Software

Ask something
Question Locked

Windows Update/Rootkit/Virus?

0 helpful
15 replies

by mbrewster

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have two computers that have the same problem. Both were at different locations when it cropped up.

-Both PCs are on different domains
-PC1 has group policies applied, login scripts, startup scripts, shutdown scripts, ect.
-PC1 has Vexira Antivirus, now removed
-PC1 has Adobe flash player, adobe reader, thunderbird, office 2003, and Java.
-PC1 is WinXP Pro SP3
-PC1 is a Gateway E series computer

-PC2 is WinXP Pro SP2
-PC2 is a Dell 2xxx series computer (I apologize I'm not next to it to get the model)
-PC2 has no group policies
-PC2 has Norton Antivirus, now removed
-PC2 had applications such as weatherbug and dealeo (crapware), now removed
-PC2 has Adobe flash player, adobe reader, office 2003, and Java.

Symptoms (both have the same):
-When the computer boots up with the network cable plugged in, after login the task bar stops responding. However the desktop is responsive.
Internet explorer works.
Task manager and control panel applets dont open. After trying to open a few things the PC will lock up.
After getting "A squared, Hijackfree" on the computer I disabled every application that starts on any users login. Through msconfig I have disabled all non windows services and verified that they dont start.
I tried to run Process Explorer however it is one of the applications that will lock up the computer. If it doesn't lock up the computer and does happen to run, the processes do not update. If I run a new process it doesn't get added to the process list. I can search for the process and it does find that it is running but I can't examine it because it isn't in the process list.

-When booting the computer up without the network cable plugged in the start bar doens't lock up after logging in. Task Manager works, and proccess explorer works. Control panel applets now work and dont lockup the computer. Plugging in the network cable after the computer has started doesn't cause problems. However if I try to copy data from the computer to another networked computer the PC will lock up.

-Rootkit revealer doesn't detect anything wrong. Neither antivirus detects anything wrong.

-The last windows update ran on either computer was KB958644 and rolling it back doesn't resolve the issue.

-Both computers stopped working after thursday of last week (10/24)

-Shutdown/startup scripts work properly while ethernet cable is plugged in. Including software installations. After logging in the PC no longer works properly. It isn't possible to log out.

-Safe mode and Safe mode with networking have the same effect as normal mode with the network cable plugged in.

Steps taken to resolve:

I rolled back all internet explorer updates on one computer including IE7 itself. Uninstalled all programs additional to windows (flash, pdf reader, Java, ect). Cleared all temp folders. Ran a system restore to a point almost a month ago. Disabled the NIC (acts the same as unplugging the NIC). Reinstalled NIC drivers. Checked for hidded non pnp devices.

My fear is that if I can't find out why these machines are doing this that I wont be able to prevent it from happening to another 450 of my computers. I will be running a repair installation over one of these computers to see if that resolves the issue but this isn't a valid fix assuming I will continue to run into the problem if steps to prevent are not in place.

15 replies

by mbrewster

Installing SP3 on PC2 didn't resolve the issue. I am now starting a repair installation.

by older mycroft

Clearly the problem only manifests itself when the network cable is attached. Doesn't that tell you anything?

Also, do these systems have a NIC installed? If so, maybe you could swap them out with another?

Have you traced the network cable to the 'other' end - what is happening there?

by rob miners

Check the memory.
You can test the memory by running Windows Memory Diagnostic that can be downloaded from http://oca.microsoft.com/en/windiag.asp. If memory problems are found, try re-seating the RAM. If it doesn't work, replace the defective RAM.

Keep us informed as to your progress if you require further assistance.

If you think that any of the posts that have been made by all TR Members, have solved or contributed to solving the problem, please Mark them as Helpful so that others may benefit from the outcome. ;) :D

by mbrewster

The issue was caused by windows update kb958644 and I haven't been able to resolve it yet.

by rob miners

tried removing the update to see if that will fix it.

by ontheropes

"The last windows update ran on either computer was KB958644 and rolling it back doesn't resolve the issue."

by older mycroft

In which case I'd reiterate my original point regarding the possibility of a rogue NIC (or two) or dodgy network cabling.

It's not beyond the realms of possibility for two separate NICs to die simultaneously, especially if they're both the same age. :)

Although I'd still be tempted to ask if the rollback was accompanied by a full shutdown and cold boot. Or if it was reinstated, since it didn't 'seem' to make any difference. ;)

by rob miners

but I don't think that it is the problem. Both PC's should have picked up if it was. There is no reference to the memory test as yet.

by mbrewster

Remember, these two computers are located in different locations. Not only is the network card a different model, they both work perfectly fine.

Memtest86's memory test passes after running over night. I find it hard to believe that people think two computers both happened to have bad RAM over the same period of time at different locations and have the same exact symptom. I mean, its not like they both have BSOD with random messages each time they boot up or something.

I had to do quite a bit of research before finally finding people with the same problems. Others have been fixed simply by rolling back the update and reinstalling.

Since I cant actually leave these computers down and troubleshoot I have already reinstalled PC2 and ran all updates and installed original software and reimported all user data and settings. There is no more problem on this computer.

I haven't reloaded PC1 and I will try to call that support number and see if they are of any help. I will follow up to let you guys know how the problem was resolved if the phone support helps.

by mbrewster

I was on the phone for about 15 minutes with a person until they put me on hold for 10 minutes and then dropped the call. It was the end of the day so I left.

We run WSUS on our domain and all the windows updates were deployed to that machine over night. So, after I had uninstalled every application like adobe reader, java, microsoft office, ran system restore, rolled back all updates on the system, redeployed the kb958644 update with no luck. The windows updates last night fixed the issues.

I would have to say rolling back all the updates including IE7 and then reinstalling all updates (not just kb958644) seems to fix the issue. What a mess..

This discussion is closed to new replies.