|
11/8/2007 11:46:46 AM
|
Chris Gooch Posts 12
|
Here's the log I got with process monitor:
Sequence ->Process Name->Operation->Path->Result
8709 FlexRefresh.exe Process Start SUCCESS
8710 FlexRefresh.exe Thread Create SUCCESS
8712 FlexRefresh.exe QueryNameInformationFile C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe SUCCESS
8718 FlexRefresh.exe Load Image C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe SUCCESS
8722 FlexRefresh.exe Load Image C:\WINDOWS\system32\ntdll.dll SUCCESS
8727 FlexRefresh.exe CreateFile C:\Program Files\Flex Framework\Flex_Exe SUCCESS
8728 FlexRefresh.exe FileSystemControl C:\Program Files\Flex Framework\Flex_Exe SUCCESS
8734 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe.Local NAME NOT FOUND
8743 FlexRefresh.exe Load Image C:\WINDOWS\system32\kernel32.dll SUCCESS
8881 FlexRefresh.exe Load Image C:\WINDOWS\system32\user32.dll SUCCESS
8883 FlexRefresh.exe Load Image C:\WINDOWS\system32\gdi32.dll SUCCESS
8885 FlexRefresh.exe Load Image C:\WINDOWS\system32\advapi32.dll SUCCESS
8940 FlexRefresh.exe Load Image C:\WINDOWS\system32\rpcrt4.dll SUCCESS
8952 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager REPARSE
8953 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS
8954 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode NAME NOT FOUND
8955 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager SUCCESS
8960 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\tsappcmp.dll NAME NOT FOUND
8966 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\tsappcmp.dll SUCCESS
8971 FlexRefresh.exe CreateFile C:\WINDOWS\system32\tsappcmp.dll SUCCESS
8984 FlexRefresh.exe CreateFile C:\WINDOWS\system32\tsappcmp.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
8991 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option REPARSE
8992 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option NAME NOT FOUND
8993 FlexRefresh.exe RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS
8994 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\windows\safer\codeidentifiers\TransparentEnabled NAME NOT FOUND
8996 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\windows\safer\codeidentifiers SUCCESS
8998 FlexRefresh.exe RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers NAME NOT FOUND
9001 FlexRefresh.exe CloseFile C:\WINDOWS\system32\tsappcmp.dll SUCCESS
9010 FlexRefresh.exe Load Image C:\WINDOWS\system32\tsappcmp.dll SUCCESS
9022 FlexRefresh.exe Load Image C:\WINDOWS\system32\msvcrt.dll SUCCESS
9023 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options SUCCESS
9024 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions SUCCESS
9025 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\msvcrt.dll NAME NOT FOUND
9043 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\tsappcmp.dll NAME NOT FOUND
9044 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server REPARSE
9045 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS
9046 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat SUCCESS
9047 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\IAT SUCCESS
9048 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS
9049 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList SUCCESS
9050 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\DefaultUserProfile SUCCESS
9051 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList SUCCESS
9052 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\ntdll.dll NAME NOT FOUND
9054 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\kernel32.dll NAME NOT FOUND
9055 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\RPCRT4.dll NAME NOT FOUND
9059 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\ADVAPI32.dll NAME NOT FOUND
9062 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\GDI32.dll NAME NOT FOUND
9064 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\USER32.dll NAME NOT FOUND
9066 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server REPARSE
9068 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS
9069 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat SUCCESS
9070 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSUserEnabled SUCCESS
9071 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\Terminal Server SUCCESS
9072 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\FlexRefresh NAME NOT FOUND
9073 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS
9074 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LeakTrack SUCCESS
9075 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS
9077 FlexRefresh.exe RegOpenKey HKLM SUCCESS
9079 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics NAME NOT FOUND
9081 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\FlexRefresh NAME NOT FOUND
9084 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Error Message Instrument REPARSE
9086 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Error Message Instrument NAME NOT FOUND
9097 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32 SUCCESS
9098 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\FlexRefresh NAME NOT FOUND
9099 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32 SUCCESS
9100 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility SUCCESS
9102 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IME Compatibility\FlexRefresh NAME NOT FOUND
9103 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IME Compatibility SUCCESS
9113 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows SUCCESS
9115 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs BUFFER OVERFLOW
9116 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SUCCESS
9120 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\RMProcessLink.dll NAME NOT FOUND
9128 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\RMProcessLink.dll NAME NOT FOUND
9129 FlexRefresh.exe QueryOpen C:\WINDOWS\system\RMProcessLink.dll NAME NOT FOUND
9130 FlexRefresh.exe QueryOpen C:\WINDOWS\RMProcessLink.dll NAME NOT FOUND
9138 FlexRefresh.exe QueryOpen D:\Documents and Settings\cgooch_admin\WINDOWS\RMProcessLink.dll NAME NOT FOUND
9141 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\RMProcessLink.dll NAME NOT FOUND
9142 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\RMProcessLink.dll NAME NOT FOUND
9143 FlexRefresh.exe QueryOpen C:\WINDOWS\RMProcessLink.dll NAME NOT FOUND
9144 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\wbem\RMProcessLink.dll NAME NOT FOUND
9145 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\RMProcessLink.dll NAME NOT FOUND
9146 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\Subsystems\RMProcessLink.dll NAME
NOT FOUND 9147 FlexRefresh.exe QueryOpen C:\WINDOWS\System32\Citrix\IMA\RMProcessLink.dll PATH NOT FOUND
