FUTUREX service failed to start [...] Access denied.

[CostaRica]

Many of my clients have been randomly getting these errors in the system log:

The FUTUREX service failed to start due to the following error:
Access is denied.

Event ID: 7000
Source: Service Control Manager


I have not been able pinpoint what creates this. As far as I know, the only similarities between the clients getting this error is using NT 4.0, and using McAfee antivirus (Groupshield and/or Netshield). I cannot find any files with "futurex" as part of the name, and in the registry there is only an entry for LEGACY_FUTUREX in H_L_M/System/ControlSet001/Enum/root/LEGACY_FUTUREX

Anybody having this problem too? Any ideas? TIA!

 

[mhmmuenchen]

This problem is not limited to Windows NT 4 and McAfee.
We have many different PCs with this error message running Win NT/2000 but not McAfee antivirus.

Sorry, no idea what causes this error.

 

[Steve Bowman]

where you want to start would be in Control Panel->Services
look for an entry "futurex" dbl-clck the entry and look at the "path to executable" FUTUREX is the service name not the program.exe the service represents

Steve Bowman
steve.bowman@ultraex.com

 

[dutch62]

You could also check in Settings, Control Panel, Services
whick account is running the service. Should be administrator. You could also try checking the option "allow service to interact with desktop".

Dutch

 

[CostaRica]

Well, you see, my concern is not that the service is denied access. In fact, I am glad that it IS denied access. I want to know who/what is trying to start this service. It does not show up in the Services list. I don't believe it is a proper service.

My concern is that it might be some kind of RPC attack, browser hijack, or else, trying to start the service remotely, whether it be from inside the network (an "infected" workstation) or from the outside on the open ports (say 80 or 25, or whatnot. Although not all clients that have this error message have the same open ports through the firewall, and some have none open at all).

But... I really have no fundation for this suspicion, other than the years have taught me not to trust processes that just "suddenly appear" on your server.

I know it's not just me getting these messages. But to this day I have not been able to find out any information.


In the end, it could be some harmless error trying to display a website's encrypted page or something. But... I will only feel at ease when I know for sure.

 

[StoneDeCroze]

I've got this problem too. I would like to know what it is as I am having problems browsing the web and this is the only niggle I can find in any log.

Peter

 

[StoneDeCroze]

Finally the answer:

http://www.livewiredev.com/bbs/show...9caaf5c4ef5c454ac6ad&threadid=3753&highlight=

Peter