Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » Problem with Automatic Update since Tuesday
Search Topic:
Uniqs:
7495
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
Security Software Updates - 15 May 2007 »
« Trojan could be infecting computers through Microsoft update  
page: 1 · 2 · 3 · 4
AuthorAll Replies


Gooiool
May God bless you.
Premium
join:2006-11-27
Roland, OK
clubs:

reply to slashman
Re: Problem with Automatic Update since Tuesday

said by slashman See Profile :

I am having a weird issue since this Tuesday. I have several pcs that will slow down and then not launch any programs within a couple of minutes of launch. Even task manager will not come up.

So far I have been able to work around it by disabling Microsoft Automatic Updates and rebooting. Then everything is fine. I did AS and AV scan on the machines and they come up clean. Is this maybe a patch problem?

Today I had a client call with the same problem. Anyone else see this too?
Same here but only one pc out of 4 was effected ...
--
As always thank you Gooiool ©2005.Team Discovery
Please join us in the fight against cancer and juvenile diseases.Project Hope


altermatt
Premium
join:2004-01-22
White Plains, NY
·Verizon Online DSL

reply to La Luna
said by La Luna See Profile :

Trying going to Start>Windows Update (I know, I know, sounds wrong, but it's not), then click on "change settings" on the left side of the page.
Thanks, I will try that tomorrow. Just to clarify with you, though, that link is to »update.microsoft.com/microsoftup···ln=en-us . (That may be what you meant by "I know it sounds wrong ).
--
The truth of a thing is the feel of it, not the think of it. -- Stanley Kubrick

mikefxu

join:2004-10-05
Titusville, FL

reply to rdhw
said by rdhw See Profile :

For a fix to this problem, please do BOTH of the following:

1. For 32-bit systems, download and save to hard disk, and then install:
»download.windowsupdate.com/v7/wi···-x86.exe

2. (not for Vista) Download and install update KB927891:
»support.microsoft.com/kb/927891

If the first of these produces an error message about "Update agent already installed", then execute the installer again manually, with parameter /wuforce as in:

WindowsUpdateAgent30-x86.exe  /wuforce

After the fixes have been installed, doing a Microsoft Update or Automatic Update might still take some time (though not as much as before) and processor and disk usage, but it should not lock out user-level interaction with the system and applications, so it should not be an inconvenience.
If this works I love you long time!


La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
·Optimum Online
·Vonage

reply to altermatt
said by altermatt See Profile :

said by La Luna See Profile :

Trying going to Start>Windows Update (I know, I know, sounds wrong, but it's not), then click on "change settings" on the left side of the page.
Thanks, I will try that tomorrow. Just to clarify with you, though, that link is to »update.microsoft.com/microsoftup···ln=en-us . (That may be what you meant by "I know it sounds wrong ).
Yep, Start says "Windows Updates", giving the impression that's where you're going when you are actually going to MS Updates.
--
~~"As long as America is an infidel enemy, terrorizing it is a duty." Sayed Imam Abdul-Aziz el-Sheriff~~



La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
·Optimum Online
·Vonage

reply to mikefxu
said by mikefxu See Profile :

If this works I love you long time!
Please let us know if that works for you, I've read reports that it did nothing.
--
~~"As long as America is an infidel enemy, terrorizing it is a duty." Sayed Imam Abdul-Aziz el-Sheriff~~


OZO
Premium
join:2003-01-17

reply to slashman
The problem is due to a poor memory management used in program doing update. It happens when a badly written program/module calls memory allocation / deallocation functions extremely often (querying small portions of bytes multiple times instead of taking a bigger block and properly utilizing it). Do you need an example? Assume that that there is a badly written "strings" class where concatenation of two strings done by calling a realloc function for every byte added from the second to the first string. No one will do that except a novice programmer... And it looks like the case here.