9148 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\RMProcessLink.dll SUCCESS
9150 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\RMProcessLink.dll SUCCESS
9163 FlexRefresh.exe CloseFile C:\Program Files\Citrix\System32\RMProcessLink.dll SUCCESS
9168 FlexRefresh.exe Load Image C:\Program Files\Citrix\System32\RMProcessLink.dll SUCCESS
9170 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\RMProcessLink.dll NAME NOT FOUND
9179 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\mfaphook.dll NAME NOT FOUND
9180 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\mfaphook.dll NAME NOT FOUND
9190 FlexRefresh.exe QueryOpen C:\WINDOWS\system\mfaphook.dll NAME NOT FOUND
9191 FlexRefresh.exe QueryOpen C:\WINDOWS\mfaphook.dll NAME NOT FOUND
9199 FlexRefresh.exe QueryOpen D:\Documents and Settings\cgooch_admin\WINDOWS\mfaphook.dll NAME NOT FOUND
9202 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\mfaphook.dll NAME NOT FOUND
9210 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\mfaphook.dll NAME NOT FOUND
9213 FlexRefresh.exe QueryOpen C:\WINDOWS\mfaphook.dll NAME NOT FOUND
9214 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\wbem\mfaphook.dll NAME NOT FOUND
9215 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\mfaphook.dll NAME NOT FOUND
9225 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\Subsystems\mfaphook.dll NAME NOT FOUND
9226 FlexRefresh.exe QueryOpen C:\WINDOWS\System32\Citrix\IMA\mfaphook.dll PATH NOT FOUND
9227 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\mfaphook.dll SUCCESS
9228 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\mfaphook.dll SUCCESS
9238 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\mfaphook.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9246 FlexRefresh.exe CloseFile C:\Program Files\Citrix\System32\mfaphook.dll SUCCESS
9254 FlexRefresh.exe Load Image C:\Program Files\Citrix\System32\mfaphook.dll SUCCESS
9258 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mfaphook.dll NAME NOT FOUND
9263 FlexRefresh.exe RegOpenKey HKLM SUCCESS
9268 FlexRefresh.exe RegOpenKey HKU SUCCESS
9270 FlexRefresh.exe RegOpenKey HKCU SUCCESS
9271 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment REPARSE
9272 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\EnvironmentSUCCESS
9273 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\Environment\SAFEBOOT_OPTION NAME NOT FOUND
9274 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment SUCCESS
9275 FlexRefresh.exe RegOpenKey HKLM\Software\Citrix\CtxHook SUCCESS
9276 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\Flags NAME NOT FOUND
9277 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook SUCCESS
9278 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment REPARSE
9279 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment SUCCESS
9280 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\Environment\SAFEBOOT_OPTION NAME NOT FOUND
9281 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\Session Manager\Environment SUCCESS
9282 FlexRefresh.exe RegOpenKey HKLM\Software\Citrix\CtxHook SUCCESS
9283 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\Flags NAME NOT FOUND
9284 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook SUCCESS
9285 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook SUCCESS
9286 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\ExcludedImageNames NAME NOT FOUND
9287 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook SUCCESS
9288 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9289 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9290 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\ActiveSync SUCCESS
9291 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\ActiveSync\FilePathName SUCCESS
9292 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\ActiveSync\Flag SUCCESS
9293 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\ActiveSync SUCCESS
9294 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9295 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook SUCCESS
9296 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook\FilePathName SUCCESS
9297 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook\Flag SUCCESS
9298 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\CtxSbxHook.dll NAME NOT FOUND
9307 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\CtxSbxHook.dll NAME NOT FOUND
9308 FlexRefresh.exe QueryOpen C:\WINDOWS\system\CtxSbxHook.dll NAME NOT FOUND
9309 FlexRefresh.exe QueryOpen C:\WINDOWS\CtxSbxHook.dll NAME NOT FOUND
9310 FlexRefresh.exe QueryOpen D:\Documents and Settings\cgooch_admin\WINDOWS\CtxSbxHook.dll NAME NOT FOUND
9311 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\CtxSbxHook.dll NAME NOT FOUND
9318 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\CtxSbxHook.dll NAME NOT FOUND
9322 FlexRefresh.exe QueryOpen C:\WINDOWS\CtxSbxHook.dll NAME NOT FOUND 9332 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\wbem\CtxSbxHook.dll NAME NOT FOUND
9333 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\CtxSbxHook.dll NAME NOT FOUND
9341 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\Subsystems\CtxSbxHook.dll NAME NOT FOUND
9344 FlexRefresh.exe QueryOpen C:\WINDOWS\System32\Citrix\IMA\CtxSbxHook.dll PATH NOT FOUND
9345 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\CtxSbxHook.dll SUCCESS
9346 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\CtxSbxHook.dll SUCCESS
9354 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\CtxSbxHook.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9363 FlexRefresh.exe CloseFile C:\Program Files\Citrix\System32\CtxSbxHook.dll SUCCESS
9367 FlexRefresh.exe Load Image C:\Program Files\Citrix\System32\CtxSbxHook.DLL SUCCESS
9376 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\CtxSbxHook.dll NAME NOT FOUND
9377 FlexRefresh.exe RegOpenKey HKLM\SYSTEM\CurrentControlSet\Services\MSIServer REPARSE
9378 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Services\MSIServer SUCCESS
9380 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Services\MSIServer\ImagePath BUFFER TOO SMALL
9382 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Services\MSIServer\ImagePath SUCCESS
9385 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Services\MSIServer SUCCESS
9388 FlexRefresh.exe RegOpenKey HKLM\SYSTEM\CurrentControlSet\Services\MSIServer REPARSE
9390 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Services\MSIServer SUCCESS
9391 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Services\MSIServer\ImagePath BUFFER TOO SMALL
9392 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Services\MSIServer\ImagePath SUCCESS
