I have two computers that have the same problem. Both were at different locations when it cropped up.
-Both PCs are on different domains
-PC1 has group policies applied, login scripts, startup scripts, shutdown scripts, ect.
-PC1 has Vexira Antivirus, now removed
-PC1 has Adobe flash player, adobe reader, thunderbird, office 2003, and Java.
-PC1 is WinXP Pro SP3
-PC1 is a Gateway E series computer
-PC2 is WinXP Pro SP2
-PC2 is a Dell 2xxx series computer (I apologize I’m not next to it to get the model)
-PC2 has no group policies
-PC2 has Norton Antivirus, now removed
-PC2 had applications such as weatherbug and dealeo (crapware), now removed
-PC2 has Adobe flash player, adobe reader, office 2003, and Java.
Symptoms (both have the same):
-When the computer boots up with the network cable plugged in, after login the task bar stops responding. However the desktop is responsive.
Internet explorer works.
Task manager and control panel applets dont open. After trying to open a few things the PC will lock up.
After getting “A squared, Hijackfree” on the computer I disabled every application that starts on any users login. Through msconfig I have disabled all non windows services and verified that they dont start.
I tried to run Process Explorer however it is one of the applications that will lock up the computer. If it doesn’t lock up the computer and does happen to run, the processes do not update. If I run a new process it doesn’t get added to the process list. I can search for the process and it does find that it is running but I can’t examine it because it isn’t in the process list.
-When booting the computer up without the network cable plugged in the start bar doens’t lock up after logging in. Task Manager works, and proccess explorer works. Control panel applets now work and dont lockup the computer. Plugging in the network cable after the computer has started doesn’t cause problems. However if I try to copy data from the computer to another networked computer the PC will lock up.
-Rootkit revealer doesn’t detect anything wrong. Neither antivirus detects anything wrong.
-The last windows update ran on either computer was KB958644 and rolling it back doesn’t resolve the issue.
-Both computers stopped working after thursday of last week (10/24)
-Shutdown/startup scripts work properly while ethernet cable is plugged in. Including software installations. After logging in the PC no longer works properly. It isn’t possible to log out.
-Safe mode and Safe mode with networking have the same effect as normal mode with the network cable plugged in.
Steps taken to resolve:
I rolled back all internet explorer updates on one computer including IE7 itself. Uninstalled all programs additional to windows (flash, pdf reader, Java, ect). Cleared all temp folders. Ran a system restore to a point almost a month ago. Disabled the NIC (acts the same as unplugging the NIC). Reinstalled NIC drivers. Checked for hidded non pnp devices.
My fear is that if I can’t find out why these machines are doing this that I wont be able to prevent it from happening to another 450 of my computers. I will be running a repair installation over one of these computers to see if that resolves the issue but this isn’t a valid fix assuming I will continue to run into the problem if steps to prevent are not in place.