If you watch what's going on with Process Explorer you can see that most of the time CPU is running "ntdll.dll!RtlAllocateHeap+0x18c" method, which is called from "ole32.dll!StringFromGUID2+0x627". It's part of "svchost.exe -k netsvcs" process.

Obviously the program was NOT thoroughly tested. At least I'm sure that developers do not know what profiler is for... To help to solve it quicker I've even made some basic recommendations for its developers (see this post).

Unfortunately there is nothing we can do about it just to wait until the problem will be finally fixed by m$. My experience shows that two previous attempts (916089 and 927891) were unsuccessful (see this post). Let's wait and hope that next fix will eventually help...
--
Keep it simple, it'll become complex by itself...


La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
·Optimum Online
·Vonage


1 edit
The weird thing for me is that this just *suddenly* started happening. I've had this computer for a year and a half, always getting updates with no problem, until this week. Others report having the problem months ago.

I wonder what triggers it, or what keeps it from ever triggering?

mikefxu

join:2004-10-05
Titusville, FL

reply to La Luna
said by La Luna See Profile :

said by mikefxu See Profile :

If this works I love you long time!
Please let us know if that works for you, I've read reports that it did nothing.
It worked immediately, 5 minutes after installing those two files, WU popped up and said 8 updates to install. No maxing out processor either. I have cpu monitor on task bar and randomly svchost.exe would max out and I would kill it for the past month or so.


La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
·Optimum Online
·Vonage

said by mikefxu See Profile :

said by La Luna See Profile :

said by mikefxu See Profile :

If this works I love you long time!
Please let us know if that works for you, I've read reports that it did nothing.
It worked immediately, 5 minutes after installing those two files, WU popped up and said 8 updates to install. No maxing out processor either. I have cpu monitor on task bar and randomly svchost.exe would max out and I would kill it for the past month or so.
Cool beans, thanks! I might give it a try, I was just a little concerned about reports saying it didn't work and I don't want to bork anything up more than it already is!
--
~~"As long as America is an infidel enemy, terrorizing it is a duty." Sayed Imam Abdul-Aziz el-Sheriff~~


mikefxu

join:2004-10-05
Titusville, FL
The worse that can happen is you are right where you started 2 minutes ago, hurry give it a try!

gworkman7

join:2005-10-18
Vail, AZ
·PHONE POWER
·magicjack.com
·Qwest.net
·Broadvox Direct

reply to OZO
Are any of you experiencing this issue with W2K server? My server started doing this last night. I've had issues with GFI MailEssentials and that's where I started looking. As I googled away, I found several folks talking about WinUpdate, but only for XP. This place is supposed to be where I go for entertainment...now I can officially call this browsing experience "work".

mikefxu

join:2004-10-05
Titusville, FL
I have 2 W2K3 servers and I havent had any problems but they are updated via WSUS.

OZO
Premium
join:2003-01-17

reply to La Luna
said by La Luna See Profile :

The weird thing for me is that this just *suddenly* started happening. I've had this computer for a year and a half, always getting updates with no problem, until this week. Others report having the problem months ago.

I wonder what triggers it, or what keeps it from ever triggering?
There is a noticeable difference between computer running 90% of CPU and one that require 100%. In former case you will never see it (unless you desire to watch it on purpose). In latter case computer tries to do many other things to schedule the processes, change priorities and actually may ask for "avalanche" of extra tasks needed for processing. It may drop its "effectiveness" significantly. That's the time when user begin to see the problem. We have different computers, with different processing power, running in different environment. We have dofferent number of installed fixes (and programs) too. It may explain that some folks see it, and others may not yet. There is a lot of other reasons though.
--
Keep it simple, it'll become complex by itself...

rdhw

join:2002-09-21
Cambridge UK

reply to OZO
said by OZO See Profile :

My experience shows that two previous attempts (916089 and 927891) were unsuccessful
Please be aware that 927891 was silently updated to v3 on 7th May, containing v3.1.4000.4039 of msi.dll dated 18 April 2007. The KB article has not yet caught up. It is this version you should be trying in conjunction with the new UpdateAgent30.
--
Robin Walker »homepage.ntlworld.com/robin.d.h.walker/ for broadband troubleshooting tips


Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC

reply to slashman
Some more confirmation that it is working..

