3 services, renamed the exisitng log file. Restarted services to create a log file. I then rebooted and have posted the log.

                  Thanks for your help
                  • 6. RE: Many Thanks
                    tonyb99
                    does the log cover the time period when you got the error?
                    what was the timestamp for the error?
                    • 7. RE: Many Thanks
                      Tony

                      I get the message when the server shuts down but its intermittant. i perform some reboots now and make sure the error appears and then paste that section of the log file.

                      Cheers
                      • 8. RE: Many Thanks
                        OK. I've rebooted at 09:57ish and got the error message. Below is the section of the log. Cheers Tony

                        20080410095700 I #1372 FrmSvc Starting Subsystem <Scheduler>
                        20080410095700 I #1372 Sched >>--CSchedule::Start
                        20080410095700 I #1372 naCmnLib Random seed = 0xc1b0****
                        20080410095700 I #1372 naCmnLib Random seed = 0x9f34****
                        20080410095700 I #1372 Sched Glbs.szMyPlatform: WXPS:5:2:2
                        20080410095700 I #1372 Sched Servers Update @ 2hrs - Last run time(local) is Thu Apr 10 08:02:00 2008
                        20080410095700 I #1372 Sched
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
                        20080410095700 I #1372 Sched CNaiSchedule::GetRandomizedDelayMins() : 17
                        20080410095700 i #1372 Sched Next time(local) of task Servers Update @ 2hrs: 10 April 2008 10:17:00
                        20080410095700 I #1372 Sched eP0 Update @ Logon - Last run time(local) is Thu Apr 10 09:26:25 2008
                        20080410095700 I #1372 Sched
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
                        20080410095700 I #1372 Sched eP0 Wakeup @ Logon - Last run time(local) is Thu Apr 10 09:36:25 2008
                        20080410095700 I #1372 Sched
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
                        20080410095700 I #1372 Sched eP0 Update @ 11.00AM - Last run time is : not run yet
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
                        20080410095700 I #1372 Sched CNaiSchedule::GetRandomizedDelayMins() : 149
                        20080410095700 i #1372 Sched Next time(local) of task eP0 Update @ 11.00AM: 10 April 2008 13:29:00
                        20080410095700 I #1372 Sched Immediate Update - Last run time is : not run yet
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
                        20080410095700 I #1372 Sched Deployment Task - Last run time(local) is Wed Apr 09 17:34:34 2008
                        20080410095700 I #1372 Sched
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=EPOAGENT3000
                        20080410095700 I #1372 Sched {A14CD6FC-3BA8-4703-87BF-E3247CE382F5} - Last run time is : not run yet
                        20080410095700 I #1372 Manage DoesSoftwareExists SoftwareID=VIRUSCAN8000
                        20080410095700 I #1372 Sched CNaiSchedule::GetRandomizedDelayMins() : 50
                        20080410095700 i #1372 Sched Next time(local) of task {A14CD6FC-3BA8-4703-87BF-E3247CE382F5}: 10 April 2008 17:50:00
                        20080410095700 I #1372 Sched All the tasks are successfully loaded from the file
                        20080410095700 i #1372 Sched Scheduler is now running
                        20080410095700 I #1372 Sched <<--CSchedule::Start
                        20080410095700 I #2020 naCmnLib Random seed = 0xe1f9****
                        20080410095700 I #2016 naCmnLib Random seed = 0xc68b****
                        20080410095700 I #2020 naCmnLib Random seed = 0x31ed****
                        20080410095700 I #2016 naCmnLib Random seed = 0x5c5d****
                        20080410095700 I #1372 naCmnLib Random seed = 0x4989****
                        20080410095700 I #1372 FrmSvc Starting Subsystem <Agent>
                        20080410095700 I #1372 Agent Subsystem starting...
                        20080410095700 I #144 naCmnLib Random seed = 0x3123****
                        20080410095700 I #144 Agent Agent communication thread started
                        20080410095700 i #144 Agent Agent will connect to the ePO Server in 60 minutes and 0 seconds.
                        20080410095700 I #148 naCmnLib Random seed = 0xa462****
                        20080410095700 i #148 Agent Agent will connect to Server in randomized full ASCI interval : 3600 seconds
                        • 9. RE: Many Thanks
                          20080410095700 I #148 naCmnLib Random seed = 0x897b****
                          20080410095700 I #152 naCmnLib Random seed = 0x88a6****
                          20080410095700 I #152 Agent Agent event worker thread started
                          20080410095700 I #1372 Agent Subsystem started
                          20080410095700 I #196 naCmnLib Random seed = 0xb1d2****
