We ran into a problem while finishing a malware removal, in which the Malicious Software Removal tool (MSRT) would not run. We first noticed the problem while downloading Windows updates -- all the other updates would install, but Windows Update kept reoffering the August 2011 MSRT. We tried many different things, such as reseting Windows Updates, double checking for root kits, rescanning the machines, manually checking files in %windir%, and an assortment of other things. One of the things we tried was downloading the standalone MSRT from http://support.microsoft.com/kb/890830. The file would download fine, but it would not run. The extraction dialog boxes would show up, then it would just disappear. Watching Task Manager while extracting the MSRT standalone package show the package would start running and then just disappear. We could not find any information in Event viewer, mrt.log, or mrteng.log.
We double checked the permissions on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools to make sure acces was not denied, since the MSRT package updates the Version subkey when a new verison successfully finishes. Our final idea was to take ownership of %windir%\system32\mrt.exe and rename the file to %windir%\system32\mrt.old. To do this we used the following commands:
takeown /f %windir%\system32\mrt.exe /a
icacls %windir%\system32\mrt.exe /grant Administrators:F
ren %windir%\system32\mrt.exe mrt.old
After successfully taking ownership and renaming the file, We reran the MSRT standalone package. This time MSRT actually continued to run, and allowed us to complete a scan. After MSRT finished a scan Windows Update stopped reoffering the the August 2011 MSRT package and offered new Windows Updates. I am not sure whether the problem was acutally permission or a corrupted mrt.exe, since I was time crunched to fix the problem before the customer returned.
One of the most frustrating problems, I've dealt with in awhile was fixing an error 39 for a Synaptics touchpad driver. I had just cloned over Windows Vista from a failing hard drive to a new hard drive. Fixed the crazy boot issues, blue screens, and starting running updates on the OS. Everything was working fine, when I left for the night, but when I came in the next day, the touchpad driver was messed up. In case you haven't seen it, this is a code 39 for a device driver:
Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)
Microsoft support states uninstall and reinstall the driver, and life will be wonderful, but I tried this in seemingly hundreds of combinations.. Searching Google for an answer was mostly a waste of time, since everyone was claiming a driver reinstall worked to random registry hacks. I tried the most common sense things first, such as uninstalling, reinstalling the driver, trying to let Windows install the driver from Windows Update, and installing the newest version straight from Synaptics. All of these avenues had no effect at all on the error. So I went off on a tangent, fixing some corrupted OS files which SFC could not repair, in the hopes maybe it was something with these files -- after getting all the files repaired, the driver still would not install, but the system was overall much more responsive. As a last desperate act, before refunding the perso'sn money, I used the new devcon from the Windows Driver kit to uninstall the driver -- devcon remove ACPI\SYN013B followed by devcon rescan. These two commands caused the touchpad to show up as an unknown device. Next I used the Update Driver option from the context sensitive menu in the Device Manager, to manually install a generic PS/2 device. Then, I uninstalled the PS/2 device rebooted, and installed the drivers from Synaptics. After the Synaptics installer finished rebooting, the touchpad worked again. It even worked after several reboots.
Thankfully, I had to handle one more problem with the computer of fixing iTunes and the missing CD drive. Updating the Gears driver for iTunes fixed both at the same time. So experience proved helpful in part of the random chase for driver repairs.
This starts like any other IT story, where I removed some malware and such from a computer for a friend. A week later, he calls me up complaining, XP won't go into standby anymore -- it just shows the "Preparing for Standby" screen and never changes. I figured it was caused by one of the drivers, I updated during my OS work. So I fetch his PC and bring it back home to work on. I power it up, and test standby. Just like he said, it freezes at the standby screen; immediately I power cycle the machine and roll back the video driver from device manager, thinking this fixes all the standby issues I've seen. I cockily reboot the machine. When it hits the desktop, I force a standby with the shutdown dialog box and it promptly locks up.
At this point, I start cursing while rolling back all the drivers I updated a week or two ago -- there were only three updated driver, video, audio, and modem. After a reboot, I let the PC sit for a few minutes until standby kicks in; of course it goes into standby without any problems, and I breath a sigh of relief. Not wanting to jump the gun, I let it go back into standby and it locks up. So rolling back the drivers, fixed it for one use of standby, which would be a hard sell as 'fixed' to someone who uses standby. At this point, I'm perplexed, so I look back over the system for some malware. As I expected, the system comes up clean. The only thing I notice which could be the problem is McAfee. So I headed to http://mvt.mcafee.com and downloaded the Virtual technician to repair Mcafee. It repaired some services and installed the newest DAT, which seemed to help with the slow performance the system was experiencing, although no change in the standby situation - still one good standby and locks up on the next.
From here I consider many many options, and chase down many blind alleys rechecking drivers, and registry keys. While systemically going through the system, I notice iTunes is giving an error when opened - "Warning! The registry settings used by the iTunes drivers for importing and burning CDs & DVDs are missing. This can happen as a result of installing other CD burning software. Please reinstall iTunes." http://support.apple.com/kb/TS2372) which was no help, and come across several other articles which cite random drivers in %windir%\system32\drivers causing the problem with itunes. One article I ran across said they fixed iTunes by installing the newest Gear drivers. I figure I have nothing to lose and download the drivers from http://www.gearsoftware.com/support/drivers.php I install the drivers, reboot, and figure might as well try test standby again. Surprisingly, standby worked twice in a row. After five or six successful standby attempts, I reboot and start over with testing -- still good after another five or reboots.
After five days of troubleshooting, it turned out to be corrupted Gears drivers. If only I had know that days ago, I could have saved myself a huge hassle.
|