9393 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Services\MSIServer SUCCESS
9396 FlexRefresh.exe RegOpenKey HKLM\Software\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook SUCCESS
9397 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook\HookMsi SUCCESS
9398 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook SUCCESS
9415 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\CtxSbxHook SUCCESS
9417 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9419 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook SUCCESS
9420 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook\FilePathName SUCCESS
9421 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook\Flag SUCCESS
9422 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Multiple Monitor Hook SUCCESS
9423 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9424 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Flash Hook SUCCESS
9425 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Flash Hook\FilePathName SUCCESS
9426 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Flash Hook\Flag SUCCESS
9427 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Flash Hook SUCCESS
9428 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9429 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Time Zone SUCCESS
9430 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Time Zone\FilePathName SUCCESS
9431 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Time Zone\Flag SUCCESS
9432 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Per Session Time Zone SUCCESS
9433 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9434 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Seamless Explorer SUCCESS
9435 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Seamless Explorer\FilePathName SUCCESS
9436 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Seamless Explorer\Flag SUCCESS
9437 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Seamless Explorer SUCCESS
9438 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9439 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Shadow Event Logging SUCCESS
9440 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Shadow Event Logging\FilePathName SUCCESS
9441 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Shadow Event Logging\Flag SUCCESS
9442 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Shadow Event Logging SUCCESS
9443 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9444 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Smart Card Hook SUCCESS
9445 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Smart Card Hook\FilePathName SUCCESS
9446 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Smart Card Hook\Flag SUCCESS
9447 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\scardhook.dll NAME NOT FOUND
9452 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\scardhook.dll NAME NOT FOUND
9458 FlexRefresh.exe QueryOpen C:\WINDOWS\system\scardhook.dll NAME NOT FOUND
9459 FlexRefresh.exe QueryOpen C:\WINDOWS\scardhook.dll NAME NOT FOUND
9460 FlexRefresh.exe QueryOpen D:\Documents and Settings\cgooch_admin\WINDOWS\scardhook.dll NAME NOT FOUND
9461 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\scardhook.dll NAME NOT FOUND
9464 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\scardhook.dll NAME NOT FOUND
9472 FlexRefresh.exe QueryOpen C:\WINDOWS\scardhook.dll NAME NOT FOUND
9473 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\wbem\scardhook.dll NAME NOT FOUND
9483 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\scardhook.dll NAME NOT FOUND
9491 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\Subsystems\scardhook.dll NAME NOT FOUND
9493 FlexRefresh.exe QueryOpen C:\WINDOWS\System32\Citrix\IMA\scardhook.dll PATH NOT FOUND
9495 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\scardhook.dll SUCCESS
9503 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\scardhook.dll SUCCESS
9506 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\scardhook.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9515 FlexRefresh.exe CloseFile C:\Program Files\Citrix\System32\scardhook.dll SUCCESS
9525 FlexRefresh.exe Load Image C:\Program Files\Citrix\System32\scardhook.dll SUCCESS
9528 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\scardhook.dll NAME NOT FOUND
9555 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Smart Card Hook SUCCESS
9556 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9560 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\SpeedScreen SUCCESS
9564 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\SpeedScreen\FilePathName SUCCESS
9565 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\SpeedScreen\Flag SUCCESS
9568 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\SpeedScreen SUCCESS
9569 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9570 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Twain Hook SUCCESS
9571 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Twain Hook\FilePathName SUCCESS
9572 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Twain Hook\Flag SUCCESS
9573 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Twain Hook SUCCESS
9574 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9575 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Unicode Injection IME Hook SUCCESS
9576 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Unicode Injection IME Hook\FilePathName SUCCESS
9578 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Unicode Injection IME Hook\Flag SUCCESS
9582 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Unicode Injection IME Hook SUCCESS
9585 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9587 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook SUCCESS
9588 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook\FilePathName SUCCESS
9590 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook\Flag SUCCESS
9592 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook\FlexRefresh.exe NAME NOT FOUND
9593 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook\C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe NAME NOT FOUND
9594 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook\C:/Program Files/Flex Framework/Flex_Exe/FlexRefresh.exe NAME NOT FOUND
9595 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\UPD Printer hook SUCCESS
9596 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9597 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook SUCCESS
9598 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook\FilePathName SUCCESS
9599 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook\Flag SUCCESS
9601 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook\FlexRefresh.exe NAME NOT FOUND
