Conficker virus - advice needed

[ToyHeartsFan]

Windows Update is one of the things that can cause svchost errors so this might be worth looking at:

You receive an error message after a Windows XP-based computer runs an automatic update, and you may be unable to run any programs after you close the "svchost.exe - Application Error" error message dialog box

 

I know its not a solution but if you disable the sound device in control panel do you still continue to get svchost errors?

I'm just wondering if its the audio driver causing the svchost errors or if its the svchost error causing the audio problem...

 

Do you have a WSUS server for your microsoft updates? And if the Answer is yes do you use WSUS to update drivers as well? - I removed the driver option on our WSUS server after an automatic update on one workstation messed it up so much I needed to do a full reinstall - I now only perform driver updates manually.

[JMB]

#Today's update#

 

Reinstalled ALL drivers, and removed McAfee (in case that was causing issues somewhere) - problem still occurring. PCs left on but not logged in lose their network connectiopn and cause local profile logins, and PCs left logged in drop connection and lose sound. The sound/network services can be restarted if it's a local admin account that's logged in, but obviously this doesn't help in situations where teachers or student accounts are logged in. I've got a call logged with ScoMIS about it, as I'll be honest, I can't think of anything else!

[localzuk]

This all sounds remarkably complicated, why not simply reimage all the machines and be done with it? I had a brief scan through and couldn't see anything saying you couldn't do this?

[JMB]

Well, I thought the same thing. We originally built a new image with a clean XP SP3 install, then imaged all our PCs; along the way, installing the relevant drivers and saving new images of different models as we went. So I don't see how an issue could have arisen with ALL the PCs. And my fear is that if we use the existing images we'll have the same problem, and if we repeat our original work (setting up new images, etc.) we're just taking up a lot of time with the same potential problems at the end of it. We're going to test a Windows 7 installation today, see if that's any better.

[JMB]

WIndows 7 appears to work fine...will therefore try a completely clean XP installation tomorrow to see if the problem comes back. I guess if it does, the issue has to be something to do with the server.

[JMB]

So far, the new XP install is going well. Added it to the domain and left it on overnight (I'll offset this carbon nightmare at a later date), and this morning both sound and network are still fine. Very odd. So am now installing all our usual software onto the PC, with a view to repeating this exercise tonight. Hopefully, this will see an end to our problems and I can begin re-imaging other machines from this one. Fingers crossed!

[RageRiot]

we had this virus in june, we purchased enough licences for nod32 for all our machines and since everything is working well. most machines have been reimaged due to the damage conficker did.

 

it was a nightmare tho. It caused sound to stop working, syslogs to be suddenly full. host32 crashing, Slow network and me piggy in the middle with staff saying "it's not working"

never thought I'd say this but nod32 saved me. cost us £700 for licences aproxx that was for 140 and we have about 133 machines so we have spare for growth

Edited October 13, 2011 by RageRiot

[efakio]

Hello from athens. We have exactly the same problem at work! PCs left on but not logged in lose their network connectiopn and cause local profile logins, and PCs left logged in drop connection and lose sound (as you say). I was also told that it was due to conficker, I have taken all the steps like you did but nothing worked for me. Only format or imaging worked….

[JMB]

Hello Athens! I'm very sorry to hear you had the same problem - hopefully you've got on top of things now? It's very odd. My final wondering was whether there was an issue caused by us imaging the PCs whilst the server was still being set up, as I basically felt I'd exhausted every other explanation. We've been reinstalling Windows (and endless CDs of ed software!) and creating new images, and mercifully that seems to have fixed it. Horrible few weeks though! I can only hope you're over the worst of it too.

[efakio]

I had 20 pc's to fix in July. Shame!!!! One "solution" was to open a sound file and play it as soon as the computer was turned on. Then you do not lose the sound.hahaha!!! very odd indeed. It is not due to the server or drivers. I am pretty much sure that this issues has nothing to do with them. Today another computer has the same symptoms and this is driving me insane!!! I will devote my time for the next 2 days on this. Keep in touch. There must be an explanation...

[efakio]

oh!!! there is another hint to determine whether you are dealing with conficker or not. When conficker is the problem, you can NOT go to microsoft's page [http://www.microsoft.com]. It is shown as a dead link. This happened to all the pc's I have removed conficker from. As soon as I remove conficker I was able to view microsoft home page.

[mwbutler]

oh!!! there is another hint to determine whether you are dealing with conficker or not. When conficker is the problem, you can NOT go to microsoft's page ["]www.microsoft.com]. It is shown as a dead link. This happened to all the pc's I have removed conficker from. As soon as I remove conficker I was able to view microsoft home page.

 

Also use a site like this one to easily identify if you have the virus or not:

 

Conficker Eye Chart