Performance counter errors in event log

[Joe_Carter]

For some time now we have been seeing the same two errors in the application event log (ID 2003) on our EV server every night:

The configuration information of the performance library "C:\WINDOWS\system32\aspperf.dll" for the "ASP" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

The configuration information of the performance library "C:\WINDOWS\system32\infoctrs.dll" for the "InetInfo" service does not match the trusted performance library information stored in the registry. The functions in this library will not be treated as trusted.

I have tried unloading and reloading the performance counters in question as suggested in various Microsoft KB articles and forums but the errors remain.

Any more ideas on how these counters can become trusted again?

Windows 2003 R2
Enterprise Vault 2007

[TonySterling]

So is this the process you used?

To reregister the performance counter libraries of the affected service, follow these steps:

1. Click Start, click Run, type cmd, and then click OK.
2. Type unlodctr ServiceName, and then press ENTER.
   
   Note Servicename represents the name of the affected service.
3. Type lodctr IniFile, and then press ENTER.
   
   Note Inifile represents the name of the .ini file for the driver that you want to reload. For example, if you want to reload the W3svc driver, you must type w3ctrs.ini.

[Joe_Carter]

Correct.  I initially tried:

unlodctr asp
unlodctr inetinfo
lodctr axperf.ini
lodctr infoctrs.ini

I've tried the lodctr /T: parameter to set the counter as trusted.

I've also tried completely rebuilding all counters using:

lodctr /R

But the problem persists every night.

[Joe_Carter]

Well, after upgrading to EV 8.0 SP4 and then moving all EV services to EV 8.0 SP4 on a new server, the problem remains (well, only the InetInfo counter now and not the ASP one).

Any ideas Symantec people?

[Rob_Wilcox1]

As crazy as this sounds -- was the error being logged PRIOR to installing Enterprise Vault?