9605 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook\C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe NAME NOT FOUND
9609 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook\C:/Program Files/Flex Framework/Flex_Exe/FlexRefresh.exe NAME NOT FOUND
9610 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\VIPHook SUCCESS
9611 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9612 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Wdmaud Hook SUCCESS
9615 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Wdmaud Hook\FilePathName SUCCESS
9616 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Wdmaud Hook\Flag SUCCESS
9617 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls\Wdmaud Hook SUCCESS
9618 FlexRefresh.exe RegEnumKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls NO MORE ENTRIES
9619 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Citrix\CtxHook\AppInit_Dlls SUCCESS
9629 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\zlc_api.dll NAME NOT FOUND
9631 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\zlc_api.dll NAME NOT FOUND
9640 FlexRefresh.exe QueryOpen C:\WINDOWS\system\zlc_api.dll NAME NOT FOUND
9648 FlexRefresh.exe QueryOpen C:\WINDOWS\zlc_api.dll NAME NOT FOUND
9651 FlexRefresh.exe QueryOpen D:\Documents and Settings\cgooch_admin\WINDOWS\zlc_api.dll NAME NOT FOUND
9666 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\zlc_api.dll NAME NOT FOUND
9674 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\zlc_api.dll NAME NOT FOUND
9682 FlexRefresh.exe QueryOpen C:\WINDOWS\zlc_api.dll NAME NOT FOUND
9685 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\wbem\zlc_api.dll NAME NOT FOUND
9695 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\zlc_api.dll NAME NOT FOUND
9705 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\Subsystems\zlc_api.dll NAME NOT FOUND
9706 FlexRefresh.exe QueryOpen C:\WINDOWS\System32\Citrix\IMA\zlc_api.dll PATH NOT FOUND
9715 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\zlc_api.dll SUCCESS
9717 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\zlc_api.dll SUCCESS
9727 FlexRefresh.exe CreateFile C:\Program Files\Citrix\System32\zlc_api.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9739 FlexRefresh.exe CloseFile C:\Program Files\Citrix\System32\zlc_api.dll SUCCESS
9746 FlexRefresh.exe Load Image C:\Program Files\Citrix\System32\zlc_api.dll SUCCESS
9756 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\zlc_api.dll NAME NOT FOUND
9757 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlc_api.dll NAME NOT FOUND
9758 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows SUCCESS
9759 FlexRefresh.exe Thread Create SUCCESS
9760 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Icons NAME NOT FOUND
9761 FlexRefresh.exe RegOpenKey HKCU SUCCESS
9762 FlexRefresh.exe RegOpenKey HKCU SUCCESS
9763 FlexRefresh.exe RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND
9764 FlexRefresh.exe RegOpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND
9765 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9766 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9767 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND
9768 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NAME NOT FOUND
9769 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9770 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9772 FlexRefresh.exe RegCloseKey HKCU SUCCESS
9773 FlexRefresh.exe RegCloseKey HKCU SUCCESS
9782 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Icons NAME NOT FOUND
9783 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Icons NAME NOT FOUND
9793 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Icons NAME NOT FOUND
9795 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Icons NAME NOT FOUND
9804 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Icons NAME NOT FOUND
9814 FlexRefresh.exe RegOpenKey HKCU SUCCESS
9815 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9816 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\Wallpaper NAME NOT FOUND
9817 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9818 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9819 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\TileWallpaper NAME NOT FOUND
9820 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9821 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9822 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\WallpaperStyle NAME NOT FOUND
9824 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9825 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9828 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\WallpaperOriginX NAME NOT FOUND
9831 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9833 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Desktop SUCCESS
9835 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Desktop\WallpaperOriginY NAME NOT FOUND
9836 FlexRefresh.exe RegCloseKey HKCU\Control Panel\Desktop SUCCESS
9839 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\test.bmp NAME INVALID
9840 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\test.bmp NAME INVALID
9848 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\test.bmp NAME INVALID
9851 FlexRefresh.exe QueryOpen C:\WINDOWS\system\test.bmp NAME INVALID
9859 FlexRefresh.exe QueryOpen C:\WINDOWS\test.bmp NAME INVALID
9862 FlexRefresh.exe QueryOpen D:\Documents and Settings\cgooch_admin\WINDOWS\test.bmp NAME INVALID
9863 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\test.bmp NAME INVALID
9864 FlexRefresh.exe QueryOpen C:\WINDOWS\test.bmp NAME INVALID
9865 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\wbem\test.bmp NAME INVALID
9866 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\test.bmp NAME INVALID
9874 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\Citrix\IMA\Subsystems\test.bmp NAME INVALID
9877 FlexRefresh.exe QueryOpen C:\WINDOWS\System32\Citrix\IMA\test.bmp PATH NOT FOUND
9879 FlexRefresh.exe QueryOpen C:\Program Files\Citrix\System32\test.bmp NAME INVALID
9886 FlexRefresh.exe QueryOpen E:\Program Files\IDM Computer Solutions\UltraEdit-32\test.bmp NAME INVALID
9889 FlexRefresh.exe RegOpenKey HKCU\Control Panel\Colors SUCCESS
9890 FlexRefresh.exe RegQueryValue HKCU\Control Panel\Colors\ActiveBorder NAME NOT FOUND
9891 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug SUCCESS
9892 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto SUCCESS
9893 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger SUCCESS
9894 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug SUCCESS
9904 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\faultrep.dll SUCCESS
