PDA

View Full Version : Could a virus cause this? (W98)



tnguy
05-25-2002, 04:20 AM
I am seeing a very peculiar problem at our school.
A little background on the situation first. We have 700 Win98 identical (IBM 6574-80U) workstations on our network. I use ImageCast to create an image of one, then image all the others with that image. I change the background color each time I create a new image so that I can differentiate between machines that have received the new image, and those that have not. Therefore, other than the machine name (which I change after imaging) and the IP (DHCP) all machines are identical (registry, programs, everything).

The problem: About once or twice a week I will get a call from a teacher telling me that the background of a computer in their class has changed, and that no one can log in on it. This is happening all over the school, completely at random (it appears), to different teachers.

When I go check out the machine, it appears that the machine has been re-imaged to an old image. That image no longer exists on our network, is too large for a floppy, and could only be run using the Admin password with an ImageCast boot floppy. The machine name is the name I had on the previous image, and the background color matches that image as well. The reason no one can log in, is because somewhere else in the building another computer has had the same problem, but it hasn't been turned in yet. Since both of these computers have the same name, and since we use MustBeValidated, the second machine to try and log in with the same computer name cannot log in.

I have also noticed that the System.ini and Win.ini have changed. On one machine that I checked, Norton Antivirus (Enterprise edition, which cannot be modified by the workstation user) had been disabled completely.

My theory: The registry, the system.ini, or the win.ini is getting corrupted somehow, and is reverting back to a previously backed up copy. This backed up version contains the machine name, background color, etc. that was created from the old image.

I checked the STARTUP menu in MSCONFIG, and scanreg /auto was UNchecked. This would have prevented the registry from being backed up each time the machine is started, right? So possibly, the only backup of the registry is from the old image, right?

One more note: This has happened around the time of a power surge or outage, but also randomly.

Someone told me that they had seen this problem in another school that uses ImageCast. The problem was solved when they changed out the RAM in the machine. But, if I reimage the goofy machine, it runs fine.

This problem has only been going on for about two months. Could a virus be causing this problem? We use Norton Enterprise Edition throughout the network, and it is updated daily. Student machines do not get email, but I have seen (via Norton's logs and warnings) that student machines have been to sites that tried to infect a machine, but NAV caught it. Norton is configured to try and clean infected files first, then delete them if the clean is unsuccessful.

I know this is an enormous post, but I am trying to give enough info to answer any questions you might have.

I hope someone has seen similiar, or has any idea.

TNguy
Network Administrator
(I am looking for an employment change, see my BIO)

Andy-S
05-25-2002, 06:30 PM
It's possible that bad memory is causing the problem and scanreg is reverting to a backup copy of the image. It's also possible that students are running scanreg /restore and reverting to a previous backup?

If you are using ImageCast then you should ensure that all previous backups are removed from the backup folder before saving the new image. This will at least rule out the students.

Cheers
Andy

tnguy
05-26-2002, 04:29 AM
Thanks Andy-S,

You are referring to RAM, right? Why would bad memory cause the registry to revert to a backup, but run fine after a re-image? I sort of figured a student might be running scanreg, so how do I prevent this from happening? I already have the floppy and CD-rom hidden so that they cannot run programs from them (I think), they can save to and open from, but they cannot boot from a floppy.

I turned on Scanregw.exe /auto (via login script so every machine will update without my touching each one) so that the machine will build a new backup each time the machine is restarted (right?), so after 5 restarts, it will only have the correct registry (right?).

TNguy
Network Administrator
(I am looking for an employment change, see my BIO)

Mocha
05-26-2002, 05:43 AM
tnguy,

The registry's only backed up once a day, not every reboot. Five days=5backups. :)

Carol

Andy-S
05-26-2002, 07:54 PM
The registry problems can be caused by bad RAM if the contents are corrupted during normal operation or shutdown. During normal operation there is a lot of registry information stored and manipulated in RAM rather than writing and reading to the hives on the hard drive (much better performance using RAM). Some information that is no longer being used is written back and can be corrupted. When you shutdown the remaining registry information in RAM has to be written back to the HDD also. If the RAM is bad then the information written to the hives can be corrupted. The next time that you boot scanreg recognizes that there is corruption and reverts back to a previous version of the registry. It may also be identified as fatal exception errors etc. during normal operation. It's unlikely that it is RAM in your case as you have so many failing.

If the problem is due to students running scanreg then I think the best way to prevent it going forward is to delete all backups as part of your image generation process.

Cheers
Andy

tnguy
05-27-2002, 06:02 AM
Will do, and thanks to all for the responses.

TNguy
Network Administrator
(I am looking for an employment change, see my BIO)

jdharm
05-28-2002, 08:08 AM
Just throwing another idea out to give you another avenue of investigation.

I havn't had this particutar problem, but I have had serious problems suddenly start appearing at random around the HS campus. Sometimes a student user.dat file gets corrupted somehow, and since we have roaming profiles the problem gets downloaded into any machine the student logs on to. I ended up having to delete the registry files from the students network profile and clean their profile out of any computer they had been on to stamp out the problem.

Do you keep log in/out records on the network so that you might see who was the last user to log on to each of the troubled machines?

Josh

"What we call 'Progress' is the exchange of one nuisance for another nuisance."

tnguy
06-01-2002, 03:32 PM
Yes I do, and there is no pattern. I checked that first, thinking I could catch someone doing this intentionally.

TNguy
Network Administrator
(I am looking for an employment change, see my BIO)

coolsights2000
06-02-2002, 04:51 AM
When I do updates and before I do backups I run registry checker five times this way it over writes all registry back up with the new one....

go start run type in msinfo32 hit ok
under tools select registry checker run it five times...

all backups will have the new settings

when it restores the registry it also restores win.ini and system.ini along with the user.dat and system.dat file

four files are saved in the backup....


Thanks
Mac!!!

I've heard a saying : about 99% of computer problems sit in front of the monitor

coolsights2000
06-02-2002, 05:01 AM
I forgot to say the user.dat and the system.dat is the files of the default desktop.... in the c:windows folder.... That is the only files that get backed up.... with the system.ini and the win.ini

if you use profiles the profile user.dat file is never backed up....

I save the profile user.dat file on a separate zip disk.....



Thanks
Mac!!!

I've heard a saying : about 99% of computer problems sit in front of the monitor