DCOM Configuration Warning!

While in the Administrative Tools under Component Services i was clicking on all the + boxes in the list on the left side to see if anything looked suspicious and i got a warning window that reads: DCOM Configuration Warning! The CLSID item "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe and title Messenger Class has the named value AppID, but is not recorded under \\HKEY_CLASSES_ROOT\AppId. Do you wish to record it? Yes or No . I haven't done anything yet. The warning message is waiting for me to pick yes or no I have read a bunch of stuff about rootkits and i just want to make sure this isn't another trick from that virus What should i do?

Hi Narrisah,

I have had the following error for years showing in my Eventviewer, have enquired through my professional techie who tells me all PC's have these errors so not to worry with it. I do not even have Google Notifier installed. My computer runs marvellously well so I took his advice and put the error out of my mind if that is any help to you.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10000
Date: 15/09/2008
Time: 3:14:41
User: ##########
Computer: PC
Description:
Unable to start a DCOM Server: {FBA44040-BD27-4A09-ACC8-C08B7C723DCD}. The error:
"The system cannot find the file specified. "
Happened while starting this command:
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -EmbeddingFor more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Errors showing in my event viewer annoy me, but I have found no answer to the above in quotes and until I saw your post had actually forgotten about it, but found it still there when I went into check before answering your thread……..darn it

kind regards,

The window that popped up looks exactly like this :

DCOM CONFIGURATION WARNING!

the CLSID {96F8C0C7-F106-437D-90DC-6C92793246C4}, item in "C:\Program
Files\Yahoo!\Messenger\YahooMessenger.exe" and the title Messenger Class has the named value AppId, but is
not recorded under \\ HKEY_CLASSES_ROOT\AppId. Do you wish to record it?


i have to choose either yes or no the red X box in the right hand corner is not usable and if i try and right click it down
in the task bar nothing happens. So i just opened up task manager and clicked on end task. Is this type of program normally
something that is recorded under the \\HKEY_CLASSES_ROOT ?

Hi Narrisah,

I do not have an answer for you. I did google your problem and feel it would be wise for you to go to Welcome to New Members. Follow Teachers_Committ… and LDTate's advice as he is the best of the best.

Keep us posted how you get on please.

kind regards,

According to Processlibrary.com, YahooMessenger.exe is the executable for Yahoo Messenger and you show it being in the right location so It's unlikely to be infected. Upload it to jotti.com and scan it there just to be on the safe side. You could try uninstalling, rebooting then reinstalling Yahoo Messenger, see if it changes anything.

If not too late… SAY NO!

If you don't know why something is wanting to do something, don't let it do it! Why would Yahoo need to know anything about what is going on in your Administrative tools! It doesn't. SAY NO!

While I agree it is not likely to be infected, when I punch that CLSID in Tony Klein's site, it is not found - doesn't mean bad, but not good either.

Have you scanned for malware?

I would urge you to purge your system of clutter using Windows [XP / Vista] Disk Cleanup, ATF Cleaner or CCleaner. If you use CCleaner, then during installation, uncheck the option to install the Yahoo toolbar and before first use, go to Options > Settings > Advanced and ensure Only delete files in Windows Temp folders older than 48 hours is unchecked.

Note: Ensure you know your site credentials (user name and password) for sites you frequent before cleaning; you may have to login again at next visit.

Download, install, update, and run Malwarebytes's Anti-Malware (MBAM) to ensure your system is free of malware. Then do the same for all other computers on your network (everything on your side of the Internet gateway, typically a cable/DSL modem).

I would probably uninstall anything to do with Yahoo until this is resolved - especially Toolbars.

If still having the same DCOM errors after that, see these WhattheTech HijackThis Log Procedures for complete for instructions on downloading and installing the latest version of HJT, and where to post your log. Once properly posted, a WTT Malware Removal expert will take over. When finished there, please post here back with a status update.
*********************
In the meantime…

DCOM errors do not necessarily mean something is wrong. If you (or your admin) has disabled the Help and Support Center service, for example, and you clicked on a help link in some program that relies on that service, it will fail to open and toss up a DCOM error, with an Event ID of 10005. No big deal. I get those occasionally.

Programs configured to automatically check for updates or new messages, or programs that are configured to "serve up" a notification to your system tray of downtown temperatures, new IM, new email, etc. that are subsequent blocked by firewalls may toss a DCOM error.

Searching on DCOM 10000 googletoobarnotifier does not lead to anything specific. You might want to see if you firewall (and anti-malware tools) settings support the notifier.