Published: 2007-05-10,
Last Updated: 2007-05-10 22:07:23 UTC
by Daniel Wesemann (Version: 1)
»isc.sans.org/diary.html?dshield=···21d807c5

Some readers reported 99% CPU eaten up by svchost.exe after they had applied the recent batch of MS updates. Cause and effect are not quite clear, but a common thread seems to be that MS recommend a look at KBID 927891
»support.microsoft.com/?kbid=927891
and some readers have also pointed us to the WSUS Blog
»blogs.technet.com/wsus/archive/2···-on.aspx
where the same issue is mentioned.
According to another ISC reader, to resolve the issue it is necessary to first apply 927891, and then to do the WU client upgrade.
»download.windowsupdate.com/v7/wi···-x86.exe
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/

OZO
Premium
join:2003-01-17

reply to rdhw
said by rdhw See Profile :

said by OZO See Profile :

My experience shows that two previous attempts (916089 and 927891) were unsuccessful
Please be aware that 927891 was silently updated to v3 on 7th May, containing v3.1.4000.4039 of msi.dll dated 18 April 2007. The KB article has not yet caught up. It is this version you should be trying in conjunction with the new UpdateAgent30.
Thank you rdhw See Profile!
I'll reinstall it.
--
Keep it simple, it'll become complex by itself...


HA Nut
Premium
join:2004-05-13
USA
reply to slashman
I'm starting to see this bug creep up more and more. I'm hoping the new updated files will help...


La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
reply to slashman
Well, here goes nothing. I'm going for it.

Why do I feel like I'm sky diving for the first time? Is this angst necessary for updating a computer?


HA Nut
Premium
join:2004-05-13
USA

said by La Luna See Profile :

Well, here goes nothing. I'm going for it.

Why do I feel like I'm sky diving for the first time? Is this angst necessary for updating a computer?
Thank goodness for ShadowProtect, True Image, Ghost, Image for DOS or whatever one uses for backup images. Worth their weight in gold sometimes...


La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
reply to slashman
One more quick question.....do I install KB927891 first or the other one? Just want to make sure I do it in the right order.
Forums » Up and Running » Security » SecuritySecurity Software Updates - 15 May 2007 »
« Trojan could be infecting computers through Microsoft update  
page: 1 · 2 · 3 · 4


Thursday, 10-Dec 11:15:56 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [200] Sprint Sued For Distracted Driving Death
· [125] AT&T Launching New 24 Mbps U-Verse Tier
· [82] 3G Network Test Says AT&T Is Tops
· [72] Mediacom Unveils 105 Mbps Pricing
· [70] AT&T Hints At Usage-Based iPhone Data Pricing
· [66] Sprint Poised For A Turnaround?
· [66] WPA Cracker: Test WPA-PSK Networks In 20 Minutes
· [51] The Future Of Wi-Fi Is Bright
· [47] Site Leaks Yahoo, Verizon Fed Data Share Pricing
· [45] Microwaving Your Innards Is Not 'Extreme'
Most people now reading
· Cross Server Dungeon Experience [World of Warcraft]
· IMG 1.7 (IMG Updates and Discussion) [Verizon FIOS TV]
· malware has been found hidden inside an Ubuntu screensaver [Security]
· Windows 7 boot manager editing questions [Microsoft Help]
· Battered Hilt Delimma [World of Warcraft]
· Forwarding previous owner's mail [Home Repair & Improvement]
· [game] CG6 - Gunslinger - Day 1 [Pub Games]
· Icecrown 5-man strats [World of Warcraft]
· Connecting to Google Voice Via SIP [VOIP Tech Chat]
· Lawyers Claim Palin Hack Suspect's PC Had Spyware [Security]