9906 FlexRefresh.exe CreateFile C:\WINDOWS\system32\faultrep.dll SUCCESS
9915 FlexRefresh.exe CreateFile C:\WINDOWS\system32\faultrep.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9917 FlexRefresh.exe QueryStandardInformationFile C:\WINDOWS\system32\faultrep.dll SUCCESS
9922 FlexRefresh.exe CloseFile C:\WINDOWS\system32\faultrep.dll SUCCESS
9932 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\faultrep.dll SUCCESS
9938 FlexRefresh.exe CreateFile C:\WINDOWS\system32\faultrep.dll SUCCESS
9943 FlexRefresh.exe CreateFile C:\WINDOWS\system32\faultrep.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9952 FlexRefresh.exe CloseFile C:\WINDOWS\system32\faultrep.dll SUCCESS
9962 FlexRefresh.exe Load Image C:\WINDOWS\system32\faultrep.dll SUCCESS
9971 FlexRefresh.exe Load Image C:\WINDOWS\system32\version.dll SUCCESS
9974 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\USERENV.dll NAME NOT FOUND
9975 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\userenv.dll SUCCESS
9976 FlexRefresh.exe CreateFile C:\WINDOWS\system32\userenv.dll SUCCESS
9981 FlexRefresh.exe CreateFile C:\WINDOWS\system32\userenv.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
9991 FlexRefresh.exe CloseFile C:\WINDOWS\system32\userenv.dll SUCCESS
9996 FlexRefresh.exe Load Image C:\WINDOWS\system32\userenv.dll SUCCESS 9997 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\WINSTA.dll NAME NOT FOUND
10012 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\winsta.dll SUCCESS
10017 FlexRefresh.exe CreateFile C:\WINDOWS\system32\winsta.dll SUCCESS
10025 FlexRefresh.exe CreateFile C:\WINDOWS\system32\winsta.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
10034 FlexRefresh.exe CloseFile C:\WINDOWS\system32\winsta.dll SUCCESS
10037 FlexRefresh.exe Load Image C:\WINDOWS\system32\winsta.dll SUCCESS
10039 FlexRefresh.exe Load Image C:\WINDOWS\system32\netapi32.dll SUCCESS
10048 FlexRefresh.exe QueryOpen C:\Program Files\Flex Framework\Flex_Exe\SETUPAPI.dll NAME NOT FOUND
10059 FlexRefresh.exe QueryOpen C:\WINDOWS\system32\setupapi.dll SUCCESS
10060 FlexRefresh.exe CreateFile C:\WINDOWS\system32\setupapi.dll SUCCESS
10064 FlexRefresh.exe CreateFile C:\WINDOWS\system32\setupapi.dll:JSY-CTXPSPP04.3 NAME NOT FOUND
10077 FlexRefresh.exe CloseFile C:\WINDOWS\system32\setupapi.dll SUCCESS
10080 FlexRefresh.exe Load Image C:\WINDOWS\system32\setupapi.dll SUCCESS
10089 FlexRefresh.exe Load Image C:\WINDOWS\system32\shlwapi.dll SUCCESS
10101 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\VERSION.dll NAME NOT FOUND
10102 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll NAME NOT FOUND
10103 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\USERENV.dll NAME NOT FOUND
10104 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll NAME NOT FOUND
10105 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS
10106 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel NAME NOT FOUND
10107 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS
10108 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS
10109 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ChkAccDebugLevel NAME NOT FOUND
10110 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS
10120 FlexRefresh.exe CreateFile C:\WINDOWS\Debug\UserMode\ChkAcc.log SUCCESS
10121 FlexRefresh.exe QueryAttributeTagFile C:\WINDOWS\Debug\UserMode\ChkAcc.log SUCCESS
10122 FlexRefresh.exe QueryBasicInformationFile C:\WINDOWS\Debug\UserMode\ChkAcc.log SUCCESS
10132 FlexRefresh.exe CreateFile C:\WINDOWS\Debug\UserMode SUCCESS
10140 FlexRefresh.exe SetRenameInformationFile C:\WINDOWS\Debug\UserMode\ChkAcc.log SUCCESS
10150 FlexRefresh.exe CloseFile C:\WINDOWS\Debug\UserMode SUCCESS
10154 FlexRefresh.exe CloseFile C:\WINDOWS\Debug\UserMode\ChkAcc.bak SUCCESS 10165 FlexRefresh.exe CreateFile C:\WINDOWS\Debug\UserMode\ChkAcc.log SUCCESS
10174 FlexRefresh.exe CloseFile C:\WINDOWS\Debug\UserMode\ChkAcc.log SUCCESS
10177 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\ProductOptions REPARSE
10178 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\ProductOptions SUCCESS
10179 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\ProductOptions\ProductType SUCCESS
10180 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\ProductOptions SUCCESS
10181 FlexRefresh.exe RegOpenKey HKCU SUCCESS
10182 FlexRefresh.exe RegOpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS
10184 FlexRefresh.exe RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal SUCCESS
10186 FlexRefresh.exe RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings SUCCESS
10190 FlexRefresh.exe RegCloseKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SUCCESS
10192 FlexRefresh.exe RegCloseKey HKCU SUCCESS
10194 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS
10197 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RsopDebugLevel NAME NOT FOUND
10198 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS
10199 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon SUCCESS
10200 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel NAME NOT FOUND
10201 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RsopLogging NAME NOT FOUND
10202 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS
10203 FlexRefresh.exe RegOpenKey HKLM\Software\Policies\Microsoft\Windows\System SUCCESS
10204 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\windows\System\UserEnvDebugLevel NAME NOT FOUND
10205 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\windows\System\RsopLogging NAME NOT FOUND
10206 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\windows\System SUCCESS
10207 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\NETAPI32.dll NAME NOT FOUND
10208 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll NAME NOT FOUND
10211 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\WINSTA.dll NAME NOT FOUND
10216 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll NAME NOT FOUND
10218 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\SETUPAPI.dll NAME NOT FOUND
10219 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll NAME NOT FOUND
10221 FlexRefresh.exe RegOpenKey HKLM\System\Setup SUCCESS
10223 FlexRefresh.exe RegQueryValue HKLM\SYSTEM\Setup\SystemSetupInProgress SUCCESS
10224 FlexRefresh.exe RegCloseKey HKLM\SYSTEM\Setup SUCCESS
10225 FlexRefresh.exe RegOpenKey HKLM\SYSTEM\CurrentControlSet\Control\MiniNT REPARSE
10226 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\MiniNT NAME NOT FOUND
10227 FlexRefresh.exe RegOpenKey HKLM\SYSTEM\CurrentControlSet\Control\MiniNT REPARSE
10228 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\MiniNT NAME NOT FOUND
10229 FlexRefresh.exe RegOpenKey HKLM\System\WPA\PnP SUCCESS
