HP ProLiant DL380 G4 Server error message on login

[Funkcija 13]

Hi!

Im recieveing error message when I try loging to Windows 2003 server console:

Error loading C:\WINDOWS\system32\drivers\macfce12.sys

The specified module could not be found.

The problem at first place was that login lasted 10-20 minutes...and after I renamed that macfce12.sys file i get that error message and login continues instantly.

Can anyone tell me is that macfce12.sys file is HP known driver and for what? Because there are some registry references saying its kernel driver...

Thanks for help!

[James ~ Happy Dude]

No Idea !

Seems like MAC OS files for the game > Super Mario !! ...
OR,

MacFC is a freeware Nintendo Entertainment System emulator.

I would be interested to know how this is related to HP or Microsoft instead !!

Regards,
James.

[~sesh]

Very strange indeed. This file is nowhere to be referenced anywhere on the web.

Have you tried booting in Safe Mode, if it works you could try and prevent the file from loading!?

Really I'm thinking my guess is as good as anybodys guess here.

When you say you are accessing Windows 2003 server console, do you mean working physically on it or remotely accessing the server?

[Joshua Small_2]

A file with a name that doesn't popup anywhere on the web generally does so because it has a random name. That could indicate some kind of virus or similar.
I would recommend uploading the file to:

http://virusscan.jotti.org
And see what you get back.

[Funkcija 13]

OK, this is what happened. At first I was unable to login to server console, the server loaded user profile and just standed there for half hour if you dont bring up task mannager and kill rundll32 process. After that desktop shows up and everything ok.

Then I renamed macfce12.sys file and I get error message and after I click OK session resumes, and desktop shows up.

I can see some registry entries for macfce12 file stating its kernel driver? I just want to be shure is it safe to delete those registry references?

[Funkcija 13]

And yes...its phisical server console and remote desktop session that lock.

Ive prevented file from loading.

And I cant get to server (very soon) to boot it in safe mode...

[Joyson Noronha]

Hi,

Since the Location is for a Driver , Try Updating the Prolaint Support pack, As that would Update all drivers

- As " macfce12.sys " Does not Relate to any Hp File, Try Running Virus Scan.

- As You have the Error at Start, Check under the Startup tab in MSCONFIG

-Incase the Issue Persist Try Searching & Deleting it from All these Locations (Back up your Registry First)


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

-Joyson

[Funkcija 13]

First key is located in:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MACFCE12]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MACFCE12\0000]
"Service"="macfce12"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="macfce12"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MACFCE12\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MACFCE12\0000\Control]
"ActiveService"="macfce12"



and when i try delete it it says "Cannot delete LEGACY_MACFCE12: Error while deleting key."

[Joshua Small_2]

It has been suggested twice that you virus scan this file.
Any further advice will be guesswork until you do so.
Please upload it to the website I mentioned where it will be scanned and report back.

[Joyson Noronha]

Hi,

Incase if a Virus Scan is Not Detecting, Try using Spyware Scan & Try Renaming it as .old and see that works out.

Incase the Issue Persist,Then back your Data and try the Repair Option for Server 2003.

[Joshua Small_2]

It is likely that the reason you cannot delete those keys is permissions.
Open regedit, right click and check permissions. There are a number of keys at the Administrator user has read-only access to, as they relate directly to hardware.

Again, before just attempting to delete these, I would be checking exactly what this file is by virusscanning it.