                          20080410095700 I #200 naCmnLib Random seed = 0x5966****
                          20080410095700 i #196 Agent Next policy enforcement in 5 minutes
                          20080410095700 I #200 Agent Agent Immediate Events worker thread started
                          20080410095700 E #148 Cmalib Error trace:
                          20080410095700 E #148 Cmalib [Add to Windows Firewall]->
                          20080410095700 I #1372 naCmnLib Random seed = 0x50ba****
                          20080410095700 E #148 Cmalib error -2147023143: There are no more endpoints available from the endpoint mapper.
                          20080410095700 I #148 Agent Agent worker thread started
                          20080410095700 i #148 Agent Agent will connect to Server in : 2459 seconds
                          20080410095700 I #1372 FrmSvc Starting Subsystem <Listen Server>
                          20080410095700 I #1372 naCmnLib Random seed = 0x446b****
                          20080410095700 E #1372 Cmalib Error trace:
                          20080410095700 E #1372 Cmalib [Add to Windows Firewall]->
                          20080410095700 E #1372 Cmalib error -2147023143: There are no more endpoints available from the endpoint mapper.
                          20080410095700 I #1372 InetMgr IP address for ePO Server =151.176.68.201
                          20080410095700 I #188 naCmnLib Random seed = 0xc37f****
                          20080410095700 I #224 naCmnLib Random seed = 0xeede****
                          20080410095700 I #232 naCmnLib Random seed = 0x3d9a****
                          20080410095700 I #240 naCmnLib Random seed = 0xac17****
                          20080410095700 I #244 naCmnLib Random seed = 0xe405****
                          20080410095700 I #252 naCmnLib Random seed = 0xbbc8****
                          20080410095700 I #308 naCmnLib Random seed = 0xb2db****
                          20080410095700 I #304 naCmnLib Random seed = 0x2cd9****
                          20080410095700 I #368 naCmnLib Random seed = 0x4db7****
                          20080410095700 I #364 naCmnLib Random seed = 0x220a****
                          20080410095700 I #372 naCmnLib Random seed = 0xa25d****
                          20080410095700 I #384 naCmnLib Random seed = 0x6d7a****
                          20080410095700 I #392 naCmnLib Random seed = 0x406c****
                          20080410095700 I #388 naCmnLib Random seed = 0x7783****
                          20080410095700 I #376 naCmnLib Random seed = 0x3856****
                          20080410095700 I #380 naCmnLib Random seed = 0xf1c2****
                          20080410095700 I #132 naCmnLib Random seed = 0x670c****
                          20080410095700 I #400 naCmnLib Random seed = 0x5105****
                          20080410095700 I #448 naCmnLib Random seed = 0xd97f****
                          20080410095700 I #192 naCmnLib Random seed = 0xa53b****
                          20080410095700 I #592 naCmnLib Random seed = 0xa8b4****
                          20080410095700 I #488 naCmnLib Random seed = 0xdafc****
                          20080410095700 I #616 naCmnLib Random seed = 0x19e2****
                          20080410095700 I #656 naCmnLib Random seed = 0xf1e4****
                          20080410095700 I #688 naCmnLib Random seed = 0x2a54****
                          20080410095700 I #640 naCmnLib Random seed = 0x778a****
                          20080410095700 I #772 naCmnLib Random seed = 0x572a****
                          20080410095700 I #776 naCmnLib Random seed = 0x3a0f****
                          20080410095700 I #780 naCmnLib Random seed = 0x2568****
                          20080410095700 I #804 naCmnLib Random seed = 0xece5****
                          20080410095700 I #880 naCmnLib Random seed = 0xfd6c****
                          20080410095700 I #952 naCmnLib Random seed = 0x24ed****
                          20080410095700 I #968 naCmnLib Random seed = 0xd9ab****
                          20080410095700 I #972 naCmnLib Random seed = 0x0188****
                          20080410095700 I #188 InetMgr IP address for ePO Server =151.176.68.201
                          20080410095700 I #188 LstnSvr CAsyncSocket::Socket() m_hSocket=1128, this=0x00cccb68
                          20080410095700 I #188 LstnSvr CAsyncSocket::AttachHandle hSocket=1128 ,pSocket = 0x00cccb68, bRet=1
                          20080410095700 x #1372 LstnSvr Subsystem started
                          20080410095700 I #1372 FrmSvc Starting Subsystem <Trusted Connection>
                          20080410095700 I #1372 TrstCon Start
                          20080410095700 I #1372 FrmSvc Service started
                          20080410095732 I #4428 FrmSvc User SID is S-1-5-21-979535682-1334220142-4116081320-500 and SessionID is 0
                          20080410095732 I #4428 Logging StartReadingMessages (\\.\mailslot\{76889C92-A0C0-46e3-A4E1-1D6A5439B8DD}00001108, 0x7f5b, 4)
                          20080410095732 I #4428 Logging - using empty 0