10230 FlexRefresh.exe RegQueryValue HKLM\SYSTEM\WPA\PnP\seed SUCCESS
10231 FlexRefresh.exe RegCloseKey HKLM\SYSTEM\WPA\PnP SUCCESS
10232 FlexRefresh.exe RegOpenKey HKLM\SYSTEM\Setup SUCCESS
10233 FlexRefresh.exe RegQueryValue HKLM\SYSTEM\Setup\OsLoaderPath SUCCESS
10234 FlexRefresh.exe RegQueryValue HKLM\SYSTEM\Setup\OsLoaderPath SUCCESS
10235 FlexRefresh.exe RegCloseKey HKLM\SYSTEM\Setup SUCCESS
10237 FlexRefresh.exe RegOpenKey HKLM\SYSTEM\Setup SUCCESS
10238 FlexRefresh.exe RegQueryValue HKLM\SYSTEM\Setup\SystemPartition SUCCESS
10240 FlexRefresh.exe RegQueryValue HKLM\SYSTEM\Setup\SystemPartition SUCCESS
10243 FlexRefresh.exe RegCloseKey HKLM\SYSTEM\Setup SUCCESS
10247 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10248 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath SUCCESS
10249 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath SUCCESS
10251 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10253 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10254 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackSourcePath SUCCESS
10255 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackSourcePath SUCCESS
10256 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10257 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10258 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackCachePath SUCCESS
10259 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackCachePath SUCCESS
10260 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10261 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10262 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\DriverCachePath SUCCESS
10263 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\DriverCachePath SUCCESS
10264 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10265 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion SUCCESS
10266 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath BUFFER OVERFLOW
10268 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath SUCCESS
10273 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion SUCCESS
10276 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10277 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\DisableDecoratedModelsRequirement NAME NOT FOUND
10278 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10280 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10282 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogLevel SUCCESS
10283 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogLevel SUCCESS
10284 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogPath NAME NOT FOUND
10285 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\AppLogLevels NAME NOT FOUND
10286 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup SUCCESS
10287 FlexRefresh.exe QueryOpen C:\WINDOWS SUCCESS
10288 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName REPARSE
10289 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName SUCCESS
10291 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName SUCCESS
10293 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName SUCCESS
10296 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters REPARSE
10300 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters SUCCESS
10305 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Hostname SUCCESS
10308 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters SUCCESS
10310 FlexRefresh.exe RegOpenKey HKLM\Software\Policies\Microsoft\System\DNSclient NAME NOT FOUND
10311 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters REPARSE
10313 FlexRefresh.exe RegOpenKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters SUCCESS
10315 FlexRefresh.exe RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Domain SUCCESS
10316 FlexRefresh.exe RegCloseKey HKLM\System\CurrentControlSet\Services\Tcpip\Parameters SUCCESS
10318 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\SHLWAPI.dll NAME NOT FOUND
10320 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll NAME NOT FOUND
10321 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\faultrep.dll NAME NOT FOUND
10322 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll NAME NOT FOUND
10323 FlexRefresh.exe RegOpenKey HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting NAME NOT FOUND
10324 FlexRefresh.exe RegOpenKey HKLM\Software\Microsoft\PCHealth\ErrorReporting SUCCESS
10325 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW SUCCESS
10326 FlexRefresh.exe RegDeleteKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW CANNOT DELETE
10327 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW SUCCESS
10328 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW SUCCESS
10329 FlexRefresh.exe RegDeleteValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW\DWFileTreeRoot NAME NOT FOUND
10330 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW SUCCESS
10331 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DoReport SUCCESS
10332 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ShowUI SUCCESS
10333 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\AllOrNone SUCCESS
10334 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\IncludeMicrosoftApps SUCCESS
10335 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\IncludeWindowsApps SUCCESS
10336 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DoTextLog NAME NOT FOUND
10337 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\IncludeKernelFaults SUCCESS
10338 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\IncludeShutdownErrs SUCCESS
10339 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\NumberOfFaultPipes NAME NOT FOUND
10340 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\NumberOfHangPipes NAME NOT FOUND
10341 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\MaxUserQueueSize NAME NOT FOUND
10342 FlexRefresh.exe RegQueryValue HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ForceQueueMode SUCCESS
10343 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList SUCCESS
10344 FlexRefresh.exe RegOpenKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList SUCCESS
10345 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting SUCCESS
10346 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList SUCCESS
10347 FlexRefresh.exe RegCloseKey HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList SUCCESS
11877 ctxcpusched.exe QueryNameInformationFile C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe BUFFER OVERFLOW
11878 ctxcpusched.exe QueryNameInformationFile C:\Program Files\Flex Framework\Flex_Exe\FlexRefresh.exe SUCCESS
|
|
11/8/2007 6:24:56 PM
|
Chris Gooch Posts 12
|
hmm ok I've found a few things regarding the set up and it's becoming apparent that logons are terribly slow for some users.
