This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unknown Error 0x80070057 decomposing ""

I am receiving this error on about 30-40 PCs. There is nothing between the "" on the error. I clear them and all systems seem to act normal. Please help with clearing this error.

This thread was automatically locked due to age.

Parents

0 QC over 8 years ago

Hello Donald Lindhuber,

0x80070057 normally means parameter error, it could have a number of causes though. I assume (it's just a guess) that a file that is to be scanned "disappears", this might be normal. How frequent are these errors (30-40 PCs out of how many endpoints - I've several thousand but less than one of these per month)? Could be a certain application (as a few ten endpoints show these errors I'd rule out disk or driver errors).

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 8 years ago

Hello Donald Lindhuber,

0x80070057 normally means parameter error, it could have a number of causes though. I assume (it's just a guess) that a file that is to be scanned "disappears", this might be normal. How frequent are these errors (30-40 PCs out of how many endpoints - I've several thousand but less than one of these per month)? Could be a certain application (as a few ten endpoints show these errors I'd rule out disk or driver errors).

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 DonaldLindhuber over 8 years ago in reply to QC

That would make sense. This happens to the 30-40 nightly if I clear the error message. This happens at 10:00pm (ET) when scanning occurs. It seems like the PCs are the same ones every night. I will be keeping track of that. It might have something to do with those workstations. This only started occurring after the recent ~140MB download/install that Sophos put out.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 8 years ago in reply to DonaldLindhuber

Hello Donald,

when scanning occurs
a scheduled scan? Then it might be feasible to set up a trace or use ProcessMonitor to find out what's going on.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 DonaldLindhuber over 8 years ago in reply to QC

It is a policy set up to scan PCs at 10pm. How would I go about setting up the trace or process monitor with Sophos?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 8 years ago in reply to DonaldLindhuber

Hello Donald,

please contact Support directly - you say that it seems to have started with the upgrade to 10.6, or perhaps it's just the engine. If it's indeed a change in a Sophos component you'd probably have to send them the logs anyway so it's better to have guidance in advance.

If you are not familiar with Sysinternal's Microsoft's ProcessMonitor (this is what I meant) don't bother (for now).

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 DonaldLindhuber over 8 years ago in reply to QC

I appreciate your help and will contact support!

P.S. I am familiar with Microsoft's Process Explorer, but wasn't sure if you meant that or if there was something that Sophos had to monitor these things.

-Don
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 8 years ago in reply to DonaldLindhuber

Hello Don,

Process Monitor is Explorer's cousin. The basics are intuitive, locating the error in the output is harder.

Christian
Cancel
Vote Up 0 Vote Down

Cancel