Windows 10 Event ID 10010 and 10016 Errors With DistributedCOM

Joanne said:

Can / Should I go back and, somehow, revert those Registry changes to their Default state? Is this even possible? .

I agree with everything @fdegrove said above.

You can't reset to default in Windows - only clean install. If you can remember what you changed (or saved the acls beforehand with icacls) you can revert it but otherwise, no.

I clean install a lot but if you want to play with permissions try something like this to save and restore permissions..

PHP Code:

function takeOwn-folder ($folder)
{   $toplevel=Split-Path $folder -leaf

    # Delete the old .acl file (in case it exists)
    If (Test-Path "$PSScriptRoot\$toplevel.acl") {Remove-Item "$PSScriptRoot\$toplevel.acl" -Force -ErrorAction 0}
     
    # backup ACLs for folder
    icacls "$folder" /save "$PSScriptRoot\$toplevel.acl" /t 
     
    # take ownership - note the /d Y on takeown - it means answer prompt with Y.  See
    # http://serverfault.com/questions/786764/takeown-you-do-not-have-permission-to-read-the-contents-of-directory
    takeown /f "$folder" /r /d Y
     
    # Grant full rights to current user
    icacls "$folder" --% /grant "%USERDOMAIN%\%USERNAME%":(F) /t
}
#-------------------------------------------------------------------------------------------------
function restoreOwn-folder ($folder, $owner)
{   $toplevel=Split-Path $folder -leaf
    $parentPath=Split-Path -parent $folder
 
    # reset owner to the owner passed in as parameter - e.g. "NT SERVICE\TrustedInstaller"
    icacls "$folder" /setowner "$owner" /t
         
    # Restore ACLs
    icacls "$parentPath" /restore "$PSScriptRoot\$toplevel.acl"
         
    # Tidy up
    Remove-Item "$PSScriptRoot\$toplevel.acl" -Force -ErrorAction 0
    
} 


Thumbnail Cache Class Factory for Out of Proc Server
{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

I have 870 errors from DCOM {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} the last 4 months.

Event ID: 10000

Code:

Unable to start a DCOM Server: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}. The error:
"367"
Happened while starting this command:
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

It used to also give some 10010 errors in the past, "The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.", but 2.5 months ago it stopped, without me knowingly doing something (maybe an MS update took care of them!), but the 10000 errors keep coming very frequently.

Does anyone have any idea what this DCOM component "Thumbnail Cache Class Factory for Out of Proc Server" is and what does it do?
And of course, is there a way to fix the EventID 10000 it produces?

If it's worth something I'm on W10x64 Pro Version 1607 Build 14393.1198

fdegrove said:

Hi,

Check your system for malware and remove the offender. Then run sfc /scannow after you have rebooted.
Powelik Trojan :

https://www.bleepingcomputer.com/vir...oweliks-trojan

Cheers,

Thanks, I'll give it a try!...and post back :)

I run the eset cleaner.

In its log I found that it did scan in:

[2017.05.14 00:12:38.850] - INFO: Processing [HKLM\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}]...
[2017.05.14 00:12:38.850] - INFO: Processing subkey [\Registry\Machine\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32]

...but it didn't find anything!!!



Any other idea... @fdegrove ?

No, everything seems to be working perfectly.
Up to a couple of months ago, maybe a little more, there was also a timeout error (EventID 10010):
EventID: 10010 , "The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.".
Not any more. I haven't seen the timeout error for more than 2.5 months.... and as you said, I had seen it and didn't bother, as I couldn't do anything with the timeout.

But the other one EventID 10000 is still there...The last time shown in event viewer is 2 days ago.

Currently, I just checked procexp and it runs.
C:\WINDOWS\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} and didn't produce any error.