Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a client machine secon (XP-Pro, SP3) and a server machine servlet. When upgrading Norton Antivirus from 11.4 to RU6, one of our applications named 'LeaftradeLauncher' did not start anymore. When I checked secon's application syslogs, these are some entries I found:

"The description for Event ID ( 0 ) in Source ( Leaftrade Alerts ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: LeaftradeLauncher::Tem.InitClient sucessful. Initialized with server:servlet"

When I Googled it, I found some sites mentioning that we need to check in services.msc, to see whether services are disabled or not. Some sites mentioned that either the DLL file responsible for generating the event for these application is damaged, or the account you are using doesn't have the rights to load the DLLs.

This mostly happens with 3rd party applications where it was installed with a user account and the service account doesn't get permission to pull the info about the required DLLs like that.

share|improve this question
When i open my antivirus-> Change settings-> Centralized Exceptions,, what should i do here – peter Jul 8 '11 at 12:38
Hi KCotreau , if i add SSRoam.wav in to my antivirus-> Change settings-> Centralized Exceptions->SecurityRiskException->File and rename it with some other name ,,Will that sufficient – peter Jul 8 '11 at 12:51
@KCotreau , one more question why we need to do for SSRoam.wav like this is it a Spam or some harmful things – peter Jul 8 '11 at 13:18
Please don't cross-post on multiple sites, and if you need to clarify your question, edit it instead of asking a new one with more info. – nhinkle Jul 8 '11 at 17:13

It clearly misidentified the file C:\WINDOWS\Media\SSRoam.wav as viral (or maybe not even). I would go into the exceptions list, and add that file as an exception, and replace it with a known-good version.

share|improve this answer
Can you make it clear – peter Jul 8 '11 at 12:19
where we can see exception list ,and how to replace it with a known-good version – peter Jul 8 '11 at 12:23
This is similar to yours, but not sure it is the same, but open your AV, and look for "Change Settings", and possibly "Centralized Exceptions" (You are going to need to use common sense here, and maybe click on a few things to find it, but you need to find where to add files that the AV will not scan, "Exceptions").Add that file to the exceptions list so it will not be scanned and deleted again. Get the file from another computer somewhere, or replace it with any wave file you rename SSRoam.wav. – KCotreau Jul 8 '11 at 12:23
you mean security risk exception or proactive threat scan exception where i need to add C:\WINDOWS\Media\SSRoam.wav , and one more thing i need to know how to replace it with a known-good version – peter Jul 8 '11 at 12:27
You just copy a file that is known-good to that same location. Either you get it from another computer or maybe repairing your AV will replace it since it looks to be part of your AV install. – KCotreau Jul 8 '11 at 12:32

The windows event log really doesn't contain event descriptions. It only contains event numbers, and Windows tries to resolve those numbers to descriptions when you view the logs. An application that adds log entries should install a number-to-description translation table.

The error message "The description for Event ID ( 0 ) in Source ( Leaftrade Alerts ) cannot be found. " means that Windows either could not find a table for Leaftrade Alerts, or that the table missed entry 0. It's an error message from Windows itself, so you can get similar error messages for different Sources.

Note however that Windows did manage to catch one part of the event coming from Leaftrade Alerts. The "LeaftradeLauncher::Tem.InitClient sucessful. Initialized with server:servlet" part doesn't come from Windows, but directly from LeaftradeLauncher. So, it seems that LeaftradeLauncher itself thinks that it started succesfully.

share|improve this answer

Based on the version you list you have Symantec Endpoint Protection 11.0.6300 and not Norton. Is that correct? Is the system running a management server (SEPM) Do you use application and device control? If managed, are there event log entries on the SEPM that can shed more light on this? Or log entries in the Symantec Client itself?

share|improve this answer
up vote 1 down vote accepted

Repairing AV fixed the problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.