Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Subscribers 3 subscribers
  • Views 14872 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unknown Error 0x80070057 decomposing ""

DonaldLindhuber

I am receiving this error on about 30-40 PCs. There is nothing between the "" on the error. I clear them and all systems seem to act normal. Please help with clearing this error.



This thread was automatically locked due to age.
  • 0

    Hello Donald Lindhuber,

    0x80070057 normally means parameter error, it could have a number of causes though. I assume (it's just a guess) that a file that is to be scanned "disappears", this might be normal. How frequent are these errors (30-40 PCs out of how many endpoints - I've several thousand but less than one of these per month)? Could be a certain application (as a few ten endpoints show these errors I'd rule out disk or driver errors).  

    Christian

  • 0 in reply to QC

    That would make sense. This happens to the 30-40 nightly if I clear the error message. This happens at 10:00pm (ET) when scanning occurs. It seems like the PCs are the same ones every night. I will be keeping track of that. It might have something to do with those workstations. This only started occurring after the recent ~140MB download/install that Sophos put out.

  • 0 in reply to DonaldLindhuber

    Hello Donald,

    when scanning occurs
    a scheduled scan? Then it might be feasible to set up a trace or use ProcessMonitor to find out what's going on.

    Christian

  • 0 in reply to QC

    It is a policy set up to scan PCs at 10pm. How would I go about setting up the trace or process monitor with Sophos?

  • 0 in reply to DonaldLindhuber

    Hello Donald,

    please contact Support directly - you say that it seems to have started with the upgrade to 10.6, or perhaps it's just the engine. If it's indeed a change in a Sophos component you'd probably have to send them the logs anyway so it's better to have guidance in advance.

    If you are not familiar with Sysinternal's Microsoft's ProcessMonitor (this is what I meant) don't bother (for now).

    Christian

  • 0 in reply to QC

    I appreciate your help and will contact support!

    P.S. I am familiar with Microsoft's Process Explorer, but wasn't sure if you meant that or if there was something that Sophos had to monitor these things.

    -Don

  • 0 in reply to DonaldLindhuber

    Hello Don,

    Process Monitor is Explorer's cousin. The basics are intuitive, locating the error in the output is harder.

    Christian

  • 0

    Looks like we had a reboot script for PCs running at the same time. Once the time was changed on this, the errors have gone away.

    Don't schedule a scan and a reboot at the same times!

Unfiltered HTML