When i turn on logging I an see that the office profile wizard is loading files and then prompting for input to overight them on the command line.
Whilst users don't see this on logon (they just see a very static Citrix bar for about 5 minutes) at logoff they do get a office Profile windows prompt box pop up saying the name already exists and hit ok to overwrite.
still can't seem to get flex refresh working on a number of servers either.
:cry:
|
|
11/8/2007 10:03:30 PM
|
shaun Posts 327
|
Couple of items:
(1) I'm working on a similar issue with tubularusa for FlexRefresh. Since you seem to be crashing in a very similar portion of the registry, I'll let you know what we discover. See the thread by him for other troubleshooting steps you can take like he did.
(2) For the Wizard and prompts, do you know specifically which files are causing the prompt? Are they somehow getting set Read-Only, Archive or System by some other process between sessions?
Also, make sure the date/time and version of the wizard match between the 2 servers. Someone may have updated it intentionally or accidentally with the original wizard.
I'm partly shooting in the dark with this one because I've seen several errors with the wizard, but never prompts to overwrite...
|
|
11/9/2007 10:23:22 AM
|
Chris Gooch Posts 12
|
Thanks Shaun,
I'll check out your other topic.
In the meantime I'll keep updating this post with my findings and hopefully between all of us we'll be able to resolve both our problems
:)
Chris
|
|
11/9/2007 12:30:14 PM
|
Chris Gooch Posts 12
|
Updates:
* Turned off memory optimisation. * Updated FPK to version 5.1 across the farm and modified gpo to point to the new logon / logoff script. * Created flex.cmd in Winlogon\Appsetup to check if timing issue. * Checked all ini files * Recreated Mandatory profile. * Checked PROFLWIZ version.
I did find a few inconsistencies with regards to the flex-framework.vbs scripts but nothing major and I still have the same problems. Updating the FPK did remove the empty WHScript window though :)
The servers that were working before, still work and the ones that don't still don't.
Logons are extremely slow still and I still get the PROFLWIZ prompting to overwrite due to the existence of a file with the same name.
So I modified my admin account to use the mandatory profile to log on via rdp rather than citrix. When I logged on to the boxes that work I could see the cmd window come up and go through the motions.
When I logged on to the boxes that don't work I got a bit more info.
Firstly, I log on and I get the "flexrefresh application error - memory can't be referenced"
Secondly I get a prompt from SetLocale saying that the registry can not be opened.
Thirdly once I ok this error it logs me on and I find that my mouse buttons have been reversed.
Permissions in the mandatory profile are set to have authenticated users full control though
|
|
11/9/2007 3:51:56 PM
|
shaun Posts 327
|
Whew! This is a tough one!
- When you say you "created flex.cmd in Winlogon\Appsetup" and "modified gpo topoint to the new logon/logoff script", those statements can't go together for Flex (but can if you separated it out). You either use one or the other. Please confirm that you are not running Flex from the GPO; just another login script I'm assuming...
- I've seen posts either in this forum or on the internet about the mouse button reversal; unfortunately, I don't have to time to search for them myself today - definitely encourage you to take a look though. I'm not convinced it is related to the other issues.
- Separate note, but I would not recommend you grant Authenticated Users "Full Control" under File Security. They should have the 3 Read permissions only. In fact, we only allow 2 administrative accounts write access to the profile (the need for that level of restriction depends on how you are handling Mandatory Profiles - different discussion). HOWEVER, on the Share Permissions, they should absolutely have Full Control.
- Tubularusa and I are still working on t/s the FlexRefresh issue; it may help me to see a different set of logs though. If you can post the FULL Procmon capture so I can download it, it would be helpful. Please try to keep under 200-300 MB (yes, they get that large), filter out anything you are concerned about in your environment confidentiality wise, and keep it in the PML format. PM me the location if you choose to do this.
- What is your server build and patch level?
- I'd also like to get an export of the HKEY_USERS\.Default\Control Panel hive from your Mandatory Profile
|
|
11/9/2007 4:10:45 PM
|
Chris Gooch Posts 12
|
Sorry Shaun I meant I specified a flex.cmd file in the registry on the server rather than using gpo to see if I got the same problem which I did.
After this I removed it and set it back to the GPO to run the script.
Script
Flex_framwork.vbs
Parameters
LOGON "\\Fileserver\Share\Flex_Config"
Server Build is Win 2k3 SP1
The mouse thing is strange as it only occurs if the log on process fails which is why I thought it was related to one of the flexrefresh parameters but I'll have a hunt around like you suggest.
I'll grab hold of the info you've requested and send you a link to an ftp site so that you can download the files.
Thanks for your help on this, really appreciated. you're right it is a weird one, I can't for the life of me see why it works on some servers and not others when they use the same infrastructure, builds, gpos you name it!
Chris
|
|
11/9/2007 4:18:45 PM
|
shaun Posts 327
|
Okay, just let me know.
Usually this "odd" behavior is a timing issue. Unfortunately, it doesn't make sense to me why it's happening when you are using the AppSetup key. The capture will allow me to narrow that down.
