Re: Damn KB890830!!! Arrrrggggghhh.

On Wed, 13 Aug 2008 07:08:54 -0700, Susan Bradley, CPA aka Ebitz - SBS Rocks
[MVP] wrote:

Interesting as I've never had that MSRT cause any issues and never
wanted a restart. Can you post the log up here?

I have tried posting the log. Twice. Not sure what the Microsoft NNTP
servers will accept, but my posts aren't making it through.

Here is something interesting: After the July Windows Updates ran, I
installed a Netgear SC-101 NAS (Network Attached Storage) device. Installed
software for it on three computers. I haven't examined the third one
closely, but it had a mysterious "serious error" report, similar to the one
on my HP Pavilion m7590n. The three computers are:

HP Pavilion m7590n, Windows MCE 2005, SP3
HP Pavilion a1440n, Windows MCE 2005, SP3
HP Pavilion 6745C, Windows XP HE, SP3

In common they have installed the "Netger Storage Central Manager Utility".

While updated some media files on the L: drive on the Pavilion m7590n, I
noticed some odd folders:

1f35316d14e6aebb8a22aafd2733783d {Created: Aug. 12, 2008, 21:59:27}
0021ee6e3a835c2662 {Created: Aug. 12, 2008, 14:26:59}
4589a0c2a93a16d5f294e7f4bc87 {Created: Aug. 13, 2008, 04:29:20}
416539e6229e527422c5 {Created: Aug. 12, 2008, 15:23:53}
b882f7407bafe0ef0d {Created: Aug. 12, 2008, 14:17:46}
b5076e7fb2e00705fd75f1c45f21 {Created: Aug. 12, 2008, 15:09:57}
dfc28be7ed3a972519f502fdeddc8d45 {Created: Aug. 12, 2008, 21:40:19}

The file creation dates and times are consistent with my attempts at getting
the computers updated. I especially recognize the Aug. 13, 2008 date/time;
that was when I gave up on the HP Pavilion 6745C for being unable to get it
to boot to Safe Mode!

All folders have the same three files in them:

$shtdwn$.req
mrt.exe._p
mrtstub.exe

The first file seems to belie the "Never wanted a restart comment". It looks
suspiciously like an abbreviation for: "Shutdown required"!

My question is: Why would these files be written to the last disk volume
letter which is not a mapped network drive? This NAS drive (different letter
on each of the three computers) is dependent on the Netgear NAS manager
loading, and I would guess it hasn't yet loaded right after a forced
restart, so the Malicious Software Removal Tool fails for lack of finding
the necessary files after a restart.

--
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.
.