How to Solve GetUserDefaultLCID failed Error

Message Topic Search Topic Options Post Reply Create New Topic Printable Version

   is there a way using sysinternals to determin what is causing the GetUserDefaultLCID failed error in the wbemcore.log?

something is generating this error constantly causing my virus program to constantly scan this file.

its very anoying...

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version
chj124 Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 26 March 2009 Online Status: Offline Posts: 5	Quote Reply Topic: How to Solve GetUserDefaultLCID failed Error Posted: 26 March 2009 at 12:45pm
	is there a way using sysinternals to determin what is causing the GetUserDefaultLCID failed error in the wbemcore.log? something is generating this error constantly causing my virus program to constantly scan this file. its very anoying...

dirbase Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 26 March 2008 Online Status: Offline Posts: 295	Quote Reply Posted: 26 March 2009 at 9:32pm
	Hi chj124, If you are talking of the messages "*GetUserDefaultLCID failed, restorting to system verion*" logged in wbemcore.log under XP SP3, I suggest you could read my recent post on this topic. If this case applies, these messages can be safely ignored and you could configure your virus program to ignore this file or disable wmi loggings (command window for wmimgmt.msc > right click on WMI control /properties >logging tab > disable

chj124 Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 26 March 2009 Online Status: Offline Posts: 5	Quote Reply Posted: 27 March 2009 at 12:51pm
	i am interested in determining the application causing it (besides the dll change) everything else is working so that i would say, yes, it can be ignored... except for the virus scanning of the file which is something we have no control over since this is corporate controlled and the paperwork involved, or time to get a change, is ridiculous. anyway, it would be nice to determine the app the error is generated for.

chj124 Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 26 March 2009 Online Status: Offline Posts: 5	Quote Reply Posted: 27 March 2009 at 2:35pm
	i have turned on verbose logging and found this... (Fri Mar 27 10:19:04 2009.88312296) : CALL ConnectionLogin::NTLMLogin wszNetworkResource = \\.\root\ccm\SoftwareMeteringAgent pPreferredLocale = (null) lFlags = 0x0 (Fri Mar 27 10:19:04 2009.88312296) : DCOM connection from NT AUTHORITY\SYSTEM at authentiction level Privacy, AuthnSvc = 10, AuthzSvc = 0, Capabilities = 0 (Fri Mar 27 10:19:04 2009.88312296) : GetUserDefaultLCID failed, restorting to system verion(Fri Mar 27 10:19:04 2009.88312296) : CALL CWbemNamespace::GetObject BSTR ObjectPath = __SystemClass long lFlags = 0 IWbemClassObject pObj = 0x20CF918 (Fri Mar 27 10:19:14 2009.88322296) : CALL ConnectionLogin::NTLMLogin wszNetworkResource = \\.\root\ccm\SoftwareMeteringAgent pPreferredLocale = (null) lFlags = 0x0 (Fri Mar 27 10:19:14 2009.88322296) : DCOM connection from NT AUTHORITY\SYSTEM at authentiction level Privacy, AuthnSvc = 10, AuthzSvc = 0, Capabilities = 0 (Fri Mar 27 10:19:14 2009.88322296) : GetUserDefaultLCID failed, restorting to system verion(Fri Mar 27 10:19:14 2009.88322296) : CALL CWbemNamespace::GetObject BSTR ObjectPath = __SystemClass long lFlags = 0 IWbemClassObject pObj = 0x240F918 and i am seeing DCOM errors in my event log and i also found this in mtrmgr.log <![LOG[Creation event received for process 1796]LOG]!><time="10:31:35.461+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:252"> <![LOG[Process ID 1796 is for process C:\Program Files\McAfee\Common Framework\McScript_InUse.exe]LOG]!><time="10:31:35.554+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="processdata.cpp:141"> <![LOG[No matching rule found for process 1796]LOG]!><time="10:31:35.554+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="3008" file="activeprocesses.cpp:65"> <![LOG[Termination event received for process 1796]LOG]!><time="10:31:37.086+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:287"> <![LOG[Termination event received for process 2444]LOG]!><time="10:34:05.179+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:287"> <![LOG[Creation event received for process 2832]LOG]!><time="10:34:28.539+240" date="03-27-2009" component="mtrmgr" context="" type="1" thread="2088" file="swmtrmanager.cpp:252"> what else should i be lookin for?

dirbase Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 26 March 2008 Online Status: Offline Posts: 295	Quote Reply Posted: 27 March 2009 at 10:41pm
	I can see about the same verbose messages in my wbemcore.log as you do; the only error message is "GetUserDefaultLCID failed, restorting to system verion". If you are using XP SP3, a way to get rid of these errors is to roll back to the XP SP2 version of wbemcore.dll (which is version 5.1.2600.2180 with 530,944 bytes). First try to grab a copy of wbemcore.dll from a system running XP SP2. On the XP3 system, in safe mode, rename wbemcore.dll to something else, for example wbemcoreSP3.dll, in two locations: c:\windows\system32\wbem\ c:\windows\servicepackfiles\i386\ Copy the SP2 version of wbemcore.dll in each of these two folders. Reboot. In wbemcore.log, you will still see many comments in verbose mode but the "GetUserDefaultLCID failed, restorting to system verion" error should not show up. With error logging mode set, the file should be pretty quiet. Edited by dirbase - 28 March 2009 at 7:04pm

dirbase Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 26 March 2008 Online Status: Offline Posts: 295	Quote Reply Posted: 30 March 2009 at 2:05pm
	This error is generated inside wbemcore.dll due to a bug in the SP3 version; more precisely a bug in the wbemcore!GetDefaultLocale routine which has been modified from the SP2 version. AFAIU, the error is logged if a certain memory value is 0; the problem is that this value is initialized with 0, and is not modified in standard cases! Edited by dirbase - 30 March 2009 at 2:06pm

chj124 Members Profile Send Private Message Find Members Posts Add to Buddy List Newbie Joined: 26 March 2009 Online Status: Offline Posts: 5	Quote Reply Posted: 30 March 2009 at 2:09pm
	thanks for the info... do you think the dcom errors i see are related? and from the other things i noticed, is it related to the software metering agent?

dirbase Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 26 March 2008 Online Status: Offline Posts: 295	Quote Reply Posted: 30 March 2009 at 2:37pm
	Could you please paste the details of the dcom errors you get in your event log (the system event log, I presume..). Are the timestamps the same for the wbemcore.log errors and the DCOM events? Edited by dirbase - 30 March 2009 at 2:46pm