Broadband Tech > Security > Security > SP3 vs McAfee led to Norton disaster

reply to Kirby Smith

Re: SP3 vs McAfee led to Norton disaster

Welcome back, Kirby!! Geez, you've been havin' problems lately, huh??

said by Kirby Smith:

---

I had to build from scratch, after quite a few experimental tries with attendant startup disk loadings.

---

said by Kirby Smith:

---

Of course, I haven't forgotten Symantic Norton AV, which destroyed my system.

---

said by Kirby Smith:

---

And then there is MicroSoft SP3 which broke McAfee Vshield.

---

said by Kirby Smith:

---

Someone, I think here at DSL Reports, was promoting a "iuctl.cab" download, I think from Microsoft, to fix some dll SP3 purportedly breaks. Anyone recognize this file and have a link to where MS touts it? TIA

---

The rumor of my computer's life was premature (with apologies to Mark Twain). Shutdown last night seemed a bit abrupt, and this morning startup led to a blue screen complaining about \winnt\system32\config\system missing. Unfortunately, I can only remember one key fix for the Abit KT7-RAID highpoint controller vs. windows not doing correct disk cache unloading, and I think I had done it.

I also had noticed during the various repeated builds a message at the top of the b/w window's startup screen that said: disk i/o error: status = 00008001. I had ignored it before, but now suspected it was related. Further testing showed that it was independent of from where I started the drive, IDE1 or highpoint IDE3. I eventually got rid of it by re-flashing my BIOS. This, I suspect, was due to Norton AV, and was related to the cause of the slow RAID discovery I mentioned in an earlier post.

But wait, there's more!

Now without the error message, I optimistically built yet another Win2k OS setup on the highpoint bus, and had it fail upon reboot from shutdown, which I tried reasonably early after installing SP3 and Ati software. However, the key was that the death reboots only occur after shutting down the computer, not during windows commanded reboots after software installs. I proved this by installing only Win2k, nothing else, and shutting down. Soon I will memorize my key. The reboot from shutdown led to a blue screen; the drive was somehow getting corrupted. Moving the drive from the highpoint IDE3 to IDE1 did not bring it back.

This message is coming to you via my emergency Win2k disk that is normally not connected to the motherboard. It seems to work OK, but I haven't had the guts to move it to the highpoint controller to see if I can break it.

My next step, besides heaping opprobrium onto Symantic, and most likely Microsoft, will be to try to do a build on the former highpoint IDE3 drive from IDE1. I am going to install McAfee on the emergency drive first and exercise it on the victim drive before trying though.

Is it possible that a virus (e.g., Norton AV?) could screw up the drive MBR in some manner that formatting the C: partition would not clean up? If so, how do I fix it?

kirby

said by Kirby Smith:

---

Is it possible that a virus (e.g., Norton AV?) could screw up the drive MBR in some manner that formatting the C: partition would not clean up? If so, how do I fix it?

---

reply to Kirby Smith
I'm soon going to run McAfee thru the entire bad disk drive. I have the version (5.21) that wouldn't fully run under SP3 functioning under this SP1 build. I'm not ready to blame Norton for MBR hacking yet. It always could be a virus that sneaked in when VShield was down. Or, there may be nothing wrong with it. I just want to cover all bases before I do my nth rebuild. On the other hand, only reliable web sites were visited during that period, Netscape 4.73 doesn't auto-open attachments, and most mail I get comes from a forum server that strips attachments. In fact, before VShield went down, it never reported a virus on my email. I think Verizon strips them also along with its spam filtering.

I'll have to look into fdisk and any win2k equivalents. This functioning drive does have DOS on it, and I could conceptually blast the bad drive with it, then reformat with Win2k. There isn't much on that drive that I don't have on a backup tape.

Thanks for the help

kirby

Hope you eventually get your entire system restored to health, Kirby. :)

reply to Kirby Smith
Thanks Randy:

BTW, my fattest of Win2k tomes, "Win2k Resource Kit," describes the recovery console's capabilities. Included are the commands 'fixmbr' and 'fixboot' that I can use to wreak further havoc.

kirby

reply to Kirby Smith
OK, here is the bottom line:

x My MBR was corrupted, the Recovery console command 'fixmbr' did its job without blasting anything else. Due to the late discovery of this, I cannot be sure whether (a) Norton did it because of an incompatibility with the highpoint RAID controller and whatever Highpoint does to the MBR, or (b) to attempts at tape restore. I suspect Norton.

x fixboot was also run without claiming corruption or not.

x chkdsk fixed a few files.

The last Win2k build on that logical disk would then run on IDE1. Perhaps I could have saved the original or any of the many intermediates with Recovery Console, although I suspect running it before I had re-flashed the BIOS would not have worked and thereby misled me.

After adding a reasonable amount of software to the build, starting with SP3, the build showed it could handle repetitive shutdowns and restarts. I installed McAfee 5.21 with 4.1.60 engine. As was the case a week ago when I tried this, Avsynmgr failed to run on bootup. A message from the McAfee VS 5.x help forum at Symantic suggested extenting a time parameter in the registry. This didn't work in this case. I am awaiting other suggestions from them. There is plenty of evidence on that forum that the Avsynmgr problem has happened to several people.

For comparison, a Win2k Pro SP1 build on a separate hard drive and operated on IDE1 was also subjected to McAfee. Installing 5.21 with engine 4.1.30 showed the same behavior, but with 4.1.60 Avsynmgr worked. I did use the time parameter, but I don't think it was necessary.

I now have the SP3 hard drive on the Highpoint controller (IDE3). It started fine. I will restart a few times to determine stability next.

kirby

said by Kirby Smith:

---

A message from the McAfee VS 5.x help forum at Symantic suggested extenting a time parameter in the registry.

---

reply to Kirby Smith
There is a help forum at McAfee. (Sorry, Symantic only owns 75% of them, I think I read somewhere.) One gets there via a button on the virus scan console. I haven't been able to find the path yet from the main web site.

I presently have one drive functioning correctly on the Highpoint RAID controller IDE bus. I have installed a representative portion of the original software build. (As noted above, VShield 5.21 is not working under SP3.) I still have to connect up IDE2 DVD and Zip drive.

I guess there is one benefit from all of this besides education -- a definitely clean installation of Ati's software.

Before I mirror another drive and re-establish the RAID 1 configuration, I would like to find out if mirroring (on the Abit KT7-RAID) will replace a bad MBR on the disk mirrored to.

kirby

reply to Kirby Smith
"There is a help forum at McAfee. (Sorry, Symantic only owns 75% of them, I think I read somewhere.)"

Hold on here Kieby..what is all this about somone owns 75% of some one else.??????????

Hope you stock broker is not telling you that story?????

»www.nai.com/naicommon/aboutnai/i···ions.asp

»www.symantec.com/corporate/

Yeh, I thought Network Associates (NAI) owned McAfee, but maybe that isn't the case anymore...I don't know. :)

reply to Kirby Smith
I recall reading that somewhere, and the two prime candidates for the source of IT news are DSLReports' main page and The Register.

kirby

reply to Kirby Smith
Well do not spread it around cause the first one is not true.

reply to Kirby Smith
Well, I was a bit off base, but my memory didn't completely fail me. It is Network Associates that owns 75% of McAfee, not Symantic.

»www.nai.com/naicommon/aboutnai/p···Sel=1312

kirby