Also, I asked Tubular to REM out entries in the Flex INIs which bring over "Control Panel" hive items. Not sure this will help, but I'm testing a theory if you want to try as well.
|
|
11/11/2007 10:04:49 PM
|
Chris Gooch Posts 12
|
ok will do.
thanks
Chris
|
|
11/12/2007 1:51:45 PM
|
Chris Gooch Posts 12
|
I tried REM ing out this keys but there was no change unfortunately.
|
|
11/12/2007 3:48:39 PM
|
shaun Posts 327
|
Didn't work for tubularusa either. Will be taking a look at your logs today.
|
|
11/12/2007 4:11:32 PM
|
Chris Gooch Posts 12
|
Great
Much appreciated Shaun!
I've been doing some further testing today and I've found another interesting correlation.
I checked out every server on the farm and I found the following:
All of the servers that have had issues are now able to connect to a published app through citrix with no errors at log on. I tested the addition and removal of favourites to check that stuff was being written and saved and it was.
These servers however still receive the prompt from the Office Profile Wiz on log off for the overwrite of the ops file. :(
The other interesting thing is that these are the same servers that won't allow me to run the flexrefresh.exe manually or call the script successfully through terminal services.
Interesting huh??? :P
|
|
11/19/2007 4:48:50 PM
|
cendrars Posts 16
|
Hello,
How are you two progressing on this issue? Interested to know the outcome. Thanks.
|
|
11/19/2007 4:52:38 PM
|
shaun Posts 327
|
I reviewed Chris' Group Policies and other items in the environment and made some recommendations of changes to try and test. He is currently working through Change Control to try those out.
I've also continued to review the process captures and found nothing else out of the ordinary. Been trying to work with Dennis to see why FlexRefresh would error out (seems to always be on the Control Panel\Colors section), but he's been pretty busy lately.
I will definitely post back once we've found the answer. Also applies to tubularusa's post.
|
|
11/27/2007 3:18:55 PM
|
Chris Gooch Posts 12
|
OK quick update.
I moved an unused production server into its own ou.
I then denied all GPO s to this OU with the exception of the Flex Profile OU (runs logon and log off script)
I then modified the GPO to execute the logon and log off scripts from locally on the server (after copying and modifying the scripts here) rather than from a central file share where they currently reside.
So far I have yet to see any flex errors or prompts during the logon / logoff process though I am still getting errors locally on the server.
Still troubleshooting :D
|
|
11/27/2007 5:41:10 PM
|
cendrars Posts 16
|
What is the nature of the error on the server? Is this the popup window on the admin console designating a refresh.exe error? Thanks.
RTE
|
|
12/10/2007 12:09:50 PM
|
Chris Gooch Posts 12
|
Basically users thorugh Citrix or RDP (including admins) get a flexrefresh.exe error pop up as part of the log in process.
The error written to event viewer basically says that flexrefresh.exe has a faulting module.
It looks like my client wants to rebuild their farm as they have a multitude of other issues so I'll keep you all posted on developments though I would still like to resolve this in the interim as the rebuild process will be lengthy.
Many thanks to everyone who has contributed so far, especially Shaun who has been a star.
Chris
|
|
12/12/2007 6:37:08 PM
|
shaun Posts 327
|
No problem at all!
I am back in the office now. We just had our baby girl, so I've been out for the last 2 weeks. Hopefully I didn't miss any important questions :)
|
|
1/4/2008 1:11:01 PM
|
Chris Gooch Posts 12
|
Many Congratulations!
:D
|
|
2/1/2008 11:49:42 AM
|
Chris Gooch Posts 12
|
Thought I would update this post as it's been a while.
Basically the situation is dramatically improved thanks to the efforts of Shaun and others.
It's not 100% and never will be as there are far too many issues with the organisations infrastructure to point the finger of blame purely at Flex Profiles.
As a result of this my client has elected for a New PS 4.5 Implementation in a brand new domain and will then perform a staged migration of users and apps.
It's definitely worth pointing out things that we found though for future reference:
Neverfail:
The client uses a product called Neverfail which is essentially a replication tool to provide resilience for file and print services and the SQL databases.
What it does is it effectively creates an off line clone of the live server by replicating all changes etc What is happening with the clients environment is that for some reasons this process seems to lock files occasionally and this prevents them being accessed at all (read, modified etc). Needless to say all of the flex INI files are stored on this location and therefore some of the errors generated are because the logon /logoff scripts are unable to read or write to this central share sporadically.
I'm not saying this is a bad product, I think that it's down to misconfiguration at this customer site but not knowing the product I'm in the dark! :cry:
Mandatory profile:
The mandatory profile had somehow been overwritten (maybe due to the issues with the file server above, slack permissions, who knows!) so I had to generate a new one.
Ini Configuration Issues
Found some spaces in some of the ini files :evil:
Group Policy Issues
The client has hundreds and hundreds of GPOs and an awful lot of them are totally unnecessary, an AD review is currently underway and has already found some conflicts with policies directly relating to terminal servers.
Empty WSH box
Known issue and upgrading to the latest version solved this.
Most of the issues are now resolved though we still get the Faulting Module Errors on some of the servers in the event viewer and when logging on to the server via RDP and sporadic prompting for The PROFLWIZ to save the settings (though I think this is down to the Neverfail issue mentioned earlier). The server builds are far too inconsistent though to determine an exact cause or troubleshoot effectively.
As I was saying though, the client now wants to build a new infrastructure with a new citrix solution so I guess we'll never find out the root cause of all of the issues but once again thanks to Shaun, Denis and everyone else for taking the time to assist.
:D
Chris
|
|
pages:
1 |